Iris Code — Keep AI-assisted code up to your standards

Catch secrets, duplicate code, security smells, and maintainability regressions before they reach human review.

Iris Code is a deterministic, local-first quality gate for JavaScript, TypeScript, Vue, Svelte, Go, and Python. Source analysis runs directly in VS Code, JetBrains IDEs, and the iris CLI, hooks, and CI without sending your source to an AI model or analysis backend.

Iris Code does not guess whether code was written by AI. It independently checks the result against explicit rules, whether it was written by a person, an AI assistant, or both.

Install for VS Code · Read the docs · Security · Support

Also available on Open VSX for Cursor, Windsurf, VSCodium, and Trae, and on the JetBrains Marketplace for IntelliJ IDEA, WebStorm, PyCharm, GoLand, and other IntelliJ-based IDEs - all served by the same analysis engine. See Supported editors.

Local file analysis, interactive change reviews, and one complete Project Review are free and require no account. Pro adds fresh project-wide reviews, automation, and enforcement.

Review your changes before someone else does

When Git reports local changes, Iris Code shows a Git-changed files detected strip above the five sidebar tabs. Select it to check every supported staged, unstaged, and untracked Git file. The result opens in a dedicated Change Review editor tab with blockers first, filterable findings, file health, and click-to-open source locations.

This interactive workflow is free. It does not alter full-workspace trend history or pretend a partial scan can identify unused dependencies. Pro adds automated changed-file checks in the CLI, hooks, and CI.

One signal, then the evidence

Iris Code gives you a clear health score and shows exactly what changed it:

• Health score — a 0–100 score for the active file, updated whenever you open or save it
• Duplicate code — structural matching catches copied blocks even after identifiers, literals, comments, or formatting change
• Secrets and security smells — catch exposed credentials, unsafe eval, SQL concatenation, weak hashing, unsafe regexes, disabled TLS checks, and more
• Maintainability signals — complexity, long functions, deep nesting, debug prints, magic numbers, unused code, and TODO load
• TypeScript quality — track any, @ts-ignore, non-null assertions, and missing return types
• Dependency risk — inspect installed versions, outdated packages, and version-matched OSV advisories

Findings stay connected to the code. Click a result to open its source location, use inline diagnostics when you want editor squiggles, or detach Iris Code into a full editor panel for a wider view.

Start in under a minute

1. Install Iris Code.
2. Open a Git project in VS Code.
3. Select the Iris Code icon in the Activity Bar.
4. Select Review my changes, then open any blocker or warning directly from the review.
5. Open WS and run your one free Project Review for a saved whole-project snapshot.

No configuration, account, or AI key is required for local file analysis or interactive change reviews. The free Project Review is stored locally for that workspace; Pro is only required when you refresh it or use enforcement features.

See the gate in action

Iris Code uses the same local analysis engine in the editor, the iris CLI, hooks, and CI. When a configured rule fails, the action stops with the evidence instead of a generic red status.

Block a push before the regression leaves the machine

Apply the same gate before a build

Duplicate code that survives cosmetic changes

Iris Code 1.12 detects copy-pasted structure within and across files. Rename variables, change string or number literals, reformat the block, or edit comments—the structural match remains visible.

• Detection and duplication percentage are free.
• Import headers, re-export blocks, uniform data tables, oversized files, and minified-looking files are filtered to reduce noise.
• // iris-ignore: duplicate-code -- <reason> records an intentional exception without silently hiding it.
• Pro opens either side in an editable diff and can enforce a repository-wide duplicate-block cap with gateMaxDuplicateBlocks.

Read how duplicate detection works

Free for analysis. Pro for enforcement.

A 14-day Pro trial is available by request with no credit card required. Request a trial or compare plans.

Preview before you block anything

Gate Preview scans the project against five built-in policies without installing a hook or blocking a file:

Start with a preset, see how many files would fail, and only enable enforcement when the threshold is realistic for the repository.

Enforce the same standard everywhere

Pro uses the same analysis engine in the editor, CLI, hooks, and CI:

• Pre-push hook — blocks a push when the configured gate fails; a hung analysis is stopped after 120 s (IRIS_HOOK_TIMEOUT env var to adjust) so a push is never stuck forever
• Build hook — runs before Node builds or Makefile-based Go/Python builds
• GitHub Actions — emits inline annotations and a job summary with --format github
• Other CI systems — use the exit code plus JSON output in GitLab CI, Bitbucket Pipelines, or any shell runner

Commit one .irisconfig.json so the team shares the same preset and limits:

{
  "$schema": "https://www.iriscode.co/schema/v1/irisconfig.schema.json",

  "presetId": "balanced",
  "minHealthScore": 75,
  "gateMaxSecrets": 0,
  "gateMaxDuplicateBlocks": 2,
  "gateMaxNamingViolations": 0,
  "gateMaxSecuritySmells": 0
}

Generated configs include that $schema line, and it is what gives you key completion, hover docs, and a warning on typos - in VS Code, JetBrains, Neovim, or anything else that reads JSON schema, with no editor-specific setup. Iris Code ignores the key itself, so removing it changes nothing but the editor help.

File naming is Free. You don't have to configure it by hand: after a workspace scan, if no policy is set, Iris Code detects the convention your files already follow and offers to adopt it in one click. Or set a workspace fallback and add ordered path rules for components, hooks, composables, routes, or any other project role. Pro additionally unlocks per-file thresholds:

{
  "fileNaming": {
    "convention": "kebab-case",
    "ignore": ["src/generated/**"],
    "overrides": [
      { "files": ["**/components/**"], "convention": "PascalCase" },
      { "files": ["**/hooks/**", "**/composables/**"], "convention": "camelCase" }
    ]
  },
  "fileNamingScope": "new-files",
  "fileLengthThreshold": 300,
  "languages": {
    "typescript": {
      "fileNaming": { "convention": "camelCase", "scope": "all", "ignore": [] },
      "functionLengthThreshold": 30
    },
    "python": { "fileLengthThreshold": 500, "complexityThreshold": 8 }
  }
}

Language keys are typescript, javascript, go, and python (.tsx counts as TypeScript, .jsx as JavaScript). Top-level ignore globs always exclude matching files. Path rules are evaluated in order and the last match wins. When no path rule matches, a nested language naming policy is used as a backward-compatible fallback; otherwise the top-level convention applies. A matching path rule or language fallback may override fileNamingScope. Blocks may also carry Pro per-file thresholds, healthScoreWeights, severityOverrides, and gate caps; scan-total gates and enable* toggles stay top-level.

Naming warnings are on by default once a naming policy is configured: violations color the Explorer entry through VS Code's Problems decorations and show a rename hint at the top of an open file. Set inlineDiagnostics.fileNaming to false to opt out of the diagnostic while keeping scan findings.

Fixing names. A violation's CodeLens, its Quick Fix (lightbulb), and the Explorer right-click menu all rename the file to its suggested convention through an editable prompt. Iris Code renames through a workspace edit so TypeScript and JavaScript imports are rewritten automatically, and every rename can be undone from the toast or the "Iris Code: Undo Last Rename" command. Pro adds a File Naming panel (from the sidebar's File Naming section) that lists every violation with an editable target name so you can rename selected files, or all of them, in one import-updating pass. Renaming Python files does not rewrite import statements - Iris Code warns when a Python file is renamed. Committing before a large batch is recommended.

Preset configuration and per-language file naming are free. Custom thresholds and enforcement fields require Pro.

Set up GitHub Actions · Configure .irisconfig.json

Use Iris Code from the terminal

The extension includes the iris CLI used by its hooks. You can also install the standalone package:

npm install -g @iris-code/cli

Common commands:

iris check src/app.ts       # free single-file health check
iris secrets .              # free secrets scan
iris security .             # free security-smell scan
iris report .               # free HTML report

iris check .                # Pro directory scan
iris gate .                 # Pro quality gate
iris deps .                 # Pro dependency and CVE audit
iris cve . --severity high  # Pro CVE severity gate
iris sbom .                 # Pro CycloneDX 1.5 SBOM

The CLI supports pretty, JSON, and GitHub Actions output. Read the CLI guide.

Supported languages

Dependency audits understand npm/yarn/pnpm workspaces, go.mod, requirements.txt, and pyproject.toml. Lockfiles are used when available so advisory checks reflect installed versions rather than manifest ranges.

Supported editors

One analysis engine backs every editor, so a finding in one is a finding in all of them. There is no "lite" edition with quieter rules.

In JetBrains IDEs, Iris Code runs as a local language server and provides inline diagnostics, one-click iris-ignore suppressions that scaffold the required reason, per-file health scores on hover, code lenses, filename-convention renames, and a local workspace dashboard under Tools > Iris Code. Configuration comes from the same .irisconfig.json, and a single sign-in in ~/.iris/credentials is shared with the CLI - sign in or out from Tools > Iris Code, and analysis and the panel refresh in place without an IDE restart. A config built in the dashboard Config Studio can be pulled in from Tools > Iris Code > Sync Config from Dashboard - paste the one-time code the dashboard shows, review a real diff, and confirm before anything is written. The panel follows the IDE's own theme, and its text scales with your IDE interface font rather than staying at a fixed size. Analysis stays on the machine in every host. The same pasted-code route works in any VS Code-compatible editor whose own URI scheme the dashboard cannot deep-link into (Trae, Positron): run Iris Code: Sync Config from Dashboard from the command palette.

Install the LSP4IJ plugin first, and use a full IDE restart after installing - JetBrains registers file-type associations at startup. If .irisconfig.json reports "JSON standard does not allow comments", the IDE is holding a user-level override that cancels the JSON5 association Iris Code ships; reinstalling the plugin will not clear it. Fix it under Settings > Editor > File Types: select JSON5 and add .irisconfig.json back to its file-name patterns. Full explanation in docs.iriscode.co/installation and hosts/jetbrains/README.md.

Accuracy you can check

Every analysis rule is measured against a labelled corpus of real code and reported as per-rule, per-language precision and recall - no single global accuracy figure that averages away the detail that matters. The measured baseline is checked in, and Iris Code's own test suite fails the build if any rule regresses, so no release ships a quality regression unnoticed. Every finding in the sidebar carries a 👍 / 👎 control; the feedback is count-only (rule id, language, verdict) and never leaves source code behind.

Read the accuracy methodology

Local analysis and network boundaries

Source analysis runs locally. Iris Code does not send source code, file contents, or project structure to an analysis backend or AI model.

Network requests are limited to:

• sign-in, licence validation, billing, and config sync
• product-use events, which can be disabled in account settings outside required trial operation
• dependency version and advisory lookups; only package ecosystem, name, and version are sent after consent

Dependency results are cached locally for 24 hours. CLI network consent can be revoked with --revoke-network.

Read the privacy policy

Documentation and support

• Getting started
• All features
• Enforcement guides
• Configuration reference
• CLI command reference
• Changelog
• Security and data handling
• Privacy policy
• Support and issue reporting

Iris Code is built and maintained by David Jaja. Questions, bugs, or security concerns can be sent to hello@iriscode.co.

Already using Iris Code? An honest Marketplace review helps other developers decide whether it belongs in their workflow.