Greptile
AI pull request reviewer that indexes the whole repository graph for context and can execute PR code in a sandbox.
Deployment
Cloud · Self-Hosted · Air-Gapped
Languages
10+
Pricing model
Per contributing developer, Usage-based credits, Quote-based
Free plan
Yes
Partial means the documentation covers only part of a capability, a related capability, or a beta. The description next to it says what is covered.
Workflow coverage
Where in the development lifecycle Greptile operates.
3 yes 3 partial 2 no
| Feature | Availability | Description |
|---|---|---|
| Real-Time IDE Feedback | Partial | MCP server and Claude Code plugin view and resolve comments in IDE; no as-you-type analysis |
| AI Agent Guardrails | Yes | MCP server with 11 tools, Claude Code plugin, check-pr and greploop skills, agent-aware CLI |
| Local Analysis (Pre-Commit) | Yes | greptile review runs full-fidelity local branch review in ~60s; exit codes usable in hooks |
| Inline PR Comments | Yes | Inline comments with severity, type and suggested fix on every PR; 1 credit each |
| Quality Gates (Merge Blocking) | Partial | statusCheck posts a review status check on GitHub, GitLab, Bitbucket and Gitea; no fail criteria documented. |
| Full Repo Scan | Partial | Indexes entire repo graph and knowledge base as review context; findings remain PR-scoped |
| Scheduled Rescans | No | Config reference documents triggerOnUpdates (re-run on PR update) as the only trigger; no cron/schedule option |
| Runtime Monitoring | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
Security scanning
3 yes 1 partial 9 no
| Feature | Availability | Description |
|---|---|---|
| SAST | Yes | Opengrep rule-based pattern-matching SAST engine plus AI review catch SQLi, SSRF, injection and more |
| Taint Analysis (Data-Flow) | No | Security Check names pattern-based Opengrep rules and SCA only; no interfile taint/dataflow tracing described |
| Secrets Detection | Yes | Custom rule can disallow hardcoded secrets; CLI withholds secret-looking files unless --include |
| Secrets Validation | No | Security Check enumerates its scan types; only static secrets detection is described, no live validation |
| SCA | Yes | SCA scan type in Security Check reviews dependencies against known vulnerability databases for CVEs |
| Reachability Analysis | Partial | Repo graph surfaces impacted callers and contracts of changed code; not dependency-vulnerability reachability |
| Malicious Package Detection | No | SCA described only as CVE-checking against vulnerability databases; no typosquat/malicious package detection |
| License Compliance | No | Security Check page describes SCA as CVE-checking only; no license identification or policy enforcement |
| SBOM Generation | No | Security Check page enumerates 3 scan types (SAST, SCA, AI); no SBOM/CycloneDX/SPDX export mentioned |
| IaC Scanning | No | Security Check's 3 scan types cover code and dependencies only; no Terraform/CloudFormation/K8s misconfig scanning |
| Container Scanning | No | Security Check's scan types cover code and dependencies only; no container image or base-image CVE scanning |
| CSPM | No | Security Check reviews pull requests only; no live cloud account configuration scanning described |
| DAST | No | Security Check is static PR-time scanning only; no running-app or API endpoint exercise described |
Code quality
2 yes 2 partial 5 no
| Feature | Availability | Description |
|---|---|---|
| Code Smell Detection | Yes | style and syntax comment types cover naming, formatting, structural consistency, language best practice |
| Complexity Metrics | Partial | Custom rules can cap function length and complexity; no computed complexity metrics reported |
| Duplication Detection | No | Analytics dashboard docs list 5 named metrics; no duplication/clone detection metric documented |
| Dead Code Detection | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Test Coverage Tracking | No | Analytics dashboard docs list 5 named metrics (PRs reviewed, merge time, addressed rate, bugs, upvotes); no coverage |
| Diff Coverage (New Code) | No | Analytics dashboard docs list 5 named metrics; no new-code or diff coverage metric documented |
| Architecture Governance | Yes | Custom rules enforce architecture patterns (no DB models in controllers, repository pattern); rule-based only |
| Technical Debt Quantification | No | Analytics dashboard docs list 5 named metrics; no remediation-effort or cost quantification documented |
| Behavioral Code Analysis | Partial | Dashboard tracks PRs reviewed, critical bugs, addressed rate, time to merge, upvote ratio |
AI review & fixes
4 yes 1 no
| Feature | Availability | Description |
|---|---|---|
| AI Logic Bug Detection | Yes | logic comment type for logic errors and algorithmic problems; T-Rex confirms runtime bugs |
| PR Summaries & Walkthroughs | Yes | PR summary with 0-5 confidence score, per-file issues, auto-generated sequence diagrams or flowcharts |
| Autofix Suggestions | Yes | Most inline comments include an applicable code suggestion |
| Autofix Pull Requests | No | Fix with your Agent hands issues to Claude Code, Codex, Conductor, Cursor, Devin; no native fix PRs |
| AI Triage (False-Positive Filtering) | Yes | Learning suppresses consistently-ignored comment types; security, leaks, null derefs never suppressed |
Rules & repo support
2 yes
| Feature | Availability | Description |
|---|---|---|
| Custom Rule Authoring | Yes | Dashboard rules plus .greptile/ folder (config.json, rules.md, files.json) and legacy greptile.json |
| Monorepo Support | Yes | Cascading .greptile/ per-directory config lets monorepo packages own strictness, rules and filters |
AI capabilities
6 yes 1 no
| Feature | Availability | Description |
|---|---|---|
| AI Code Review | Yes | Codebase-graph-grounded AI review posting summary, confidence score and inline comments |
| Bring Your Own Model | Yes | Any OpenAI-compatible or custom LLM (Anthropic, OpenAI, Azure OpenAI, Bedrock); self-hosted only |
| MCP Server | Yes | Hosted MCP server at api.greptile.com/mcp, API-key authenticated, exposing 11 tools |
| AI Code Governance | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Conversational Review | Yes | Reply to comments for follow-ups; CLI offers conversational Chat with Greptile |
| Learning From Feedback | Yes | Learns from PR comments, replies, thumbs reactions and commit-based checks of addressed comments |
| Code Excluded From Training | Yes | Opt out of anonymized cloud training; self-hosted code never trained on unless configured. |
Models used
Anthropic Claude 3.7 Sonnet (recommended default)OpenAI Embeddings (recommended default)
Compliance & governance
3 yes 1 no
| Feature | Availability | Description |
|---|---|---|
| Audit Logs | Yes | Audit logging referenced as an enterprise feature; no scope, retention or export detail |
| SSO (SAML) | Yes | SAML SSO via bundled BoxyHQ Jackson service, documented for self-hosted deployments |
| Role-Based Access Control | Yes | Organization Admin/Member roles; per-team Admin/Member roles in multi-team workspaces |
| Compliance Reporting & Exports | No | Trust Center and Enterprise page list security controls and certifications; no audit-ready framework export feature |
Certifications
SOC 2 Type IIHIPAAGDPR
Integrations
9 yes 1 no
| Git provider | Availability |
|---|---|
| GitHub | Yes |
| GitHub Enterprise Server | Yes |
| GitLab | Yes |
| GitLab Self-Managed | Yes |
| Bitbucket | Yes |
| Bitbucket Data Center | Yes |
| Azure DevOps | No |
| API & CLI | Availability |
|---|---|
| REST API | Yes |
| CLI | Yes |
| Webhooks | Yes |
IDEs
CursorVS CodeWindsurf
Issue trackers
Jira (read-only, one authorized Atlassian site)Linear (read-only, scopable to teams)
Languages
Languages and frameworks named in Greptile's documentation.
PythonJavaScriptTypeScriptGoJavaRubyElixirRustPHPC++
Pricing & plans
$30/seat/month (no annual discount published; custom pricing available for annual/multi-year contracts)
Minimum seats: None documented for Pro (billed per seat, no stated floor); Starter is capped at 1 active developer
Trial: 14-day free trial with no payment method or credit card required (cloud sign-up and CLI onboarding); no free trials for self-hosted, but 100% refund within the first 30 days
StarterFreeIndividual developers
- 50 credits per month
- Unlimited repositories
- Codebase-aware PR review
- Free tier extended in full to open-source and public repos
- Only 1 active developer
- 50 credits per month (1 credit per standard review, 3 per T-Rex review)
- No self-hosting, SSO or custom compliance controls
Pro$30/seat/monthTeams
- 50 credits included per seat
- Full codebase-aware review with confidence scores and diagrams
- Custom rules, learning system, analytics dashboard
- MCP server, CLI, coding-agent handoff
- Flex usage for overage at $1/credit
- Credits are charged to the PR author, not pooled across the team
- Overage billed at $1/credit unless flex usage is capped
- T-Rex reviews cost 3 credits each
- No self-hosting or SSO/SAML
EnterpriseCustom pricingOrganizations at scale, data-sovereignty and air-gapped requirements
- Self-hosting via Docker Compose or Kubernetes, including air-gapped
- SSO/SAML
- Custom deployment and compliance controls
- Bring-your-own-LLM and custom code host integrations
- Custom credit allocation
- Quote-only
- No free trial for self-hosted
- Refunds: 100% within 30 days, pro-rated in months 2-4 for upfront annual payments only
- Self-hosted CLI reviews need deployments from 2026-05-14 or later
Who it's for
Best for teams that want AI review with whole-repository context, not just the diff.
Starter covers 1 active developer; self-hosted sizing guidance is Docker Compose up to 100 developers and Kubernetes for 100+ developers.
A good fit if
- You want review informed by a code graph and a self-updating knowledge base
- You want reviews that write and run tests and browser flows, with logs and screenshots attached (T-Rex, in beta)
- You want per-directory configuration with clear precedence rules
Consider alternatives if
- Your code is on Azure DevOps
- You need dependency, IaC, container or dedicated secrets scanning
- You want flat per-seat costs, since reviews draw on credits with overage billed per credit
Similar tools
Other PR Review Tool tools in the directory.
CodeAnt AIAI pull-request review platform bundling SAST, SCA, secrets, IaC and multi-cloud posture scanning with IDE and CLI review.CodeRabbitAI pull request reviewer layering 57 third-party linters and a separately metered AI Deep Scan, plus IDE extension and CLI.Cursor (Bugbot)Cursor's PR review layer: Bugbot diff review, Security Agents, PR routing/approval and a PR/merge-queue workspace.QodoAI pull-request review platform with multi-agent review, rules mined from PR history, and remediation agents across four Git providers.
FAQ
When should you choose Greptile?
Greptile is best for teams that want AI review with whole-repository context, not just the diff. It's a good fit if:
- You want review informed by a code graph and a self-updating knowledge base
- You want reviews that write and run tests and browser flows, with logs and screenshots attached (T-Rex, in beta)
- You want per-directory configuration with clear precedence rules
Consider alternatives if:
- Your code is on Azure DevOps
- You need dependency, IaC, container or dedicated secrets scanning
- You want flat per-seat costs, since reviews draw on credits with overage billed per credit
What languages does Greptile support?
Greptile supports 10+ languages and frameworks, including Python, JavaScript, TypeScript, Go, Java, Ruby, Elixir, Rust, PHP, C++.
What does Greptile integrate with?
Greptile integrates with:
- Source control: GitHub, GitHub Enterprise Server, GitLab, GitLab Self-Managed, Bitbucket and Bitbucket Data Center
- IDEs: Cursor, VS Code and Windsurf
What tools are similar to Greptile?
Other PR review tools tracked here:
What are Greptile's plans and pricing?
Greptile has a free plan, and paid plans start at $30/seat/mo. Enterprise pricing is by quote.
Opens www.greptile.com in a new tab. Review Radar is not affiliated with Greptile.