CodeRabbit

VS Code, Cursor, Windsurf extension reviews on local commit or on demand, not as-you-type

CLI plugin and Skills for Claude Code, Codex, Cursor, Gemini CLI; --agent JSON output

cr CLI reviews committed, staged, unstaged and untracked local changes; 3 reviews/hour on Free

Full inline PR reviews require Pro; Free plan gets PR summarization only

Pre-merge checks in error mode block merges via Request Changes Workflow; custom checks Pro+

AI Deep Scan analyzes full committed source and IaC; separately billed usage-based product

Weekly recurring Dependencies, SBOM, Secrets scans; requires Security trial or paid add-on

Not offered in vendor documentation reviewed as of 2026-09-05.

Catalog includes Semgrep, OpenGrep, Brakeman, PHPStan, fbinfer, PMD, detekt; tool support from Pro

AI Deep Scan traces untrusted input to sensitive sinks with call stacks; separately billed

Gitleaks, Betterleaks, TruffleHog, Presidio in tool catalog; dedicated Secrets scan needs add-on

Verifies detected credentials against service providers by default; requires Security trial or add-on

OSV Scanner and Trivy in tool catalog; dedicated Dependencies scan requires Security add-on

Deep Scan findings carry reachability and exploitability signals with call stacks when available

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

Generates SBOM as a dedicated scan type; requires Security trial or paid add-on.

Checkov, TFLint, Hadolint, zizmor, actionlint; Deep Scan covers Terraform, Kubernetes, Helm, ARM

Trivy and Hadolint cover Dockerfiles in-repo; no container registry or image scanning described

Not offered in vendor documentation reviewed as of 2026-09-05.

Maintainability & Code Quality review category plus ESLint, PHPMD, Pylint, RuboCop, detekt

Not documented. Dashboard-metrics reference is exhaustive; no cyclomatic/complexity metric exists

Maintainability & Code Quality category explicitly names duplication; tracked in dashboard metrics

Not documented on the exhaustive dashboard-metrics or reports reference pages

Not documented; no coverage ingestion/reporting metric in the metrics reference

Not documented; same absence basis as overall test coverage tracking

Cross-repo breaking-change detection and natural-language Custom Checks; no dependency-rule enforcement engine

Technical debt appears only as example prompt text in a report template, not a metric

Analytics and custom reports with organization-wide PR statistics; no delivery or behavioral code metrics

Functional Correctness review category; AI reasoning finds logic and correctness defects

Summary plus Walkthrough with Mermaid diagrams, review-effort score, related issues; Free includes summaries

ast-grep YAML rules and shareable packages; natural-language Custom Checks require Pro+

One-click fixes for linter findings and committable code suggestions; autofix listed under Pro

Fix with AI opens fix PRs for security findings (add-on); IDE routes complex fixes to external agents

Deep Scan Verify stage rejects duplicate, mitigated, speculative, test-only findings; Learnings suppress noise

Glob path filters/instructions and hierarchical per-directory config; monorepos never named explicitly

LLM-based reasoning engine with 57 static analysis tools layered on top

Bring-your-own-LLM provider available only in self-hosted Enterprise deployments

Acts as MCP client consuming external servers (Pro 5, Pro+ 15, Enterprise 20); exposes none

Deep Scan detects LLM app risks (prompt injection, excessive agency); no AI usage inventory

Context-aware chat in PR comments; 50 messages/hour Pro, 100 on Pro+ and Enterprise

Learnings database built from chat replies; editable, scoped, optional admin approval delay

Trust Center: code never used to train models; models trained solely on public datasets

Searchable admin change history plus REST API for SIEM export; Enterprise plan only

Enterprise SSO workspaces with IdP-member to Git-identity linking; Enterprise plan only

Built-in Admin, Member, Billing Admin roles; custom per-resource RBAC requires Enterprise

Custom report templates and audit-log REST API support compliance reporting; no framework-mapped reports.