Norma is an AI code governance platform for teams shipping AI-generated code. It answers three questions before code lands: does it follow policy, are secrets exposed, and is the architecture sound.

In the editor. Norma connects over MCP to Cursor, Claude Code, Windsurf, VS Code, Replit, Lovable and any MCP-capable client, and serves your organization's active rules to the agent while the code is being written. Editor enforcement is unlimited on the free tier. A VS Code extension is also published on the Marketplace and Open VSX.

Across the repository. Connect GitHub or Bitbucket and Norma runs a deterministic audit of the whole repository, detecting the stack and frameworks with no configuration file. Findings come back ranked by severity with the context needed to fix each one.

Why deterministic matters. Rules are evaluated by static analysis rather than model judgment, so the same file measured against the same rules returns the same verdict on every run, whichever agent produced the code. That makes the output usable as an internal record instead of an opinion that shifts between runs. Every call and every finding is stored.

What you get back. A Production-Ready Score, an AI Authorship Ratio that classifies a codebase as Native, Hybrid or Delegated by how much was written by AI, and a Quality Certified badge for the README that expires by itself if the code stops meeting the standard.

Coverage spans JavaScript, TypeScript, Python, PHP, Java, Node, React and Supabase, with rules grounded in SOLID design principles and per-stack conventions.

The free tier is permanent, not a trial: one developer, one workspace, one repository and five Full Scans a week. Pro is $199 a month for three workspaces, ten repositories and the full rule set. Business is quoted and adds compliance frameworks, audit log export and support with an SLA.

Quality Clouds is ISO 27001:2022 certified and SOC 2 Type II attested.