Code Guardian Finally, high quality in software development with AI
Code Guardian stands between the AI model and your software, checking the quality of your code in real time through static code analysis, optimised skills and scripts. Not only quality, but also security and software architecture are checked and corrected.
Built from more than 120 software projects, with weekly updates, and based on more than 20 years of experience in software development.
Version v16.161
Company licence 142.80 €, one-off
Updates 29.75 €/month, optional
Total prices incl. 19 % VAT.
Runs in Claude Code or Codex · optimised for macOS
- 5Modes
- 7Gates
- 24Hooks
- 22Detectors
Buy once. Updates for as long as you like.
142.80 €incl. 19 % VAT, one-off
equals 120.00 € net plus VAT
The first 30 days of updates are included. After that, optionally 29.75 € per month incl. VAT (25.00 € net), cancellable at any time, even without signing in.
What you need
- Claude Code or Codex. Code Guardian is a skill package for an AI coding assistant: it runs INSIDE your agent, not next to it. Without Claude Code or Codex there is nothing for it to hook into. There is a separate package for each of the two; which one you need is decided by your agent, not by your licence.
- macOS, Linux or Windows. It is developed and driven daily on macOS; the gates are shell scripts, and that is where they are measured. The same mechanics run on Linux. On Windows you need Git for Windows and explicitly not WSL: its
bash.exeis a different launcher and aborts. Since late August, every release runs both packages through a real Windows machine: the Codex package as the built zip, the Claude package through the same installer that ships in the package.
- Unlimited developers in the licensed company
- First month of updates included
- Five modes, seven gates, 24 hooks, 22 detectors
- 24 skills and 13 review agents, not just one skill
- Two editions: for Claude Code and for OpenAI Codex
- Adaptable for internal use
- Permanent right of use, no expiry date
Code Guardian: update subscription · 29.75 €/month incl. VAT
- Every new version for as long as the subscription runs
- Licence key for automatic retrieval by Claude Code or Codex
- Cancellable monthly in the portal, to the end of the paid month
- After cancellation, everything released during the term stays downloadable
You are not buying one skill, but twenty-four.
The reviewer is the core, but it does not work alone. It comes with the framework it runs in, and with thirteen review agents that read cold.
The reviewer
Five modes, seven gates, 24 hooks, 22 detectors. Six of the seven gates actually stop the operation with a hook instead of scolding it in a report. Four act before the command (deploy, migration, new dependency, option question), two at the end of the answer, where the finished text is available: finding and legal text. Only the data gate deliberately has no hook of its own. A verdict about data is not a command that can be intercepted; it is enforced through a mandatory block, without which the analysis does not count as finished.
The working framework
Intake and airlock before every change, an interview that puts every open decision to you one at a time, option questions in plain language instead of jargon, and a task list plus task folder that both outlive what a long conversation would otherwise forget.
The second opinion
A council of five advisers with a chair for decisions where being wrong is expensive. A root-cause analysis that separates the root from the symptom. And two retrospectives: one on request for long runs, one automatic after every task, which reports the same friction the second time as a decision instead of letting it cost you a third time. New: a procurer for legal sources that fetches citations with a retrieval date instead of answering from memory.
The quality tools
A full-repository audit against AI sloppiness, two critical test reviewers for backend and user interface, and three tools that set up static analysis in a foreign project: for PHP, for JS/TS/Vue and for Python.
Without asking back
An autopilot for runs where nobody is at the screen. It does not decide on its own: every question that would otherwise go to you goes to the council, and afterwards stands verbatim in the log. Alongside it, a dispatcher that hands tasks to the other open sessions on your machine instead of letting them wait.
The thirteen review agents run cold: without the conversation, without the plan, without the author's verdict. That is exactly why they find what the author overlooks. A reviewer who is handed the answer delivers an echo.
Two editions, and they are not the same.
Since late August, Code Guardian comes in two editions: for Claude Code and for the Codex command line by OpenAI. Both carry the same version number and are built from the same source, each with its own test track of eighteen levels. The release aborts if both packages carry the same checksum, because then one of them would not have been translated.
The airlock keeps write access closed until you approve the plan. Before that, no file can be changed.
A latch requires a plan with at least two steps before the first file change. That proves planning happened, not that a human agreed. For real read-only safety, switch on Codex's own plan mode.
The question appears as a choice in the window, with the recommended answer first.
The same through the counterpart there. It needs a terminal and is absent in batch mode; there the latch stays silent, because it cannot intercept something that is never called.
From installation onwards.
Only after you have explicitly confirmed the latches once, and that trust is lost again after every update, without warning. That is why the installer reports on request armed or not armed, instead of asserting it.
One difference in scope is stated here rather than in the small print: the session dispatcher is missing from the Codex package, because there are no parallel sessions there to dispatch to. In return, the Codex edition brings three latches of its own that Claude Code does not need. The numbers above describe the Claude Code edition.
That Windows is tested at all has a specific reason. In late August a paying user reported that not a single latch fired on his machine: checksum correct, 127 files character-identical, ten defects among them, and none of our checks could see any of them, because the Windows path had never been executed. Since then, every release runs both packages through a real Windows machine: the Codex package as the built zip, the Claude package through the same installer that ships in the package. What this run does not do, we say as well: it does not check the file from your portal byte by byte, but the same state in the same form.
The principle in one screen.
A command that destroys work is refused at the tool boundary: before it runs, not afterwards in the report. Pick one. The response below is the actual text of the respective hook, translated from the German original.
git reset --hardblockeddestructive-command-check.sh
git reset --hard discards ALL uncommitted changes in the working tree.
A gate checks the output, a guardrail limits the system. This command belongs to the one class that even git does not undo. Save the state first: «git stash -u» or a commit on a throwaway branch, then the command is harmless.
Before the first line of code: an approval.
Every task starts read-only. The agent explores, puts every open decision to you one at a time with a recommendation first, and presents a plan. Only your click opens write access. And what later becomes your decision does not end up as an open item on a list.
- read-only
Explore, secure the facts. No file can be changed.
- Interview
Every open decision one at a time, recommendation first. Facts are looked up, never asked.
- Plan
What happens, which files, how it is proven. Plus the log of all decisions.
- Your approval
From here on, building is allowed. Not before.
- afterwards
If an item becomes your decision during the work, it cannot be written off with the closing receipt. The latch requires that it is put to you.
Nothing reaches a server unclassified.
Transferring and existing are two different axes. The production .env must never be transferred and yet has to be there. A database dump may do neither. Whoever squeezes that into one axis eventually deletes the wrong thing.
10 files in the transfer list
- app/Http/Controllers/PostController.php
- resources/js/Pages/Home.vue
- public/build/assets/app-DI5faExM.js
- .env
- storage/app/private/
- tests/Feature/CheckoutTest.php
- .git/
- dump-2026-07-24.sql
- .audit-log.md
- database/seeders/
A migration counts as irreversible until the opposite is proven.
Application code comes back with git revert and a dropped column does not. The same command, executed twice:
$table->dropColumn('rabatt_prozent');M3CREATE TABLE _backup_orders_rabatt_20260725 AS SELECT id, rabatt_prozent FROM orders;
| id | kunde | rabatt_prozent |
|---|---|---|
| 4711 | Hoffmann GmbH | 12.5 % |
| 4712 | Baker & Sons | 5.0 % |
| 4713 | Lentz Medien | 20.0 % |
A new package is a supply-chain decision.
This rule is written against a class of attack that would not exist without AI agents.
The model invents a name
The agent needs an HTTP client and writes «npm install reqests». The package does not exist. Not yet.
The hallucination repeats
Same model, same task, same typo, reproducible across runs. That makes the name predictable.
Someone registers exactly this name
From now on the package exists. The check «does the package exist?» says yes. That is exactly what the attack is built on.
The next agent installs it
And with «postinstall», foreign code runs on the developer machine and travels into production.
That is why the gate checks reputation, not existence: age, download history, a real repository with more than one contributor, and the name proximity to a well-known package.
A verdict about data is a verdict about the whole schema.
From a real misjudgement: orders were declared orphaned because nobody knew the deferral column. They were deferred, not broken.
SELECT id, kunde, status, erstellt FROM auftraege WHERE status = 'offen';| id | kunde | status | erstellt |
|---|---|---|---|
| 8801 | Hoffmann GmbH | offen | 2026-04-02 |
| 8814 | Baker & Sons | offen | 2026-04-11 |
| 8827 | Lentz Medien | offen | 2026-04-19 |
ORPHANED? Open for months, never processed. Looks like a defect, and this is exactly where the repair job gets written that touches healthy data.
No option question without a recommendation.
An agent that lists three equivalent paths and lets you choose has merely passed the work on. This is what every question you receive looks like instead:
How should the licence work?
- Company licence, unlimited (Recommended)Needs no seat tracking and no licence server. The files are local; any other count would not be verifiable.
- Per developerMore revenue with large teams, but technically not verifiable. Creates control effort without control.
- TieredTwo tariffs to maintain, the same lack of verifiability.
The gate recommends. You always decide.
A claim is a hypothesis.
An agent reads code, infers a bug from it and asks whether it should fix it. That is the moment a reading turns into an action, and up to then nobody has checked whether the reading is right.
This gate came out of exactly such a case. The answer was neither "yes" nor "no", but "check again whether that is true" and the finding collapsed. Not a bug, a misreading. Since then, three blind pairs of eyes do what that one interjection did.
Claim "The reminder goes out too early." derived from reading, nothing executed
- ExecutionRefute it by running it.
- IntentCould this be exactly as intended?
- EnvironmentWhat already intercepts the trigger?
CONFIRMED exists only when the execution lens has reproduced it. Majority votes are forbidden: one executed refutation outweighs three readings.
A legal notice written from memory looks like one taken from the statute book.
When an agent wrote a legal text (legal notice, privacy policy, terms, withdrawal notice, cookie notice, a pricing document or an AI disclosure), nothing intervened until now. A model's knowledge has a cut-off date, the law keeps moving after it, and nothing reports that.
The seventh gate requires for every obligation a primary source with norm, version, address and retrieval date, and for every load-bearing obligation additionally an official interpretation. If the two diverge, the result is contested and it goes to a human instead of being decided.
It never says "compliant".
The verdict reads n proven, m open, with a mandatory line stating what was NOT checked. Legal compliance rarely fails on a wrongly cited obligation and often on a missing one, and eight proven points with a forgotten ninth look more finished than no list at all.
It answers in typified form, never for your individual case.
That is not a disclaimer but the reason the output can be checked at all: a typified statement can be held against a norm, an assessment of an individual case only against an opinion. It does not replace legal advice, and that stands as the closing line of every block.
Without a network it says so, instead of guessing.
If it cannot reach a source, it reports legal position unverified and not a sentence from memory that looks like a citation. A check that did not run is not a check that passed.
And it fires rarely: a latch that triggers on every commit is switched off after the third time and afterwards exists only in the feature list. Three hurdles push the trigger down to less than one per mille of all write operations, measured across 2,404 session transcripts, not estimated.
Every rule has a damage as its father.
None of these rules comes from a checklist. Each one ships in the package with the incident it came from and with the measurement that backs it.
- 646
- real migrations checked
- Across three Laravel projects. Every finding confirmed by hand as a true hit.
- 436
- tests for the detectors
- Plus a fixture with 58 marked cases as an independent reference.
- 0
- productive symbols ever released for deletion
- The hard safety condition of the cleanup layer. A violation fails the run.
- 42/42
- mechanical slop rules fire on the traps
- The two threshold rules test their own tests. On the clean counterparts: zero findings.
And does it work?
Thirteen controlled comparison runs since 19 August, eleven of them with a result: seven times the apparatus scores mechanically measurably better than the same model without it, three times the difference is undecidable, once none is proven. No run shows it worse.
And the backstory, because it belongs here: the very first comparison of this kind, in early August, went against the apparatus. Six of sixteen of its runs did not change a single line; they were waiting for an approval that nobody gives in an unattended run. That was a flaw in the process, not in the result, and it is fixed. It stands here because a balance sheet without its worst point is no balance sheet.
What is left after a working day.
A field report from our customer forum, reproduced anonymised and translated from the German. It is a single report and is presented here as one; in the same text the author wrote down five weaknesses. What the tool cannot do is stated directly below.
In a single day the cold reviewer found four real bugs in freshly written code that our own test suite had not seen.
Against 6,500 tests, mutation tests and a golden master: a sticky warning flag, a daylight-saving edge case in a day count, a test anchor silently hollowed out by a refactoring (proven by injection test), and data loss in the save-load-save cycle of a form.
Exactly the class "my own fix is the next bug" that otherwise shows up only days later.
On the same day the destructive-command guardrail stopped a cleanup command live. On the gate texts: "textbook quality, you always understand why a latch is there."
The subscription paid for itself on day one; the cold reviewer alone is worth the price.
A member of our Community, after the first full working day with Code Guardian.
Six questions that come before buying.
- What is a quality gate?
- A check that stops an operation instead of scolding it afterwards. Code Guardian ships seven of them: before every deploy, every migration, every new dependency, every verdict about data, every claim about a defect, every option question and every legal text. Six of the seven actually stop the operation with a hook; the data gate deliberately has none.
- Does Code Guardian run with OpenAI Codex?
- Yes. There are two editions, one for Claude Code and one for the OpenAI Codex CLI. The company licence covers both; which one the customer downloads is chosen in the customer portal.
- Which operating systems does it run on?
- macOS, Linux and Windows. On Windows via Git for Windows, explicitly not via WSL. The gates themselves are language-independent; individual tool layers require Python or PHP.
- How does it differ from a linter?
- A linter checks source code against rules. Code Guardian checks the workflow: whether a plan was approved before the change, whether a claim is backed by command output, and whether a deploy or a migration may start at all. The two do not exclude each other.
- What can Code Guardian not do?
- The gates are language-independent, the tool layers beneath them are not: some require Python or PHP. Without the Superpowers skills, the brainstorming part of the workflow is missing. And it is not a support contract: there is no response time and no on-call service.
- Is it a subscription?
- No. The company licence is a one-off payment and applies permanently to an unlimited number of developers in the licensed company. Only the delivery of newly released versions is a monthly cancellable subscription; after it ends, the licence and all versions released up to then remain yours.
Understand first, then buy.
The rules in this package come from incidents, not from a textbook. If you want to know what this is all about, you will find the topics behind it explained in depth, without any product angle (articles in German).
- Code audit and code qualityThe overview: what a review delivers and where its limits are.
- What a quality gate isWhy it must not be talked round, and where that fails.
- Code review for AI codeSix patterns a classic review does not look for.
- Who is liable for AI codeWhat changes in the legal position in 2026.
What it cannot do.
Three things you should know before buying. They are also in the README, because a promise you only find after the purchase is no promise.
The gates are language-independent, the tool layers are not.
Static analysis is wired up for PHP/Laravel, JS/TS/Vue and Python. Mutation tests run as a latch for PHP and JS/TS; for Python the tool is included but deliberately only advises, because it mutates paths instead of changed lines, and a latch that runs for minutes gets switched off. The slop scanner additionally reads Go, Rust, Ruby and shell scripts. On another stack you get the gates, the reflexes and the scanner, but no analysis gate: there is nothing there it could delegate to.
Without Superpowers, brainstorming is missing.
The reviewer itself no longer mentions obra/superpowers at all; the decision interview that used to come from there now ships as a skill of its own. What still points there is the intake for very large tasks: divergent brainstorming and writing formal plans. If Superpowers is not installed, these two references lead nowhere. No gate is skipped, no check fails. Superpowers is not part of the delivery.
It is not a support contract.
Included are all versions that appear during your update period. Not included are a promised update frequency and individual support. When the update period ends, all versions released up to then remain yours permanently, in the portal and via the update API. Only newer ones no longer arrive without a subscription.