If you last looked at Codacy in 2024 or 2025, three things changed: a Codacy that runs inside your coding agents and from the terminal, an AI review and governance layer that did not exist, and security scanning that keeps working after the commit lands. Everything below is live today.
The work moved into the agent loop, so Codacy did too. Scanning runs on your machine before a pull request exists, and the CLIs let an agent configure Codacy and drive it by prompt.
Scanning moved earlier than the pull request. Your agent writes code, the Codacy CLI analyses it on your machine over MCP, and your agent fixes it before a PR exists. Free in VS Code, Cursor and JetBrains, and it works offline.
Configuration by prompt. Skills drive the Codacy CLIs from Claude, Codex or Copilot, so an agent unblocks a failing pull request, tunes your scan rules to cut PR noise, or sets up test coverage reporting. The catalog is public and free.
A Cloud CLI that drives your Codacy account over the API: pull findings and metrics, adjust settings, and script the parts you would rather not click through the UI.
Two separate problems. Reviewing code an agent wrote, and answering an auditor who asks which models your product calls. Codacy covers both now.
Reviews pull requests on GitHub using the PR, the linked Jira ticket and your existing Codacy findings, so it catches the logic and intent gaps scanners miss and flags weak tests. Runs on Gemini, with secrets masked before anything reaches the model.
An org-level view of AI risk read from your code rather than from a survey. Compliance is scored across unapproved model calls, AI safety, hardcoded secrets and insecure dependencies, with a risk level based on the safeguards you actually switched on.
Every model call, dependency, API key and endpoint in your source, across 13 providers, plus which AI assistants and MCP servers your developers are running. Drillable to the line, and the evidence ISO 42001, the EU AI Act and DORA keep asking for.
A CVE disclosed on Thursday does not wait for your next push. Most of what follows exists because scanning only on commit leaves a window open.
A nightly scan of your dependencies against newly disclosed vulnerabilities, so a finding opens the day the CVE is published rather than the next time somebody happens to commit.
Dependencies are checked against the OSSF Malicious Packages database, updated daily. Separate from CVE matching, and aimed at the install-time attacks that a vulnerability feed never sees.
When the vulnerable package is three levels down, Codacy shows the path from your direct dependency to the broken one, so you know what to bump. Where the advisory names them it lists the affected functions too, though plenty of advisories name none.
The same dependency scan reads the licence on every version in use and flags the risky ones, copyleft licences such as GPL included, next to the security findings and the OSSF Scorecard rating for the upstream project.
Upload a container image SBOM in CycloneDX or SPDX and findings tie to specific image tags. Every stored SBOM is re-scanned every 24 hours against new CVEs, so a base image that turns vulnerable next month still surfaces.
Dynamic testing against a running application, either from your own pipeline with the reports uploaded, or configured as targets and started from the Codacy UI. Available as early access rather than general availability.
A separate product, in public beta and free to install today. It runs beside your agent rather than inside Codacy.
An independent gate for coding agents. When your agent stops, a model that did not write the code judges the change against your standard on quality, security and intent, then passes it or blocks it with file-and-line findings so the agent can fix its own work before the commit lands.
npm install -g @codacy/verity-cli && verity initTwenty minutes with someone who can answer the awkward questions is the fastest way to judge whether any of this changes your original decision.