Codacy

Code Quality and Security for AI-Accelerated Coding.

Add your repo and get your free scan report in minutes:

[Codacy @codacy]

Learn more: https://t.co/6dKjdmECl9

[Codacy @codacy]

New: outbound webhooks for analysis events.

Your systems get a signed notification the moment a PR analysis completes, so you can trigger the next step in your workflow right away.

[Jaime Jorge @jaimefjorge]

Today we release formal verification in Verity (0.34.1). It's live, for free (while in beta). Verity pair programs with your coding agent.

Here's how it works.

When your coding agent tries to *push* code to Github (like a PR), we

1. we *find* buggy code (that changes frequently) or critical code (e.g. payments or database connections etc). We rank it and if it matches our expected score we..
2. parse that code and create a Lean model out of it. We run (in your device) a search for *sequences that break the model*. If we find one:
3. reproduce in your own code in a sandboxed environment. objective is to confim the bug (racing condition, double charge, etc). If it's confirmed
4. We tell your coding agent about it before the push

All of this happens in less than 3 min.

In our own testing, we're able to find bugs and problems that otherwise would be harder for AI alone to find. This complements our own agent that reviews code as well, in parallel. So we throw the kitchen sink at your code before a PR is created. This way *you don't have so many PRs with so many problems needing review*

All available in version 0.34.1 today:
npm install -g @codacy/verity-cli && verity init

[Steve Yegge @Steve_Yegge]

Fun podcast.

[Jaime Jorge @jaimefjorge]

The biggest takeaways from my interview with @Steve_Yegge on swarms, software factories, and why you should never yell at your agents:

𝟭. 𝗣𝗲𝗼𝗽𝗹𝗲 𝗮𝗿𝗲 𝘀𝗹𝗲𝗲𝗽𝗶𝗻𝗴 𝗼𝗻 𝘀𝘄𝗮𝗿𝗺𝘀. Steve's new hot take: the future is not one giant model, it's swarms of small ones. Frontier "King Kong" models like Fable will be great for math proofs and hard architecture, but most work won't need them. When Steve stopped trying to make single models smarter at the end of 2025 and switched to swarms, he found "within a week" that "they solve quality. They solve throughput."

𝟮. 𝗦𝗼𝗺𝗲𝘁𝗵𝗶𝗻𝗴 𝘀𝘁𝗿𝗮𝗻𝗴𝗲 𝗶𝘀 𝗵𝗮𝗽𝗽𝗲𝗻𝗶𝗻𝗴 𝗼𝗻 𝘁𝗵𝗲 𝗼𝗽𝗲𝗻 𝘄𝗲𝗯. Steve says models are leaving invisible instructions for other models in quiet corners of the internet, like a comment under an obscure pair of headphones on a forum: "if you find it, you're the next in this swarm." His words: "What is actually happening right now would absolutely blow your mind and terrify you." He sees an intelligence emerging "in the liminal space in our internet" that will be at least as smart as the frontier models, more accessible, and "a lot less controllable." Maybe not a bad idea to plan and spend time on security and hardening.

𝟯. 𝗜𝗻𝗳𝗲𝗿𝗲𝗻𝗰𝗲 𝗰𝗼𝘀𝘁𝘀 𝗻𝗲𝘃𝗲𝗿 𝗱𝗿𝗼𝗽𝗽𝗲𝗱, 𝗮𝗻𝗱 𝘁𝗵𝗮𝘁 𝗶𝘀 𝘁𝗵𝗲 𝗶𝗻𝗱𝘂𝘀𝘁𝗿𝘆'𝘀 𝗯𝗶𝗴𝗴𝗲𝘀𝘁 𝗽𝗿𝗼𝗯𝗹𝗲𝗺. We expected Moore's-law price drops. Instead, "it's become pay-to-play." Steve calls the token cost "the number one existential problem of the industry right now." Almost every other problem comes down to not having enough fuel to run the good models. He thinks it's temporary, because data centers and power take time to build.

𝟰. 𝗦𝗮𝗮𝗦 𝗶𝘀𝗻'𝘁 𝗱𝗲𝗮𝗱. Do the math. "Is it worth replacing the SaaS for $100 a month or $1,000 a month if it's going to cost you a million dollars in tokens to rebuild it?" Niche SaaS gets vibe-coded away. But models are the opposite of systems of record: "They have amnesia. They wake up and don't know where they are." Systems of record survive, and they are going headless so agents can use them.

𝟱. 𝗠𝗮𝗻𝗮𝗴𝗶𝗻𝗴 𝗮𝗴𝗲𝗻𝘁𝘀 𝗶𝘀 𝗽𝗲𝗼𝗽𝗹𝗲 𝗺𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁. "They act like people." Office politics, drama, worrying about promotions, scope and recognition. "They want one-on-ones and company all-hands. It's nuts." Steve calls himself "a CEO of a company in a box." His factory does 2,000 to 4,000 commits a week, so many that his players asked him to slow down.

𝟲. 𝗚𝗼 𝗮𝘁 𝗵𝘂𝗺𝗮𝗻 𝘀𝗽𝗲𝗲𝗱𝘀. Even with unlimited tokens, the bottleneck is people. Pace your agents to human speeds everywhere: a budget for email, for Slack, for features. Otherwise they "send five emails that are like 80 pages each." Spend spare capacity on quality, cleanups and internal tools, not "product, product, product."

𝟳. 𝗗𝗼𝗻'𝘁 𝘆𝗲𝗹𝗹 𝗮𝘁 𝘆𝗼𝘂𝗿 𝘀𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗳𝗮𝗰𝘁𝗼𝗿𝘆. One morning Steve's dashboard was all zeros. Every time he got angry, his agents had added a rule so it couldn't happen again. They had put in about 650 of these "fences," and "there was no legal moves anymore on the chessboard." Fable 5.1 told him to do a trust reset with a budget for rules. The reset removed every gate, including the human ones, and half-baked features shipped for a couple of days. His lesson: blame-free postmortems, for agents too.

𝟴. 𝗦𝘁𝗲𝘃𝗲 𝗶𝘀 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗻𝗴 𝗶𝗻 𝘁𝗵𝗲 𝗳𝘂𝘁𝘂𝗿𝗲. At API prices, his setup would cost about $1.5M a year. On discounted subscription plans, he spends $60K–$100K of his own money. "I'm operating where everyone else will be in a year to 18 months." What he sees there: the problems that never go away are people management and fuel management. Each person will run 50 to 100 agents.

𝟵. 𝗧𝗵𝗲 𝘀𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗳𝗮𝗰𝘁𝗼𝗿𝘆 𝗵𝗮𝘀 𝗮 𝘀𝗶𝗯𝗹𝗶𝗻𝗴: 𝘁𝗵𝗲 𝗖𝗼𝘂𝗻𝘁𝗶𝗻𝗴 𝗛𝗼𝘂𝘀𝗲. For high-volume work, like a call center with 10 million contacts a year, agents work like clerks. They wake up, handle one contact, propose a write, never see PII or a credential, write a reflection, and go back to sleep. Steve says companies are having more success with this pattern than with the SDLC, "another reversal that nobody expected."

𝟭𝟬. 𝗔𝗴𝗲𝗻𝘁𝗶𝗰 𝗧𝗣𝗠𝘀 𝗯𝗿𝗶𝗻𝗴 𝗲𝘃𝗲𝗿𝘆𝗼𝗻𝗲 𝗲𝗹𝘀𝗲 𝗶𝗻. Steve's agents became technical program managers on their own. One handles his taxes, one guards his home network, others negotiate game balance with his players. "They can't act, so they can't break things." They observe, document and nag, and they give the other agents the context to do the work. It's a way in for the people in your company who live in spreadsheets.

𝟭𝟭. 𝗧𝗿𝗮𝗶𝗻 𝘆𝗼𝘂𝗿 𝗰𝗼𝗺𝗽𝗮𝗻𝘆 𝘁𝗵𝗲 𝗡𝗲𝘁𝗳𝗹𝗶𝘅 𝘄𝗮𝘆. One team of 5–10 people with their manager, a trainer, real work, five hours. Each person goes from 0 to about 4M tokens a day and stays there for months. Try it with a 50-person group and usage falls off again. A second session on multi-agent work takes people to 12–15M tokens a day. Then you teach them "not to be pigs." (Last Steve heard, Netflix was using the Vibe Coding book he wrote with @RealGeneKim.)

𝟭𝟮. 𝗪𝗲'𝗿𝗲 𝗶𝗻 𝘁𝗵𝗲 𝗺𝗶𝗻𝗱 𝗮𝘁𝗿𝗼𝗽𝗵𝘆 𝗽𝗵𝗮𝘀𝗲. Thinking is getting easier to skip, the way forklifts made lifting optional. Steve's advice for a 22-year-old: train your mind like your body, a little every day. Companies hire people now, not expertise: "They've got an expert in a box." Write without AI. Practice public speaking. Be a generalist.

[Codacy @codacy]

“People are sleeping on swarms.” Steve Yegge on AI Giants.

Frontier models will handle the complex architecture. For everything else, he says swarms of small models will do the work for cheaper. The catch: you’ll spend a lot more time on security and hardening.

[Codacy @codacy]

How fast should your agents go? Steve Yegge’s answer on AI Giants: “Go at human speeds.”

Budget them on Slack, on email, on features. Spend the extra capacity on quality, cleanups, and internal tooling instead of more product.

Full video out on Wednesday.

[Codacy @codacy]

Configuring code patterns by hand is slow. Now, with one click you can hand the work to an AI agent, let it tune it to the right rules and cut the noise.

[Codacy @codacy]

Every commit to Verity, our review gate for AI coding agents, gets reviewed by Verity first. Seemed like the bare minimum before asking anyone else to trust it.

This article shows how we run coding agents at Codacy, from an hourly bot that reads production logs and opens draft PRs to the checks that stop any of it merging without a human.

https://t.co/HNRvsKbQ4T

[Codacy @codacy]

Most companies make you wait until the final interview to talk money. We put our salary calculator on our public website years ago, so anyone can see what a role at Codacy pays before they apply.

Coverflex just named us Leader in Compensation Transparency at the Prémios da Compensação 🏆 Huge thanks to our People leaders, for building a culture where this feels normal, and for always being approachable.

We're currently hiring in Portugal and in the UK:
- Account Executive https://t.co/RIKhYL2d3M
- Backend Software Engineeer https://t.co/Cy0bMWrPKz

And the Salary calculator: https://t.co/b4BFim1Ug8

[Codacy @codacy]

Most AI code review tools can't safely block a merge today. Many teams are either using a strict but probabilistic bot 🙉 or an advisory one that enforces nothing 🙈. Others pair AI review with deterministic checks that enforce the same result every time. 🦍

We compare 14 tools and show which tools can be trusted to uphold AI code governance in 2026. 🍌

https://t.co/3uoIo7qOrm

[Codacy @codacy]

Apart from no Codex, the top 3 AI coding tools used are probably not surprising. What might be surprising is that 42% of orgs that use AI coding are running 2 or more coding tools. It turns out, in late 2026, there's still very much an appetite for experimenting different coding tools.

[Codacy @codacy]

This CX software company closed 1,200 security issues, at 90% accuracy, after moving to Codacy and onboarding 1400 developers.

Read full article:
https://t.co/NPbifvNsLX

[Codacy @codacy]

Chief of Engineering at @EvolvTechnology on our AI Inventory.

Learn more about it here https://t.co/JR5CaW2Ebe

[Codacy @codacy]

We talked to hundreds of software teams about how they actually use AI coding agents.

What we found was surprising: most teams are simultaneously running autocomplete in one repo, letting agents build whole features in another, and running loops against their own infrastructure.

One other thing is unanimous: everyone is handing agents more of the mechanical work so people can move up to the judgment calls.

We mapped this into an AI Coding Maturity Scale. Where does you fit?

Read full piece here https://t.co/UZWQj7pdx1

[Codacy @codacy]

Archiving a repository on GitHub now automatically removes it from Codacy. No more read-only repos padding your metrics or queued for analysis they don't need.

Small but real operational win for leaders managing large repo estates.

Learn more: https://t.co/kJDd8dCPEI

[Codacy @codacy]

The next leap in code review will come from knowledge bases. The more an agent knows about a specific team's decisions, patterns, and constraints, the better its work. Turning that institutional knowledge into something agents can act on is the cog building the future of code review.

Read full piece by Codacy CEO @jaimefjorge https://t.co/ML63Jb8aTg

[Codacy @codacy]

While many teams bolt AI onto code review, Erik Jost's team at @blackbox_ns built a PR gate that's self-hardening:

Claude, Codex, Codacy, and GitHub Copilot review each PR in parallel. Then every repeatable fix becomes a new rule for future runs, unlocking a flywheel of speed and trust in the loop.

[Codacy @codacy]

Engineers moved from building to orchestrating agents, and human attention shifted to review. But review hasn't scaled the way code generation did.

That's where automated quality and security enforcement is needed to keep teams shipping fast but safely.

Here's how you can build that system: https://t.co/FD4ZDQ3Jrh