Greptile

MCP server and Claude Code plugin view and resolve comments in IDE; no as-you-type analysis

MCP server with 11 tools, Claude Code plugin, check-pr and greploop skills, agent-aware CLI

greptile review runs full-fidelity local branch review in ~60s; exit codes usable in hooks

Inline comments with severity, type and suggested fix on every PR; 1 credit each

config.json statusCheck posts a GitHub status check with review result; no fail-state/required-check documented

Indexes entire repo graph and knowledge base as review context; findings remain PR-scoped

Config reference documents triggerOnUpdates (re-run on PR update) as the only trigger; no cron/schedule option

Not offered in vendor documentation reviewed as of 2026-09-05.

Opengrep rule-based pattern-matching SAST engine plus AI review catch SQLi, SSRF, injection and more

Security Check names pattern-based Opengrep rules and SCA only; no interfile taint/dataflow tracing described

Custom rule can disallow hardcoded secrets; CLI withholds secret-looking files unless --include

Security Check enumerates its scan types; only static secrets detection is described, no live validation

SCA scan type in Security Check reviews dependencies against known vulnerability databases for CVEs

Repo graph surfaces impacted callers and contracts of changed code; not dependency-vulnerability reachability

SCA described only as CVE-checking against vulnerability databases; no typosquat/malicious package detection

Security Check page describes SCA as CVE-checking only; no license identification or policy enforcement

Security Check page enumerates 3 scan types (SAST, SCA, AI); no SBOM/CycloneDX/SPDX export mentioned

Security Check's 3 scan types cover code and dependencies only; no Terraform/CloudFormation/K8s misconfig scanning

Security Check's scan types cover code and dependencies only; no container image or base-image CVE scanning

Security Check reviews pull requests only; no live cloud account configuration scanning described

Security Check is static PR-time scanning only; no running-app or API endpoint exercise described

style and syntax comment types cover naming, formatting, structural consistency, language best practice

Custom rules can cap function length and complexity; no computed complexity metrics reported

Analytics dashboard docs list 5 named metrics; no duplication/clone detection metric documented

Not offered in vendor documentation reviewed as of 2026-09-05.

Analytics dashboard docs list 5 named metrics (PRs reviewed, merge time, addressed rate, bugs, upvotes); no coverage

Analytics dashboard docs list 5 named metrics; no new-code or diff coverage metric documented

Custom rules enforce architecture patterns (no DB models in controllers, repository pattern); rule-based only

Analytics dashboard docs list 5 named metrics; no remediation-effort or cost quantification documented

Dashboard tracks PRs reviewed, critical bugs, addressed rate, time to merge, upvote ratio

logic comment type for logic errors and algorithmic problems; T-Rex confirms runtime bugs

PR summary with 0-5 confidence score, per-file issues, auto-generated sequence diagrams or flowcharts

Dashboard rules plus .greptile/ folder (config.json, rules.md, files.json) and legacy greptile.json

Most inline comments include an applicable code suggestion

Fix with your Agent hands issues to Claude Code, Codex, Conductor, Cursor, Devin; no native fix PRs

Learning suppresses consistently-ignored comment types; security, leaks, null derefs never suppressed

Cascading .greptile/ per-directory config lets monorepo packages own strictness, rules and filters

Codebase-graph-grounded AI review posting summary, confidence score and inline comments

Any OpenAI-compatible or custom LLM (Anthropic, OpenAI, Azure OpenAI, Bedrock); self-hosted only

Hosted MCP server at api.greptile.com/mcp, API-key authenticated, exposing 11 tools

Not offered in vendor documentation reviewed as of 2026-09-05.

Reply to comments for follow-ups; CLI offers conversational Chat with Greptile

Learns from PR comments, replies, thumbs reactions and commit-based checks of addressed comments

Opt out of anonymized cloud training; self-hosted code never trained on unless configured.

Audit logging referenced as an enterprise feature; no scope, retention or export detail

SAML SSO via bundled BoxyHQ Jackson service, documented for self-hosted deployments

Organization Admin/Member roles; per-team Admin/Member roles in multi-team workspaces

Trust Center and Enterprise page list security controls and certifications; no audit-ready framework export feature