CodeRabbit
AI pull request reviewer layering 57 third-party linters and a separately metered AI Deep Scan, plus IDE extension and CLI.
Deployment
Cloud · Self-Hosted
Languages
9+
Pricing model
Per developer seat, Usage-based credits, Quote-based
Free plan
Yes
Partial means the documentation covers only part of a capability, a related capability, or a beta. The description next to it says what is covered.
Workflow coverage
Where in the development lifecycle CodeRabbit operates.
6 yes 1 partial 1 no
| Feature | Availability | Description |
|---|---|---|
| Real-Time IDE Feedback | Partial | VS Code, Cursor, Windsurf extension reviews on local commit or on demand, not as-you-type |
| AI Agent Guardrails | Yes | CLI plugin and Skills for Claude Code, Codex, Cursor, Gemini CLI; --agent JSON output |
| Local Analysis (Pre-Commit) | Yes | cr CLI reviews committed, staged, unstaged and untracked local changes; 3 reviews/hour on Free |
| Inline PR Comments | Yes | Full inline PR reviews require Pro; Free plan gets PR summarization only |
| Quality Gates (Merge Blocking) | Yes | Pre-merge checks in error mode block merges via Request Changes Workflow; custom checks Pro+ |
| Full Repo Scan | Yes | AI Deep Scan analyzes full committed source and IaC; separately billed usage-based product |
| Scheduled Rescans | Yes | Weekly recurring Dependencies, SBOM, Secrets scans; requires Security trial or paid add-on |
| Runtime Monitoring | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
Security scanning
8 yes 1 partial 4 no
| Feature | Availability | Description |
|---|---|---|
| SAST | Yes | Catalog includes Semgrep, OpenGrep, Brakeman, PHPStan, fbinfer, PMD, detekt; tool support from Pro |
| Taint Analysis (Data-Flow) | Yes | AI Deep Scan traces untrusted input to sensitive sinks with call stacks; separately billed |
| Secrets Detection | Yes | Gitleaks, Betterleaks, TruffleHog, Presidio in tool catalog; dedicated Secrets scan needs add-on |
| Secrets Validation | Yes | Verifies detected credentials against service providers by default; requires Security trial or add-on |
| SCA | Yes | OSV Scanner and Trivy in tool catalog; dedicated Dependencies scan requires Security add-on |
| Reachability Analysis | Yes | Deep Scan findings carry reachability and exploitability signals with call stacks when available |
| Malicious Package Detection | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| License Compliance | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| SBOM Generation | Yes | Generates SBOM as a dedicated scan type; requires Security trial or paid add-on. |
| IaC Scanning | Yes | Checkov, TFLint, Hadolint, zizmor, actionlint; Deep Scan covers Terraform, Kubernetes, Helm, ARM |
| Container Scanning | Partial | Trivy and Hadolint cover Dockerfiles in-repo; no container registry or image scanning described |
| CSPM | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| DAST | No |
Code quality
2 yes 2 partial 5 no
| Feature | Availability | Description |
|---|---|---|
| Code Smell Detection | Yes | Maintainability & Code Quality review category plus ESLint, PHPMD, Pylint, RuboCop, detekt |
| Complexity Metrics | No | Not documented. Dashboard-metrics reference is exhaustive; no cyclomatic/complexity metric exists |
| Duplication Detection | Yes | Maintainability & Code Quality category explicitly names duplication; tracked in dashboard metrics |
| Dead Code Detection | No | Not documented on the exhaustive dashboard-metrics or reports reference pages |
| Test Coverage Tracking | No | Not documented; no coverage ingestion/reporting metric in the metrics reference |
| Diff Coverage (New Code) | No | Not offered in vendor documentation reviewed as of 2026-08-19; the dashboard metrics reference has no coverage metric for new or changed code. |
| Architecture Governance | Partial | Cross-repo breaking-change detection and natural-language Custom Checks; no dependency-rule enforcement engine |
| Technical Debt Quantification | No | Technical debt appears only as example prompt text in a report template, not a metric |
| Behavioral Code Analysis | Partial | Analytics and custom reports with organization-wide PR statistics; no delivery or behavioral code metrics |
AI review & fixes
5 yes
| Feature | Availability | Description |
|---|---|---|
| AI Logic Bug Detection | Yes | Functional Correctness review category; AI reasoning finds logic and correctness defects |
| PR Summaries & Walkthroughs | Yes | Summary plus Walkthrough with Mermaid diagrams, review-effort score, related issues; Free includes summaries |
| Autofix Suggestions | Yes | One-click fixes for linter findings and committable code suggestions; autofix listed under Pro |
| Autofix Pull Requests | Yes | Fix with AI opens fix PRs for security findings (add-on); IDE routes complex fixes to external agents |
| AI Triage (False-Positive Filtering) | Yes | Deep Scan Verify stage rejects duplicate, mitigated, speculative, test-only findings; Learnings suppress noise |
Rules & repo support
1 yes 1 partial
| Feature | Availability | Description |
|---|---|---|
| Custom Rule Authoring | Yes | ast-grep YAML rules and shareable packages; natural-language Custom Checks require Pro+ |
| Monorepo Support | Partial | Glob path filters/instructions and hierarchical per-directory config; monorepos never named explicitly |
AI capabilities
5 yes 1 partial 1 no
| Feature | Availability | Description |
|---|---|---|
| AI Code Review | Yes | LLM-based reasoning engine with 57 static analysis tools layered on top |
| Bring Your Own Model | Yes | Bring-your-own-LLM provider available only in self-hosted Enterprise deployments |
| MCP Server | Partial | Acts as MCP client consuming external servers (Pro 5, Pro+ 15, Enterprise 20); exposes none |
| AI Code Governance | No | Deep Scan detects LLM app risks (prompt injection, excessive agency); no AI usage inventory |
| Conversational Review | Yes | Context-aware chat in PR comments; 50 messages/hour Pro, 100 on Pro+ and Enterprise |
| Learning From Feedback | Yes | Learnings database built from chat replies; editable, scoped, optional admin approval delay |
| Code Excluded From Training | Yes | Trust Center: code never used to train models; models trained solely on public datasets |
Compliance & governance
4 yes
| Feature | Availability | Description |
|---|---|---|
| Audit Logs | Yes | Searchable admin change history plus REST API for SIEM export; Enterprise plan only |
| SSO (SAML) | Yes | Enterprise SSO workspaces with IdP-member to Git-identity linking; Enterprise plan only |
| Role-Based Access Control | Yes | Built-in Admin, Member, Billing Admin roles; custom per-resource RBAC requires Enterprise |
| Compliance Reporting & Exports | Yes | Custom report templates and audit-log REST API support compliance reporting; no framework-mapped reports. |
Standards mapping
CWE
Integrations
8 yes 2 partial
| Git provider | Availability |
|---|---|
| GitHub | Yes |
| GitHub Enterprise Server | Yes |
| GitLab | Yes |
| GitLab Self-Managed | Yes |
| Bitbucket | Yes |
| Bitbucket Data Center | Yes |
| Azure DevOps | Yes |
| API & CLI | Availability |
|---|---|
| REST API | Partial |
| CLI | Yes |
| Webhooks | Partial |
CI/CD systems
GitHub ActionsGitLab CICircleCIAzure DevOps Pipelines
IDEs
VS CodeCursorWindsurf
Issue trackers
GitHub IssuesGitLab IssuesAzure DevOps BoardsJiraLinear
Chat & notifications
SlackDiscord
Languages
Languages and frameworks named in CodeRabbit's documentation.
JavaScriptTypeScriptCRustGoJavaC#KotlinPython
Pricing & plans
$24/mo/user billed annually ($30/mo/user billed monthly)
Minimum seats: None documented for Pro/Pro+ (per-seat, no floor); Enterprise self-hosted requires 500+ seats
Trial: 14-day Pro+ trial, no credit card, capped at 3 PR/IDE/CLI reviews per developer per hour and 50 chat messages per hour; a separate 14-day Security trial covers Dependencies, SBOM and Secrets scans
Free$0, no credit cardIndividuals and teams evaluating CodeRabbit
- Unlimited public and private repositories
- PR summarization
- Full code reviews via VS Code extension and CLI
- 150 files per review
- Includes a 14-day Pro+ trial
- No full PR reviews in the pull request itself
- No PR review rate allowance (3/hour IDE, 3/hour CLI only)
- No chat messages
- No linter/SAST tool catalog, Knowledge Base or integrations
- No usage-based add-on access
Open Source (OSS)$0, no credit cardOpen-source projects on public repositories
- Unlimited public repositories
- Pro+ features free
- 25 chat messages per hour
- Rate-limit tier scales with project popularity and community size
- Public repositories only
- PR review limit of 1 per hour, per-repo scoped
- Files-per-review limit not stated
Pro$24/developer/month annual, $30 month-to-monthTeams wanting full AI PR review
- Full PR reviews
- 57-tool linter and SAST catalog
- Knowledge Base and Learnings
- Analytics, docstrings, autofix
- Usage-based add-on access
- Up to 5 connected MCP servers
- 5 PR / 5 IDE / 5 CLI reviews per developer per hour
- 150 files per review
- 50 chat messages per hour
- No CodeRabbit Plan, unit test generation or Custom Checks
- Security scanning still requires the add-on
Pro+$48/developer/month annual, $60 month-to-monthTeams wanting planning, test generation and higher throughput
- Everything in Pro
- CodeRabbit Plan issue planning
- Unit test generation
- Merge conflict resolution and pre/post-merge actions
- Custom Checks
- Up to 15 connected MCP servers
- 10 PR / 10 IDE / 10 CLI reviews per developer per hour
- 300 files per review
- 100 chat messages per hour
- No self-hosting, SSO, custom RBAC or audit logs
EnterpriseContact salesOrganizations needing self-hosting and governance controls
- Everything in Pro+
- Self-hosting and Reverse Tunnel
- Multi-organization support and SSO
- Custom RBAC and audit logging
- API access and SLA support with a dedicated CSM
- Up to 20 connected MCP servers
- 12 PR / 12 IDE / 12 CLI reviews per developer per hour
- 300 files per review
- Self-hosting is not self-serve
- Quote-only pricing
Who it's for
Best for teams that want AI pull request review backed by deterministic linters and SAST, on any major git platform.
A good fit if
- You want 57 configurable linters and SAST tools run alongside the AI review, skipping any you already run in CI
- You want review in the IDE, the CLI and Slack as well as on the pull request
- Your team uses AI coding agents such as Claude Code, Codex or Cursor and wants review in the same loop
Consider alternatives if
- You need full pull request reviews on a free plan
- You need high review volume per developer, since reviews are rate-limited per hour
- You need security scanning without a paid add-on
Similar tools
Other PR Review Tool tools in the directory.
CodeAnt AIAI pull-request review platform bundling SAST, SCA, secrets, IaC and multi-cloud posture scanning with IDE and CLI review.Cursor (Bugbot)Cursor's PR review layer: Bugbot diff review, Security Agents, PR routing/approval and a PR/merge-queue workspace.GreptileAI pull request reviewer that indexes the whole repository graph for context and can execute PR code in a sandbox.QodoAI pull-request review platform with multi-agent review, rules mined from PR history, and remediation agents across four Git providers.
FAQ
When should you choose CodeRabbit?
CodeRabbit is best for teams that want AI pull request review backed by deterministic linters and SAST, on any major git platform. It's a good fit if:
- You want 57 configurable linters and SAST tools run alongside the AI review, skipping any you already run in CI
- You want review in the IDE, the CLI and Slack as well as on the pull request
- Your team uses AI coding agents such as Claude Code, Codex or Cursor and wants review in the same loop
Consider alternatives if:
- You need full pull request reviews on a free plan
- You need high review volume per developer, since reviews are rate-limited per hour
- You need security scanning without a paid add-on
What languages does CodeRabbit support?
CodeRabbit supports 9+ languages and frameworks, including JavaScript, TypeScript, C, Rust, Go, Java, C#, Kotlin, Python.
What does CodeRabbit integrate with?
CodeRabbit integrates with:
- Source control: GitHub, GitHub Enterprise Server, GitLab, GitLab Self-Managed, Bitbucket, Bitbucket Data Center and Azure DevOps
- CI systems: GitHub Actions, GitLab CI/CD, CircleCI and Azure Pipelines
- IDEs: VS Code, Cursor and Windsurf
What tools are similar to CodeRabbit?
Other PR review tools tracked here:
What are CodeRabbit's plans and pricing?
CodeRabbit has a free plan, and paid plans start at $24/user/mo. Enterprise pricing is by quote.
Opens www.coderabbit.ai in a new tab. Review Radar is not affiliated with CodeRabbit.