What is self-hosted (on-premises) deployment?

Self-hosting keeps code inside your perimeter. For defense, finance, healthcare and anyone with a hard data-residency rule, it is frequently the only deployment that passes review, which makes it a hard filter rather than a preference.

The cost is ownership: you run the upgrades, the database, the scaling and the incident response. Check carefully whether a vendor's self-hosted edition is a first-class product or a legacy option kept alive for existing customers, because those age very differently.

What to look for

Whether the self-hosted edition reaches feature parity with the cloud one
Whether it is actively developed or maintained for legacy customers only
Infrastructure requirements and realistic operational burden
How vulnerability and rule updates reach an installation you control

Best 16 code quality, security and code review tools that can be self-hosted

Every tool in the directory whose documentation covers this, 10 fully and 6 partially. Full support is shown first. Shown in a random order that changes on every visit, so no tool gets an advantage from its position.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

Code Security Platform

Aikido

Aikido Machine runs code scanning and AI pentesting on an on-site GPU server; Pro's Local Scanner reports to Aikido Cloud.

AI Coding Agent

ChatGPT / Codex

Codex CLI --oss mode runs against buyer's own Ollama/LM Studio or any OpenAI-compatible endpoint.

PR Review Tool

CodeAnt AI

Enterprise Plan only: full on-prem/VPC deployment (AWS/GCP/Azure or private data center)

PR Review Tool

CodeRabbit

Container image runs in customer infra; Enterprise only, 500-seat minimum.

Code Quality Platform

CodeScene

On-prem (Self managed) deployment listed on all three paid tiers: Standard, Pro, Enterprise

Code Quality Platform

DeepSource

Full Enterprise Server platform installs into customer VPC or datacenter via standalone or existing Kubernetes.

Code Security Platform

GitHub Advanced Security

GitHub Enterprise Server is customer-installed; Code Security and Secret Protection sold as standalone SKUs since 3.17.

PR Review Tool

Greptile

Docker Compose (up to 100 developers) or a Kubernetes Helm chart on customer infrastructure, with bundled or managed PostgreSQL with pgvector.

PR Review Tool

Qodo

Documented Kubernetes install, images via Replicated registries.

Code Quality Platform

SonarQube

SonarQube Server self-managed; free Community Build; Data Center edition for large enterprises.

Code Security Platform

Checkmarx One

On-prem CxSAST installs in customer infrastructure, SAST only; the Checkmarx One platform stays vendor-hosted.

AI Coding Agent

Claude Code

Buyer runs runners executing cloud sessions in own network; control plane and inference stay with Anthropic.

Code Quality Platform

Qlty

Only the Fair Source CLI runs locally; Qlty Cloud platform and dashboard are SaaS-only.

Code Security Platform

Semgrep

OSS engine runs in customer CI; platform stays SaaS. Enterprise adds Semgrep-managed tenant, not customer install.

Code Security Platform

Snyk

Broker Client and Container Registry Agent deploy in customer infra; Broker Server and scanning stay Snyk-hosted.

Code Security Platform

Veracode

SCA and CI agents run in customer network; analysis platform and results remain Veracode SaaS.

Cloud (SaaS) Deployment Air-Gapped (Offline) Deployment

FAQ