The question has two readings, a review tool or its model, and on most hosted tools they are one choice, because the vendor picks the model: GitHub says of Copilot code review "Model switching is not supported", Anthropic's Code Review "chooses the Claude models that reviews run on", and CodeRabbit and Sourcery name OpenAI and Anthropic; PR-Agent runs the model you choose. No vendor page settles which tool: each reports accuracy in its own metric on its own data, and in the table of Should we trust AI code review benchmarks? every vendor-run comparison against other tools puts its author first. Named most often on 27 best-of lists I read on 25 October 2026 are CodeRabbit, GitHub Copilot, Greptile and Qodo; vendors wrote some of those lists. How often a tool is right on your code is a number you count yourself over two weeks: findings fixed against findings dismissed.
Every fact about a tool below comes from that tool's own pages as I read them on 25 October 2026; the counts come from 27 best-of lists read the same day; none of the vendors saw this text before publication.
Which model does each reviewer run on?
On most hosted review tools the vendor picks the model. Copilot code review: "Model switching is not supported". Anthropic: "Code Review chooses the Claude models that reviews run on", with no model choice in its admin settings. Cursor: "Bugbot uses a combination of frontier and in-house models to review code." CodeRabbit: "Your code is shared with OpenAI and/or Anthropic for reviewing purposes only". Graphite: "Many of our AI features are powered through partnerships with Anthropic and OpenAI, who currently act as our AI subprocessors." Sourcery sends "the relevant sections of the diff and the surrounding code context to two LLM providers, OpenAI and Anthropic." Greptile: "Greptile uses third-party LLM providers for AI inference." Codex code review is OpenAI's own product. PR-Agent is the one where you choose, among models it lists "and any other model reachable through LiteLLM". Outside PR-Agent and some self-hosted or bring-your-own-key setups, choosing a review tool chooses its model as well, so the model question comes back to the same count on your own pull requests.
How each reviewer says it checks a finding before you see it
Each cell is from the vendor's own pages, read on 25 October 2026; "not stated" means not found on the pages listed at the end that day. Rows follow the number of lists that name the tool.
| Tool | What its pages say happens before a comment is posted | What its pages say about its own limits | Named on, of 27 lists |
|---|---|---|---|
| CodeRabbit | "Specialized AI agents working in parallel: Review, Verification, Chat, Pre-Merge Checks" | on its security check of a pull request: "A successful or neutral result does not guarantee that the code has no security issues." | 27 |
| GitHub Copilot code review | GitHub's blog: "Silence is better than noise." | "Copilot is not guaranteed to spot all problems or issues in a pull request. Sometimes it will make mistakes."; "Copilot may repeat the same comments again, even if they have been dismissed" | 26, counting any mention of Copilot |
| Greptile | "TREX runs your PR branch in a sandbox to catch the bugs that only show up at runtime."; its docs changelog says "TREX is generally available" in an entry dated 16 October 2026, while the homepage menu still says "TREX: Runtime Validation Beta" | an organization turns TREX on in its settings, and a run is billed apart from the code review; on its auto-approval feature: "Do not enable it broadly across all PRs." | 24 |
| Qodo | several review agents, "filtering out low-impact or irrelevant comments before they reach the pull request" | not stated; a finding you tell Qodo does not apply is recorded as "False positive, Rejected, Deferred, or Intentional" | 24 |
| Cursor Bugbot | "Bugbot detects the hardest logic bugs with a low false positive rate."; it reads earlier comments on the pull request, which "helps avoid duplicate suggestions" | on what a review takes in: "Each rule is truncated at 30,000 characters when included in a review."; "Bugbot doesn't read the contents of files whose path looks like a credential file" | 17 |
| Claude Code (Anthropic) | managed Code Review: "A verification step checks findings against the code before they're reported."; /code-review in the terminal, at its low effort level: "the review reports the findings it's most confident in, so you see fewer false positives" |
"Code Review uses AI to review code and may miss bugs, security vulnerabilities, or other issues."; "A review never approves or blocks the pull request, so the decision to merge stays with your team." | 14 |
| Graphite Agent | for comment exclusions you set: "This reduces noise and focuses AI reviews on what matters most to your team." | on custom rule files: "Too many files can reduce review quality" | 12 |
| OpenAI Codex code review | "In GitHub, Codex flags only P0 and P1 issues so review comments stay focused on high-priority risks." | "Code review rules guide Codex; they don't replace tests, branch protections, or required approvals." | 11 |
| Sourcery | the Quiet review profile "posts only the highest-priority comments."; the default "posts all but the lowest-priority ones." | on its own findings report: "The report counts findings and can't tell you which ones are false positives." | 10 |
| Sigma (Mnemoverse, the author's company) | "Sigma checks potential issues and brings the evidence back to your code."; "A fresh verifier confirms, rejects or reclassifies each one", and "only confirmed candidates are verified findings" | candidates no verifier confirmed are listed apart under "Unverified suspicions"; its docs call them "leads, not findings" | added outside that count |
Every cell in the second column is a description, not a measurement; how often each check is right on your code is what the count at the end of this page measures.
The last row is a reviewer for GitHub pull requests in closed beta, described by its homepage and docs only. Sigma runs on Claude Code and OpenAI models. Its homepage takes requests through a "Request beta access" form and says "A request does not grant access automatically."
Does it read the diff, the files or the whole repository?
A reviewer that reads only the lines in the diff can miss how a change breaks code elsewhere, so what each tool reads is part of the answer. The vendors put it in different words. GitHub lists "Full project context gathering" for Copilot code review and says "This capability analyzes your entire repository to better understand the context of code changes."; the review "runs in an ephemeral development environment, similar to Copilot cloud agent." CodeRabbit's architecture page lists "Sandboxed cloud execution with your full repository cloned for isolated analysis". Qodo writes "Specialized review agents reason over full codebase context to flag real bugs, rule violations, and requirements gaps with less noise." Graphite says its AI reviews analyze "your entire codebase to provide relevant feedback". Greptile's homepage describes "AI agents that review and test pull requests with full context of the codebase.", its docs say a review builds context "from your entire codebase, not just the diff", and its TREX also runs the pull request branch in a sandbox; Greptile's docs changelog says "TREX is generally available" in an entry dated 16 October 2026, and its TREX docs say that an organization turns TREX on in its settings and that a run is billed apart from the code review.
Others describe a narrower or more specific read. Anthropic's Code Review docs say "Several agents read each change alongside the surrounding code" and that a review works "without building or running your code". Sourcery "reads the diff of the changed code" and, for some changes, "supplements the diff with related code from your repository". Codex "reviews the pull request diff, follows your repository guidance". Cursor says Bugbot "reads both top-level and inline pull request comments from connected providers and includes them as context during reviews", and it reads project rules from .cursor/BUGBOT.md files. None of these sentences says how often the tool is right; whether a wider read means fewer misses on your code is what the count at the end of this page measures.
What is the best AI code review tool?
No list can answer this for your code, but the lists can be counted. On 25 October 2026 I read again the 28 tool lists that web searches for lists of AI code review tools returned on 9 October; 27 answered, and one returned a server error on three attempts, so every count on this page is out of 27. A tool counts when the page names it. That measures mentions, not use or quality, and some lists are written by vendors whose own tool is on them, so the table gives the count with and without such lists.
| Tool | Named on, of 27 lists | Without lists written by the tool's own vendor |
|---|---|---|
| CodeRabbit | 27 | 27 |
| GitHub Copilot | 26, counting any mention of Copilot; Copilot code review by name on 20 | 26 |
| Greptile | 24 | 23 |
| Qodo | 24 | 24 |
| Cursor Bugbot | 17 | 17 |
Next by count, among names with a pull request reviewer, are PR-Agent (15), Claude Code (14), Graphite (12), Codex (11) and Sourcery (10), each counting any mention of the name. SonarQube, a static analysis platform whose maker sells a separate AI review product, is named on 19 of the 27, more often than Bugbot, and has its own section below. Sigma appears in the tables of this page outside that count.
Best AI PR code reviewer?
For a pull request reviewer, the pages differ most on where your code can live, what the bill counts, and whether the reviewer can run inside your own infrastructure.
| Tool | Code hosts | What you pay for | Self-hosting |
|---|---|---|---|
| CodeRabbit | GitHub, including GitHub Enterprise Server; GitLab, including self-managed; Azure DevOps; Bitbucket Cloud and Bitbucket Data Center | each developer who creates pull requests: Essentials $24 per developer per month billed annually, $30 monthly; 5 PR reviews per hour per developer on Essentials, then $0.25 per reviewed file only with usage-based reviews turned on; the Free plan gives "PR summarization only; code reviews are available through the VS Code extension and CLI."; "Open-source projects receive Team features with no paid subscription required." | Enterprise "with 500 or more user seats" |
| GitHub Copilot code review | GitHub.com; "Azure DevOps (public preview)"; "Copilot is not currently available for GitHub Enterprise Server." | AI credits from the plan's monthly allowance, which GitHub estimates per review at $0.05 to $1 USD on Lite effort and $0.25 to $5 USD on Balanced; also GitHub Actions minutes for context gathering and tool use, except on self-hosted runners; "Available for all paid Copilot plans", not on Copilot Free, while maintainers of popular open source projects may be eligible for free Copilot Pro; on Copilot Business and Enterprise an organization can also let members without a Copilot license use it | its agentic capabilities run on GitHub Actions, and GitHub says you can "use self-hosted runners" for them; a self-hosted review service was not found on the code review page as of 25 October 2026 |
| Greptile | GitHub, GitLab, Bitbucket, Cursor Origin; on Enterprise also GitHub Enterprise Server, GitHub Enterprise Cloud with data residency, GitLab Self-Managed, Bitbucket Data Center and Gitea, and Perforce through P4 Code Review for on-premises deployments | Pro $1 per credit with no seat fees, credits prepaid and shared across the organization; a Base review is 1 credit, Plus 3, Apex 10; Starter free for one active developer with 50 credits a month; free for qualified non-commercial projects with an OSI-approved license; a startup discount of 500 free credits a month for 6 months for pre-Series A startups with under $2M revenue in the past 12 months | Enterprise: "Self-host in your own infrastructure"; "The entirety of Greptile's service can be self-hosted in an air-gapped environment." |
| Qodo | "GitHub (cloud and Enterprise Server), GitLab (cloud and self-managed), Bitbucket (Cloud and Data Center), Azure DevOps."; Gerrit, which the homepage puts on Enterprise and the deployment docs list for every deployment model | a credit pool for the team: Pro Team $30 a month for 2,500 credits, ~18 reviews by Qodo's estimate, "$.012/credit, pooled across the team"; "We don't offer a permanent free tier.", while qualified open source projects can get free access through the Qodo for Open Source program | Enterprise: "Single-tenant SaaS or on-prem" |
| Cursor Bugbot | Origin; GitHub, including GitHub Enterprise Server; GitLab, including GitLab Self-Hosted; Bitbucket, including Bitbucket Data Center; Azure DevOps Services | each run beyond the plan's included usage: "Bugbot first consumes your included usage, then bills additional reviews from your prepaid credit, or from on-demand spend on a legacy Cursor plan."; "The average Bugbot run costs between $1.00 and $1.50, depending on PR size and complexity."; on Cursor's current plans Bugbot starts with Premium at $30 a month, and Teams seats at $30, $100 or $200 per seat a month are Premium or higher; Plus does not include it | a self-hosted Bugbot service was not found on Cursor's Bugbot docs as of 25 October 2026 |
| PR-Agent | GitHub, GitLab, BitBucket, Azure DevOps and Gitea, by its README | open source, "a community-maintained legacy project of Qodo"; you pay the model provider you choose, "and any other model reachable through LiteLLM" | CLI, GitHub Actions, Docker, self-hosted or webhooks, by its README |
| Claude Code (Anthropic) | managed Code Review: "repositories hosted on GitHub, including GitHub Enterprise Server and GitHub Enterprise Cloud with data residency"; /code-review: a GitHub pull request or a GitLab merge request; GitLab CI/CD: "currently in beta" |
managed Code Review on Team and Enterprise plans, "billed on token usage through usage credits", "Code Review has no flat per-review price.", billed to the organization; /code-review: "The command works on any plan." |
managed Code Review runs "on Anthropic infrastructure, in a managed environment"; Claude in your own CI runs on "Your own CI runners" with a Claude API key or cloud provider credentials |
| Graphite Agent | GitHub; GitHub Enterprise Server for Enterprise customers | per user per month billed annually: Starter $20, Team $40; AI reviews limited on Hobby and Starter, unlimited on Team and Enterprise; Hobby is free for personal projects | "There is no self-hosted deployment of Graphite's service available for a user to run in their own cloud." |
| OpenAI Codex code review | "GitHub code review is generally available. GitLab merge request support in Code Review is in preview." | your ChatGPT plan's usage; "Code Review usage applies only when Codex runs reviews through GitHub"; on an API key, "No cloud-based features (GitHub code review, Slack, etc.)" | the review service on GitHub: not found on the Codex code review page as of 25 October 2026; the /review command reviews changes in your local checkout |
| Sourcery | GitHub; GitLab.com and self-managed GitLab on every plan; GitHub Enterprise Server on Enterprise | Pro $12 per seat per month billed annually, $15 monthly; Team $24 or $30; "You pay only for the developers you assign seats to."; free for public repositories | "Sourcery can run entirely inside your own infrastructure, under an Enterprise agreement" |
| Sigma | "Sigma reviews pull requests on GitHub." | closed beta, by invitation | not stated |
| Tool | How the vendor describes noise | Training on your code |
|---|---|---|
| CodeRabbit | review and verification run as separate agents (table above) | "CodeRabbit never uses customer code for model training." |
| GitHub Copilot code review | "Silence is better than noise."; "Model switching is not supported, as changing the model is likely to compromise reliability, user experience, and the quality of review comments." | the plans FAQ says "In addition, for Individual subscribers only: GitHub may use Copilot interaction data" to train and improve AI models, and "Individual subscribers can opt out of having their data used for AI model training at any time" |
| Greptile | TREX checks at runtime, "generally available" per its docs changelog of 16 October 2026 (table above) | on de-identified data: it "may aggregate and anonymize Customer Data" and "may use such data to train and improve artificial intelligence algorithms and models"; "To opt your organization out of AI training, an organization admin can open Organization Settings" |
| Qodo | "Specialized review agents reason over full codebase context to flag real bugs, rule violations, and requirements gaps with less noise." | "Your code is analyzed and discarded. Nothing stored, logged, or used to train models." |
| Cursor Bugbot | "Bugbot detects the hardest logic bugs with a low false positive rate." | with Privacy Mode on: "Customer Data will not be used for training by Cursor."; "Privacy Mode is on by default for Enterprise teams." |
| Claude Code (Anthropic) | "a verification step checks the candidate findings against the code and filters out false positives." | "Anthropic does not train generative models using code or prompts sent to Claude Code under commercial terms" |
| Graphite Agent | comment exclusions, "This reduces noise and focuses AI reviews on what matters most to your team." | "Neither Graphite nor any of its subprocessors use your data to train their models" |
| OpenAI Codex code review | only P0 and P1 issues in GitHub | on the Business and Enterprise plans: "No training on your business data by default." |
| Sourcery | the Quiet and default review profiles (table above) | "none of your code is used to train any model" |
| Sigma | "only confirmed candidates are verified findings"; "unverified suspicions are leads, not findings" | not stated |
Static analysis and security platforms on the same lists
Four platforms whose main product is code analysis or security are named on 10 or more of the 27 lists. Each describes AI in its analysis or on pull requests, by its own pages.
| Platform | Named on, of 27 lists | What it does on a pull request, in its words | What you pay for |
|---|---|---|---|
| SonarQube | 19 | static analysis, "decorating pull requests with actionable issue summaries"; AI review of pull requests is a separate Sonar product, Gitar: "Gitar AI Code Review Reviews every pull request in full context, writes the fix, and iterates until CI passes." | SonarQube by lines of code, "SonarQube plan pricing starts at $34 monthly for analysis of up to 100k LOC."; a free tier, and "SonarQube Team Plan, free for your private projects up to 50k LOC."; Gitar "Core at $20 per user per month, Pro at $40 per user per month" |
| Snyk | 12 | Snyk Code results "in your IDE and pull requests"; its DeepCode AI models "use training data from millions of permissively licensed open source projects with verified code fixes"; pull request checks start when "A developer creates a pull request (PR) in an SCM integrated with Snyk." | "Try for Free or from $25/month" on its plans page |
| Codacy | 11 | "AI Code Reviewer for Pull Requests" | "Starting at $18 Per dev/mth"; "Free forever for open-source projects" |
| Semgrep | 11 | "PR checks in GitHub, GitLab, Bitbucket, Azure"; "Combine AI reasoning with rule-based analysis for detection, triage, and remediation" | "Starting at $30 / month per contributor"; "No charge for up to 10 contributors" |
Also named on 5 to 9 of the 27 lists
Counted without the vendor's own list, among names with a pull request reviewer. DeepSource (8): "Powered by 5,000+ deterministic rules along with our state-of-the-art AI review agent."; Team at $24 per user per month billed yearly; self-hosted deployment on Enterprise. CodeAnt AI (5): "AI agents that review every pull request and continuously secure your code, cloud, and runtime."; "Deploy in your VPC on AWS, GCP, or Azure or fully on-premises." on Enterprise. Bito (5): GitHub, GitLab and Bitbucket in the cloud and self-hosted; "Bito hosted or self-hosted ($5/seat/month add-on)". Gitar (5): the Sonar product above, "Gitar is a code change verification agent."
What changed recently
The date of a list matters, because several lists still describe products under names or terms their vendors have since replaced. Each row below is a vendor's own statement.
| Vendor | What its pages say now |
|---|---|
| Anthropic | 15 October 2026: "Code Review is out of research preview and available to Claude Team and Enterprise organizations."; "Code Review has no flat per-review price." |
| Cursor | the current plan table puts Bugbot in Premium at $30 a month and leaves it out of Plus, "No Auto, Cloud Agents, Automations, Bugbot, Origin, third-party models, or your own API keys."; older plans "continue for existing customers" |
| CodeRabbit | "Essentials is the new name for Pro, and Team is the new name for Pro Plus." |
| Qodo | "The current product is Qodo Review (v2)."; "Historical names: Qodo Merge, PR-Agent, Qodo Gen, Codiumate"; PR-Agent is now "a community-maintained legacy project of Qodo" |
| Graphite | "As of 10/08/2025, the Diamond name has been deprecated, and AI code review capabilities now slot under Graphite Agent" |
| Amazon | from 7 November 2025: "After that point, you will only be able to use CodeGuru Reviewer with existing repository associations." |
| from 17 July 2026: "the consumer version is shut down, and all code review activities performed by the app end."; "The enterprise version of Gemini Code Assist on GitHub is not affected by these changes." |
Where your code lives
Every reviewer in the code host table above lists GitHub. On GitHub Enterprise Server: CodeRabbit, Cursor Bugbot, Claude Code's managed Code Review on Team and Enterprise, Greptile, Graphite and Sourcery on Enterprise, and Qodo, whose deployment table marks its "GitHub Enterprise" row for single-tenant, on-prem and air-gapped deployments and not for multi-tenant; "Copilot is not currently available for GitHub Enterprise Server." On GitLab: CodeRabbit, Greptile, Qodo, Bugbot, Sourcery, PR-Agent, Claude Code through /code-review or GitLab CI/CD in beta, and Codex in preview; GitLab and Bitbucket were not found on Copilot's code review page as of 25 October 2026. On Bitbucket: CodeRabbit, Greptile, Qodo, Bugbot and PR-Agent. On Azure DevOps: CodeRabbit, Qodo, Bugbot (Azure DevOps Services), PR-Agent and Copilot in public preview.
Self-hosting, data and compliance
Self-hosting comes with a condition on every page that offers it: CodeRabbit from 500 user seats on Enterprise, Greptile, Qodo, Sourcery and DeepSource on Enterprise, PR-Agent as open source you run yourself. Graphite says it has no self-hosted deployment, and Claude's managed Code Review runs on Anthropic infrastructure, while Claude in your own CI pipeline runs on your runners with your own credentials. Some training terms carry conditions: Anthropic's applies to commercial terms, Cursor's to Privacy Mode, OpenAI's to its Business and Enterprise plans, and Greptile's to organizations that opt out, while GitHub's plans FAQ says GitHub may use Copilot interaction data to train and improve AI models "for Individual subscribers only", who can opt out. Certifications are stated on the vendors' own pages, for example "Greptile is SOC 2 Type II compliant." and "Sourcery is SOC 2 Type 2 certified, and the report is available on request."
How to measure reliability on your own pull requests
The pages above tell you what each tool intends; only your pull requests tell you how often it is right on your code, and the count needs nothing beyond a spreadsheet. Pick two tools from the tables that fit your code host and your bill, and turn both on for the same repositories for two weeks. For every comment, record one of three outcomes: fixed, dismissed as wrong, or left without action. At the end, divide fixed by all comments for each tool; that share is your reliability number, on your code, with your own definition of a real problem.
Two more readings make the number useful. Run one large pull request through each tool twice, a day apart, and compare the two sets of findings: a reviewer that reports different problems on the same diff shows you how stable its output is. Then note what each tool cost in its own unit, from its own usage page, before you compare. Two vendors point the same way in their docs: Qodo records why a finding was dismissed, and Sourcery writes of its findings report, "Judge that yourself on a sample."
Sources, all read on 25 October 2026; the text describes these pages as of that day. Tool lists: 27 pages found by web searches on 9 October 2026, read again on 25 October 2026, counted by name. CodeRabbit: pricing, platforms, self-hosted, FAQ, architecture, rate limits, plans, usage-based reviews, docs index. GitHub: Copilot code review, using code review, plans (docs), plans and FAQ, blog. Greptile: homepage, pricing, credits, self-hosting, security, docs index, changelog, TREX. Qodo: homepage, pricing, how review works, deployment models, docs index, full docs, PR-Agent. Cursor: Bugbot, Bugbot docs, Bugbot billing, models and pricing, data use, privacy. Anthropic: Code Review, Code Review hosts, costs, /code-review, GitLab CI/CD, GitHub Enterprise Server, data usage, general availability. Graphite: AI reviews, pricing, GitHub Enterprise Server, AI privacy, name change, docs index. OpenAI: Codex code review, GitHub, pricing. Sourcery: homepage, pricing, self-hosted, code retention, compliance, docs index. Sonar: plans, SonarQube, Gitar. Snyk: Snyk Code, DeepCode AI, plans, pull request checks. Codacy: pricing, AI Reviewer. Semgrep: homepage, pricing. DeepSource: homepage, pricing. CodeAnt AI: docs, enterprise. Bito: code review, pricing. Amazon: reviewer guide, document history. Google: consumer deprecation. Sigma: homepage, docs, reading a review.
Top comments (0)