Plans & Pricing

Simple, seat-based pricing for teams of any size.

No Servers. No Pipelines. Unlimited Lines of Code.

 

Developer

For Al-driven engineers shipping faster without sacrificing security, quality and good vibes

Free forever

$0

$0

per dev / month

Get VSCode Extension

Different IDE? Get Extension for Cursor or Windsurf

Guardrails for AI-generated code
  • Make every line of AI code clean, secure and compliant as it is being generated
  • One-click integration with VSCode, Cursor and Windsurf
  • Works with any MCP-ready LLM (Copilot, Claude, etc.)
  • Supports TypeScript, JavaScript, Python & Java
Security and quality scans embedded in your IDE
  • SAST vulnerabilities
  • Hardcoded secrets
  • Insecure dependencies
  • Complex code and duplications
  • Error-prone code
  • Code performance issues

Team

For modern teams up to 30 devs protecting their apps from inception to product

Starting at

$18

$21

per dev/mth, billed

per dev/mth, billed

Yearly
Monthly
Start Free Trial

← Everything in Developer, plus:

AI Guardrails across teams and projects
  • Sharable security and coding standards enforced in every developer’s IDE
  • Fix critical issues and write missing unit tests at scale from your AI chat panel
  • Query your security and quality data without leaving your IDE
Pull Request scanning for any stack
  • Scan unlimited lines of code in up to 100 private repos – no pipeline steps needed
  • Maintain secure, healthy code and high test coverage across 49 languages
  • SAST, secret and dependency scans for application and infrastructure-as-code
Triage and fix findings at scale
  • Scurity and Risk Management monitor with SLA tracking
  • Explore findings by team, repo, issue category and severity
  • Track issues on Jira and Slack

Business

For leading organizations with enterprise-level security and reporting requirements

Custom

 

← Everything in Team, plus:

360° DevSecOps from code to runtime
  • Unlimited private projects
  • Daily vulnerability database updates with real-time monitoring across all lines of code
  • DAST (pipeline-less runtime scans)
  • License scanning 
  • Penetration testing (billed separately)
  • SBOM explorer (coming soon)
Enterprise-ready deployment
  • Priority queue for fastest scan results
  • Custom API scripts for configuration and reporting at scale
  • Audit log for usage tracking
  • Session timeout
White-glove customer excellence
  • Dedicated Customer Success Manager (depending on contract value)
  • Premium technical support with screen sharing and video chat
  • Extended proof-of-value (trial) with dedicated support

Audit

One-off 360° compliance report for code quality and security audits

Custom

 
Full overview of your compliance status with exportable reports, ready in minutes

  • SAST vulnerabilities
  • Hardcoded secrets
  • IaC misconfiguration
  • Software Composition Analysis (SCA)
  • SBOM report
  • DAST report upload
  • Dependency license checking
  • Human-led penetration testing
  • Unlimited retests included
  • White-glove customer service and priority technical support

An experience our customers love

users-love-us
StaticCodeAnalysis_Leader_Leader-Mar-26-2025-09-26-39-2778-AM
StaticApplicationSecurityTesting(SAST)_HighPerformer_HighPerformer
StaticCodeAnalysis_MomentumLeader_Leader-3
StaticApplicationSecurityTesting(SAST)_BestSupport_QualityOfSupport
StaticApplicationSecurityTesting(SAST)_BestEstimatedROI_Roi-1
DynamicApplicationSecurityTesting(DAST)_EasiestSetup_EaseOfSetup-1
DynamicApplicationSecurityTesting(DAST)_EasiestAdmin_EaseOfAdmin-2

Features included

Developer
Team
Business
AI Guardrails (IDE Extension)
Guardrails for clean, secure and compliant AI code enforced during code generation
check-circle
check-circle
check-circle
One-click integration with VSCode, Cursor and Windsurf
check-circle
check-circle
check-circle
Support for all MCP-ready LLMs (Copilot, Claude, etc.)
check-circle
check-circle
check-circle
Local, real-time security scans for SAST issues, hardcoded secrets and insecure dependencies, embedded in the IDE
check-circle
check-circle
check-circle
Local, real-time quality scans for complex and error-prone code, duplications and performance issues, embedded in the IDE
check-circle
check-circle
check-circle
Customize scan rules locally via configuration files
check-circle
check-circle
check-circle
Customize scan rules globally in the Codacy Cloud Platform UI
cross
check-circle
check-circle
Sharable AI security and coding standards enforced in every developer’s IDE
cross
check-circle
check-circle
Query, report, prioritize and fix security and quality findings at scale from your AI chat panel
cross
check-circle
check-circle
AI-generate missing unit tests for files with low test coverage
cross
check-circle
check-circle
Integration
Unlimited public repositories
cross
right
right
Unlimited private repositories
cross
cross
right
GitHub, Bitbucket and GitLab integration (Cloud-hosted only)
cross
right
right
Test coverage tracker and merge gates
cross
right
right
Two-way Jira integration
cross
right
right
Slack integration for critical security alerts
cross
right
right
Code Scanning
49 languages and frameworks supported
cross
right
right
Real-time Commit & Pull Request scans
cross
right
right
Pull Request merge gates
cross
right
right
Smart PR review assistant
cross
right
right
False positive triage
cross
right
right
One-click fix suggestions
cross
right
right
Smart configuration with over 12k scan rules
cross
right
right
Custom scan rules
cross
cross
right
Prioritized PR analysis for faster results
cross
cross
right
Application Security
SAST vulnerability scanning
right
right
right
Hardcoded secrets & password detection
right
right
right
Infrastructure-as-code (IaC) misconfiguration detection
right
right
right
Dependency / SCA scanning of new code
right
right
right
Daily SCA vulnerability database updates and rescans across all lines of code
cross
cross
right
License scanning
cross
cross
right
DAST (pipeline-less runtime scans)
cross
cross
right
Penetration testing (billed separately)
cross
cross
right
Vulnerability Management and Reporting
Customizable management reports across teams and projects
cross
right
right
Organization-wide Security and Risk Management Dashboard
cross
right
right
Configurable SLA remediation due date tracking
cross
right
right
Create and track Jira tickets from findings in Codacy
cross
right
right
Import external security findings via Jira
cross
right
right
Live critical security alerts via Slack
cross
right
right
SBOM explorer
cross
cross
right
Report automation and custom integrations via Codacy API
cross
cross
right
Enterprise Compliance
SOC2 Type 2-certified cloud infrastructure
cross
right
right
Single sign-on (SSO) via GitHub, Bitbucket or GitLab
cross
right
right
Static IP for allowlisting Codacy (billed separately)
cross
check-circle
right
Audit logs (via API)
cross
cross
right
Session timeout
cross
cross
right
Access control checks
cross
cross
right
Service Level Agreement (SLA)
cross
cross
right
Customer Experience
Standard support via email & in-app chat
check-circle
right
right
Priority support via screen sharing and video chat
cross
cross
right
Dedicated Customer Success Manager and Solutions Engineer
cross
cross
right
Personalized training for users and administrators
cross
cross
right
Custom configuration and API scripting support
cross
cross
right
Extended proof-of-value (trial)
cross
cross
right

Want to talk?

 

FAQS

How does Codacy work?

Codacy is the easiest way for engineering teams to maintain a clean and secure codebase without any pipeline integrations, ready to go with a few clicks:

  1. Log in with your GitHub, Bitbucket or GitLab account to add your organization or workspace (requires org admin permissions)
  2. Add your repositories with the click of a button. Codacy scans the entire codebase for quality and security violations within minutes. Easily browse all findings, and tackle the most critical risks before they cause damage.
  3. As the codebase evolves, every new Pull/Merge Request is scanned in real time, catching new quality and security violations before they get merged, built and released.

On top of code scanning, Codacy tracks test coverage results across files and Pull Requests, preventing untested critical code from being merged.

Why does Codacy not require any CI/CD pipeline integration for code scanning?

Codacy's code scanning as-a-service allows businesses to reduce hosting and maintaining complex, dynamic and costly pipeline integrations while ensuring full quality and security coverage across all projects and languages.

As a 100% cloud-based GitHub, Bitbucket and GitLab app, Codacy uses webhooks to keep track of all code changes in real time, and performs all scans on its own AWS infrastructure, while seamlessly updating the latest coding conventions and scan rules for you to keep up with industry trends and evolving programming languages.

For more details on how Codacy keeps your source code safe, see here.

What sort of quality issues does Codacy detect?

Codacy scans source code in 49 languages across a range of common violations, including error prone code, performance problems, complex code, duplications and code style deviations. Learn more about issue categories here.

What sort of security issues does Codacy detect?

Codacy detects a wide range of security vulnerability types through a curated collection of analysis tools built into the Codacy platform:

  • Static Application Security Testing (SAST)
  • Hardcoded Secrets and Passwords
  • Infrastructure-as-code (IaC scanning)
  • Software Composition Analysis (SCA) / Dependency checks
  • Dynamic Application Security Testing (DAST)
  • Penetration Testing (manual testing via Bulletproof)
  • License scanning (coming soon)

Learn more about security categories here.

Does Codacy support projects versioned on self-hosted GitHub, GitLab or Bitbucket?

No, Codacy currently does not support projects hosted on any on-premise Git deployments.

The supported Git providers are GitHub Cloud, Bitbucket Cloud, and GitLab Cloud.

Does Codacy support projects versioned on Azure Repos?

Codacy currently does not support Azure Repos, but you can now join our waitlist to get notified once we do.

The supported Git providers are GitHub Cloud, Bitbucket Cloud, and GitLab Cloud.

Does Codacy support my programming language?

Codacy supports 49 popular programming languages and frameworks across back-end, front-end, infrastructure-as-code, mobile code, and everything in between. See a full list of supported languages here.

Can I use Codacy locally in my IDE?

Yes, Codacy provides plugins for Jetbrains IDEs and VSCode (requires GitHub, Bitbucket or GitLab integration on codacy.com)

The Codacy plugin shows all scan results and fix suggestions for every open Pull Request right inside the IDE for more seamless code reviews, faster remediation, and to help avoid context switching.

While real-time scanning within the IDE (outside the Pull Request flow) is not supported yet, make sure to stay tuned for a major update to our IDE plugin in 2025! 🤫

Is my code secure?

As we provide cloud solutions for leading enterprises around the world, keeping our customers' data protected at all times is the highest of all priorities. Codacy has implemented bulletproof cloud security measures in accordance with the latest industry standards, and certified by SOC2.

For details on Codacy's security measures, visit https://security.codacy.com.

Is my personal data secure?

Codacy is compliant with the General Data Protection Regulation (GDPR). The purpose of GDPR is to protect the private information of EU citizens and give them more control over their personal data.

For any further questions about personal data privacy, contact us at security@codacy.com.

 

What is the right plan for me?

Open Source (free): For individuals and teams working exclusively on public projects.

Pro: For individuals and teams of up to 30 contributors working on up to 100 private projects.

Business: For engineering organizations with more than 30 contributors or more than 100 private projects, as well as teams with advanced security, reporting, and support requirements (see comparison table above)

 

How does Codacy count user seats?

Codacy requires a seat for every Git contributor who commits code changes to a private repo added to Codacy. Typically, the required number of seats reflects the total size of the development team.

What is a 14-day trial?

Simply sign up with your Git provider (no credit card required), and enjoy full access to the Codacy platform for 14 days, free of charge.

After the trial period, you can upgrade to a paid plan to continue using Codacy with private repositories, or keep scanning your public repositories for free on the Open Source plan.

Which payment methods do you accept?

Codacy accepts credit cards by Visa, Mastercard, American Express, and Discover. Wire transfers and ACH are accepted only for annual Pro and Business plans.

If your preferred payment method is not supported, please contact us at billing@codacy.com.

Can I change or cancel my plan anytime?

Yes, you can change or cancel your plan at any time. If you choose to cancel your annual subscription before the conclusion of the 12 months, your account will continue to work for the remainder of the annual billing period.