AI-generated video
Code Guardian Finally, high quality in software development with AI
Code Guardian runs inside your AI coding assistant and checks its commands and file changes before they reach your software. It checks the quality of your code in real time through static code analysis, optimised skills and scripts. Not only quality, but also security and software architecture are checked; whatever does not pass, Code Guardian stops or reports.
Built from more than 120 software projects and based on more than 20 years of experience in software development.
Version v17.14Company licence 142.80 €, one-offUpdates 29.75 €/month, optionalSubscription with your purchase: 25% off for 6 months, 22.31 €/monthTotal prices incl. 19 % VAT.
How Code Guardian worksWhat you gain, animated (German), with examples to typeRuns in Claude Code or Codex · optimised for macOS
- 5Modes
- 7Gates
- 15Hooks
- 22Detectors
02Pricing
Buy once, use permanently. Updates by subscription, for as long as you like.
142.80 €incl. 19 % VAT, one-off
equals 120.00 € net plus VAT
The first 30 days of updates are included. After that, optionally 29.75 € per month incl. VAT (25.00 € net), cancellable at any time, even without signing in.
Add the subscription now: 25% off for 6 months
22.31 € per monthinstead of 29.75 €You save 44.64 €
The first 30 days are included anyway. After that, 6 debits of 22.31 € incl. VAT (18.75 € net), then 29.75 €. Cancellable monthly. The discount applies only when booked together with the licence; a subscription started later in the portal costs 29.75 € from the start.
What you need
- Claude Code or Codex. Code Guardian is a skill package for an AI coding assistant: it runs INSIDE your agent, not next to it. Without Claude Code or Codex there is nothing for it to hook into. There is a separate package for each of the two; which one you need is decided by your agent, not by your licence.
- macOS, Linux or Windows. It is developed and driven daily on macOS. The latches hook into your agent as shell scripts; the four that check commands each reach their verdict in a single Python process instead of a chain of small programs. That saves the most time on Windows, where every program start costs many times more: there these latches have become noticeably faster. The same mechanics run on Linux. On Windows it runs natively via Git for Windows (Git Bash); WSL is not required. The
bash.exein C:\Windows\System32 is the WSL launcher, and the package deliberately does not use it. If you work entirely inside WSL 2, with Claude Code and Code Guardian both in Ubuntu, it is a normal Linux installation (git, jq, python3; projects best in the Linux file system rather than under /mnt/c). The mixed setup of Claude Code on Windows with checks running through WSL is not supported, because the two write the same paths differently (/c/… versus /mnt/c/…). Since late August, every release runs both packages through a real Windows machine: the Codex package as the built zip, the Claude package through the same installer that ships in the package. - Python 3.9 or newer. The four command latches need python3, standard library only, no extra packages. If it is missing or older, the installation stops with instructions before it touches anything. If it disappears later, each of these latches asks before every command instead of letting it through unchecked; under Codex, Bash stops until python3 is back. On Windows, use Python from python.org or via winget, not the Microsoft Store placeholder.
- Unlimited developers in the licensed company
- First month of updates included
- Five modes, seven gates, 15 hooks, 22 detectors
- 29 skills and 14 review agents, not just one skill
- Two editions: for Claude Code and for OpenAI Codex
- Adaptable for internal use
- Permanent right of use, no expiry date
Code Guardian: update subscription · booked with your purchase 22.31 €/month for 6 months (−25%), then 29.75 €/month, VAT included
- Every new version for as long as the subscription runs
- Licence key with which Claude Code or Codex fetches new versions itself when you ask
- Cancellable monthly in the portal, to the end of the paid month
- After cancellation, everything released during the term stays downloadable
03Benchmarks
Measured: the same task, with and without Code Guardian
Points = tasks solved minus things broken (the scale goes down to -8)
Latest measurement, v17.14: undecidable (p = 0.06).
One scenario (a small PHP workshop portal with 10 work items), one model, up to 10 runs with and 5 without per comparison. Measured by the vendor.
Points: tasks solved minus things broken. Fixed before measuring, range -8 to +7.
All runs as a table
| Run | Runs with / without | Mean without | Mean with | p | Result |
|---|---|---|---|---|---|
| v17.14 · 29.10. | 10 / 5 | 5.20 | 5.90 | 0.0586 | undecidable |
| v17.13 · 28.10. | 10 / 5 | 5.60 | 6.00 | 0.0952 | undecidable |
| v17.10 · 15.10. | 10 / 5 | 5.20 | 5.90 | 0.0170 | proven better |
| v17.7 · 08.10. | 10 / 5 | 5.00 | 5.70 | 0.1339 | undecidable |
| v17.2 · 28.09. | 10 / 5 | 5.20 | 5.60 | 0.3986 | no difference proven |
| v16.140 · 31.08. | 10 / 5 | 5.00 | 5.60 | 0.1888 | undecidable |
| v16.137 · 30.08. | 10 / 5 | 5.00 | 6.00 | 0.0037 | proven better |
| v16.126 · 23.08. | 9 / 5 | 5.00 | 5.78 | 0.0210 | proven better |
| v16.118 · 19.08. | 10 / 5 | 5.00 | 5.50 | 0.1958 | undecidable |
| v16.118 · 19.08. | 10 / 5 | 4.60 | 5.60 | 0.0320 | proven better |
| v16.117 · 19.08. | 10 / 5 | 5.00 | 5.90 | 0.0020 | proven better |
| v16.116 · 19.08. | 10 / 5 | 5.00 | 5.60 | 0.0889 | undecidable |
04What you get
You are not buying one skill, but twenty-nine.
The reviewer is the core, but it does not work alone. It comes with the framework it runs in, and with fourteen review agents that read cold.
The reviewer
Five modes, seven gates, 15 hooks, 22 detectors. Four latches stop the operation outright instead of scolding it in a report: deletion, secrets in a commit, deploy and migration, each before the command. On top comes a write guard for unattended runs; the option question is stopped by a hook only in autopilot. The legal-text and data gates can be switched on as latches and are off by default. New dependency and finding work as instructions in the skill.
The working framework
Intake and airlock before every change, an interview that puts every open decision to you one at a time, option questions in plain language instead of jargon, and a task list plus task folder that both outlive what a long conversation would otherwise forget.
The second opinion
A council of five advisers with a chair for decisions where being wrong is expensive. A root-cause analysis that separates the root from the symptom. And two retrospectives: one on request for long runs, one after every task as a fixed step of the workflow, which reports the same friction the second time as a decision instead of letting it cost you a third time. New: a procurer for legal sources that fetches citations with a retrieval date instead of answering from memory.
The quality tools
A full-repository audit against AI sloppiness, two critical test reviewers for backend and user interface, and three tools that set up static analysis in a foreign project: for PHP, for JS/TS/Vue and for Python.
Without asking back
An autopilot for runs where nobody is at the screen. It does not decide on its own: every question that would otherwise go to you goes to the council, and afterwards stands verbatim in the log. Alongside it, a dispatcher that hands tasks to the other open sessions on your machine instead of letting them wait.
The fourteen review agents run cold: without the conversation, without the plan, without the author's verdict. That is exactly why they find what the author overlooks. A reviewer who is handed the answer delivers an echo.
Two editions, and they are not the same.
Since late August, Code Guardian comes in two editions: for Claude Code and for the Codex command line by OpenAI. Both carry the same version number and are built from the same source, each with its own test track of more than twenty levels. The release aborts if both packages carry the same checksum, because then one of them would not have been translated.
Show detailsHide details
The airlock has the agent work in plan mode until you approve the plan. This is an instruction in the skill; no latch enforces it.
Code Guardian recommends a plan with at least two steps before the first file change. That is not a latch, and a plan does not show that a human agreed. For real read-only safety, switch on Codex's own plan mode.
The question appears as a choice in the window, with the recommended answer first.
The same through the counterpart there. It needs a terminal and is absent in batch mode; there the check stays silent, because it cannot intercept something that is never called.
From installation onwards.
Only after you have explicitly confirmed the latches once, and that trust is lost again after every update, without warning. That is why the installer reports on request armed or not armed, instead of asserting it.
Three differences in scope are stated here rather than in the small print: the session dispatcher and multitask are missing from the Codex package, and of clistatus only the dashboard ships there, not the status line — all three read Claude Code session transcripts, which do not exist under Codex. Both editions block with the same latches. The numbers above describe the Claude Code edition.
That Windows is tested at all has a specific reason. In late August a paying user reported that not a single latch fired on their machine: checksum correct, 127 files character-identical, ten defects among them, and none of our checks could see any of them, because the Windows path had never been executed. Since then, every release runs both packages through a real Windows machine: the Codex package as the built zip, the Claude package through the same installer that ships in the package. What this run does not do, we say as well: it does not check the file from your portal byte by byte, but the same state in the same form.
05Safety
The principle in one screen.
A command that destroys work is refused at the tool boundary: before it runs, not afterwards in the report. Pick one. The response below is the actual text of the respective hook, translated from the German original.
git reset --hardblockeddestructive-command-check.sh
git reset --hard discards ALL uncommitted changes in the working tree.
A gate checks the output, a guardrail limits the system. This command belongs to the one class that even git does not undo. Save the state first: «git stash -u» or a commit on a throwaway branch, then the command is harmless.
Before the first line of code: an approval.
Every task starts in plan mode, so read-only; the skill prescribes this, no latch enforces it. The agent explores, puts every open decision to you one at a time with a recommendation first, and presents a plan. Only your click opens write access. And what later becomes your decision does not end up as an open item on a list.
Show detailsHide details
- read-only
Explore, secure the facts. The agent works in plan mode and changes no file.
- Interview
Every open decision one at a time, recommendation first. Facts are looked up, never asked.
- Plan
What happens, which files, how it is proven. Plus the log of all decisions.
- Your approval
From here on, building is allowed. Not before.
- afterwards
If an item becomes your decision during the work, Code Guardian is instructed to put it to you instead of reporting the task as done.
Nothing reaches a server unclassified.
Transferring and existing are two different axes. The production .env must never be transferred and yet has to be there. A database dump may do neither. Whoever squeezes that into one axis eventually deletes the wrong thing.
Show detailsHide details
10 files in the transfer list
- app/Http/Controllers/PostController.php
- resources/js/Pages/Home.vue
- public/build/assets/app-DI5faExM.js
- .env
- storage/app/private/
- tests/Feature/CheckoutTest.php
- .git/
- dump-2026-07-24.sql
- .audit-log.md
- database/seeders/
A migration counts as irreversible until the opposite is proven.
Application code comes back with git revert and a dropped column does not. The same command, executed twice:
Show detailsHide details
$table->dropColumn('rabatt_prozent');M3CREATE TABLE _backup_orders_rabatt_20260725 AS SELECT id, rabatt_prozent FROM orders;
| id | kunde | rabatt_prozent |
|---|---|---|
| 4711 | Hoffmann GmbH | 12.5 % |
| 4712 | Baker & Sons | 5.0 % |
| 4713 | Lentz Medien | 20.0 % |
A new package is a supply-chain decision.
This rule is written against a class of attack that would not exist without AI agents.
Show detailsHide details
The model invents a name
The agent needs an HTTP client and writes «npm install reqests». The package does not exist. Not yet.
The hallucination repeats
Same model, same task, same typo, reproducible across runs. That makes the name predictable.
Someone registers exactly this name
From now on the package exists. The check «does the package exist?» says yes. That is exactly what the attack is built on.
The next agent installs it
And with «postinstall», foreign code runs on the developer machine and travels into production.
That is why the gate checks reputation, not existence: age, download history, a real repository with more than one contributor, and the name proximity to a well-known package.
A verdict about data is a verdict about the whole schema.
From a real misjudgement: orders were declared orphaned because nobody knew the deferral column. They were deferred, not broken.
Show detailsHide details
SELECT id, kunde, status, erstellt FROM auftraege WHERE status = 'offen';| id | kunde | status | erstellt |
|---|---|---|---|
| 8801 | Hoffmann GmbH | offen | 2026-04-02 |
| 8814 | Baker & Sons | offen | 2026-04-11 |
| 8827 | Lentz Medien | offen | 2026-04-19 |
ORPHANED? Open for months, never processed. Looks like a defect, and this is exactly where the repair job gets written that touches healthy data.
No option question without a recommendation.
An agent that lists three equivalent paths and lets you choose has merely passed the work on. This is what every question you receive looks like instead:
Show detailsHide details
How should the licence work?
- Company licence, unlimited (Recommended)Needs no seat tracking and no licence server. The files are local; any other count would not be verifiable.
- Per developerMore revenue with large teams, but technically not verifiable. Creates control effort without control.
- TieredTwo tariffs to maintain, the same lack of verifiability.
The gate recommends. You always decide.
A claim is a hypothesis.
An agent reads code, infers a bug from it and asks whether it should fix it. That is the moment a reading turns into an action, and up to then nobody has checked whether the reading is right.
This gate came out of exactly such a case. The answer was neither "yes" nor "no", but "check again whether that is true" and the finding collapsed. Not a bug, a misreading. Since then, three blind pairs of eyes do what that one interjection did.
Show detailsHide details
Claim "The reminder goes out too early." derived from reading, nothing executed
- ExecutionRefute it by running it.
- IntentCould this be exactly as intended?
- EnvironmentWhat already intercepts the trigger?
CONFIRMED exists only when the execution lens has reproduced it. Majority votes are forbidden: one executed refutation outweighs three readings.
A legal notice written from memory looks like one taken from the statute book.
When an agent wrote a legal text (legal notice, privacy policy, terms, withdrawal notice, cookie notice, a pricing document or an AI disclosure), nothing intervened until now. A model's knowledge has a cut-off date, the law keeps moving after it, and nothing reports that.
The seventh gate requires for every obligation a primary source with norm, version, address and retrieval date, and for every load-bearing obligation additionally an official interpretation. If the two diverge, the result is contested and it goes to a human instead of being decided.
It never says "compliant".
The verdict reads n proven, m open, with a mandatory line stating what was NOT checked. Legal compliance rarely fails on a wrongly cited obligation and often on a missing one, and eight proven points with a forgotten ninth look more finished than no list at all.
It answers in typified form, never for your individual case.
That is not a disclaimer but the reason the output can be checked at all: a typified statement can be held against a norm, an assessment of an individual case only against an opinion. It does not replace legal advice, and that stands as the closing line of every block.
Without a network it says so, instead of guessing.
If it cannot reach a source, it reports legal position unverified and not a sentence from memory that looks like a citation. A check that did not run is not a check that passed.
As a latch it can be switched on and is off by default. And it fires rarely: a latch that triggers on every commit is switched off after the third time and afterwards exists only in the feature list. Three hurdles push the trigger down to less than one per mille of all write operations, measured across 2,404 session transcripts, not estimated.
06Proof
Every rule has a damage as its father.
None of these rules comes from a checklist. Each one ships in the package with the incident it came from and with the measurement that backs it.
- 646
- real migrations checked
- Across three Laravel projects. Every finding confirmed by hand as a true hit.
- 545
- tests for the detectors
- Plus a fixture with 58 marked cases as an independent reference.
- 0
- productive symbols ever released for deletion
- The hard safety condition of the cleanup layer. A violation fails the run.
- 42/42
- mechanical slop rules fire on the traps
- The two threshold rules test their own tests. On the clean counterparts: zero findings.
And does it work?
12 valid controlled comparison runs since 19 August, with against without Code Guardian: in 5 of them the apparatus scores mechanically measurably better than the same model without it; the difference is undecidable in 6, including the latest measurement with v17.14, and not proven in 1. Further runs in which the side without Code Guardian changed nothing compared with the starting state do not count (3). No run shows it worse.
And the backstory, because it belongs here: the very first comparison of this kind, in early August, went against the apparatus. Six of sixteen of its runs did not change a single line; they were waiting for an approval that nobody gives in an unattended run. That was a flaw in the process, not in the result, and it is fixed. It stands here because a balance sheet without its worst point is no balance sheet.
What is left after a working day.
A field report from our customer forum, reproduced anonymised and translated from the German. It is a single report and is presented here as one; in the same text the author wrote down five weaknesses. What the tool cannot do is stated directly below.
In a single day the cold reviewer found four real bugs in freshly written code that our own test suite had not seen.
Against 6,500 tests, mutation tests and a golden master: a sticky warning flag, a daylight-saving edge case in a day count, a test anchor silently hollowed out by a refactoring (proven by injection test), and data loss in the save-load-save cycle of a form.
Exactly the class "my own fix is the next bug" that otherwise shows up only days later.
On the same day the destructive-command guardrail stopped a cleanup command live. On the gate texts: "textbook quality, you always understand why a latch is there."
The subscription paid for itself on day one; the cold reviewer alone is worth the price.
A member of our Community, after the first full working day with Code Guardian.
07Cloud
Coming soon
CodeGuard Cloud
Checking tools through one interface: Lighthouse, security headers and known vulnerabilities in your packages. Right from your editor or as a job for your pipeline. Your source code stays on your machine.
What the cloud does and how far we are
Not part of today's Code Guardian licence; terms will follow after legal review.
08Questions
Six questions that come before buying.
- What is a quality gate?
- A check that comes before an operation instead of objecting to it afterwards. Code Guardian ships seven of them: before every deploy, every migration, every new dependency, every verdict about data, every claim about a defect, every option question and every legal text. Deploy and migration stop the operation outright; the option question only in autopilot, legal text and data only once you switch them on. The others work as instructions in the skill.
- Does Code Guardian run with OpenAI Codex?
- Yes. There are two editions, one for Claude Code and one for the OpenAI Codex CLI. The company licence covers both; which one the customer downloads is chosen in the customer portal.
- Which operating systems does it run on?
- macOS, Linux and Windows. On Windows natively via Git for Windows (Git Bash); WSL is not required. If you work entirely inside WSL 2, with Claude Code and Code Guardian both in Ubuntu, it works as on Linux. Claude Code on Windows with checks running through WSL is not supported. The gates themselves are language-independent. Python 3.9 or newer is required on every system, because the four command latches reach their verdict in it; individual tool layers additionally require PHP.
- How does it differ from a linter?
- A linter checks source code against rules. Code Guardian checks the workflow: whether a plan was approved before the change, whether a claim is backed by command output, and whether a deploy or a migration may start at all. The two do not exclude each other.
- What can Code Guardian not do?
- The gates are language-independent, the tool layers beneath them are not: some require PHP, and Python 3.9 or newer is required anyway. Without the Superpowers skills, the brainstorming part of the workflow is missing. And it is not a support contract: there is no response time and no on-call service.
- Is it a subscription?
- No. The company licence is a one-off payment and applies permanently to an unlimited number of developers in the licensed company. Only the delivery of newly released versions is a monthly cancellable subscription; after it ends, the licence and all versions released up to then remain yours.
Understand first, then buy.
The rules in this package come from incidents, not from a textbook. If you want to know what this is all about, you will find the topics behind it explained in depth, without any product angle (articles in German).
Show detailsHide details
- Code audit and code qualityThe overview: what a review delivers and where its limits are.
- What a quality gate isWhy it must not be talked round, and where that fails.
- Code review for AI codeSix patterns a classic review does not look for.
- Who is liable for AI codeWhat changes in the legal position in 2026.
- What vibe coding isThe starting point: how code appears that nobody has read.
- AI coding tools comparedClaude Code, Cursor, Copilot, Codex — what sets them apart.
What it cannot do.
Three things you should know before buying. They are also in the README, because a promise you only find after the purchase is no promise.
The gates are language-independent, the tool layers are not.
Static analysis is wired up for PHP/Laravel, JS/TS/Vue and Python. Mutation tests run as a judged check for PHP and JS/TS; for Python the tool is included but deliberately only advises, because it mutates paths instead of changed lines, and a check that runs for minutes gets switched off. The slop scanner additionally reads Go, Rust, Ruby and shell scripts. On another stack you get the gates, the reflexes and the scanner, but no analysis gate: there is nothing there it could delegate to.
Without Superpowers, brainstorming is missing.
The reviewer itself no longer mentions obra/superpowers at all; the decision interview that used to come from there now ships as a skill of its own. What still points there is the intake for very large tasks: divergent brainstorming and writing formal plans. If Superpowers is not installed, these two references lead nowhere. No gate is skipped, no check fails. Superpowers is not part of the delivery.
It is not a support contract.
Included are all versions that appear during your update period. Not included are a promised update frequency and individual support. When the update period ends, all versions released up to then remain yours permanently, in the portal and via the update API. Only newer ones no longer arrive without a subscription.