Norma and Qodo: what each one gives you

Qodo reviews and writes code with AI agents. Norma scores a repository against a fixed rule set and keeps the result. Both can run on the same repository, and for most teams that is the sensible setup.

This page covers what Norma adds, and what Qodo already does well, so you can decide which parts you need.

Same code, same score

Norma computes a Production-Ready Score for a repository from a fixed rule set covering security, maintainability and architectural risk. Run it twice on the same commit and you get the same score, whoever runs it and whenever they run it.

LLM review works differently by design. Two runs on the same diff can return different suggestions, because the output is probabilistic. That is fine for a reviewer sitting next to you. It is harder to use as evidence, because you cannot reproduce the result on demand.

The Production-Ready Score is diagnostic. It tells you where a repository stands today, and it stays comparable week to week because the rules behind it do not change between runs.

What Qodo actually does

Comparison pages tend to describe a version of Qodo that no longer exists. Here is the current picture.

Qodo consolidated its products into one platform in 2026: Qodo Git for pull request review, Qodo IDE, Qodo CLI, and the Context Engine for multi-repo search. Qodo is SOC 2 Type II certified and publishes a trust centre. It has a rules system, and it can generate a best_practices.md file from your own merged pull requests, so its checks reflect your codebase rather than generic patterns. It supports MCP: the Context Engine runs as an MCP server, and Qodo CLI agents can be exposed as MCP servers too. Its CLI agents have exit conditions built for CI, so they can fail a build.

So the honest difference is narrower than "AI suggestions versus governance". It comes down to two things:

Reproducibility. Norma's score is computed, not generated. You can put the same commit through it a year apart and compare the numbers.

Where the evidence lives. Qodo's stated posture is zero data retention: code is analysed and discarded. That is a strong security answer, and it means the record of what was checked stays in your pull request threads. Norma keeps the scan result and the score in your workspace, outside the Git provider, so the evidence is not tied to a PR conversation. [CONFIRM before publishing: is the stored scan history exportable today? If export is not shipped, cut the second half of this sentence.]

Where Norma runs

In the editor. The Norma by Quality Clouds extension is on the VS Code Marketplace, and on Cursor and VSCodium through Open VSX. It runs Livecheck on the file you are working on and puts findings in the Problems panel. Fix with AI hands a prompt to your editor's AI chat. Norma never edits your code itself, which keeps the check independent of the thing being checked.

In the agent loop. Norma's MCP server is live in production at api.qualityclouds.ai/mcp, and the extension registers it for you. Agents writing code can call the same checks that run in your editor, so AI-generated code meets the same standard as everything else before it reaches a pull request.

In CI. Quality Gates run Norma's checks in your pipeline. [CONFIRM: exact enforcement behaviour and whether this is configured via API, CLI or the portal.]

AI-generated code

Norma includes rules aimed at what tends to go wrong in AI-generated code: insecure completions, calls to APIs that do not exist, and logic that reads well but does not hold. [CONFIRM: are AI Findings computed entirely from the fixed rule set? If any part of that detection is model-driven, it cannot sit on the same page as the reproducibility argument above.]

Where the rules come from

Quality Clouds has spent 9 years governing enterprise platforms: 950+ governed instances across ServiceNow, Salesforce and Dynamics 365, and more than 13 million catalogued issues. That work is platform governance, and Norma is a separate, repository-based product. What carries over is the judgement: 9 years of watching which patterns actually cause incidents in regulated environments, applied to repositories.

Who Norma fits

Regulated teams in finance, healthcare and government. You need a result you can reproduce and hand to an auditor, not a set of suggestions from a model that has moved on since. Quality Clouds is ISO 27001 certified. [CONFIRM: the certificate version, whether Norma sits inside the certified scope, and whether the ISO 27001 rule pack has shipped in the product. Do not claim product-level certification.]

Teams adopting AI coding assistants. Norma's MCP server puts the check inside the agent loop, so the standard applies while the code is being written.

Platform teams running many repositories. Workspaces and team management give you one view across repositories instead of a per-PR view. [CONFIRM: multi-branch scanning.]

Adding Norma to a Qodo setup

1. Create a workspace at portal.qualityclouds.ai. The free tier is permanent, not a trial, and includes 1 certificate per month.

2. Connect your repositories. [CONFIRM which providers are live: GitHub only, or GitHub and Bitbucket.]

3. Install Norma by Quality Clouds from the VS Code Marketplace, or from Open VSX for Cursor and VSCodium. Sign in with OAuth and the MCP server registers itself.

4. Run a Full Scan and read the Production-Ready Score for the repository.

5. Add Quality Gates to your pipeline once you know where your repositories currently score.

Pro is $199 a month and adds the SOLID design-principle rules. Business is $599 a month.

Nothing here asks you to remove Qodo. Keep the review agent you have, and add the part that produces a repeatable number.

Start free at portal.qualityclouds.ai.