quodeq 1.0.6

Source code quality evaluation platform powered by AI

AI-powered code quality and security scanner

v1.0.6

Watch the 2-min demo · Website · Blog · Releases

---

AI models can now autonomously find and exploit zero-day vulnerabilities across operating systems, browsers, and web applications. Thousands of previously unknown flaws uncovered in weeks, not years.

The code you ship today will be read by models that can spot what humans miss. But the tools to prepare for this are locked behind enterprise contracts and partner programs.

Quodeq exists to change that.

Open source. MIT license. Runs locally. No telemetry. No account. No servers.

Scans any codebase with AI across six quality dimensions from ISO 25010: Security, Reliability, Maintainability, Performance, Flexibility, and Usability.

Every finding maps to a CWE identifier. You get grades, violations with line numbers, and a fix plan. Cloud providers (Claude, Gemini, Codex) for speed. Local models via Ollama for privacy.

---

What It Finds

CRITICAL  src/db.py:15        SQL Injection via string concatenation     CWE-89
          query = f"SELECT * FROM users WHERE id = {user_id}"

HIGH      src/auth.py:42      Hardcoded credentials in source code       CWE-798
          credentials = {"user": "admin", "pass": "secret123"}

MEDIUM    src/api.py:88       Missing rate limiting on login endpoint     CWE-307
          @app.route("/login", methods=["POST"])

MINOR     src/utils.py:23     Bare except clause hides errors             CWE-396
          except: pass

Each finding includes a reason, the offending code, and a fix plan. Results are stored as JSON on your machine.

---

Getting Started

pipx install quodeq    # Install quodeq
quodeq                 # Launch the dashboard

Running quodeq opens the dashboard, where you can point to any project and run evaluations from the UI. Also available via pip install quodeq.

Requirements: Python 3.12+ and Node.js 18+ (for the dashboard UI).

macOS App (beta)

Download the .dmg from Releases, open it, and drag Quodeq.app to Applications. On first launch:

xattr -cr /Applications/Quodeq.app    # Required for unsigned apps

Or right-click the app, select Open, then click Open in the dialog.

---

Dashboard

• Grades and scores per dimension with A-F letter grades, numeric scores, and trends across runs
• Violations explorer to drill into findings by file, principle, or CWE classification
• Code map showing a visual heatmap of where issues concentrate in your codebase
• Custom standards to create your own evaluation dimensions or import from the library

Click any dimension, file, or principle to explore the details. Dismiss false positives directly from the UI.

Running quodeq is equivalent to quodeq dashboard. Both open the same UI.

CLI

quodeq evaluate /path/to/project
quodeq evaluate /path/to/project --scope src/api    # Scoped to a subdirectory
quodeq evaluate /path/to/project -d security        # Single dimension

---

AI Providers

Choose what fits your workflow. Configure in Settings from the dashboard.

Provider	Type	Getting started
Ollama	Local	Free, private, code never leaves your machine
Claude Code	Cloud	Best balance of speed, quality, and cost
Codex CLI	Cloud	OpenAI models
Gemini CLI	Cloud	Google models

For local analysis we recommend Gemma 4 (gemma4:26b). Reducing the context window to 32k still gives good results and allows running multiple subagents in parallel.

---

How It Works

1. Detect languages, frameworks, and project structure
2. Analyze with AI agents that read the code using read-only tools
3. Collect findings as structured JSONL via tool calls
4. Score against ISO 25010 principles with CWE classifications
5. Report per-dimension grades, violations, compliance, and fix plans

Results are stored in ~/.quodeq/evaluations/ and persist across sessions. Works with any language. The AI analysis engine reads and understands code regardless of the tech stack.

Quodeq scores each principle on a 0 to 10 scale using four independent constraints. Full details in the scoring formula documentation.

Standards

By default, Quodeq evaluates the six ISO 25010 dimensions. It also ships with Clean Architecture and Domain-Driven Design standards. You can create your own from the dashboard, or ask any AI to generate one as a .json file and import it.

---

Development

git clone https://github.com/quodeq/quodeq.git && cd quodeq
uv sync
uv run pytest

Changelog

See CHANGELOG.md for release history.

License

MIT. See LICENSE.