AI review & fixes

What are autofix pull requests?

The tool opens its own pull request containing a fix, rather than suggesting an edit inside yours.

By Cláudia FernandesUpdated 2026-10-02

This goes a step beyond inline suggestions: the tool branches, edits, sometimes runs your tests, and raises a pull request for review. It suits work that spans multiple files or arrives on a schedule, like dependency upgrades.

The operational question is volume. An agent that opens a pull request per finding will bury your review queue, so batching, scheduling and scoping controls matter as much as the quality of each fix.

What to look for

Batching and scheduling controls to limit pull request volume
Whether the agent runs your test suite before opening the PR
Scoping, meaning which repositories and issue classes it is allowed to touch
How its pull requests are attributed and reviewed

Best 16 code quality, security and code review tools that open autofix pull requests

Every tool in the directory whose documentation covers this, 15 fully and 1 partially. Full support is shown first. Shown in a random order that changes on every visit, so no tool gets an advantage from its position.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

Code Security Platform

Aikido

AutoFix opens pull requests with proposed fixes; never auto-merged

AI Coding Agent

ChatGPT / Codex

Codex can push a fix to the PR branch with permission; a PR can be opened from a finding page.

Code Security Platform

Checkmarx One

SCA Auto Pull Request opens a manifest version-bump PR (default Off); transitive remediation is beta, npm only.

AI Coding Agent

Claude Code

Opens fix PRs on request; the GitHub Action can commit fixes automatically.

PR Review Tool

CodeRabbit

Fix with AI opens fix PRs for security findings (add-on); IDE routes complex fixes to external agents

Code Quality Platform

CodeScene

PR Refactoring Agent runs in CI and commits Code Health fixes back to GitHub and GitLab PRs

Code Security Platform

Corgea

Automatically opens a PR with issue and fix context on GitHub/Azure DevOps/Harness

PR Review Tool

Cursor (Bugbot)

Autofix spawns a Cloud Agent pushing to a new or existing branch; needs on-demand usage billing.

Code Quality Platform

DeepSource

Autofix opens a PR or commits onto an existing PR branch; vulnerability autofix opens PRs with a breakage score.

Code Security Platform

GitHub Advanced Security

Dependabot security-update PRs; Copilot cloud agent pushes validated fixes (Copilot license and AI Credits)

PR Review Tool

Qodo

Remediation Agent fixes findings above a severity threshold and opens a separate fix PR

Code Security Platform

Semgrep

Autofix opens a draft PR/MR with AI description; requires Multimodal, AI credits and SCM write access.

Code Security Platform

Snyk

Automatic Fix, backlog, dependency upgrade and Dockerfile base-image PRs; base-image PRs default-on for free accounts.

Code Quality Platform

SonarQube

Remediation Agent fixes backlog issues on GitHub and Azure DevOps; requires Sonar Agent Essentials.

Code Security Platform

Veracode

Fix GitHub Action creates branch and PR; SCA auto-opens dependency-upgrade PRs on GitHub/GitLab

Code Quality Platform

Codacy

MCP lets AI assistants auto-remediate flagged code; no autofix pull-request creation described.

AI Logic Bug Detection PR Summaries & Walkthroughs Autofix Suggestions AI Triage (False-Positive Filtering)

FAQ