How do I install Codacy Guardrails?

The Codacy IDE Extension can be installed directly through your VSCode, IntelliJ, Cursor and Windsurf marketplace. Once installed, click the Codacy tab, log in or create your Codacy account, activate the Codacy CLI for local analysis, and install MCP Server. For other IDEs, Codacy Guardrails can also be installed manually.

Does Guardrails work with all OS?

Codacy Guardrails works with Windows (via WSL), macOS, and Linux operating systems.

Which AI security and quality standards can I enforce with Guardrails?

Codacy Guardrails detects and auto-remediates security risks and quality issues in JavaScript, TypeScript, Python, and Java, including: SAST vulnerabilities, hardcoded secrets, insecure dependencies, error prone code, performance issues, best practices, complex code, code duplications, and styling violations.

How much does Guardrails cost?

Codacy Guardrails is available free of charge to all developers. Team and Organization plans unlock central configuration and enforcement of AI coding standards across teams and projects, query and auto-fix existing problems across your codebase, generate custom security and code quality reports, and full access to the Codacy Cloud platform.

AI Guardrails for Code Quality & Security

Quality & Security Guardrails for Agentic Workflows

Turn your quality and security standards into auto-repair instructions for your AI coding agents. Open review-ready PRs on first try.

Get the code quality and security context your agent is missing

Codacy Guardrails brings reliable, deterministic code analysis inside your agentic workflow, making your coding agents follow the rules you define, consistently. Give your agent all the context it needs to auto-repair new and old code on the fly.

Get clean, secure AI code on every prompt

Get clean, secure AI code on every prompt

Codacy Guardrails silently scans every line of AI code against your policies, while it's being generated. Let your agent auto-fix its own issues, before you even see the code.

Review

Secret scanning
Insecure dependencies (SCA)
AI policy violations
SQL Injections
SAST
Unapproved model calls

Fix legacy issues without leaving the chat panel

Fix legacy issues without leaving the chat panel

Turn Codacy’s scan results into actionable context for your AI agents. Empower them to auto-fix issues identified across your legacy codebase with verified precision.

Review

Secret scanning
Insecure dependencies (SCA)
AI policy violations
SQL Injections
SAST
Unapproved model calls

Adjust your policies and get code health reports

Adjust your policies and get code health reports

Set your AI Guardrails to match your organization's coding standards and apply them across agents and IDEs. Generate real-time code health reports across teams and projects.

Review

Secret scanning
Insecure dependencies (SCA)
AI policy violations
SQL Injections
SAST
Unapproved model calls

"Codacy Guardrails became a no-brainer for us. It's part of our agreed coding standards and I honestly cannot think of a reason not to use it."

Daan van Leth AI Solutions Consultant at ihomer

Put your coding agent to work on what matters

Codacy Guardrails pairs the Codacy MCP Server with the Codacy CLI, allowing your agents to write clean and secure code, fix issues, configure coding policies and create quality & compliance reports – all from the comfort of your chat panel.

Your coding agents can ship faster when they know exactly what to fix. Codacy gives agents full visibility into every issue detected across your codebase, with the exact repo and location of each one, so they can get straight to fixing.

That includes DAST findings, where agents can trace an endpoint vulnerability back to its origin in the code. And with access to Codacy's code coverage data, agents can spot which critical code lacks tests and write them.

Configure Codacy directly from their IDE, without switching context to the Codacy UI.
The plugin connects to the Codacy API, so agents can handle configuration tasks, like enabling or disabling rules configured in Coding Standards, according to their permissions level.

Instead of digging through dashboards, can query Codacy in plain language from the chat panel.
Get a list of overdue security issues, compare trends across teams, or check which repos aren't meeting your compliance thresholds. Any question you'd normally answer by navigating the Codacy UI, you can now just ask.

Loved by engineers

Codacy has changed the way engineering teams ship secure, high-quality applications without sacrificing speed.