Your rules, running inside the agent loop
Connect Cursor, Claude Code, Lovable, Replit or any MCP capable editor. Norma answers three questions before the code lands: does it follow policy, are any secrets or credentials exposed, and is the architecture sound.
Norma MCP
Ask your agent if it’s ready to ship. Get the same answer every time.
Connect Norma to Claude Code, Cursor, Copilot or any MCP client. Your code gets checked against your organization’s rules while the agent writes, and the result comes back the same whoever asks and whenever they ask.
Any coding agent can tell you what a function does, and a rules file can tell it what your standards are. The verdict is the harder part. A model asked twice about the same file can answer twice differently.
Norma runs the check outside the model and returns a fixed result: rule ID, severity, line, fix.
A verdict that repeats. Same file, same rules, same answer, whichever agent is driving.
A record you did not write yourself. Rules verified, violations fixed and where, tagged with the model and version.
One ruleset, versioned centrally, so 40 repositories cannot drift into 40 versions of your standards.
norma · mcp session
Is admin-client ready to ship?
norma · live_check → src/lib/admin-client.ts
No. Two rules fail, 10 pass.
HIGH
line 15
sb-exposed-service-role-key-1.0
A service_role key is hardcoded in client code. It bypasses every row level security policy. Move it into an Edge Function.
MEDIUM
line 15
sb-hardcoded-anon-key-1.0
The key is pinned in source, so rotating it means a code change. Read it from an environment variable.
Want me to fix both?
Yes
norma · live_check → clean
norma · register_applied_actions → 2 fixed, 10 verified
Both fixed and re-checked. Recorded against your ruleset, tagged to the model that made the change.
Same file, same rules, same verdict, on any agent.
Why the result has to be repeatable
A judgment that changes between runs cannot be a gate. If the same file passes on Tuesday and fails on Wednesday with nothing changed, the build signal is noise and the team stops trusting it within a week.
A fixed result is comparable. You can trend it across releases, set a Quality Gate on it, hand it to an auditor, and tell a real regression apart from a different sampling of the model.
Your editor queries Norma for your organization’s rules before each suggestion. Unlimited enforcement on the free tier, no usage cap.
Grounded in SOLID principles, configured to your context, and every result on the record.
SOLID by default
Rules grounded in SOLID principles and stack best practice. You switch off what does not fit your context.
Enforce
In the agent loop through the Norma MCP server, and in every Full Scan.
Evidence
Every finding records rule, version, file, line, commit, author and timestamp.
Audit
Every check and fix is on the record, and every exception is logged with its reason.
The free tier is permanent, not a trial. Pro at $199 per month and Business at $499 per month when you outgrow it.
The verification page behind the badge: the live Production-Ready Score, the six areas behind it, and every issue by severity. Anyone can open it without asking you for anything.
See it working before you connect anything
Two ways to watch Norma run without signing up and without pointing it at your own code.
Interactive demo
A guided walkthrough of the loop. The agent proposes, Norma returns the applicable rules and the violations, the agent corrects, and the change lands. Runs in your browser, no install.
Open the interactive demo →
Live demo repository
A public repository governed by Norma. Read the code, the checks it runs and the findings history, all in the open.
Open the demo repository →
Both are read only. Nothing reaches your own repositories until you connect one yourself.
What is AI code governance?
It is the practice of deciding what good code looks like for your organization, then enforcing that decision automatically wherever code gets written, including when a model writes it. Rules are authored in plain English, reviewed and approved, versioned so every change is traceable, and applied identically in every editor and every scan. What you get back is not just a warning, it is a record of what was enforced and why.
Which editors and agents does Norma work with?
Cursor, Claude Code, Windsurf, VS Code, Lovable, Replit and any other MCP capable client. Authenticate with a key generated in the portal and add one entry to your MCP config. Agents your own team builds can call the same server.
Who decides which rules apply?
You do. Norma ships a rule library grounded in SOLID principles and stack best practice, and your architects decide what applies: switch off the rules that do not fit your context, and every check runs against the set you chose. What ran and what was excepted is always on the record.