Codacy
Automated code-quality and security gates for pull requests
Overview
A static-analysis and SAST platform that scans commits and PRs across 40+ languages, enforcing quality gates that can block merges. Built for engineering teams on GitHub, GitLab and Bitbucket.
Pricing
Pricing shown for reference only. These figures reflect RECATOOLS research as of 13 Jul 2026 and may be out of date or incomplete. This is not financial or purchasing advice — always confirm the current price on the provider’s official website before making any decision.
- Public repos
- Core static analysis
- PR feedback
- Advanced security scanning
- Quality gates
- PR review assistant
- One-click fixes
- SSO
- Compliance controls
- Custom data retention
- Self-hosted deployment
What you can produce with Codacy
- Static analysis across 40+ languages
- SAST and secrets detection
- Coverage tracking with merge-blocking quality gates
- PR review assistant with one-click fixes
- Real-time scanning inside the IDE
- GitHub, GitLab and Bitbucket integrations
- SSO, compliance controls and self-hosted deployment (Enterprise)
- Documented API
ASEAN Perspective
Codacy in Southeast Asia
ASEAN-region availability and pricing notes coming soon. Drop the editorial team a note via /contact/ if you can supply local context (Singapore/Malaysia/Indonesia/Thailand/Vietnam).
Codacy earns its keep by making standards enforceable rather than aspirational. It scans every commit and pull request across 40-plus languages for complexity, duplication, coverage gaps, style violations, secrets and SAST issues, then lets you set quality gates that actually block a merge when code slips below the bar. Real-time scanning in the editor closes the loop before code even reaches a PR. It's aimed at dev teams and platform or security engineers, not solo hobbyists, though a free tier covers open source and pairs of committers. The honest caveats: importing a legacy repo dumps a wall of findings, many of them low-priority style noise, so budget time to tune rules and ignore patterns before the signal-to-noise ratio feels right. Per-seat pricing scales with your contributor count, and it competes hard with SonarQube, CodeRabbit and DeepSource.
What people say
Reviewers treat Codacy as a mature, low-drama way to keep quality and security consistent across a team's Git history, and the ratings back that up. It was named a Leader in G2's Static Code Analysis report and carries a 4.6 G2 rating, edging SonarQube (4.4); on Gartner Peer Insights, 63% of reviewers give it five stars versus 38% for SonarQube.
The praise clusters around onboarding and support. Codacy scores 9.1 for ease of setup and 9.2 for quality of support on G2, and users repeatedly call the integration with existing GitHub, GitLab and Bitbucket workflows painless. The static-analysis engine itself rates 9.0, with multi-language coverage and real-time PR feedback the most-cited wins. Quality gates that block merges are the feature teams point to when they want standards enforced without a human policing every review.
The recurring gripe is noise on day one. On both G2 and Capterra, users say importing legacy projects generates a high volume of findings, many of them false positives or low-priority style nits, and that it takes real configuration work, tuning rules and ignore patterns, to get the signal manageable. A second thread of complaints targets support responsiveness: despite the high support score, several reviewers note replies can take more than 24 hours and that initial emails sometimes miss questions. Pricing is the third flag, with smaller shops finding the per-seat model steep.
On cost, Codacy runs a free Starter tier for open source and teams up to two committers, then Pro at $21/developer/month ($18 on annual billing) for private repos, advanced security scanning, quality gates, the PR review assistant and one-click fixes. Enterprise is custom-priced and adds SSO, compliance controls, custom data-retention policies and self-hosted deployment. The company reports more than 250,000 developers on the platform.
Best fit: teams that want enforceable, automated quality on every PR and are willing to invest early tuning. Poor fit: individuals or two-person side projects that won't use the gate-and-governance machinery.
Summary of public user & expert reviews, compiled by RECATOOLS.
About this listing
This entry was compiled from publicly available data including Codacy's official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with Codacy unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to Codacy directly →
Spotted something out of date? Suggest an update →
Codacy in the news
More in Code & Dev Tools
