Hi there. I'm Jaime Jorge, CEO and Co-founder of Codacy.
Today we're launching Verity in free public beta.
We've built Verity because our customers have been needing ways to better deal with the complexity and scale of working with coding agents, specially when you start orchestrating them in loops. Specifically: security, context/memory and cost are the biggest problems people seem to have.
So Verity has:
- Gates: a standardized review layer for agent-generated changes, combining adversarial AI review with deterministic checks before code moves forward. This forces the agents to self-heal without humans in the loop
- Memory: a local+cloud markdown knowledge base that records good decisions made by your agents - which make them better over time. This also make Verity work better with your code
- Cost control: visibility into token usage and estimated cost by task, session, and repo.
We're launching for claude code first, looking to support more harnesses and tools soon.
Last week we released what we think is the most comprehensive and easy way to detect every trace of AI assets and dev tools in codebases, including models, libraries, MCP servers and API keys. It’s called AI Inventory and you can try it now by connecting a repo.
The announcement article goes through why this was our most requested feature of the past few months and how it works in detail.
For me Cursor is unbeatable in going from 0 to fixing an issue. Claude code is great but the cold start problem of getting all the context first sometimes is annoying. I find cursor is a good choice in combination with other tools.
My 2 cents: cursor could also reproduce bugs leveraging things like playwright and other tools. That closes the loop somewhat.
I sometimes wish that other types of fiction were as easy to read (for me) as sci-fi. I devoured all 6 books of Dune. Loved Hyperion with the canterbury tales structure and the politics - I already know I’m going to like the second book.
I must check The Terror, thank you for the pointer. I have also the Neuromancer waiting for me to eat my literary veggies.
I feel an urge to build personal local AI bots that would be personal spam filters. AI filtering AI, fight fire with fire. Mostly because the world OP wants is never coming back. Everything will be AI and it's everywhere.
I also feel an urge to build spaces in the internet just for humans, with some 'turrets' to protect against AI invasion and exploitation. I just don't know what content would be shared in those spaces because AI is already everywhere in content production.
Honestly, I’ll take that big fat raspberry. Our website is made in Hubspot and that poses all sorts of limitations. I deeply regret that. So yes.. workarounds unfortunately
Thanks for testing. Please do share feedback.
Windsurf is crucially important to us as we’re working with their team to make the experience good. Would you mind sending any feedback to Jaime at Codacy.com?
Yes. My point is that because of training cutoffs it should be mandatory to run SCA scans when dealing with AI code generation.
Not putting exact versions would be a good idea. But that’s not what’s happening today.
Hi there. Yes, the extension, the cli and the MCP server are open source.
The local analysis can run locally in a sandboxes environment (provided you download the dependencies and tools etc).
Only if you want to then use our cloud scans, or let your coding agent interact with data from Codacy, then you’d need the MCP server connecting to our API.
I think at first glance we try to establish a strong bond between what’s running in the IDE with our CLI and what tool configs you have running on the cloud in Codacy. We spend a lot of time on coding standards, gates, and making all the tools that we integrate (which seems to be pretty comparable to qlty - we do have our own tools right now for example for secret scanning) run well with good standards for large teams. We also have an MCP server and we found that tying code analysis with code agents is not trivial so I think that’s also something different. Beyond that, DAST + Pen testing, etc. We’ve become a full-on security company and that’s been our focus.
We do and we’re looking into it. It really started for us when we launched an MCP server.
Hi there.
Codacy runs in the cloud when PRs acre created. We run a large number of tools and we have gates, and coding standards, etc. It’s a standardization use case.
Codacy Guardrails is about local code analysis with a special focus on coding agents. The problem is that AI generates insecure code and if you don’t have Codacy centrally analyzing things, you’ll introduce vulnerabilities in your repo.
On context pollution unfortunately we rely a lot on the model actually being used. One thing we do is: clear instructions to only analyze the code being produced and not act on ALL issues/problems identified. Still we recommend a good small selection of tools to start and go from there: an SCA (mandatory really), a secret scanner and a good curated list of security issues. If we feed too many issues to the models they.. well.. don’t work
Hey thanks for testing! That's been my experience well, it's very frequent to see libraries with vulnerable versions being introduced in code.
What's also interesting is that, despite using incredible AI coding models like Sonnet 4, you still get CVEs in your code.
Try this with Codacy Guardrails: "create a Java server using undertow".
Thanks for testing. Please do share your feedback when you test further!
The guardrails are ran every time there is code being generated by the agent. We give instructions to the coding agents to run the guardrails on the code that is changed.
It doesn't YET work with Claude Code and Amp but because it leverages an MCP server, we can easily do it. It's in the plans to do.
I think dev-time is critical, because AI is producing large swaths of code as we speak. We also make sure that regardless of what happens in dev time, we can always run our cloud checks in CI time.
Thanks for your questions!
Below is a list of things that I've gathered over time that work for me. If you'd like to have a chat, happy to hear you out, sometimes that also helps.
State of mind
- First remember that anxiety is normal and debilitating. There's nothing inherently wrong, sometimes it's just a culmination of different things.
- Anxiety comes in peaks usually matching particular stressors like workload or difficulty in coping with work. It might seem in that peak that everything is wrong, but it usually isn't and you'll be clearer of mind soon.
> Many are the things that have caused terror during the night and been turned into matters of laughter with the coming of daylight. Seneca, Letters from a Stoic
- Anxiety creates a vicious cycle of guilt. Break that by giving yourself time and space to be better. An afternoon or morning away is better than a week feeling like shit.
> “If there is no solution to the problem then don't waste time worrying about it. If there is a solution to the problem then don't waste time worrying about it.” - Dalai Lama XIV
Writing down
- Because of the Zeigarnik effect, the mind finds closure in things that are written down. It's a good exercise to write all the tasks that clobber our mind.
Plan it
- We have anxiety, which tends to lead to procrastination, when workload is high or tasks are difficult. So it's important to divide and conquer. Break down large tasks into small ones that we can do easily
- As much as possible, address small things that you can do. You build momentum on winning small tasks. Identify small things that you can do to win. Winning creates a virtuous circle of serotonin which builds momentum.
- As soon as there is a plan, our mind anchors to that plan as a way to relax.
Exercise
- Seratonin has anxiolitic properties that help to counter anxiety.
- Go outside in the morning to get natural light. It sets your circadian rhythm for the day. You can combine this practice with a short jog, bike ride, or walk. Lateral eye movement caused by self-propelled motion is shown to reduce stress. Your eyes scan the environment in front of you from side to side. This triggers a process that tells your brain there are no imminent threats ahead of you, causing a calming effect that will help you break free from stress-induced tunnel vision. (Andrew Huberman, Ph.D., a professor at Stanford)
Sleep
- Sleeping affects mood. Sleeping 8 hours, if possible, is critical
Food
- Heavy processed and junk food also affect the body leaving us clunky and unmotivated. Important to regulate
- Healthy homemade food is the best course of action. If possible, cooked by yourself, as the action of cooking food is rewarding by itself.
Reading
- In an anxiety peak, it's difficult to focus and to be productive. Reading is an activity that is beneficial to reduce stress even if forced.
Expectations
- People sometimes accumulate expectations from others. Insecurity can lead to accumulate these to a point where it's not possible to deliver work. One must be effective in managing these expectations.
- Create boundaries. In an anxiety peak: Remove news, email, twitter and slack from daily consumption; Remove screens from start and end of the day. -> - Smartphones reduce available cognitive capacity and lead to Survivorship bias; Force to say 'no' to things
Granny's Rule
- Grannys rule - eat your carrots first This means that you should have things that you look forward to doing. What brings you joy? What do you feel like doing? Aim to include that in your plan and have that as your reward!
Today we're launching Verity in free public beta.
We've built Verity because our customers have been needing ways to better deal with the complexity and scale of working with coding agents, specially when you start orchestrating them in loops. Specifically: security, context/memory and cost are the biggest problems people seem to have.
So Verity has: - Gates: a standardized review layer for agent-generated changes, combining adversarial AI review with deterministic checks before code moves forward. This forces the agents to self-heal without humans in the loop - Memory: a local+cloud markdown knowledge base that records good decisions made by your agents - which make them better over time. This also make Verity work better with your code - Cost control: visibility into token usage and estimated cost by task, session, and repo.
We're launching for claude code first, looking to support more harnesses and tools soon.
Would love some feedback!