AI code review for GitHub and Bitbucket
AI code review that tells you if your repo is ready to ship
Connect a GitHub or Bitbucket repository and Norma reviews all of it. Rule-based checks test the code against your standards. An AI review asks the questions a senior engineer would ask. You get a Production-Ready Score out of 100, split across security, performance, scalability, architecture, maintainability and manageability, plus a list of what to fix.
Free forever · No credit card required · GitHub and Bitbucket
Connects to GitHub and Bitbucket. Works alongside Claude Code, Cursor, GitHub Copilot, Windsurf, Lovable, Replit and any MCP client. Quality Clouds is ISO 27001:2022 certified and SOC 2 Type II attested.
Production-Ready Score
One score that says whether your app is ready for production
Full Scan reviews the whole repository and returns one score out of 100, split across six areas: security, performance, scalability, architecture, maintainability and manageability. Each area lists its issues by severity, high, medium and low, so you know where to start. The score is a diagnosis. It shows what is failing and never blocks a merge by itself.
A real score from Norma’s public demo repository: 59 out of 100 and marked Not ready, with security and architecture failing.
01
Connect a repository
Link GitHub or Bitbucket and pick a repo.
02
Norma reads the stack
It detects languages, frameworks and integrations by itself, so there’s no config file, and runs the rulesets that fit.
03
Read your score
Open each area, see the issues by severity, and fix the high ones first.
See how it works
How Norma checks AI-generated code in your coding agent, on every pull request and across the whole repository. 79 seconds.
Read the transcript
Your teams are writing more code with AI every week. And a lot of it reaches production without anyone checking it against your standards. That's the gap Norma fills. Norma checks code against a fixed set of rules. Same code, same verdict, every time. And every check is recorded. There's nothing to configure. Norma detects your stack and turns on the rulesets that fit: languages like TypeScript and Python, and frameworks like React and FastAPI. And it works where the code gets written. Connect Cursor, Claude Code, or any other agent through MCP. The agent checks each file as it writes it, fixes whatever Norma flags, and records the result against the repository. It covers the repository, too. When someone opens a pull request, the Norma GitHub App comments with every new issue. So code that never went near an agent still gets checked. And a full scan gives each repository a Production-Ready Score, so you can see where the risk is before you ship.
How Norma reviews code
AI code review in three places: the repository, the pull request and your agent
Repository review: GitHub and Bitbucket
Full Scan reviews the whole repository with rule-based checks plus AI findings, and produces your Production-Ready Score. It is useful when business teams build apps on Lovable and IT needs to know which ones are ready for real use.
Pull request review: GitHub and Bitbucket
Norma comments on each pull request with every new issue it finds, including code that never went near an AI agent. On GitHub it runs as the Norma GitHub App, which asks for one permission, read and write on pull requests, so it can’t push code or merge. Bitbucket pull requests get the same review.
In your coding agent: Claude Code, Cursor and others
Your agent asks Norma for your rules before it writes, and checks each file against them as it goes. The free tier has unlimited enforcement with no usage cap.
Any AI model, any coding agent
Using Claude, GPT or another model for code review? Give it your rules and a score to hit
Norma checks the code whichever model wrote it, Claude, GPT, Gemini or any other, through Claude Code, Cursor, GitHub Copilot, Windsurf or any MCP client. Connect it once and your agent checks its own changes against your rules before you open the pull request. You get four things that carry over from one session to the next: your organization’s rules, checked the same way on every run; the same senior-engineer questions on every repository; a Production-Ready Score you can track over time; and a record of what was checked and fixed.
claude mcp add --transport http norma https://api.qualityclouds.ai/mcp
The command above is for Claude Code. Cursor, GitHub Copilot, Windsurf and other MCP clients take one config entry. Sign-in is OAuth, so there is no API key to manage.
Loop engineering
Code leaves the loop only when it passes
The agent writes, Norma checks, and anything that fails goes straight back to the agent. What comes out is working code plus a record of what was checked and fixed.
Norma MCP
Ask your agent if it’s ready to ship. Norma checks it against your rules.
Connect Norma to Claude Code, Cursor, Copilot or any MCP client. Your code gets checked against your organization’s rules while the agent writes, and each check returns the same result whoever runs it.
Any coding agent can tell you what a function does, and a rules file can tell it what your standards are. Holding every file in every repository to those standards takes a check that runs outside the model.
Norma runs that check and returns the rule ID, severity, line and a fix.
Checks that repeat. Same file, same rules, same result, whichever agent is driving.
A record you did not write yourself. Rules verified, violations fixed and where, tagged with the model and version.
One ruleset, versioned centrally, so 40 repositories cannot drift into 40 versions of your standards.
In a few minutes. OAuth sign-in, one config entry.
norma · mcp session
Is admin-client ready to ship?
norma · live_check → src/lib/admin-client.ts
No. Two rules fail, 10 pass.
HIGH
line 15
sb-exposed-service-role-key-1.0
A service_role key is hardcoded in client code. It bypasses every row level security policy. Move it into an Edge Function.
MEDIUM
line 15
sb-hardcoded-anon-key-1.0
The key is pinned in source, so rotating it means a code change. Read it from an environment variable.
Want me to fix both?
Yes
norma · live_check → clean
norma · register_applied_actions → 2 fixed, 10 verified
Both fixed and re-checked. Recorded against your ruleset, tagged to the model that made the change.
Checked, fixed and recorded, on any agent.
Checks and findings
Checks are rule-based. The same code gets the same result every time, so you can set a Quality Gate on them and track them across releases.
Findings are an AI review in Full Scan. It asks the questions a senior engineer would ask, the same questions on every repository, and the results show up in the Norma app. The first findings ruleset, DevOps Design Patterns, is live now.
One rule library, governed end to end
Grounded in stack best practice, configured to your context, and every check on the record.
Best practice by default
Rules for your stack’s best practice on every plan, with SOLID design rules on paid plans. You switch off what doesn’t fit your context.
Enforce
In the agent loop through the Norma MCP server, and in every Full Scan.
Evidence
Every check records rule, version, file, line, commit, author and timestamp.
Audit
Every check and fix is on the record, and every exception is logged with its reason.
AI Authorship Ratio
Know what share of your codebase was written by a model, and which band you are in. Native under 30%, Hybrid 30 to 70%, Delegated over 70%.
Production-Ready certificate
Turn your Production-Ready Score into a certificate you can share with customers and auditors. The free tier includes one certificate per month.
Free, permanently
The free tier is permanent, not a trial, and you don’t need a credit card to sign up. Pro is $199 per month. Business is quoted for your organization, and Enterprise adds full audit trails, single sign-on and named support.
See it working before you connect anything
Two ways to see Norma run before you point it at your own code.
Interactive demo
A guided walkthrough of the loop. The agent proposes, Norma returns the applicable rules and the violations, the agent corrects, and the change lands. Runs in your browser, no install.
Open the interactive demo →
Live demo repository
A public repository governed by Norma. Read the code, the checks it runs and the findings history, all in the open.
Open the demo repository →
Both are read only. Nothing reaches your own repositories until you connect one yourself.
Talk to us
Rolling Norma out to a team? Let’s talk.
Tell us about your stack, your repositories and the coding agents your team uses. We’ll show you how rulesets, Quality Gates and the audit record fit your setup, and answer your security team’s questions.
Prefer to look around first? Open the live demo, or sign up free. No credit card required.
Send us a message and we’ll get back to you.
Questions
What is AI code review?
AI code review uses a model to read code and flag problems a human reviewer would catch: security holes, slow queries, weak architecture. Norma pairs it with rule-based checks, so the hard rules return the same verdict every time and the AI review covers the judgment calls.
Does Norma work with Bitbucket?
Yes. Connect a Bitbucket or GitHub repository and Full Scan reviews the whole codebase and produces your Production-Ready Score. Norma also comments on pull requests in both.
What does the Production-Ready Score tell me?
How ready your repository is for production, as one number out of 100. Norma scores six areas, security, performance, scalability, architecture, maintainability and manageability, and lists every issue by severity. The score reports what is failing; only a Quality Gate you set can block anything.
Does Norma work with Claude, GPT and other AI models?
Yes. Norma checks the code itself, so it works whichever model wrote it: Claude, GPT, Gemini or another. Connect it to Claude Code, Cursor, GitHub Copilot, Windsurf or any MCP client and the same rules apply in all of them.
What is AI code governance?
It is the practice of deciding what good code looks like for your organization, then enforcing that decision automatically wherever code gets written, including when a model writes it. Rules are authored in plain English, reviewed and approved, and versioned so every change is traceable. They apply the same way in every editor and every scan, and each check leaves a record of what was enforced and why.
Which editors and agents does Norma work with?
Cursor, Claude Code, Windsurf, VS Code, Lovable, Replit and any other MCP capable client. Add one entry to your MCP config and the first call opens your browser to sign in. OAuth, no API key needed. Agents your own team builds can call the same server.
Who decides which rules apply?
You do. Norma ships a rule library built on stack best practice, with SOLID design rules on paid plans, and your architects decide what applies: switch off the rules that do not fit your context, and every check runs against the set you chose. What ran and what was excepted is always on the record.
Is the free plan really free?
Yes. The free tier is permanent, not a trial, and signing up doesn’t ask for a credit card. It includes unlimited enforcement through the Norma MCP server and one certificate per month. Pro is $199 per month when your team needs more, and Business is quoted for your organization.
Where is my code processed?
Livecheck processes file content in memory and does not store it, and Norma deletes repository code after a Full Scan. The GitHub App asks for one permission, read and write on pull requests, so it cannot push or merge code. Quality Clouds is ISO 27001:2022 certified and SOC 2 Type II attested.
Get your app’s Production-Ready Score
Free forever. No credit card required.