jaimefjorge

We launched a free AI Coding Risk Assessment tool to help engineering teams and businesses benchmark the security and compliance posture of their AI coding workflows and policies against peers in the industry. This anonymous 24-question survey delivers:

- A 0–100 risk score that measures your AI coding security posture

- A live benchmark that compares your AI-assisted development practices with peers

- A research-based checklist that identifies improvement areas

We're seeing more and more clients signal their concerns about the sudden increase of source code written by AI coding agents that nobody’s fully watching or even knows how to oversee. That’s why we created this open benchmarking tool.

We hope this will help companies identify where they stand, compare themselves to the market, and take concrete, actionable steps to leverage AI at scale.

Thanks for reading, we are keen to hear your thoughts!

Link: https://ai-risk.codacy.com/

We just launched Codacy Guardrails, an IDE extension with a CLI for code analysis and MCP server that enforces security & quality rules on AI-generated code in real-time. It hooks into AI coding assistants (like VS Code Agent Mode, Cursor, Windsurf), silently scanning and fixing AI-suggested code that has vulnerabilities or violates your coding standards, while the code it’s being generated.

We built this because coding agents can be a double-edged sword. They do boost productivity, but can easily introduce insecure or non-compliant code. One recent research team at NYU found that 40% of Copilot’s outputs were buggy or exploitable [1]. Other surveys mention that people are spending more time debugging AI-generated code [2].

That's why we created “guardrails” to catch security problems early.

Codacy Guardrails uses a collection of open-source static analyzers (like Semgrep and Trivy) to scan the AI’s output against 2000+ rules. We currently support JavaScript/TypeScript, Python, and Java, focusing on things like OWASP Top 10 vulns, hardcoded secrets, dependency checks, code complexity and styling violations, and you can customize the rules to match your project’s needs. We're not using any AI models, it's “classic” static code analysis working alongside your AI assistant.

Here’s a quick demo: https://youtu.be/pB02u0ntQpM

The extension is free for all developers. (We do have paid plans for teams to apply rules centrally, but that’s not needed to use the extension and local code analysis with agents.)

Setup is pretty straightforward: Install the extension and enable Codacy’s CLI and MCP Server from the sidebar.

We’re eager to hear what the HN community thinks! Does this approach sound useful in your AI coding workflow? Have you encountered security issues from AI-generated code?

We hope Codacy Guardrails can make AI-assisted development a bit safer and more trustworthy. Thanks for reading!

Get extension: https://www.codacy.com/get-ide-extension Docs: https://docs.codacy.com/codacy-guardrails/codacy-guardrails-...

Sources [1]: NYU Research: https://www.researchgate.net/publication/388193053_Asleep_at... [2]: https://devops.com/survey-ai-tools-are-increasing-amount-of-...