The label has four different meanings
Search for "open source AI code review tools" and every result uses the same word: open source. The word is doing a lot of work. It currently covers at least four different things, and they are not interchangeable.
The first is a project that is genuinely MIT-licensed and community-owned but backed by a vendor that sells a paid platform. The second is a project that ships an open core while keeping enterprise features under a separate license. The third is a fully closed-source product that gets called "open source" inside a listicle because its vendor also maintains an open-source project. The fourth is a free hosted tier, which is a billing decision, not a license.
Before comparing any of these tools it helps to separate four things a buyer usually conflates: the license, the maintainers, whether it can be self-hosted with your own model and key, and how the vendor makes money. Most of the confusion on this SERP comes from treating the last three as if they were the first.
The listicle that ranks itself
A useful way to see the problem is a page a Qodo community manager published: 5 Open Source Code Review Tools: What Works and What Doesn't at Scale. The list includes SonarQube, Gerrit, Phabricator, GitHub Code Review, and Qodo itself. Qodo is a commercial enterprise SaaS. Listing it as one of five "open source" tools is possible because the vendor also maintains the open-source project PR-Agent. But the open-source project and the commercial product are different things, a distinction the page never draws.
The PR-Agent repository makes this explicit in its own README. The banner reads "This project is not the Qodo free tier," and again "It is not the Qodo offering for open-source projects." Qodo donated PR-Agent to the community, and the project now lives under its own org, fully community-owned under an MIT license. It is genuinely free to run, inspect, modify, and self-host. Separately, Qodo offers a hosted free tier for open-source projects as a sponsored offering. Those are two different things with overlapping names, and the "open source" tools list folds them together to keep a commercial product on the list.
A vendor publishing a list titled "open source" that includes its own non-open-source product is a methodology problem, and it is exactly the gap on this SERP. Every comparison result is a vendor or a marketing page. None of them answers what "open source" means for a buyer who needs to decide based on the license, not on the word.
The four checks that separate the license from the business model
Four checks turn the label into a decision. They do not replace reading the actual repository, but they will catch the pages that use "open source" loosely.
Who owns the license and can you fork it? PR-Agent is MIT under a community org. Qodo is closed-source commercial software. MIT is not optional the way a free tier is optional. You can fork it, keep it running after a vendor changes direction, and you are not renting a capability. The moment your process depends on a reviewer, the ability to fork and maintain it matters more than any feature list.
What is the actual license, core versus enterprise? Some projects are open-core. The kodus-ai repository is a public monorepo with both a license file and a separate license_ee.md for enterprise features. The open core, the CLI, and the self-host path are public; some enterprise surface is gated behind the second license. That is a real "open source" claim with a visible boundary, and the boundary is in the repo rather than hidden on a pricing page. If the repository carries two license files, the honest description is open-core, not open source.
Can you run it with your own model and key? PR-Agent is model-agnostic through LiteLLM and runs as a CLI or a GitHub Action against your own key. Kodus advertises bring-your-own-key and lists Claude, GPT-5, Gemini, Llama, GLM, Kimi, or any OpenAI-compatible endpoint, with self-host documentation and a telemetry setting you can disable. A tool that only runs against the vendor's cloud and the vendor's model, whatever its license file says, is not actually self-hostable. Self-hosting is the property most teams mean when they say they want open source, and it is a separate check from the license.
Is the "free" thing the license or the tier? Qodo's free tier for open-source projects is a hosted service, not the MIT project. Mixing the two is how a commercial product lands on an "open source" list. When a vendor says an open-source project is free, check whether the free thing is the downloadable code or the hosted account. A free tier is a pricing decision that a vendor can change at any release; a license is not.
What this does to review
These distinctions matter because the review of agent output is where the boundary shows up. If your team runs agents that generate most of the code, the reviewer becomes part of your trust boundary. You need to be able to inspect what the review tool itself does, not just trust its summary. An open-source reviewer you can read, prompt, and point at a model you control is a different tool from a hosted reviewer with its own cost and governance attached. The license answer determines which one you are getting, and no marketing page will tell you that truthfully about its own product.
There is a secondary effect on review policy. When the review tool is open-core, the parts of review that your team actually runs on may sit on either side of the enterprise boundary. Before you design a review pipeline around a tool, confirm which features are in the open core and which require the paid tier. A review policy written around a feature that turns out to be enterprise-gated will not survive the next migration.
The practical next step is cheap and future-proof: before comparing stars and features, open the repository and read the license file, then search the README for the phrase "not the free tier" or its equivalent. Lists and marketing pages will sort the tools into categories. Reading the repo will tell you which category each one actually belongs in, which is the only version of the answer that holds up when a vendor changes its pricing, its roadmap, or its offering.
Top comments (0)