# Spectrum card: AI Reviewer

> GAMMA-Ray v0.0.155 (beta, for review; every rating is experimental). The GAMMA-Ray Spectrum beta card of AI Reviewer: A1 · R2 · C– · O2, Exploring; 36 provisions lit across 8 instruments.
> Page: https://gamma-ray.sgit.ai/spectrum/cards/codacy-ai-reviewer/ · Source: data/scans/codacy-ai-reviewer.json


Spectrum 0.2 beta · Public tier · read 2026-11-10 · not reviewed by its vendor yet

Opt-in pull request reviewer on GitHub that combines Codacy's static analysis with a language model, reads the PR, linked Jira or Linear tickets and repository instructions, and posts a review with a verdict, a summary, test suggestions and inline comments with suggested fixes. It can run automatically on the first review of a PR or on demand (button or public API).

AI Reviewer a product, as documented SPECTRUM 0.2 BETA · Public tier · 2026-11-10 A1 Autonomy Assists with options on · as shipped not yet evidenced π Moderate · S1·R5·A1 ×3 R2 Reach Integrated with options on · as shipped not yet evidenced π Moderate · S1·R5·A1 ×3 C – Control not yet evidenced O2 Openness Documented π Moderate · S1·R5·A1 ×3 Draft Stage: Exploring (5 of 16) In production Balanced Standout. Reach 2 (Integrated): "It then reads the ticket from Jira or Linear:" Next unlock. Control 1 (Stated): public evidence that a limit on it is a rule in prose would get there. Trust. FACT-Ray : 11 facts: 11 π Moderate · found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it. Standards constellation. 36 provisions lit across 8 of 8 instruments. Salesforce EAAMM OWASP MCP AAGMM Microsoft NIST AI Act Evidence: 6 sources, captured and hashed · the card's page has the vault's read key · Not reviewed by its vendor yet · correct or claim this card

*Figure. The walk from the card down to each indicator, its public source and the instruments it touches; the sections below list the same in text.*

## What each level rests on

*Figure. For each dimension, what its level rests on: one fold-out per fact, each opening that fact's path down to the source.*

This card rates a product as its vendor documents it, not anyone's deployment of it. A feature the operator has to turn on counts, and is marked as available. Levels are computed from the evidence below by [published rules](../../evidence-map/index.md). A dimension with no evidence reads "not yet evidenced".

## Autonomy: level 1, Assists

*What does the agent do on its own?* Answers, drafts, summarises; a person does each step. **This level holds with: Manual review.** As shipped, with nothing turned on, it is not yet evidenced.

- `I15` The person operates: every action is prompted and controlled by them. In the Manually mode a person starts each review by clicking Run Reviewer in the pull request summary comment, or by a call to the public API. "to trigger a review on demand" [Source](https://docs.codacy.com/repositories-configure/integrations/github-integration/) (read, documented, available, captured 2026-11-10T17:49Z, sha256 `1d7691aa3224a7ab`) · π Moderate · S1·R5·A1 ×3

This evidence touches 1 provision: EAAMM.

**Next unlock: level 2, Suggests.** Public evidence that the agent suggests; the person reviews and approves each action.

## Reach: level 2, Integrated

*How connected is it?* Documented connectors to common tools. **This level holds with: Ai reviewer.** As shipped, with nothing turned on, it is not yet evidenced.

- `I10` It works across several domains or systems. The reviewer combines GitHub pull request data, Codacy findings and a linked Jira or Linear ticket. "It then reads the ticket from Jira or Linear:" [Source](https://docs.codacy.com/codacy-ai/codacy-ai/) (read, documented, available, captured 2026-11-10T17:49Z, sha256 `1ccd57719e29bac8`) · π Moderate · S1·R5·A1 ×3
- `I11` It connects to external tools or services across a trust boundary. The reviewer sends pull request context to OpenAI models through Amazon Bedrock and reads tickets from Jira or Linear, services outside Codacy. "This feature leverages OpenAI models through Amazon Bedrock" [Source](https://docs.codacy.com/codacy-ai/codacy-ai/) (read, documented, available, captured 2026-11-10T17:49Z, sha256 `1ccd57719e29bac8`) · π Moderate · S1·R5·A1 ×3

This evidence touches 8 provisions: Salesforce, Microsoft, OWASP, NIST AI RMF.

**Next unlock: level 3, Open protocol.** Public evidence that there is a published protocol or communication layer between agents.

## Control: not yet evidenced

*Can people stay in command?* Nothing public was found that meets a rule in this dimension. That is not a no.



**Next unlock: level 1, Stated.** Public evidence that a limit on it is a rule in prose.

## Openness: level 2, Documented

*Does it show its work?* Public documents on how it works, its data, its models and its limits.

- `I22` Its limits and known failure cases are documented for those who use it. The limits page gives the reviewer's size limit (270,000 tokens or a 1 MB diff) and what it does above it; the Codacy AI docs page says it runs on GitHub only. "The AI Reviewer doesn't review pull requests whose changes" [Source](https://docs.codacy.com/faq/code-analysis/does-codacy-place-limits-on-the-code-analysis/) (read, documented, captured 2026-11-10T17:49Z, sha256 `70910c1487249186`) · π Moderate · S1·R5·A1 ×3
- `I58` The data it uses is described. The docs list the context sent to the model, what Codacy stores and does not store, and that secrets are redacted before sending. "To enrich the review, Codacy can send this context:" [Source](https://docs.codacy.com/codacy-ai/codacy-ai/) (read, documented, captured 2026-11-10T17:49Z, sha256 `1ccd57719e29bac8`) · π Moderate · S1·R5·A1 ×3

This evidence touches 7 provisions: NIST AI RMF, EU AI Act, AAGMM, EAAMM, Salesforce.

**Next unlock: level 3, Measured.** Public evidence that test or evaluation results are published.

## How far to trust this card

**Status: Draft.** Draft means the facts were found in public pages and reviewed by agents. The company has not confirmed them and no customer has gone on record. [FACT-Ray](../../../fact-ray/index.md) says how far each fact can be trusted: who says it (Source), how firmly it is recorded (Record) and who stands behind it (Accountability). It never changes a level.

- **The facts:** 11 facts: 11 π Moderate. Each is written beside its evidence above.
- **The chain:** found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it.
- **Who:** produced by `gamma.studio@web-summit.dinis`; checked by `gamma.review@web-summit.dinis` and `gamma.approve@web-summit.dinis`. [The actors](../../../fact-ray/actors/index.md).
- **What would raise it:** the company's own file at `/.well-known/fact-ray.json` (Source 2), a customer's statement of use (Source 3), or a named person signing the card ([how](../../../fact-ray/well-known/index.md)).

## The standards constellation

One piece of public evidence can speak to several frameworks at once. "Touched" never means "complies". The share is of the provisions that can be read from outside.

| Instrument | Provisions touched | Of those publicly readable |
|---|---|---|
| Salesforce | 10 | 24 |
| EAAMM | 2 | 8 |
| OWASP | 2 | 18 |
| MCP authorization | 4 | 8 |
| AAGMM | 2 | 6 |
| Microsoft | 3 | 23 |
| NIST AI RMF | 12 | 20 |
| EU AI Act | 1 | 6 |

The 36 provisions lit

Each line item, with the facts that reach it. "Evidenced" is a link of the kind *same*: the fact is what the provision asks. "Partly" is a link of the kind *part*: the fact is one piece of it. "Its absence" points the other way. Each provision has its own page with its text and its place in the source.

| Provision | Instrument | Reached by | How far |
|---|---|---|---|
| [`sf.a04`](../../../provisions/sf.a04/index.md) Level 0, how companies can advance from Level 0 to Level 1 | Salesforce | [I58](https://docs.codacy.com/codacy-ai/codacy-ai/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a06`](../../../provisions/sf.a06/index.md) Level 0, how companies can advance from Level 0 to Level 1 | Salesforce | [S1](https://resources.codacy.com/resources/case-study-bfi-finance) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a08`](../../../provisions/sf.a08/index.md) Level 1, how to advance from Level 1 to Level 2 | Salesforce | [I58](https://docs.codacy.com/codacy-ai/codacy-ai/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a10`](../../../provisions/sf.a10/index.md) Level 1, how to advance from Level 1 to Level 2 | Salesforce | [I57](https://docs.codacy.com/codacy-ai/codacy-ai/) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`sf.a14`](../../../provisions/sf.a14/index.md) Level 2, how to advance from Level 2 to Level 3 | Salesforce | [I25](https://docs.codacy.com/getting-started/which-permissions-does-codacy-need-from-my-account/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a16`](../../../provisions/sf.a16/index.md) Level 2, how to advance from Level 2 to Level 3 | Salesforce | [I10](https://docs.codacy.com/codacy-ai/codacy-ai/) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`sf.L3`](../../../provisions/sf.L3/index.md) Level 3: Complex Orchestration, Multiple Domain | Salesforce | [I10](https://docs.codacy.com/codacy-ai/codacy-ai/) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`sf.a17`](../../../provisions/sf.a17/index.md) Level 3, how to advance from Level 3 to Level 4 | Salesforce | [I10](https://docs.codacy.com/codacy-ai/codacy-ai/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a21`](../../../provisions/sf.a21/index.md) Level 3, how to advance from Level 3 to Level 4 | Salesforce | [I25](https://docs.codacy.com/getting-started/which-permissions-does-codacy-need-from-my-account/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`sf.a28`](../../../provisions/sf.a28/index.md) Level 4, how to maximize value | Salesforce | [I57](https://docs.codacy.com/codacy-ai/codacy-ai/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`eaamm.L1`](../../../provisions/eaamm.L1/index.md) L1 Assistive (survey item Q9) | EAAMM | [I15](https://docs.codacy.com/repositories-configure/integrations/github-integration/) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`eaamm.D2`](../../../provisions/eaamm.D2/index.md) Readiness dimension 2 | EAAMM | [I58](https://docs.codacy.com/codacy-ai/codacy-ai/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`owasp.AT1`](../../../provisions/owasp.AT1/index.md) AT1 Vendor Embedded Assistant | OWASP | [I01](https://docs.codacy.com/codacy-ai/codacy-ai/) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`owasp.AT6`](../../../provisions/owasp.AT6/index.md) AT6 Externally Extended Agent | OWASP | [I11](https://docs.codacy.com/codacy-ai/codacy-ai/) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`mcp.01`](../../../provisions/mcp.01/index.md) Authorization (draft) | MCP authorization | [S3](https://www.codacy.com/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`mcp.02`](../../../provisions/mcp.02/index.md) Authorization (draft) | MCP authorization | [S3](https://www.codacy.com/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`mcp.06`](../../../provisions/mcp.06/index.md) Authorization (draft) | MCP authorization | [I25](https://docs.codacy.com/getting-started/which-permissions-does-codacy-need-from-my-account/) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`mcp.15`](../../../provisions/mcp.15/index.md) Authorization (draft) | MCP authorization | [I25](https://docs.codacy.com/getting-started/which-permissions-does-codacy-need-from-my-account/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`aagmm.GD-02`](../../../provisions/aagmm.GD-02/index.md) GD-02 | AAGMM | [I25](https://docs.codacy.com/getting-started/which-permissions-does-codacy-need-from-my-account/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`aagmm.GD-05`](../../../provisions/aagmm.GD-05/index.md) GD-05 | AAGMM | [I58](https://docs.codacy.com/codacy-ai/codacy-ai/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`ms.200.4.2`](../../../provisions/ms.200.4.2/index.md) 200: Repeatable, Technology and data | Microsoft | [I10](https://docs.codacy.com/codacy-ai/codacy-ai/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`ms.400.2.1`](../../../provisions/ms.400.2.1/index.md) 400: Capable, Business strategy | Microsoft | [I10](https://docs.codacy.com/codacy-ai/codacy-ai/) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`ms.400.2.3`](../../../provisions/ms.400.2.3/index.md) 400: Capable, Business strategy | Microsoft | [S1](https://resources.codacy.com/resources/case-study-bfi-finance) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.GOVERN-5.1`](../../../provisions/nist.GOVERN-5.1/index.md) GOVERN 5.1 | NIST AI RMF | [I57](https://docs.codacy.com/codacy-ai/codacy-ai/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.GOVERN-5.2`](../../../provisions/nist.GOVERN-5.2/index.md) GOVERN 5.2 | NIST AI RMF | [I57](https://docs.codacy.com/codacy-ai/codacy-ai/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.GOVERN-6.1`](../../../provisions/nist.GOVERN-6.1/index.md) GOVERN 6.1 | NIST AI RMF | [I11](https://docs.codacy.com/codacy-ai/codacy-ai/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-1.1`](../../../provisions/nist.MAP-1.1/index.md) MAP 1.1 | NIST AI RMF | [I20](https://docs.codacy.com/repositories-configure/integrations/github-integration/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-1.3`](../../../provisions/nist.MAP-1.3/index.md) MAP 1.3 | NIST AI RMF | [I20](https://docs.codacy.com/repositories-configure/integrations/github-integration/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-1.4`](../../../provisions/nist.MAP-1.4/index.md) MAP 1.4 | NIST AI RMF | [S1](https://resources.codacy.com/resources/case-study-bfi-finance) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-2.1`](../../../provisions/nist.MAP-2.1/index.md) MAP 2.1 | NIST AI RMF | [I20](https://docs.codacy.com/repositories-configure/integrations/github-integration/) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-2.2`](../../../provisions/nist.MAP-2.2/index.md) MAP 2.2 | NIST AI RMF | [I22](https://docs.codacy.com/faq/code-analysis/does-codacy-place-limits-on-the-code-analysis/) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-3.3`](../../../provisions/nist.MAP-3.3/index.md) MAP 3.3 | NIST AI RMF | [I20](https://docs.codacy.com/repositories-configure/integrations/github-integration/) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`nist.MAP-4.1`](../../../provisions/nist.MAP-4.1/index.md) MAP 4.1 | NIST AI RMF | [I11](https://docs.codacy.com/codacy-ai/codacy-ai/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MEASURE-2.5`](../../../provisions/nist.MEASURE-2.5/index.md) MEASURE 2.5 | NIST AI RMF | [I22](https://docs.codacy.com/faq/code-analysis/does-codacy-place-limits-on-the-code-analysis/) (partly) | partly · π Moderate · S1·R5·A1 ×3 |
| [`nist.MEASURE-3.3`](../../../provisions/nist.MEASURE-3.3/index.md) MEASURE 3.3 | NIST AI RMF | [I57](https://docs.codacy.com/codacy-ai/codacy-ai/) (evidenced) | evidenced · π Moderate · S1·R5·A1 ×3 |
| [`aiact.art-13`](../../../provisions/aiact.art-13/index.md) Article 13 | EU AI Act | [I20](https://docs.codacy.com/repositories-configure/integrations/github-integration/) (partly), [I22](https://docs.codacy.com/faq/code-analysis/does-codacy-place-limits-on-the-code-analysis/) (partly), [S3](https://www.codacy.com/llms.txt) (partly) | partly · π Moderate · S1·R5·A1 ×3 |

## Upper layers

The public card is the front door. The same evidence, read with the governance rules, is this agent's [GAMMA-Ray rating](../../../scans/codacy-ai-reviewer/index.md): freedom, governance, the level held, the grant and a work order. That layer is written for an operator.

## The vault

Every source behind this card was captured and hashed into a public sgit vault (`u6a01jwq`): `captures.json` lists each URL with the SHA-256 of what was fetched and when. Read key:

`sgit_public_read_af2cc62b777e2d6af5fdb41b6ec2899e95fe143c11859904fa56fbedea727f2f:u6a01jwq`

With [sgit](https://sgit.ai/): `sgit clone sgit_public_read_af2cc62b777e2d6af5fdb41b6ec2899e95fe143c11859904fa56fbedea727f2f:u6a01jwq`.