# Report: Codacy > GAMMA-Ray v0.0.155 (beta, for review; every rating is experimental). The GAMMA-Ray beta report on Codacy: AI Reviewer A1 · R2 · C– · O2; 36 provisions lit, 11 sources captured. > Page: https://gamma-ray.sgit.ai/reports/codacy/ · Source: data/reports/codacy.json GAMMA-Ray report · Spectrum 0.2 beta · Public tier · read 2026-11-10 · not reviewed by the company yet A cloud platform that runs code quality, security and coverage checks on repositories, with AI features that review pull requests and tools that feed its findings to coding agents. 1 solution carded of 7 found 11 sources captured and hashed 36 provisions lit in 8 of 8 instruments 3 examples of the agent at work, with sources Built only from Codacy's own public pages and, for company basics only, the news sources named beside each fact. Codacy has not seen this report. Nothing was tested and no credentials were used. If you are Codacy and something here is wrong or missing, the correction will be made and dated, and you can claim the card to add evidence. ## The agentic solutions One card per solution. Each level is computed from the evidence by a [published rule](../../spectrum/evidence-map/index.md); a dimension with nothing public reads "not yet evidenced", which is not a no. A card rates a product as documented, not anyone's deployment of it. ### AI Reviewer Opt-in pull request reviewer on GitHub that combines Codacy's static analysis with a language model, reads the PR, linked Jira or Linear tickets and repository instructions, and posts a review with a verdict, a summary, test suggestions and inline comments with suggested fixes. It can run automatically on the first review of a PR or on demand (button or public API). AI Reviewer a product, as documented SPECTRUM 0.2 BETA · Public tier · 2026-11-10 A1 Autonomy Assists with options on · as shipped not yet evidenced π Moderate · S1·R5·A1 ×3 R2 Reach Integrated with options on · as shipped not yet evidenced π Moderate · S1·R5·A1 ×3 C – Control not yet evidenced O2 Openness Documented π Moderate · S1·R5·A1 ×3 Draft Stage: Exploring (5 of 16) In production Balanced Standout. Reach 2 (Integrated): "It then reads the ticket from Jira or Linear:" Next unlock. Control 1 (Stated): public evidence that a limit on it is a rule in prose would get there. Trust. FACT-Ray : 11 facts: 11 π Moderate · found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it. Standards constellation. 36 provisions lit across 8 of 8 instruments. Salesforce EAAMM OWASP MCP AAGMM Microsoft NIST AI Act Evidence: 6 sources, captured and hashed · the card's page has the vault's read key · Not reviewed by its vendor yet · correct or claim this card [The full card, every answer and its evidence](../../spectrum/cards/codacy-ai-reviewer/index.md) · [the governance layer](../../scans/codacy-ai-reviewer/index.md) ### Codacy Guardrails (AI Guardrails) IDE extension plus the Codacy MCP server and Codacy CLI that give a user's own coding agent Codacy's scan results so the agent fixes issues; Codacy states it is not a language model itself. *No card yet (available; free IDE extension, central configuration on paid plans): this solution has not been assessed.* ### Codacy MCP Server MCP server for the Codacy API (npm @codacy/codacy-mcp) exposing repositories, issues, security findings, pull requests and local analysis to MCP-compatible agents. *No card yet (published, npm latest 0.7.2): this solution has not been assessed.* ### Auto-configure repository Paid feature in which an AI coding agent reviews a repository and applies tool and code-pattern settings in Codacy, once per repository per day. *No card yet (available, paid): this solution has not been assessed.* ### Codacy Skills Skills for Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI that drive the Codacy CLIs. *No card yet (available, public and free): this solution has not been assessed.* ### Smart False Positive Triage AI triage that scores issues for likely false positives and surfaces them for manual review. *No card yet (Business plan, enabled on request): this solution has not been assessed.* ### Codacy platform (Code Quality, Security, Coverage, AI Risk Hub, AI Inventory) Static analysis, SAST/SCA/secrets/IaC/DAST, coverage gates and AI-usage inventory across repositories. *No card yet (generally available): this solution has not been assessed.* ## Our reading **The shape.** Codacy's AI Reviewer reads A1 · R2 · C– · O2 (Exploring). It is an opt-in reviewer for GitHub pull requests: it combines Codacy's static analysis with a language model, reads the pull request, a linked Jira or Linear ticket and the repository's instructions, and posts a review with a verdict, a summary, test suggestions and inline comments with suggested fixes. A person decides what to apply. **Three levels hold with the reviewer on.** An admin turns the AI Reviewer on per repository or organisation, on GitHub, for Team and Business plans, so Reach 2 is marked available. Control reads "not yet evidenced". Autonomy 1 rests on the Manually setting, in which a person starts each review with Run Reviewer or a call to the public API. Openness 2 holds as shipped: the docs give the reviewer's size limit (270,000 tokens or a 1 MB diff), list the context it sends to the model and what Codacy stores, and say secrets are redacted before sending. **Where the evidence is strongest.** The documentation is specific. Teams write a review.md file whose template has a section for what the reviewer should ignore (shown, and not counted as a limit, since no page says the reviewer is bound by it); people contest a comment by replying in the pull request; the reviewer posts through the Codacy GitHub App, whose permission table lists access scope by scope. A Codacy case study names BFI Finance, which compared the reviewer with its previous AI review tool and switched that tool off. Its figure of around 170 developers is the company's own, and a headcount, not a count of reviews. **What would move it.** Autonomy 2: a page stating that the reviewer's suggested fixes are proposed actions a person approves one at a time. Reach 3: a published protocol or agent interface for the reviewer itself. Control 1: a page stating how people approve, override or stop the reviewer, or a written rule that binds it. Openness 3: published test or evaluation results for the reviewer, with a method; an llms.txt and an OpenAPI description already resolve. **Seen, and not counted.** The challenger lowered the reading of a posted review as an action: the reviewer changes no code, record or setting, so Autonomy rests on the manual mode. The Codacy MCP server and the review endpoint in the general REST API serve the whole platform, not the reviewer as an agent interface. The docs name OpenAI models through Amazon Bedrock while another Codacy page says the reviewer runs on Gemini, so the models are not counted as listed. The SOC 2 Type 2 statement does not show that its scope covers the AI features. ## What would move it The one piece of public evidence that would lift each card next: - **AI Reviewer**: Control 1 (Stated). Public evidence that a limit on it is a rule in prose. ## The agent at work Examples from public pages that name a customer or give figures. Each source was captured and hashed on the date shown. ### BFI Finance Evaluated the AI Reviewer against an existing AI code review tool and switched that tool off; Codacy says its AI reviewer is part of daily work for around 170 developers. "Codacy's AI Reviewer is better aligned with its workflow" [Source](https://resources.codacy.com/resources/case-study-bfi-finance) (captured 2026-11-10T17:49Z, sha256 `563b62540a7f7d7b`) ### ihomer Uses Codacy Guardrails with GitHub Copilot in VS Code; the agent that fixes code is Copilot, not Codacy. "50%+ of developers adopting AI guardrails in their daily workflow" [Source](https://resources.codacy.com/resources/case-study-ihomer) (captured 2026-11-10T12:47Z, sha256 `cb14cfc515ff60ff`) ### LSports Uses quality gates across 800 repositories and the IDE plugin with MCP integration; no AI Reviewer usage stated. "800 Repos, One Standard" [Source](https://resources.codacy.com/resources/case-study-lsports) (captured 2026-11-10T12:47Z, sha256 `918c2f5d7f8e01b7`) ## The company - Founded in 2012 by Jaime Jorge (CEO) and João Caxaria (CTO), headquartered in Lisbon. "headquartered in Lisbon, Portugal." [Source](https://www.codacy.com/llms.txt) (captured 2026-11-10T17:49Z, sha256 `52a0c32c01ff8dea`) - The about page states the founding year and the founders. "Founded in 2012 by developers Jaime Jorge and João Caxaria" [Source](https://www.codacy.com/about) (captured 2026-11-10T12:47Z, sha256 `21db0b3236096cbb`) - The home page's structured data gives Lisbon as its locality. ""addressLocality": "Lisbon"" [Source](https://www.codacy.com/) (captured 2026-11-10T12:47Z, sha256 `3351e5842223d38b`) - The company states it holds SOC 2 Type 2 and is GDPR compliant. "Codacy is SOC 2 Type 2 certified and GDPR compliant." [Source](https://www.codacy.com/llms.txt) (captured 2026-11-10T17:49Z, sha256 `52a0c32c01ff8dea`) - The AI features of the platform are optional and opt-in. "Codacy AI is a set of optional features integrated into the Software" [Source](https://docs.codacy.com/codacy-ai/codacy-ai/) (captured 2026-11-10T17:49Z, sha256 `1ccd57719e29bac8`) ## The people Public and professional only, from the company's own pages or a public professional source. - **Jaime Jorge**, Co-founder and CEO. [Source](https://www.codacy.com/about) - **João Caxaria**, Co-founder; named CTO on the AI Info page. [Source](https://www.codacy.com/ai-info) - **Emma Hunt**, VP of People Operations. [Source](https://www.codacy.com/about) - **David Galante**, VP of Operations. [Source](https://www.codacy.com/about) ## The graph The company, its people and the stories on the left; each solution, the captured sources behind its card, the indicators those sources evidence and the provisions of the instruments those indicators touch, to the right. "Touched" never means "complies". people and stories company solutions 6 sources 11 indicators 36 provisions, by instrument I01: The AI Reviewer is one of the vendor's optional AI features inside its hosted platform, used as supplied once an admin turns it on. I10: The reviewer combines GitHub pull request data, Codacy findings and a linked Jira or Linear ticket. I11: The reviewer sends pull request context to OpenAI models through Amazon Bedrock and reads tickets from Jira or Linear, services outside Codacy. I15: In the Manually mode a person starts each review by clicking Run Reviewer in the pull request summary comment, or by a call to the public API. I20: The docs state what the reviewer does: comment on Codacy issues worth attention, summarise the rest, and check changes against requirements and project logic. I22: The limits page gives the reviewer's size limit (270,000 tokens or a 1 MB diff) and what it does above it; the Codacy AI docs page says it runs on GitHub only. I25: The AI Reviewer is a setting of Codacy's GitHub integration; the permissions page lists the Codacy GitHub App's access per scope, with repository contents and metadata read-only and pull requests, checks and issues read and write, and its pull requests row covers creating comments and suggestions. The page does not mention the AI Reviewer: the credit is for the platform's GitHub App, shared by all Codacy features. I57: People can contest a review comment by replying in the pull request, and the reviewer learns from those replies and reactions. I58: The docs list the context sent to the model, what Codacy stores and does not store, and that secrets are redacted before sending. S1: A vendor-published case study names BFI Finance, which switched off its previous AI review tool, and its summary list puts the AI reviewer in daily work for around 170 developers (a team headcount, not a count of reviews); the closing paragraph's list of tools in daily work omits the reviewer. S3: An llms.txt resolves at codacy.com and an OpenAPI 3.0.1 description resolves at api.codacy.com/api/api-docs/swagger.yaml; both are the vendor's platform-wide files, in which the AI Reviewer is one entry. Codacy Jaime Jorge João Caxaria Emma Hunt David Galante BFI Finance ihomer LSports AI Reviewer AI Reviewer A1 · R2 · C– · O2 Codacy Guardrails (AI Guardrails) Codacy Guardrails Codacy MCP Server Codacy MCP Server Auto-configure repository Auto-configure repository Codacy Skills Codacy Skills Smart False Positive Triage Smart False Positive Triage Codacy platform (Code Quality, Security, Coverage, AI Risk Hub, AI Inventory) Codacy platform docs.codacy.com/codacy-ai/codacy-… docs.codacy.com/repositories-conf… docs.codacy.com/faq/code-analysis… docs.codacy.com/getting-started/w… resources.codacy.com/resources/ca… codacy.com/llms.txt It is a vendor's assistant, used as supplied I01 It works across several domains or systems I10 It connects to external tools or services across a trust boundary I11 The person operates: every action is prompted and controlled by them I15 Its purpose and permitted tasks are stated in writing I20 Its limits and known failure cases are documented for those who use it I22 It asks for narrower access than the whole account I25 There is a channel to report problems with it or contest its output I57 The data it uses is described I58 It is in production: a public source names a customer or gives usage figures for what it does on its own S1 It is machine-readable for agents: it publishes an llms.txt, an AGENTS.md, an API description or an agent card S3 Salesforce 10 EAAMM 2 OWASP 2 MCP authorization 4 AAGMM 2 Microsoft 3 NIST AI RMF 12 EU AI Act 1 OWASP, AT1 Vendor Embedded Assistant Salesforce, Level 3: Complex Orchestration, Multiple Domain Salesforce, Level 2, how to advance from Level 2 to Level 3 Salesforce, Level 3, how to advance from Level 3 to Level 4 Microsoft, 400: Capable, Business strategy Microsoft, 200: Repeatable, Technology and data OWASP, AT6 Externally Extended Agent NIST AI RMF, GOVERN 6.1 NIST AI RMF, MAP 4.1 EAAMM, L1 Assistive (survey item Q9) NIST AI RMF, MAP 1.1 NIST AI RMF, MAP 2.1 NIST AI RMF, MAP 3.3 NIST AI RMF, MAP 1.3 EU AI Act, Article 13 NIST AI RMF, MAP 2.2 NIST AI RMF, MEASURE 2.5 MCP authorization, Authorization (draft) Salesforce, Level 2, how to advance from Level 2 to Level 3 Salesforce, Level 3, how to advance from Level 3 to Level 4 AAGMM, GD-02 MCP authorization, Authorization (draft) NIST AI RMF, MEASURE 3.3 NIST AI RMF, GOVERN 5.1 Salesforce, Level 1, how to advance from Level 1 to Level 2 Salesforce, Level 4, how to maximize value NIST AI RMF, GOVERN 5.2 AAGMM, GD-05 EAAMM, Readiness dimension 2 Salesforce, Level 0, how companies can advance from Level 0 to Level 1 Salesforce, Level 1, how to advance from Level 1 to Level 2 NIST AI RMF, MAP 1.4 Microsoft, 400: Capable, Business strategy Salesforce, Level 0, how companies can advance from Level 0 to Level 1 MCP authorization, Authorization (draft) MCP authorization, Authorization (draft) ## The evidence | Source | Read | SHA-256 (first 16) | |---|---|---| | [docs.codacy.com/codacy-ai/codacy-ai/](https://docs.codacy.com/codacy-ai/codacy-ai/) | 2026-11-10T17:49Z | `1ccd57719e29bac8` | | [docs.codacy.com/faq/code-analysis/does-codacy-place-limits-on-the-code](https://docs.codacy.com/faq/code-analysis/does-codacy-place-limits-on-the-code-analysis/) | 2026-11-10T17:49Z | `70910c1487249186` | | [docs.codacy.com/getting-started/which-permissions-does-codacy-need-fro](https://docs.codacy.com/getting-started/which-permissions-does-codacy-need-from-my-account/) | 2026-11-10T17:49Z | `86c7dbdcaceb3cdd` | | [docs.codacy.com/repositories-configure/integrations/github-integration](https://docs.codacy.com/repositories-configure/integrations/github-integration/) | 2026-11-10T17:49Z | `1d7691aa3224a7ab` | | [resources.codacy.com/resources/case-study-bfi-finance](https://resources.codacy.com/resources/case-study-bfi-finance) | 2026-11-10T17:49Z | `563b62540a7f7d7b` | | [resources.codacy.com/resources/case-study-ihomer](https://resources.codacy.com/resources/case-study-ihomer) | 2026-11-10T12:47Z | `cb14cfc515ff60ff` | | [resources.codacy.com/resources/case-study-lsports](https://resources.codacy.com/resources/case-study-lsports) | 2026-11-10T12:47Z | `918c2f5d7f8e01b7` | | [www.codacy.com/](https://www.codacy.com/) | 2026-11-10T12:47Z | `3351e5842223d38b` | | [www.codacy.com/about](https://www.codacy.com/about) | 2026-11-10T12:47Z | `21db0b3236096cbb` | | [www.codacy.com/ai-info](https://www.codacy.com/ai-info) | 2026-11-10T12:47Z | `a34206341e4a2da7` | | [www.codacy.com/llms.txt](https://www.codacy.com/llms.txt) | 2026-11-10T17:49Z | `52a0c32c01ff8dea` | ## How this report was made A researcher-assessor gathered and captured the sources and mapped the evidence to indicators, without assigning a level. A challenger argued against every level three and four and every doubtful credit. The [deterministic scorer](../../spectrum/pipeline/index.md) computed the levels and the gate checked the rules. A card appears here only after two rounds of review and a sign-off by agents that did not write it (the team's workflow); AI Reviewer: reviewed in 4 rounds, signed off by gamma.approve@web-summit.dinis on 2026-11-10. A person's sign-off of the series is still to come. | Role | Who | |---|---| | researcher-assessor | a sub-agent of gamma.studio@web-summit.dinis | | challenger | a sub-agent | | scorer | build/spectrum.mjs | | analyst, designer, writer | gamma.studio@web-summit.dinis | | review | gamma.review@web-summit.dinis, 4 rounds | | sign-off | gamma.approve@web-summit.dinis, 2026-11-10 | ## The vault Every capture, the dossier, both assessors' mappings, the challenger's notes and this report's data are in a public sgit vault (`u6a01jwq`). Read key: sgit_public_read_af2cc62b777e2d6af5fdb41b6ec2899e95fe143c11859904fa56fbedea727f2f:u6a01jwq With [sgit](https://sgit.ai/): `sgit clone` followed by the key. The key reads; it cannot write. ## Corrections None yet. A correction is made in place, dated here, and carried to the card, the vault and the article. ## The article [AI Reviewer on the GAMMA-Ray Spectrum: A1 · R2 · C– · O2](article.md), written from this report for PrompTugal.news.