Codaro Review

Policy, independent audit and verifiable evidence for AI-assisted development.

Keep your existing AI coding tools. Add independent review, policy and evidence.

Codaro Review reads the code in your editor, applies your organisation's policy, and records what it found - so AI-written code gets a second opinion, and you have a history you can point at afterwards. It reviews; it does not write your code for you.

What it gives you

• Deep Audit - a full-project AI review, on a processing route you confirm first.
• Deterministic security and code checks - secrets, hallucinated and vulnerable dependencies, and risky licences, found locally without a model.
• Organisation policy - your rules loaded into the editor, with the version in use shown, and applied to what Review will and will not do.
• Findings and evidence history - what was reviewed, and what was decided, recorded against your organisation.
• Codaro Compliance - for organisations entitled to it, findings and evidence are collected into that record.

Works with VS Code, Cursor, Windsurf, and any VS Code-based editor.

The Problem

AI agents write code 10x faster. But do they write it well?

Speed is great - until you spend hours debugging a hallucinated package or tracking down a security leak. The faster you prompt, the faster you stack tech debt.

How Codaro Fixes This

Codaro's agents understand context, consequences, and compliance - not just syntax. They run locally in your IDE, catch issues in real-time, and fix them.

Agentic Fix Workflow

1. Agent detects issue
2. Fix generated automatically
3. Applied - issue resolved

No context switching. No copy-pasting prompts. The agent finds the bug and fixes it for you - all without leaving your IDE.

Compliance Agent

AI tools happily import packages with GPL or AGPL licenses that legally force your entire product to be open-source. Codaro's compliance agent flags risky licenses and missing privacy requirements automatically.

Secret Detection

Catches hardcoded AWS keys, database passwords, API tokens, and other credentials before they ever reach your repository.

Dependency Sentinel

Detects hallucinated, malicious, or vulnerable packages in your project - protecting you from supply-chain attacks across npm, PyPI, Cargo, Composer, pub, Go, Gems, Maven, and Gradle.

Real Case: App Store Rejection

A solo dev used Cursor to add camera features. The AI generated perfect code - but never added NSCameraUsageDescription to Info.plist. Apple rejected it instantly.

Codaro's agent would have caught it before the commit.

Your Data, Your Security

• Zero-Retention & IP Protection - We never train on your code. Data is processed ephemerally - encrypted to extract insights, then deleted.
• Enterprise-Grade Encryption - AES-256 at rest, SSL/TLS in transit.
• EU Infrastructure & GDPR - Hosted on Google Cloud with strict EU residency.

Privacy & Telemetry

Codaro collects minimal, anonymous usage data to improve the extension:

• Command invocations (name and success/error status - no arguments, no code)
• Audit and fix counts (for plan-limit enforcement - no code content)
• Error types and truncated error messages (for crash diagnostics)
• Extension version and an anonymous device fingerprint (for subscription lookup)

We never collect source code, file contents, prompts, or personal information.

Telemetry respects VS Code's global setting. To opt out, set in settings.json:

"telemetry.telemetryLevel": "off"

Full details: codaro.dev/privacy

Pricing

Free plan included - get started with no credit card required.

See full pricing & upgrade

Getting Started

1. Install the extension
2. Click the Codaro icon in the sidebar
3. Connect your account (free)
4. Run your first Deep Audit

That's it. Codaro starts protecting your code immediately.

Learn more at codaro.dev

Deep links (vscode://codaro.codaro/...)

The plugin handles the following URIs:

These are used by codaro.dev to deep-link back into the editor after web-side actions (invite emails, magic links, post-checkout). Safe to ignore if you're not using the relevant flow; unknown paths are silently dropped.