Guardrails for
AI-Generated Code
Make every line of AI-generated code play by your rules –
while it's being generated. Security and quality standards for
VS Code, Copilot, Cursor and Windsurf, under your full control.
Codacy Guardrails
- SAST
- Hardcoded secrets
- Insecure dependencies
- License scanning
- Infrastructure-as-code misconfiguration
- Error prone code
- Performance issues
- Best practices
- Complex code
- Code duplications
- Code style violations
- SAST
- Hardcoded secrets
- Insecure dependencies
- License scanning
- Infrastructure-as-code misconfiguration
- Error prone code
- Performance issues
- Best practices
- Complex code
- Code duplications
- Code style violations
Trusted by
See Guardrails in action
Shift left completed. Once and for all.
Install Codacy IDE Extension
Guardrails runs inside VS Code, Cursor and Windsurf, checking every line of AI-written code in real-time.
Set your Coding Standards
Customize and enforce your business's security and quality rules across every IDE in your organization.
Future-proof your Applications
Every line of AI-generated code is safe and compliant from the start, following the standards you define.
"Codacy Guardrails made using a coding agent go from useful to essential."
Daan van Leth
AI Solutions Consultant at ihomer
One source of truth. Limitless possibilities.
Codacy Guardrails pairs trusted static analysis methods with the power of AI coding agents, delivering unmatched speed without leaving a trail of destruction.
BUILD APPS WITHOUT THE REWORK
Write a web server following our coding standards
EFFORTLESS APPSEC FOR DEVS
Fix all critical security issues in this repo
UNIT TESTS IN SECONDS
Write tests for all files with low test coverage
BUILD REPORTS INSTANTLY
List my open security issues by severity
SKIP THE SECURITY TICKET
Am I using any insecure or unlicensed dependencies?
NO MORE SCAVENGER HUNTS
Fix all DAST findings in this repo
LEAN CODE ON DEMAND
Refactor all files with duplicated blocks of code
LEAN CODE ON DEMAND
Refactor all files with duplicated blocks of code
BUILD APPS WITHOUT THE REWORK
Write a web server following our coding standards
BUILD REPORTS INSTANTLY
List my open security issues by severity
UNIT TESTS IN SECONDS
Write tests for all files with low test coverage
EFFORTLESS APPSEC FOR DEVS
Fix all critical security issues in this repo
NO MORE SCAVENGER HUNTS
Fix all DAST findings in this repo
SKIP THE SECURITY TICKET
Am I using any insecure or unlicensed dependencies
Loved by
_EasiestAdmin_EaseOfAdmin.png?width=73&height=85&name=DynamicApplicationSecurityTesting(DAST)_EasiestAdmin_EaseOfAdmin.png)
_BestSupport_QualityOfSupport.png?width=74&height=85&name=StaticApplicationSecurityTesting(SAST)_BestSupport_QualityOfSupport.png)

_BestEstimatedROI_Roi.png?width=73&height=85&name=StaticApplicationSecurityTesting(SAST)_BestEstimatedROI_Roi.png)
.png?width=73&height=85&name=StaticCodeAnalysis_Leader_Leader%20(1).png)

_EasiestSetup_EaseOfSetup.png?width=74&height=85&name=StaticApplicationSecurityTesting(SAST)_EasiestSetup_EaseOfSetup.png)
_HighPerformer_HighPerformer.png?width=73&height=85&name=StaticApplicationSecurityTesting(SAST)_HighPerformer_HighPerformer.png)
Ready to give Guardrails a spin?
Helping industry leaders build a future they can trust




Proudly shaping the future of software, since 2012
“A SECURITY MUST-HAVE”
Codacy is easy to integrate and its new security dashboard provides useful insights into metrics across the company. The support team is really helpful and provides immediate assistance.

“A GAME-CHANGER FOR CODE QUALITY AND TEAM PRODUCTIVITY”
My team's overall code quality has improved significantly by using codacy. We have extensively used it to fix syntaxes, detect and remove hardcodings, and improve any redundancy in the code. In addition to code quality, its integration with pull requests and project management tools such as Jira has helped me to manage code reviews and quality efficiently.

"Great tool for detecting code issues, code coverage, code duplication and complexity"
From the point of view of a company that processes card transactions and is subject to Compliance/Certifications with card scheme standards, automated code review and detection of security problems is the most useful thing. Codacy helps developers save time in code reviews, so developers can focus on other things. Codacy centralizes customizable code patterns and enforces them within engineering teams so that everyone's code goes through static analysis and is evaluated before being put into production. Easy integration with GitLab. Customer Support is of high quality, responds quickly to inquiries, always helps us as much as possible.

“GREAT TOOL TO ENSURE YOUR QUALITY STANDARDS”
The high number of programming languages that are supported by Codacy helped a lot in our situation, once we had different tech stacks. It was also very easy to integrate with our CI/CD flows, and we are seeing a really cool product roadmap.

“COMPANY THAT UNDERSTANDS DEVELOPERS”
I like how Codacy works to build strong partnerships with its customers. I like the focus on developers and the developer experience. I like that Codacy gives me a hassle-free single pane of glass view into code quality across my organization.

Frequenty asked questions
How do I install Codacy Guardrails?
The Codacy IDE Extension can be installed directly through your VSCode, Cursor and Windsurf marketplace:
Once installed, follow the steps below:
- Click the Codacy tab (Codacy icon)
- Log in or create your Codacy account (5 second signup via Github, Bitbucket and GitLab)
- Activate the Codacy CLI for local analysis
- Install MCP Server
For other IDEs, Codacy Guardrails can also be installed manually:
1. Install Codacy CLIhttps://github.com/codacy/codacy-cli-v2
2. Install Codacy MCP Server
NPM: https://www.npmjs.com/package/@codacy/codacy-mcp-
GitHub: https://github.com/codacy/codacy-mcp-server
Can I use Guardrails without an AI copilot?
Codacy Guardrails is designed to be installed from our IDE extension for VS Code, Cursor and Windsurf. but as long as you have an AI code generator that is compatible with the MCP protocol you can also add Guardrails into your MCP configuration manually.
Without an AI coding agent, you instead need to use the Codacy IDE extension without the MCP Server.
Does Guardrails work with all OS?
Guardrails is supported on MacOS, Linux, and Windows (via WSL)
Which AI security and quality standards can I enforce with Guardrails?
Codacy Guardrails detects and auto-remediates security risks and quality issues in JavaScript, TypeScript, Python, and Java, including:
- SAST vulnerabilities
- Hardcoded secrets
- Insecure dependencies
- Error prone code
- Performance issues
- Best practices
- Complex code
- Code duplications
- Styling violations
Configuring and enforcing coding standards at scale across all IDEs in your organization requires a Codacy Team or Business subscription.
How much does Guardrails cost?
Check our Team and Organization plans to unlock:
- Central configuration and enforcement of AI coding standards across teams and projects
- Query and auto-fix existing problems across your codebase from the AI chat panel
- Generate custom security and code quality reports using AI prompts
- Full access to the Codacy Cloud platform including:
- Pipeline-less AppSec and code quality scans
- PR merge gates
- Team dashboards
- Security reports
- DAST pipelines
- Jira integration
Is my data secure?
Codacy Guardrails is not a large language model, but an IDE extension that uses an MCP Server to communicate with existing AI coding agents owned by the user.