# Qodo (Codium)

> Qodo (Codium) is a community-maintained IDE extension from Qodo. Anomity scores its risk at 50 out of 100 (medium).

- **Canonical URL:** https://catalog.anomity.ai/extension/qodo
- **Kind:** IDE extension
- **Publisher:** Qodo
- **Trust level:** community
- **Risk score:** 50/100 (medium)
- **Website:** https://qodo.ai
- **Last updated:** 2026-09-02
- **JSON:** https://catalog.anomity.ai/api/entries/extension/qodo

## Description

Qodo, formerly known as CodiumAI, is an AI extension focused on test generation and automated code review rather than the general chat-and-completion category. Inside the IDE it reads the function the developer is working on, proposes a set of behavioral tests, and surfaces likely edge-case failures; in the pull request flow it leaves contextual review comments on changed code through a companion GitHub app.

Declared capabilities include reading files in the open workspace to gather context for test generation and review, making outbound network requests to Qodo's hosted service for model inference, and accessing the user's Qodo and provider credentials stored in the IDE secret store. The extension does not request filesystem write or shell execute permissions — generated tests are inserted by the IDE on acceptance, and any test execution happens through the user's own commands.

Qodo is community trust because it is an independent vendor. The credential plus outbound network pairing produces a routine risk signal but does not match any dangerous combination. The notable cost is the same as any SaaS coding assistant: the source code being reviewed is transmitted to the vendor on each request, so teams in regulated environments should validate the data-handling agreement before rollout.

## Why it scored 50

The score starts at the catalog's neutral base of 50 and moves only through the signals below. The formula is published at https://catalog.anomity.ai/about — there is no model and no hidden heuristic.

| Signal | Contribution | Severity | Evidence |
| --- | --- | --- | --- |
| Established community project | -10 | trust offset |  |
| 1 high-risk capability: credentials:access | +10 | high |  |

Clamped result: **50/100**, band **medium**.

## Capabilities

| Capability | Name | Security implication |
| --- | --- | --- |
| `filesystem:read` | Filesystem read | Can read files on the host system. Used for context, indexing, or analysis. |
| `network:outbound` | Outbound network | Can make outbound network requests. Required for hosted model providers and remote APIs; also the path for data exfiltration if combined with read access. |
| `credentials:access` | Credentials access | Reads provider API keys, OAuth tokens, or other secrets from the host keychain or environment. |

## Related IDE extensions

- [Claude Code for VS Code](https://catalog.anomity.ai/extension/claude-code-for-vscode) — risk 100 (critical)
- [Cline](https://catalog.anomity.ai/extension/cline) — risk 100 (critical)
- [Kilo Code](https://catalog.anomity.ai/extension/kilo-code) — risk 100 (critical)
- [OpenAI Codex for VS Code](https://catalog.anomity.ai/extension/openai-codex-vscode) — risk 100 (critical)
- [Roo Code](https://catalog.anomity.ai/extension/roo-code) — risk 100 (critical)
- [Blackbox AI](https://catalog.anomity.ai/extension/blackbox-ai) — risk 80 (critical)

---

Source: Anomity Catalog (https://catalog.anomity.ai/). Scoring methodology: https://catalog.anomity.ai/about. Machine-readable index: https://catalog.anomity.ai/llms.txt · https://catalog.anomity.ai/openapi.json