Norma for engineering

Your architecture standards, enforced at the moment of generation

Human review does not scale to agent output. Norma holds your rule library, runs it inside every AI editor through MCP, and runs it again on every repository scan.

Read the MCP docs

The three checks review keeps missing

Policy compliance

Does this generated code follow the rules security and platform set?

Secret and credential exposure

Is a key, token or service-role credential about to be hardcoded, committed, or shipped where the browser can read it?

Architectural discipline

Is the API called once where it should be, or fifty times because the model did not notice the existing call?

Norma answers all three at generation time.

Governance in the loop

As development moves from prompts to autonomous loops, review that happens after the commit arrives too late. Norma runs inside the loop through MCP, so the agent gets the rule before it writes, not a rejection after.

Agent proposes

→

Norma returns applicable rules and violations

→

Agent corrects

→

Code lands

The second step is the MCP hop: get_rules_for_tool hands the agent your active rules, live_check verifies what it wrote, and register_applied_actions records the outcome as evidence.

Server source, setup and the full tool reference: github.com/qualityclouds/norma-mcp

Watch it in under two minutes

The risks of ungoverned AI code, how the loop works, and how to set it up with Norma in three steps.

Read the transcript

Coding agents now write a big share of the code that ships. Without governance, that code carries real risks. Passwords and keys left in the source. Insecure patterns. Code that drifts from your architecture. And no record of what anyone checked. Loop engineering deals with this inside the agent's own loop. The agent takes a goal, plus the context of your repo and your rules, and writes the code. Then Norma checks every file against those rules. If a check fails, the agent gets the finding, fixes the code, and checks again. The rules are fixed, so the same code always gets the same answer. What comes out of the loop is working code, plus a record of what was checked, what failed, and what got fixed. Setting it up takes a few minutes. Create a free Norma account, then add the Norma MCP server to your agent: Claude Code, Cursor, Windsurf, or any other MCP client. You sign in once, from the agent. Next, ask the agent to link your repository to Norma. From then on, it checks each file as it writes it, fixes what Norma flags, and records the result. Then install the Norma GitHub App. Every pull request gets a comment listing any new issues, so code written outside the agent gets checked too. Your agents keep their speed. And you get code you can stand behind, with the evidence to prove it.

Deterministic, not probabilistic

Norma’s rules are deterministic. The same code and the same rule version produce the same finding every time. That is what makes the output usable as evidence and what stops the tool arguing with itself between runs.

Works with what you already run

Norma governs the rule and holds the evidence, and connects to the detection tooling you already run. Available on paid plans. Repositories on GitHub, GitHub Enterprise, Bitbucket and Azure DevOps, plus custom CI.

You can also see it right now: an agent gives the live demo. Talk to it or chat, and steer it to your stack and standards.

Start the agent demo

Pick a time

Put your standard inside the loop

Read the MCP docs