Codacy vs Qlty Cloud

Codacy is a cloud platform for engineering teams focused on code quality, security, and AI coding standards. Its AI Reviewer reviews pull requests with fix suggestions and summaries, and can identify false positives automatically. Listed security capabilities include SAST, software composition analysis, secret scanning, infrastructure-as-code scanning, DAST, and container image scanning. Team offers shared coding standards across 49 languages, integrations for GitHub, Bitbucket, GitLab, Jira, and Slack, and capacity for up to 30 developers and 100 private repositories with unlimited lines of code. Developer includes an IDE plugin and integrations for VSCode, JetBrains, and Cursor; the IDE extension comparison also names Windsurf. Developer costs nothing. Team costs $18 a year with yearly billing or $21 a month with monthly billing, billed per developer per month. A 14-day free trial is available without a credit card. Codacy states that it is GDPR compliant and has SOC 2 Type II compliance; its services run on AWS, with data in transit encrypted using TLS.

Qlty Cloud analyzes code quality and coverage, then gives feedback on pull requests. Its automated reviews can return quality feedback and pass-fail statuses, with customizable analysis and triage rules. Analysis covers linting, defects, formatting, duplication, security, and complexity. Coverage features include gates, diff coverage, comments on GitHub pull requests, and separate tags for unit and integration suites. Qlty integrates with GitHub through a GitHub App and supports GitHub Actions and CircleCI Orb for coverage workflows. It advertises more than 70 linters, formatters, and security analyzers, and says cloud analysis requires no CI setup. The free plan includes 1,000 analysis minutes and 100 AI autofixes per month, with unlimited contributors and repositories. Pro costs $20 a month and includes 20,000 analysis minutes and 5,000 AI autofixes per month. Qlty says AI explanations and fixes for business services require opt-in, and that it does not store repository clones. Analysis runs in sandboxed AWS Fargate containers that are destroyed afterward.