Codacy

Had a lot of fun talking to Steve Yegge this week about the state of agentic engineering: - how swarms of cheap agents could beat frontier models, - why we still need to move at human speeds, and - what our kids should know about this new world they are growing into. The new AI Giants podcast episode is coming out next Wednesday!

𝗞𝗻𝗼𝘄𝗹𝗲𝗱𝗴𝗲 𝗺𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 defines how effective AI coding can be. And very few companies are doing it. We built a system for this. We're sharing our design process in this video. As we interact with coding agents and direct them to do their work, there is a lot of knowledge that is lost and only saved by the model providers or, sometimes, stored as memories of those coding agents locally. Sometimes we remember and we add a few rules to CLAUDE or AGENTS files. If you scale this out in a team and organization, there is a lot of knowledge repeated or lost leading to more tokens spent, more rework and ineffective coding sessions. In Verity.md we've been designing from the ground up a system that is able to - 𝗘𝘅𝘁𝗿𝗮𝗰𝘁 knowledge from your interactions, - 𝗜𝗻𝗷𝗲𝗰𝘁 knowledge into coding agents at the right time and in our Verity reviewer, - automatically 𝗿𝗮𝗻𝗸 that knowledge in a loop for usefulness (so that useful knowledge is used more often), - 𝗥𝗮𝗶𝘀𝗲 that knowledge to an organization level when it can be used by many repositories. So that any coding interaction makes the whole organization better. Verity builds knowledge bases for you and your team so that your coding agents work even better over time. This is live, today, in Verity. Verity is the best peer reviewer for your coding agents. It finds issues no one else is finding. We crossed 200B tokens observed last week. I hope you enjoy this video!

We recently shipped affected functions on advisories. Most of the times, when an insecure dependency is reported, our code is not really using the vulnerable code. Codacy now shows the actual affected functions on advisory-linked findings, plus a ready-made prompt for your coding assistant to search the repo for those calls. Is it used? Could be used? Upgrade. If not, review what it found, then ignore it as "Not exploitable" and move on. Available via the UI, API and CLI. Specially useful via the CLI to put your agent to verify and ignore in bulk. Learn more about it here: https://lnkd.in/e2ADqyvM

Your agent can already check Codacy results on a PR, fix issues, and unblock a quality check. That’s useful. But why wait until the PR exists? When I’m working with agents like Claude Code, I often run /code-review locally before I even open a draft PR. So the natural next step was: what if that same review flow could also run Codacy analysis locally and fix issues before the first push? That’s why we created two Codacy Skills: one that teaches the agent how to set up and run Codacy analysis locally, and another one that teaches it how to use Codacy analysis as part of any code review. The result is a tighter feedback loop: the agent writes the code, runs the same kind of independent analysis your team relies on, reads the findings, and fixes them while everything is still local. Here are the skills: https://lnkd.in/eBTimbr6 And here’s a walkthrough: https://lnkd.in/dTxuUJx2

Of all the agent skills we built, this one pays off the most. The Codacy Analysis CLI skill lets your coding agent scan your changes locally and fix the issues it finds before you commit. Agents like Claude Code get specific findings to work through, so you can deal with those issues before they show up in a pull request. That means fewer rounds of pushing a change, waiting for checks, and coming back to fix something you could have caught locally. Here’s how to get started: https://lnkd.in/g4JVhWA6

When your PR comes back red, how many pushes does it take to get it green? Three? Four? And how many of those findings were real? You know at least one wasn't. You rewrote working code anyway, because arguing with the checker costs more than caving to it. In Claude Code: "Review pull request 42 with Codacy." Whole list at once. Fixed on your machine. False positives dismissed with a reason logged, so nobody argues them again. Then the real question: if the agent can do that after the PR, why are you waiting for the PR? Scan before you commit. Open it clean. Walkthrough here: https://lnkd.in/gpkkhk-f