Codacy

A European retail company with 1,500 engineers built remediation agents on top of Codacy that close their own security issues. We turned what they built into a reference architecture: a 7-stage loop from pulling open findings, through triage and fix, to merge and close.

AI is changing the Engineering Manager role. There is more context, more capacity, and more happening in parallel. A bigger part of the job is making sure the team can still focus on what matters, without getting overwhelmed by the sheer amount of information coming at them. I shared some thoughts on this alongside Jorge Braz for this article. https://lnkd.in/eqT-wFEP

New in Codacy: affected functions on advisories.

Most AI code review tools can't safely block a merge today. Some teams are either using a strict but probabilistic bot 🙉 or an advisory one that enforces nothing 🙈. Others pair AI review with deterministic checks that enforce the same result every time. 🦍 We compare 14 tools and show which tools can be trusted to uphold AI code governance in 2026.

A CVE on a dependency flags the whole package as vulnerable, even when the flaw sits in a few specific functions your code may never call. Across a long advisory list, everything ends up looking equally urgent. Codacy now shows which functions inside a vulnerable dependency or container image a CVE actually affects. Your team can check usage with a ready-made prompt for your AI coding assistant, then upgrade if the code calls affected functions or ignore the finding if not. Now when auditors or CISOs want to know why a vulnerability is still open, you have a concrete answer: "we checked and it's not exploitable". Now available via the UI, CLI and API: https://lnkd.in/eRSAGUkU

When a new CVE is published, the usual thing to hear from engineering teams is "does it actually touch our code?" That's because a package having a CVE doesn't mean every part of it is a problem. Usually the flaw lives in a few specific functions. Codacy now shows if there are affected functions on findings linked to an advisory, so triage starts from the part of the package that's implicated, not just the package name. One click copies a prompt for your AI coding assistant to check whether your code calls them. Less time debating whether a CVE matters. More confidence that the ones you escalate deserve it. Now available via the UI, CLI and API: https://lnkd.in/ehRzq_qp

The future is here. See how this real-world agentic loop operates in an enterprise. 🫨

When your PR comes back red, how many pushes does it take to get it green? Three? Four? And how many of those findings were real? You know at least one wasn't. You rewrote working code anyway, because arguing with the checker costs more than caving to it. In Claude Code: "Review pull request 42 with Codacy." Whole list at once. Fixed on your machine. False positives dismissed with a reason logged, so nobody argues them again. Then the real question: if the agent can do that after the PR, why are you waiting for the PR? Scan before you commit. Open it clean. Walkthrough here: https://lnkd.in/gpkkhk-f

Your agent can already check Codacy results on a PR, fix issues, and unblock a quality check. That’s useful. But why wait until the PR exists? When I’m working with agents like Claude Code, I often run /code-review locally before I even open a draft PR. So the natural next step was: what if that same review flow could also run Codacy analysis locally and fix issues before the first push? That’s why we created two Codacy Skills: one that teaches the agent how to set up and run Codacy analysis locally, and another one that teaches it how to use Codacy analysis as part of any code review. The result is a tighter feedback loop: the agent writes the code, runs the same kind of independent analysis your team relies on, reads the findings, and fixes them while everything is still local. Here are the skills: https://lnkd.in/eBTimbr6 And here’s a walkthrough: https://lnkd.in/dTxuUJx2

Of all the agent skills we built, this one pays off the most. The Codacy Analysis CLI skill lets your coding agent scan your changes locally and fix the issues it finds before you commit. Agents like Claude Code get specific findings to work through, so you can deal with those issues before they show up in a pull request. That means fewer rounds of pushing a change, waiting for checks, and coming back to fix something you could have caught locally. Here’s how to get started: https://lnkd.in/g4JVhWA6