Features

Everything Qualor does

Gates, AI review, dependency tracking, your agent and your chat, on one server you run.

Get it on GitHubTry the live demo

Analysis and AI review, up close

Analysis

Your analyzers in one list, and a gate on the code you change, reported in your merge requests.

It judges only the code you changed

Old issues stay visible, but they never block a merge. The gate looks at new code: new issues, coverage of new lines, duplication in new lines. Small changes don't fail on coverage percentages.

Your analyzers, one list

Qualor runs proven open-source tools, adds its own security rules, and merges what they find. The same finding from two tools shows once.

Security
  • Qualor security rulesJS, TS, Python, Java, Go, C#
  • FindSecBugsJava
  • OpenGrepYour own rules
  • GitleaksSecrets
  • TrivyDependencies
Code quality
  • ESLintTS, JS
  • RuffPython
  • PMDJava
  • SpotBugsJava bytecode
  • detektKotlin
  • SwiftLintSwift
  • PHPStanPHP
  • RuboCopRuby
  • staticcheck + gosecGo
  • cppcheckC, C++
  • Roslyn + RoslynatorC#
  • stylelint + HTMLHintCSS, HTML
  • Your SARIFany tool

Security that follows the request

Qualor's own rules follow request data into SQL, commands, file paths, URLs and templates in JavaScript, TypeScript, Python, Java, Go and C#. For ASP.NET Core, a deep analysis after your build follows it across files, projects and Razor views.

  1. routes/invoices.tsreads the request
  2. services/invoices.tspasses it on
  3. invoices/export.tsbuilds SQL with it

HighSQL built from request data

Coverage, duplication, complexity

Imports coverage from LCOV, Cobertura and JaCoCo, measures cognitive complexity and finds copy-pasted code. Keeps the history of every branch and merge request.

  • Coverage86.2%Better than 64.0%64%66.1%65.2%70.4%72.8%76%79.3%82.5%86.2%
  • Duplication1.8%Better than 4.1%4.1%3.9%4%3.2%2.9%2.6%2.3%2%1.8%
  • Complexity6.3Better than 9.89.89.59.68.78.17.676.66.3

Triage unblocks the merge

Mark a finding as a false positive or won't fix, and the gate is judged again at once, with no new pipeline. Qualor knows an issue by its code, not its line number, so the decision survives a refactor.

Medium src/invoices/csv.ts:41 Cognitive complexity 21 is over 15
Quality gateFailed: 1 new issuePassed, judged again, no pipeline

Better together

The reviewer is shown what your analyzers found, so it doesn't repeat it.

Both kinds of finding land in one issue list, so your agent fixes both through MCP.

AI findings never fail the gate.

Review

A reviewer on your model, in the merge request's threads.

Reads the code behind the change

It reads the change and opens any file of the repository it needs, not only the diff.

  • src/invoices/csv.tschanged
  • src/db.tsopened
  • src/invoices/list.tsopened

Suggested changes

It starts threads on the changed lines. Where a fix fits, the thread carries it as a suggested change for a person to apply.

The final page of invoices is never exported

for (let page = 1; page < pages; page++) {for (let page = 1; page <= pages; page++) {
Apply suggestion

It answers replies

Reply in its thread and it answers. A member's reply can mark the finding won't fix or false positive.

Team member replied

Accounting exports a few dozen invoices a month. Can this wait for the next release?

AI review · reply

I’d recommend fixing it before the next release: an export with 1–50 matching invoices contains no invoice rows, so accounting’s usual exports are likely affected. Changing the loop condition to page <= pages includes the final page; tests around the 50-invoice boundary would help prevent a recurrence.

Only what changed since the last review

After a push, only new changes raise new findings. Fixed findings close and their threads resolve.

  1. First push · 7 findings
  2. Next push · the fix

ResolvedThe final page of invoices is never exported

Your model, three sizes

A strong, a standard and a fast model: any OpenAI-compatible or Anthropic model with your key, or a local one through Ollama or vLLM.

  • Strongjudges the findings
  • Standardreviews and replies
  • Fastsmall changes

What a review looks like

Screens from a real pull request on GitHub: a thread with its suggested change, the summary comment, and an answer to a reply.

A pull request conversation on a changed line: the AI review's finding, why it matters, and its suggested change
A finding on the changed line, with a suggested fix for a person to apply.
Qualor's summary comment: the AI review's verdict, its findings by severity and a walkthrough of the change
The summary comment: the quality gate, then the AI review's findings by severity.
A team member asks in an AI review thread whether the fix can wait, and the reviewer answers that it should be fixed before the release
A reply in the thread gets an answer that reads the code. A member's decision can also mark the finding won't fix.

One line in your pipeline

The scanner runs in your CI, collects what every analyzer finds, works out which lines the merge request changed, and sends one report to your server. It waits for the verdict and fails the job when the gate fails.

On GitLab, findings also show in the merge request widget and the security tab through the Code Quality and SAST reports. The CI/CD component is in the GitLab CI/CD catalog.

include:
  - component: gitlab.com/qualor/qualor/qualor@0.15
    inputs: { image-tag: "0.15" }

Your agent fixes both kinds of findings

Connect Claude Code, Cursor or any MCP client with one URL. Your agent reads your analyzers' issues and the AI review's findings, each with its code, fixes them, and checks the gate again after CI. It signs in as you and can do only what you can.

In Qualor itself, the assistant explains an issue, suggests whether a finding is a false positive, and suggests a fix that a person can post to the merge request. On Enterprise, fix suggestions for new findings are posted without a click.

How to connect

Gate failures reach your team — in Slack and Teams

Add a Slack or Microsoft Teams channel in a minute. When the main branch's quality gate fails, the channel hears about it with what failed and a button back to Qualor. When it passes again, it hears that too. Every Monday morning, a security digest shows what is new across your projects.

Connect a channel

Every gate, issue and vulnerability in one place

A web UI your whole team can read at a glance: which gate failed and why, what to fix first, and which releases a new vulnerability hits. Light or dark, on a laptop or a phone.

Click through the live demo: Qualor checking its own code. No sign-up.

A project's overview: the quality gate that failed and the condition that failed it, then the measures on new code and their trends
The gate that failed and why, the figures that matter, and where the code is heading.
A project's issues, filtered by severity and status, with the severity of each and the rule, file and line that found it
Filter by severity, status and rule, then triage in bulk.
An issue with the code around it and an explanation of the finding and how to fix it, written by the team's own model
The code around an issue, with an explanation and a fix from the model you choose.
A quality gate's conditions, each changed right in its row
Quality gates you change right in place.
A finding of the AI review in Qualor, with the code it points at, the review's text and its suggested change
An AI finding in Qualor, with the review's text and its suggested change.
A project's Vulnerabilities tab: Log4Shell and Spring4Shell as Critical and exploited, each with its fixed versions, exploit probability, the releases it is in and its status
Each vulnerability with its fix and the releases it is in, exploited ones first. New ones show up without a new scan.

Try it on your next merge request

Star on GitHubFollow the quick start

Not ready to install? Star it to find it again.

  • MIT licensed
  • Signed images
  • Latest release 0.15.0, 10 November 2026
  • The demo analyses Qualor itself