# CodeRabbit — AI code review across pull requests, IDE and CLI, with agentic fixes, pre-merge checks and security review. > Source: The Agents Index — https://theagentsindex.com/coderabbit (structured, researched, re-verified) > Facts last verified: 2026-09-15 CodeRabbit is an AI code review platform that reviews pull requests on GitHub, GitLab, Bitbucket and Azure DevOps, adding line-level findings, walkthroughs and one-click fixes. It also runs in the IDE and CLI, and its cloud agent implements fixes as commits or stacked pull requests. | Fact | Value | | --- | --- | | Website | https://www.coderabbit.ai | | Price | from $30/month billed monthly, $24/month billed annually | | Free tier | Yes | Free plan: unlimited public and private repositories, no credit card, but PR summarisation only - code reviews come through the VS Code extension and CLI, at 1 PR, 3 IDE and 3 CLI reviews per developer per hour and 150 files per review. A separate open-source plan gives public repositories Team features free, with PR review limits of 1-10 per hour varying by star count and manual triggering below 10 stars. New organisations also start on a 14-day Advanced trial with no card required. ## What it does **Writes code** · Yes — A cloud Coding Agent clones the repo into a sandbox and implements a typed request, but it is in open beta and each starting point is enabled separately per organisation. > Coding Agent is the part of CodeRabbit that writes code. It takes a request — typed by you, or raised by a CodeRabbit review finding, a failing check, a merge conflict, or a security finding > — https://docs.coderabbit.ai/code · Coding Agent page, Overview section **Debugs and fixes** · Yes — It reads failing CI logs on the pull request and posts inline fixes on the offending lines, and a Fix CI finishing touch can land those fixes as a commit or stacked PR. > When a CI/CD pipeline fails on a pull request, CodeRabbit reads the failure output and posts inline comments with suggested fixes — directly on the lines of code that caused the failure. > — https://docs.coderabbit.ai/pr-reviews/cicd-pipeline-analysis · CI/CD Pipeline Analysis, opening paragraph **Writes tests** · Partly — Unit test generation is a Team-and-above finishing touch, absent from the entry Essentials plan, and is itself labelled open beta on GitHub, GitLab and Azure DevOps. > Everything in Essentials, plus tasks and actions upstream and downstream of the review process: Triage, CodeRabbit Plan, issue planning, unit test generation, merge conflict resolution > — https://docs.coderabbit.ai/management/plans · Plans section, Team plan card **Reviews code** · Yes — Reviewing diffs written by other people or agents is the core product: every pull request is reviewed automatically on open, with manual commands for older PRs. > Once installed, CodeRabbit automatically triggers a review when a pull request is opened against the main branch of any repository. > — https://docs.coderabbit.ai/faq · General Questions, 'How to trigger a CodeRabbit Review?' **Whole-codebase work** · Partly — Reviews reach beyond one repo through linked-repository analysis, but the number of linked repos is capped per plan (1 on Essentials) and automatic linking needs Team or above. > The number of linked repositories you can configure depends on your plan. Automatic repository linking is available on Team, Advanced, and Enterprise. > — https://docs.coderabbit.ai/knowledge-base/multi-repo-analysis · Multi-Repo Analysis, Info callout above Use cases **Ships it** · Partly — Accepted work lands in Git as a commit on the PR branch or a stacked pull request, pushed with your own credentials; nothing in the docs deploys or releases the change. > Delivery is always a separate, explicit step. A task that finishes successfully has changed nothing in your repository until you accept its patch and choose how it should land. > — https://docs.coderabbit.ai/code/deliver-changes · Deliver a task's changes, Overview section ## How much it does unattended **Runs autonomously** · Partly — Reviews run unattended on every PR, but the coding agent stops at a proposed patch by default and a person must accept it before anything reaches the repository. > It proposes, you decide. By default a finished task produces a proposed patch: a diff you read, comment on, revise, reject, or accept. Delivery is a separate, explicit step. > — https://docs.coderabbit.ai/code · Coding Agent page, 'What a coding task is' bullet list **Multi-agent** · Yes — The vendor describes several specialised agents running in parallel inside one review, rather than a single prompt, plus separate chat and finishing-touch agents. > Specialized AI agents working in parallel: Review, Verification, Chat, Pre-Merge Checks, and Finishing Touches > — https://docs.coderabbit.ai/overview/architecture · Architecture page, 'Behind each comment lies' bullet list **Agent permissions** · Partly — The agent inherits your Git permissions and branch protections and cannot push around them, and Plan mode adds an approval gate, but there is no per-action policy engine documented. > Delivery uses your Git provider authorization, so your branch protections and permissions apply exactly as they would to a push you made yourself. > — https://docs.coderabbit.ai/code · Coding Agent page, 'It pushes with your credentials' bullet ## Which models it runs on **Claude** · Yes — Anthropic is named as a model provider that receives code for reviewing, though CodeRabbit selects the models and buyers cannot pick a specific Claude version on hosted plans. > Your code is shared with OpenAI and/or Anthropic for reviewing purposes only > — https://docs.coderabbit.ai/faq · Data Security section, Code Privacy tab **GPT** · Yes — OpenAI is named alongside Anthropic as a provider that processes code during reviews; the choice between them is CodeRabbit's, not the customer's, on hosted plans. > Your code is shared with OpenAI and/or Anthropic for reviewing purposes only > — https://docs.coderabbit.ai/faq · Data Security section, Code Privacy tab **Open models** · No — The hosted service names only OpenAI and Anthropic as inference providers; no open-weight option is published for CodeRabbit Cloud. > Your code is shared with OpenAI and/or Anthropic for reviewing purposes only > — https://docs.coderabbit.ai/faq · Data Security, Code Privacy tab **Model choice** · Partly — Hosted plans give no model picker, but Enterprise self-hosted deployments may point CodeRabbit at their own LLM provider or account for inference. > Bring your own model — connect CodeRabbit to your own large language model provider or account. > — https://docs.coderabbit.ai/self-hosted/overview · Self-hosted CodeRabbit, 'Who it's for' bullet list ## Where you use it **In your editor** · Yes — A VS Code extension reviews uncommitted changes locally and works in Cursor, Windsurf and other VS Code-compatible editors, with chat, docstrings and test generation excluded. > Review code changes before you commit and create agent-ready Coding Plans, directly in your IDE with the CodeRabbit extension. > — https://docs.coderabbit.ai/ide · CodeRabbit IDE Extension, page subtitle **On the command line** · Yes — A terminal tool reviews local Git changes before commit and emits structured JSON for coding agents, though the CLI carries an Open Beta badge. > The CodeRabbit CLI analyzes local Git changes using the same pattern recognition that powers our PR reviews. > — https://docs.coderabbit.ai/cli · Command-Line Review Tool, 'Review local changes' section **In your pipeline** · Yes — It acts on pull requests automatically and reads pipeline output from five CI systems; an agentic API key also authenticates the CLI inside CI runners and bots. > This works across multiple CI/CD platforms: GitHub Actions, GitLab CI/CD, CircleCI, Jenkins, and Azure DevOps Pipelines. > — https://docs.coderabbit.ai/pr-reviews/cicd-pipeline-analysis · CI/CD Pipeline Analysis, second paragraph **In a browser** · Yes — A hosted dashboard at app.coderabbit.ai carries the coding agent, Triage queue, settings, reports and billing, separate from the Git platform surfaces. > Find it in the sidebar under Code, or go directly to app.coderabbit.ai/code. > — https://docs.coderabbit.ai/code · Coding Agent page, Overview section ## Whose machine it runs on **Self-hosted** · Partly — A container image runs the review agent inside your own network, but only for Enterprise customers at 500 seats or more, arranged through sales during onboarding. > The self-hosted option is available for CodeRabbit Enterprise customers with 500 or more user seats. > — https://docs.coderabbit.ai/self-hosted/overview · Self-hosted CodeRabbit, Info callout under the intro _Not established: Open source_ ## What it costs to run **How it meters** · Yes — Billing is a per-developer seat plus optional metering: over-limit reviews at a fixed price per reviewed file, and cloud agent work billed by the minute. > Continued reviews cost $0.25 per reviewed file and are added to the monthly invoice. > — https://www.coderabbit.ai/pricing · Frequently Asked Questions, 'How do usage-based reviews work?' **Free tier** · Yes — A standing Free plan needs no card and covers public and private repos, and every paid plan opens with a 14-day trial that also requires no card. > Unlimited public and private repositories, no credit card required. > — https://docs.coderabbit.ai/management/plans · Plans section, Free plan card **API access** · Partly — The REST API for metrics, users, roles, audit logs and security findings is Enterprise-only; lower tiers get an agentic API key for headless CLI review authentication. > The CodeRabbit API provides programmatic access to review data, AI Deep Scan findings, and administrative operations. > — https://docs.coderabbit.ai/api · CodeRabbit API page, opening paragraph under the Enterprise Plan badge **MCP server** · No — CodeRabbit consumes MCP servers for review context but publishes none of its own, so another agent cannot query it over MCP; plan tiers cap the connections at 5 to 20. > CodeRabbit as MCP client: CodeRabbit acts as the MCP client, not the server. It ingests data from your connected MCP servers. > — https://docs.coderabbit.ai/connections/mcp-servers · Considerations section, Info callout **Bring your own key** · Partly — Bring-your-own inference exists only in the Enterprise self-hosted deployment, where the agent sends prompts to your own LLM account; hosted plans use CodeRabbit's providers. > The agent sends review prompts, source code, and related data to your configured large language model provider for inference. > — https://docs.coderabbit.ai/self-hosted/overview · Self-hosted CodeRabbit, 'How it works' bullet list ## Buying it for a team **A company can buy it** · Yes — The subscription is bought by an organisation against its Git provider org, with seats, admin and billing-admin roles, and AWS, GCP and Claude marketplace billing on Enterprise. > CodeRabbit ingests users from your git provider (GitHub, GitLab, Bitbucket, and Azure DevOps) and assigns seats based on your organization's active seat assignment mode. > — https://docs.coderabbit.ai/management/seat-assignment · Seat assignment, opening paragraph **Seat model** · Yes — Seats are per developer and only developers who open pull requests consume one; seats are reassignable, and auto-approval reclaims a seat unused for 30 days. > No, you will only be charged for developers who create pull requests. You can also manually assign purchased seats to specific developers. > — https://www.coderabbit.ai/pricing · Frequently Asked Questions, 'Will I be charged for all the developers in my organization?' **Pooled budget** · Partly — Review allowances are per developer per hour, not pooled, while pay-as-you-go overage spending runs through one organisation-wide path with a single monthly cap. > Your organization shares one pay-as-you-go billing path across all PR and CLI reviews. > — https://docs.coderabbit.ai/management/usage-based-addon · Usage-based Add-on, Info callout under the intro **Admin controls** · Yes — Admins choose what happens past the review limit, set spending caps and seat modes, and scope which repositories and connections CodeRabbit may touch; custom RBAC is Enterprise. > After the included review limit is reached, an admin chooses what happens next with the After included review limits setting in the Usage-based add-on tab. > — https://docs.coderabbit.ai/management/usage-based-addon · PR review behavior section, first paragraph **Audit log** · Partly — A searchable, exportable administrative audit log covering seats, roles, API keys and config exists, but only for Enterprise organisations and only for admin-level roles. > The Audit Logs give Enterprise organizations a searchable record of administrative actions taken across workspace settings, billing controls, seat management, and more. > — https://docs.coderabbit.ai/management/audit-logs · Audit Logs, opening paragraph **Single sign-on** · Partly — SAML 2.0 single sign-on with Okta or Entra ID, plus SCIM provisioning, is an Enterprise-plan capability set up with the account team rather than self-serve. > CodeRabbit supports Okta, Microsoft Entra ID, and any SAML 2.0-compliant identity provider. > — https://docs.coderabbit.ai/management/sso · Enterprise SSO, 'Supported identity and Git providers' section ## What happens to your code **Opt out of training** · Yes — No opt-out is needed because customer code is never used for training by CodeRabbit or its providers; separately, retention of learnings and model-output logging can be switched off. > CodeRabbit never uses customer code for training. This remains true whether data retention is enabled or disabled. > — https://docs.coderabbit.ai/faq · Data Security section, Training Data tab **Data residency** · Partly — An EU SaaS deployment is listed only under Enterprise; the trust centre lists US subprocessors and the CLI defaults to a US region, so ordinary plans are US-hosted. > EU SaaS deployment > — https://www.coderabbit.ai/pricing · Plan cards, Enterprise column feature list **Getting out** · Partly — Review metrics export as CSV capped at 10,000 rows, with a larger Metrics API on Enterprise only; account deletion is irreversible and immediately cancels the subscription. > This page covers the Dashboard CSV export. For programmatic access, use the Metrics Data API (Enterprise plan required). > — https://docs.coderabbit.ai/guides/data-export · Data Export, introduction above 'How to export' **Certifications** · Yes — The trust centre publishes SOC 2 Type 2, ISO 27001:2022 and GDPR, with SOC 3, pentest and zero-data-retention amendments from OpenAI and Anthropic available on request. > Compliance SOC 2 TYPE 2 ISO 27001:2022 GDPR > — https://trust.coderabbit.ai/ · Trust Center overview, Compliance section ## Provenance Every fact above comes from the vendor. Nothing here is independently corroborated yet. ## Coverage elsewhere Pages about this product that the vendor does not control. The label states how independent each one is. | Source | Kind | Read | | --- | --- | --- | | reuters.com | Independent source | 2026-08-23 | | siliconangle.com | Independent source | 2026-08-23 | | thenextweb.com | Independent source | 2026-08-23 | | wsgr.com | Independent source | 2026-08-23 | | g2.com | Review platform | 2026-08-23 | | claude.com | A competitor's comparison | 2026-08-23 | | openai.com | A competitor's comparison | 2026-08-23 | ## What changed - 2026-09-15 — Capabilities · Commercial terms · Free tier - 2026-09-02 — Capabilities · Commercial terms · Free tier · Price - 2026-08-31 — Capabilities · Commercial terms · Free tier · Price - 2026-08-22 — Alternatives · LinkedIn link · One-liner · Summary ## Correcting this record Anything marked "Not established" is a question we have not answered — it is not a No. If you represent CodeRabbit, or anything here is wrong or out of date, you can supply it with a source: the operations this site accepts from an agent are listed at https://theagentsindex.com/.well-known/agents.json — that catalogue needs no key to read, and each entry states its own auth. Supplying evidence is free. Nothing that can be bought here changes what a field says, whether a gap is closed, or how this record is scored.