Codacy

GAMMA-Ray report · Spectrum 0.2 beta · Public tier · read 2026-11-10 · not reviewed by the company yet

A cloud platform that runs code quality, security and coverage checks on repositories, with AI features that review pull requests and tools that feed its findings to coding agents.

Built only from Codacy's own public pages and, for company basics only, the news sources named beside each fact. Codacy has not seen this report. Nothing was tested and no credentials were used. If you are Codacy and something here is wrong or missing, the correction will be made and dated, and you can claim the card to add evidence.

The agentic solutions

One card per solution. Each level is computed from the evidence by a published rule; a dimension with nothing public reads "not yet evidenced", which is not a no. A card rates a product as documented, not anyone's deployment of it.

AI Reviewer

Opt-in pull request reviewer on GitHub that combines Codacy's static analysis with a language model, reads the PR, linked Jira or Linear tickets and repository instructions, and posts a review with a verdict, a summary, test suggestions and inline comments with suggested fixes. It can run automatically on the first review of a PR or on demand (button or public API).

The full card, every answer and its evidence · the governance layer

Codacy Guardrails (AI Guardrails)

IDE extension plus the Codacy MCP server and Codacy CLI that give a user's own coding agent Codacy's scan results so the agent fixes issues; Codacy states it is not a language model itself. No card yet (available; free IDE extension, central configuration on paid plans): this solution has not been assessed.

Codacy MCP Server

MCP server for the Codacy API (npm @codacy/codacy-mcp) exposing repositories, issues, security findings, pull requests and local analysis to MCP-compatible agents. No card yet (published, npm latest 0.7.2): this solution has not been assessed.

Auto-configure repository

Paid feature in which an AI coding agent reviews a repository and applies tool and code-pattern settings in Codacy, once per repository per day. No card yet (available, paid): this solution has not been assessed.

Codacy Skills

Skills for Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI that drive the Codacy CLIs. No card yet (available, public and free): this solution has not been assessed.

Smart False Positive Triage

AI triage that scores issues for likely false positives and surfaces them for manual review. No card yet (Business plan, enabled on request): this solution has not been assessed.

Codacy platform (Code Quality, Security, Coverage, AI Risk Hub, AI Inventory)

Static analysis, SAST/SCA/secrets/IaC/DAST, coverage gates and AI-usage inventory across repositories. No card yet (generally available): this solution has not been assessed.

Our reading

The shape. Codacy's AI Reviewer reads A1 · R2 · C– · O2 (Exploring). It is an opt-in reviewer for GitHub pull requests: it combines Codacy's static analysis with a language model, reads the pull request, a linked Jira or Linear ticket and the repository's instructions, and posts a review with a verdict, a summary, test suggestions and inline comments with suggested fixes. A person decides what to apply.

Three levels hold with the reviewer on. An admin turns the AI Reviewer on per repository or organisation, on GitHub, for Team and Business plans, so Reach 2 is marked available. Control reads "not yet evidenced". Autonomy 1 rests on the Manually setting, in which a person starts each review with Run Reviewer or a call to the public API. Openness 2 holds as shipped: the docs give the reviewer's size limit (270,000 tokens or a 1 MB diff), list the context it sends to the model and what Codacy stores, and say secrets are redacted before sending.

Where the evidence is strongest. The documentation is specific. Teams write a review.md file whose template has a section for what the reviewer should ignore (shown, and not counted as a limit, since no page says the reviewer is bound by it); people contest a comment by replying in the pull request; the reviewer posts through the Codacy GitHub App, whose permission table lists access scope by scope. A Codacy case study names BFI Finance, which compared the reviewer with its previous AI review tool and switched that tool off. Its figure of around 170 developers is the company's own, and a headcount, not a count of reviews.

What would move it. Autonomy 2: a page stating that the reviewer's suggested fixes are proposed actions a person approves one at a time. Reach 3: a published protocol or agent interface for the reviewer itself. Control 1: a page stating how people approve, override or stop the reviewer, or a written rule that binds it. Openness 3: published test or evaluation results for the reviewer, with a method; an llms.txt and an OpenAPI description already resolve.

Seen, and not counted. The challenger lowered the reading of a posted review as an action: the reviewer changes no code, record or setting, so Autonomy rests on the manual mode. The Codacy MCP server and the review endpoint in the general REST API serve the whole platform, not the reviewer as an agent interface. The docs name OpenAI models through Amazon Bedrock while another Codacy page says the reviewer runs on Gemini, so the models are not counted as listed. The SOC 2 Type 2 statement does not show that its scope covers the AI features.

What would move it

The one piece of public evidence that would lift each card next:

• AI Reviewer: Control 1 (Stated). Public evidence that a limit on it is a rule in prose.

The agent at work

Examples from public pages that name a customer or give figures. Each source was captured and hashed on the date shown.

BFI Finance

Evaluated the AI Reviewer against an existing AI code review tool and switched that tool off; Codacy says its AI reviewer is part of daily work for around 170 developers. "Codacy's AI Reviewer is better aligned with its workflow"

Source (captured 2026-11-10T17:49Z, sha256 563b62540a7f7d7b)

ihomer

Uses Codacy Guardrails with GitHub Copilot in VS Code; the agent that fixes code is Copilot, not Codacy. "50%+ of developers adopting AI guardrails in their daily workflow"

Source (captured 2026-11-10T12:47Z, sha256 cb14cfc515ff60ff)

LSports

Uses quality gates across 800 repositories and the IDE plugin with MCP integration; no AI Reviewer usage stated. "800 Repos, One Standard"

Source (captured 2026-11-10T12:47Z, sha256 918c2f5d7f8e01b7)

The company

• Founded in 2012 by Jaime Jorge (CEO) and João Caxaria (CTO), headquartered in Lisbon. "headquartered in Lisbon, Portugal." Source (captured 2026-11-10T17:49Z, sha256 52a0c32c01ff8dea)
• The about page states the founding year and the founders. "Founded in 2012 by developers Jaime Jorge and João Caxaria" Source (captured 2026-11-10T12:47Z, sha256 21db0b3236096cbb)
• The home page's structured data gives Lisbon as its locality. ""addressLocality": "Lisbon"" Source (captured 2026-11-10T12:47Z, sha256 3351e5842223d38b)
• The company states it holds SOC 2 Type 2 and is GDPR compliant. "Codacy is SOC 2 Type 2 certified and GDPR compliant." Source (captured 2026-11-10T17:49Z, sha256 52a0c32c01ff8dea)
• The AI features of the platform are optional and opt-in. "Codacy AI is a set of optional features integrated into the Software" Source (captured 2026-11-10T17:49Z, sha256 1ccd57719e29bac8)

The people

Public and professional only, from the company's own pages or a public professional source.

• Jaime Jorge, Co-founder and CEO. Source
• João Caxaria, Co-founder; named CTO on the AI Info page. Source
• Emma Hunt, VP of People Operations. Source
• David Galante, VP of Operations. Source

The graph

The company, its people and the stories on the left; each solution, the captured sources behind its card, the indicators those sources evidence and the provisions of the instruments those indicators touch, to the right. "Touched" never means "complies".

The evidence

How this report was made

A researcher-assessor gathered and captured the sources and mapped the evidence to indicators, without assigning a level. A challenger argued against every level three and four and every doubtful credit. The deterministic scorer computed the levels and the gate checked the rules. A card appears here only after two rounds of review and a sign-off by agents that did not write it (the team's workflow); AI Reviewer: reviewed in 4 rounds, signed off by gamma.approve@web-summit.dinis on 2026-11-10. A person's sign-off of the series is still to come.

The vault

Every capture, the dossier, both assessors' mappings, the challenger's notes and this report's data are in a public sgit vault (u6a01jwq). Read key:

sgit_public_read_af2cc62b777e2d6af5fdb41b6ec2899e95fe143c11859904fa56fbedea727f2f:u6a01jwq

With sgit: sgit clone followed by the key. The key reads; it cannot write.

Corrections

None yet. A correction is made in place, dated here, and carried to the card, the vault and the article.

The article

AI Reviewer on the GAMMA-Ray Spectrum: A1 · R2 · C– · O2, written from this report for PrompTugal.news.