Metabob
Metabob is a real-time code analysis engine that plugs into AI coding agents through MCP. It does not write code: it flags runtime, logic, security, structural and design problems while the agent works, then guides safer fixes.
What is Metabob?
Metabob is a code analysis engine built by Metabob, Inc. of Santa Clara, California, designed to run alongside generative AI coding tools rather than replace them. The vendor describes it as a real-time, intelligent engine that understands an application at runtime, follows all of its execution flows, and uses that understanding to guardrail the changes an AI agent makes. The distinction matters: as its own case study states, Metabob does not generate code. It acts as a guidance layer that tracks how a codebase evolves structurally.
In practice it reaches developers as an MCP server. A downloaded command-line binary is registered with an agent such as Claude Code, Cursor or Gemini CLI, and exposes two tools: get_priority_issues, which returns a ranked list of problems in the files the agent has just touched, and search_codebase_issues, which looks inside a single category. Five categories are covered: runtime, logic, security, structural and design. Agents can also be instructed to call Metabob on their own through an AGENTS.md file.
The underlying technology is presented as proprietary. Graph neural network models learn from earlier development decisions and debugging outcomes to work out why past changes succeeded or failed. From that history, Metabob evaluates quality patterns across a whole project, ranks problems by real business impact, predicts which regions will change next, detects relationships between components a language model cannot infer alone, and maps impact paths as the codebase moves.
The homepage claims 80% fewer introduced regressions, a 66% cut in maintenance time and 70% fewer security vulnerabilities. A named case study supports part of this: NEC's AI-Application Group, inside its MIS department, ran Metabob on a dashboard application of roughly 25,000 lines and compared three workflows, namely manual review, Gemini alone, and Metabob paired with Gemini. NEC reported a 66% reduction in maintenance and fix time against AI plus manual review, and 50% against Gemini CLI alone.
What it does
- Analyse code continuously while an AI agent writes or edits it, instead of reviewing afterwards
- Return a prioritised list of the most critical issues in the files the agent has just worked on
- Search the codebase for issues by category: runtime, logic, security, structural or design
- Steer the agent towards safe implementation patterns rather than correcting it after the fact
- Predict which regions are about to change and map the downstream impact of an edit
- Detect relationships between components that a language model cannot infer in isolation
- Rank problems by real business impact rather than surfacing a long list of cosmetic suggestions
When to use Metabob / When not to
A quick filter to help you decide if Metabob is the right fit.
When to use Metabob
- Engineering teams already shipping with AI coding agents such as Claude Code, Cursor, Gemini CLI or Kiro
- Teams losing hours to reworking and debugging AI-generated code, the exact problem described in the NEC case study
- QA and quality leads fighting repeated regressions introduced during feature work
- Application security engineers who need vulnerabilities, logic flaws and runtime failures surfaced during generation rather than after it
- Software architects and large IT departments watching technical debt accumulate as an AI-assisted codebase grows
When not to use Metabob
- Anyone looking for a code generator: Metabob deliberately writes nothing, it only reviews and guides
- Buyers who want to sign up online, since all four pricing tiers lead to a contact form and CLI access is requested by email
- Non-technical users, because setup means downloading a binary, putting it on the PATH and editing a config.json with an API key
- Mobile or browser-first users, as there is no mobile app and no product web interface
- Organisations with formal compliance requirements, given that no hosting location, DPA, subprocessor list or certification is published
How to use Metabob
A typical end-to-end flow, from setup to results.
- Request access to the Metabob CLI by email if you do not already have it
- Download the current metabob-cli release for your operating system
- Move the binary into a directory that is on your system PATH
- Make it executable with chmod +x on Mac and Linux; this step is unnecessary on Windows
- Add the Metabob MCP server to your coding agent, running the command from your project root
- Check that a .metabob/ directory has been created at the root of the project
- Create .metabob/config.json and fill in your api_key, plus include_paths and exclude_paths to scope the analysis
- Start your coding agent from the terminal
- Confirm the Metabob MCP tool is active, for example with the /mcp command in Claude Code
- Call Metabob explicitly after writing or editing code, or let the agent call it via AGENTS.md
Pros & Cons
Pros
- Plugs into the coding agents a team already uses rather than asking it to switch tools
- Intervenes during generation, which is what breaks the fix-and-break loop typical of agentic coding
- Deliberately low noise: a short list of critical runtime, security and architectural issues instead of hundreds of suggestions
- Published results come with a named customer and a described method, which is rare at this stage of maturity
- Customer ownership of the code is stated explicitly in the User Terms
- Analysis scope stays under the developer's control through include and exclude paths
- Step-by-step installation guides per agent, with a troubleshooting section
Cons
- No self-service signup: all four pricing tiers lead to a contact form, and CLI access is requested by email from a named individual
- Installation is entirely command-line, involving a binary, the PATH, chmod and a hand-edited config file
- Nothing is published about where data is hosted, and there is no DPA, no subprocessor list and no SOC 2 or ISO 27001 certification
- No mention of the GDPR at all, on a product that ingests customer source code
- Part of the documentation is stale: its pricing page is two years old, advertises a free VS Code extension and links to dead .html URLs
- The homepage FAQ is broken, returning word for word the same answer to all four questions
- The programming languages actually covered are never stated, and Copilot support is still marked as coming soon
Pricing & Plans
There is no permanent free plan. The only tier priced at 0 USD is explicitly a two-week trial. The cheapest paid entry point is the Pro plan at 40.00 USD per month, followed by Team at 50.00 USD per month, while Enterprise pricing is quoted on request. Every tier goes through a sales contact rather than online checkout. Subscriptions renew automatically in 30-day periods, and the terms provide for at least 30 days' notice before any price change takes effect at renewal.
- Free trial — 0 USD — two-week trial
- with support for Gemini
- Copilot
- Kiro
- Cursor and Claude Code
- Pro — 40 USD per month — everything in the free tier
- plus a 7-day trial and support for custom AI agents
- Team — 50 USD per month — everything in Pro
- plus an analytics dashboard and account management
- Enterprise — custom pricing — everything in Team
- plus full repository scans and reports
- an advanced analytics dashboard and priority support
Data, GDPR & hosting
A consolidated view of how Metabob handles your data.
GDPR overview
There is no mention of the GDPR anywhere on the site or in the documentation: a search across every collected page, text and HTML, returns no occurrence of GDPR, and none of CCPA, SOC 2, ISO 27001 or HIPAA either. No Article 27 EU representative is designated, no data protection officer is named, no data processing agreement is offered and no subprocessor list is published. What stands in its place is an American-style privacy policy: the right to know, to request deletion, to obtain a copy, to opt out of the sale of personal information and to non-discrimination. The User Terms refer only generically to data protection laws applicable in the customer's region, name the customer as controller, and warn that personal data is uploaded at the customer's own risk. Governing law is Californian.
Who owns the data?
Under the User Terms, the customer owns all Customer Code, a point stated twice; Metabob, Inc. remains the sole owner of the intellectual property in the Service itself. The same terms grant Metabob the right to collect and analyse Customer or User Data during and after the contract, in order to improve the Services and for development, diagnostic and corrective purposes, and to disclose that data only in aggregate or anonymised form. The contractual definition of Customer or User Data explicitly excludes personal data. For personal data, the customer is named as the controller and Metabob states it does not act as one. The privacy policy adds that personal information is not sold for money but is shared with third-party service providers and commercial partners.
Reuse rights
The customer keeps full ownership of its code and can use it freely. What is restricted is the Service, not the customer's own material: the licence granted is limited, non-transferable, non-exclusive, non-assignable and non-sublicensable, and is valid only for the customer's own business operations. Copying or republishing the Service, running it as a hosting service for third parties, creating derivative works, removing proprietary notices, reverse engineering it, building a competing product from it or redistributing it are all forbidden. Two caveats deserve attention. The terms warn that the ability to export or share Customer Code may be limited or unavailable depending on the plan. And on the trial offer, any evaluation report the user produces becomes Metabob's property and confidential information.
Data retention & training
Hosting summary
Nothing is published about where customer data is hosted. No country, no region, no cloud provider and no data centre is named anywhere on the site or in the documentation, and targeted searches across every collected page returned nothing. The User Terms define the Service only as hosted by Metabob, Inc. and made available over a network, and commit to administrative, physical and technical safeguards at a level not materially less protective than is commercially reasonable. One clause refers to a third-party software component hosting provider without ever naming it. The company is established in Santa Clara, California, and Californian law governs the agreement, which suggests a United States footprint without confirming it. The website itself is served behind Cloudflare, but that says nothing about where product data lives. No data processing agreement, subprocessor list or security certification is published.
Things to keep in mind
Risks and trade-offs to weigh before adopting Metabob.
- Proprietary source code leaves your machine for a service whose hosting location is documented nowhere
- The terms let Metabob collect and analyse customer data during and after the contract, and no opt-out from model training is documented
- After termination Metabob has no obligation to keep your code and may delete all of it, while export or sharing may be limited depending on the plan
- On the trial offer the service may be suspended or stopped without notice and data deleted at any time, and evaluation reports you write become Metabob's property
- The vendor disclaims any warranty on the quality, accuracy, performance or applicability of its recommendations
- Delegating review to a tool that invites you to sit back and watch can quietly erode a developer's own vigilance
- The headline figures come from the vendor and a single customer, and mandatory arbitration in California makes recourse expensive for a non-US customer
Setup & Integrations
Technical difficulty
Intermediate, and strictly for developers. Setup is entirely command-line and documented in nine steps: request CLI access by email, download the binary, place it on the PATH, make it executable, register the MCP server with your agent, then hand-edit .metabob/config.json to add an API key and the paths to analyse or ignore. There is no graphical installer and no self-service signup. Anyone comfortable in a terminal with Claude Code or Cursor will manage in minutes; a troubleshooting section covers the usual connection failures.
Deployment
Integrations
Behind Metabob
Fundraising
Resources
All the official URLs gathered for verification and reference.
Frequently asked questions
Does Metabob write code for me?
Which AI coding tools does it work with?
How is it installed?
What kinds of problems does it detect?
What does it cost, and is there a free plan?
Who owns the code I send to Metabob?
Does Metabob train models on my code?
Is the product GDPR compliant?
Is there any evidence that it works?
What is the minimum age to use it?
Should you pick Metabob?
Metabob occupies a narrow but genuinely useful position. Rather than adding another code generator to a crowded field, it sits behind the agent a team already uses and tries to stop the fix-and-break loop that agentic coding tends to produce. The proposition is easy to state and easy to test: no code written, issues ranked by impact, guidance delivered while the agent is still working. The NEC case study is a real asset, since it names the customer, describes the comparison method and gives figures rather than adjectives.
The weaknesses lie elsewhere. Distribution is still artisanal: every pricing tier ends at a contact form, and access to the command-line tool is requested by email. More importantly for anyone evaluating it seriously, the published trust material is thin. Nothing states where data is hosted, no data processing agreement or subprocessor list exists, no certification is claimed, and the GDPR is never mentioned at all, on a product whose entire purpose is to read customer source code. Parts of the documentation have drifted too, with a pricing page two years out of date and a homepage FAQ that returns the same answer four times.
The sensible approach is to treat Metabob as a technical evaluation rather than a purchase decision. The two-week trial is enough for an engineering team to judge whether the prioritised issue list is genuinely sharper than what their agent already reports. Anything beyond a pilot, particularly on proprietary or regulated code, warrants written answers on hosting, retention and model training before the first repository is connected.
- Choosing a selection results in a full page refresh.
- Opens in a new window.