Everything you need to ship better code.

Getting started

Create an account and you'll land in a guided setup that walks you from an empty workspace to your first analysis in about a minute. You don't need to install anything or configure a build — Impact clones the repository, analyzes it, and streams progress live.

The fastest path: paste any public Git URL on the Get started screen (or click one of the example repositories) and hit Analyze. You'll be taken to a live console as the scan runs, then to a full report with a quality score, ranked issues, and an interactive dependency map.

Connecting repositories

Public repositories work with zero setup — just paste the URL. Private repositories require a connected Git account so Impact can clone them on your behalf. Head to Settings → Git Accounts and connect via OAuth, or add a personal access token:

GitHub needs a token with the repo scope; GitLab needs read_repository; Bitbucket needs an app password with Repositories: Read; Azure DevOps needs a PAT with Code (Read). Tokens are encrypted at rest (AES-256-GCM) and never leave the backend.

Private-repo access is available on the Solo trial and all paid plans. The Free trial is public-repo only.

Reading your results

Every analysis produces a 0–100 score and an A–F letter grade, backed by a seven-pillar Code Intelligence rollup: quality, temporal risk, architecture, security, business value, human knowledge, and ecosystem health.

The issues list is ranked by blast radius — how much of your codebase a problem can affect — not just raw severity, so the things worth fixing first float to the top. Open any issue for an AI explanation and, on paid plans, a suggested fix.

Quality gates

A quality gate is a pass/fail policy evaluated on every analysis. Use it to block a merge when new critical issues appear, coverage drops, or debt crosses a threshold. Configure gates per project under Project → Settings → Quality Gate; custom gates are available on Professional and above.

# Example policy
new_critical_issues: 0      # fail if any new critical issue
coverage_drop:       "> 2%" # fail if coverage falls more than 2%
maintainability:     ">= B" # require a B or better

CI/CD & auto-rescan

Keep scores current by re-analyzing on every push. Each project gets a signed webhook URL under Project → Auto-rescan — paste it into your provider's webhook settings (GitHub, GitLab, or Bitbucket) and Impact re-scans on each push, validating the payload signature (HMAC-SHA256).

Prefer to call it from a pipeline? Trigger an analysis with the API and fail the job on a gate result:

curl -X POST https://api.impactcodeanalysis.com/api/v1/analyze \
  -H "x-api-key: $IMPACT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"projectId": "prj_123"}'

Self-hosting (Docker)

Business and Enterprise plans can run Impact entirely inside your own infrastructure. The stack ships as Docker images (backend, frontend, license server) and a Compose file; you can build from source or pull the pre-built images.

git clone https://github.com/ImpactDev/impact.git
cd impact
cp .env.example .env      # set secrets + your license key
docker compose up -d      # backend, frontend, license server
# open http://localhost:3000

Self-hosted instances run fully offline with an air-gapped license (Enterprise). Data never leaves your network.

API & CLI

Everything in the UI is available over a REST API. Generate a key under Settings → API Keys and pass it as an x-api-key header. Common endpoints:

GET  /api/v1/projects              # list your projects
POST /api/v1/analyze               # start an analysis
GET  /api/v1/analyses/:id          # analysis status + summary
GET  /api/v1/projects/:id/issues   # ranked issues

Rate limits protect the service; analysis is capped per hour and read endpoints per minute. Contact us if you need higher limits.

Security & data

We don't train on your source, and you can export or delete your data at any time. Access tokens are short-lived, refresh tokens live in HttpOnly cookies, and every data route is tenant-isolated. Git credentials are encrypted at rest. For the full picture — SOC 2 practices, encryption, SSO/SAML — see the Trust & Security page.