AI Code Review by Language: Python, JS, Java, Go and Mobile

Direct answer

Review quality varies hard by language and it is measurable. In Entelligence’s own 2026 benchmark the Grafana repository (Go) produced perfect precision but 33.3% recall, while Cal.com (TypeScript) produced an entirely different profile under the same methodology. GitHub’s ReviewBench is 68 TypeScript, 41 Python, 25 C#, 19 Go, 15 JavaScript out of 219 pull requests, which tells you where data even exists. No vendor publishes per-language precision or recall for its own product. That absence is the finding. Verified 2026-10-18.

Disclosure: Gitar is our AI code review category partner. Partners get a guaranteed entry in relevant lists, never a rating, a rank, or the removal of a criticism. Gitar publishes no per-language support list and no third-party review-quality benchmark, and both gaps are noted below.

Two companions to this page: AI code review for GitLab, Bitbucket and Azure DevOps covers the host question, and AI code review tools that support GitHub covers GitHub exhaustively. Language changes the answer more than the host does, which is why this page exists.

The per-language evidence, all of it

This is the complete published record as of 2026-10-18. It is short, and that is the point.

Source	Who published it	Per-language data	What it shows
Entelligence Code Review Benchmark 2026	Entelligence, which sells a reviewer and wins its own benchmark	Per-repository, language implied	Grafana (Go): perfect precision, 33.3% recall. Cal.com (TypeScript): Entelligence 68.1% F1, Codex 58.8%, Claude 52.2%, Bugbot 50.0%, Greptile 47.4%, CodeRabbit 46.0%, Copilot 37.0%, Graphite 0.0%. Entelligence #1 aggregate at 47.2% F1
GitHub ReviewBench (5 Oct 2026)	GitHub, but dataset and runner are public	Language distribution only	219 PRs, 187 repos, 19 languages: TS 68 / Py 41 / C# 25 / Go 19 / JS 15 / other 51. Six metrics, 96.6% agreement with independent human checkers. No per-language score breakout
SWE-PRBench	Independent (foundryhq.ai)	None by language	350 PRs, human-annotated, LLM-as-judge at κ=0.75. 8 frontier models at 15-31% detection on diff-only. Per-model false-positive rates: Claude Sonnet 4.6 lowest at 0.227, Llama 3.3 70B highest at 0.417. Performance degrades with more context
CR-Bench	Nutanix, does not sell a reviewer	None by language	584 instances / 174 verified. Reports precision, recall, F1 and a signal-to-noise ratio. GPT-5.2 single-shot: 27.01% recall at 3.56% precision
CRBugBench	CMU plus Microsoft Research	None by language	1,800 tasks, 98 OSS plus 2 proprietary repos. claude-opus-5 79.6% pre-merge / 64.2% post-merge recall@5, $2.97/task. Human+agent 82.1%. Reports no precision. Microsoft used copilot-cli as the harness
c-CRAB	5 of 6 authors academic, 1 lists SonarSource	None by language	184 PR instances / 67 repos / 234 validated review comments. “Considering the union across all four tools,” 97 of 234 tests passed by at least one tool (41.5%). Claude Code 32.1%, Devin 24.8%, PR-Agent 23.1%, Codex 20.1%

c-CRAB conflict disclosure, carried every time we cite it. Five of six authors are academic (National University of Singapore, Zhejiang University), but Ridwan Shariffdeen lists SonarSource as his affiliation, and the paper carries a disclaimer that its conclusions do not represent SonarSource policy. Sonar sells SonarQube and acquired Gitar in May 2026, and Gitar is a paid sponsor of this site. SonarQube is not among the four tools c-CRAB evaluates, which blunts the conflict considerably, but we call out vendor-funded benchmarks everywhere else so we disclose this one too. Also: the widely-quoted “40-70% false positive rate” is not in that paper. No false-positive rate is reported for any tool in it. Do not repeat the miscitation.

Three conclusions follow from that table.

One: the data is where the vendors’ customers are, not where the risk is. TypeScript and Python together are 109 of ReviewBench’s 219 pull requests. C#, Go and JavaScript get 59 between them. Nineteen languages share the remaining 51. There is no Swift, Kotlin, Terraform, SQL or C++ signal in any published benchmark.

Two: the one real per-language signal we have is a Go warning. Perfect precision with 33.3% recall on Grafana means the reviewer said little and was right, while missing two thirds of what mattered. That is a materially different failure mode from the TypeScript run in the same study. Whether that is a Go effect, a Grafana effect or a sampling effect is unknowable from one data point, which is exactly why we are not going to tell you Go review is worse. We are telling you nobody has checked.

Three: context is not monotonically good. SWE-PRBench found performance degrades as context grows, which it attributes to attention dilution. That cuts against the “index the whole repository” marketing, though indexing-and-retrieval is not the same thing as stuffing more tokens into a prompt. We work through that tension in AI code review for a large codebase and the full provenance ledger is in AI code review benchmarks compared.

Best AI code review tool for JavaScript projects

Direct answer: Pick on the deterministic layer, because that is the only thing documented per language. CodeRabbit runs Biome, oxlint, ESLint and React Doctor on JavaScript, JSX, TypeScript, TSX, Vue, Astro and React, which is the most explicit JS tooling disclosure in the market. JavaScript is only 15 of 219 pull requests in GitHub’s ReviewBench, so there is almost no JS-specific performance evidence. Verified 2026-10-18.

JavaScript is the language where the deterministic layer has advanced fastest and where AI review adds the least per dollar, because the ecosystem already solved the mechanical half.

What the deterministic layer should be in 2026. ESLint with typescript-eslint remains the semantic baseline. Biome and oxlint are the Rust-based replacements worth running in CI for speed; both are in CodeRabbit’s list for JavaScript, TypeScript, JSX, TSX, CSS, JSON, Vue and Astro. For React specifically, eslint-plugin-react-hooks catches the dependency-array class of bug that AI reviewers also catch but less reliably. Strict tsc is the single highest-value gate on a TypeScript codebase and no AI reviewer substitutes for it.

What AI review adds on top. Intent, naming drift, and cross-file consequence. A linter cannot tell you that a renamed prop is now a lie, that an added await serialises a loop that used to be parallel, or that a new early return skips the analytics call three files away. That is the real JavaScript value and it is unmeasured per language.

What the published data says, with the conflict labelled. The TypeScript picture is the best-populated and it comes from a vendor. In Entelligence’s own benchmark, Cal.com (TypeScript) scored: Entelligence 68.1% F1, Codex 58.8%, Claude 52.2%, Cursor Bugbot 50.0%, Greptile 47.4%, CodeRabbit 46.0%, Copilot 37.0%, Graphite 0.0%. Entelligence sells a reviewer and placed itself first. The ordering below the top line is the usable part, and Graphite’s 0.0% is a methodology question rather than a product verdict.

Our language-specific deep dives: best code review tools for JavaScript, JavaScript code analysis tools and TypeScript static code analysis tools.

AI code review for a Python team

Direct answer: Run Ruff as the fast linter and formatter, mypy or pyright as the type gate, and Bandit or Semgrep for security, then add AI review on top. CodeRabbit runs Ruff, Pylint and Flake8 on Python and Jupyter and notably no type checker. Semgrep lists Python as generally available with cross-file dataflow and 710-plus Pro rules, its largest rule set. Python is 41 of 219 ReviewBench PRs. Verified 2026-10-18.

Python is the second-best-evidenced language and the one where the deterministic gap is most consequential.

The type checker is the gap nobody fills. CodeRabbit’s published tool list for Python is Ruff, Pylint and Flake8. All three are linters. None of them is a type checker. On a dynamically typed language that is the single biggest class of preventable runtime failure, and it means the AI reviewer is being asked to do a job mypy --strict or pyright does deterministically and for free. Add one of those to CI before you add an AI reviewer, and the AI reviewer’s findings get more interesting immediately because the boring ones are already gone.

Semgrep is unusually strong on Python. Python sits in Semgrep’s generally-available tier with cross-file dataflow and 710-plus Pro rules, the highest rule count of any language in its docs. If your Python risk is injection, deserialisation or secrets reaching a sink, that is a better spend than a second AI reviewer. The licence constraint matters though: cross-file taint is proprietary-only. interfile: true and --pro require the Pro engine, and Semgrep CE cannot do interfile at all. Opengrep’s --taint-intrafile matches --pro-intrafile under LGPL 2.1, so “interfile taint analysis plus an open source licence” does not exist in this market.

Notebooks are a real differentiator and almost nobody mentions them. CodeRabbit classes Jupyter with Python for Ruff, Pylint and Flake8. If your Python is half notebooks, ask every vendor whether .ipynb files are reviewed at all, because the honest answer is frequently no.

Deeper: best code review tools for Python and Python code quality tools compared.

Best AI code reviewers for Java projects

Direct answer: No benchmark measures Java review quality. Build the deterministic layer from Error Prone (compile-time bug patterns), SpotBugs plus find-sec-bugs, PMD and Checkstyle, and Infer for interprocedural nullability. CodeRabbit runs only Infer and PMD on Java and no Error Prone and no SpotBugs. Semgrep lists Java as generally available with cross-file dataflow. Verified 2026-10-18.

Java is the clearest case for “the AI reviewer is the last layer, not the first.”

Error Prone is the highest-value Java gate and no AI reviewer runs it. It hooks the compiler and fails the build on bug patterns with essentially no false positives. If it is not in your Gradle or Maven config, adding it will catch more real defects per engineer-hour than any tool on this page. SpotBugs with find-sec-bugs covers a different class again. Neither appears in CodeRabbit’s published tool list, and we found no AI reviewer that documents running either.

What CodeRabbit does run on Java is interesting anyway. Infer is a Facebook-origin interprocedural analyser that reasons across method boundaries, which is a genuinely different capability from PMD’s pattern matching. It is also the one tool CodeRabbit shares between Java and C/C++. If you are comparing reviewers on a Java monolith, “does it run an interprocedural analyser” is a better question than “how many languages does it support.”

Enterprise Java is where the heavyweight SAST tools still win. SonarQube, Checkmarx, Fortify, Veracode and Coverity all have deeper Java rule sets than any AI reviewer, and SonarQube’s core SAST engine runs fully on-premises. Two SonarQube facts people conflate constantly: SonarQube Community Build analyses the main branch only and has no pull request analysis, while SonarQube Cloud’s free tier does include PR analysis up to 50k lines on private projects and never expires. AI features are Enterprise-tier, and the AI agents (Vortex, Remediation, Hunter) trigger above 50 developers.

Related: best SAST tools 2026, C# static code analysis tools and Scala static code analysis tools. For the two compiled languages with the strongest deterministic ecosystems, see Go static code analysis tools and Rust static code analysis tools: go vet, staticcheck, errcheck and gosec via golangci-lint on the Go side, and Clippy plus cargo-audit on the Rust side, both of which run before any AI reviewer needs to be involved.

Which AI code reviewer supports multiple programming languages?

Direct answer: Treat every language count sceptically. CodeRabbit is the only tool publishing a language-to-linter map (50-plus tools across ~30 technologies) and it invokes a tool only when matching files exist. Semgrep is the only one publishing maturity tiers: 20 GA, 2 beta, 19 experimental, with cross-file dataflow in just 8. Greptile’s docs say “any programming language” with no list. Verified 2026-10-18.

Here is what each vendor actually documents, not what its marketing page claims.

Tool	Language claim	What is actually documented	Verifiable?
CodeRabbit	50-plus linters	Full language-to-tool map: Go (golangci-lint), Java (Infer, PMD), Python/Jupyter (Ruff, Pylint, Flake8), JS/TS/JSX/TSX (Biome, oxlint, ESLint, React Doctor), Rust (Clippy), Kotlin (detekt), Swift (SwiftLint), C/C++ (Infer, Clang-Tidy, Cppcheck), PHP (PHPStan, PHPMD, PHPCS), Ruby (RuboCop, Brakeman), SQL (SQLFluff, Squawk), Terraform (TFLint, Checkov, Trivy), Shell (ShellCheck), Fortran (Fortitude), Lua (Luacheck), Verilog (Verilator), plus GitHub Actions (actionlint, zizmor) and Prisma	Yes, fully
Semgrep	40-plus	20 GA, 2 beta, 19 experimental. Cross-file dataflow in 8: C#, Go, Java, JavaScript, Kotlin, Python, TypeScript, C/C++. Cross-function only: JSX, Ruby, Scala, Swift, Rust, PHP, Terraform, JSON. Pro rules: 710-plus Python, 170-plus C#	Yes, with tiers
Codacy	40-plus	Named set including Python, Java, JS, TS, Go, Rust, C, C++, C#, Ruby, PHP, plus Terraform, Kubernetes, Docker, CloudFormation, ARM templates and JSON/XML/YAML/Markdown/Shell	Yes, list published
DeepSource	30-plus	5,000-plus deterministic rules run before the AI agent sees the code. Per-language rule counts not published. Acquired by Harness 9 Sept 2026	Partly
Korbit	21 named	JavaScript, TypeScript, Python, Java, Groovy, PHP, C#, C, C++, Go, Swift, Kotlin, Ruby, Dart, Rust, Scala, Shell, Vue, Fortran, Perl, Pascal	Yes, enumerated
Sourcery	Any	Docs: reviews code in “any language GitHub recognizes as a programming or markup language”. Historically Python-first	Unfalsifiable
Greptile	Any	Docs: “All languages supported - Greptile works with any programming language in your codebase.” No list, no tiers	No
Qodo	Not stated	Publishes a per-platform feature matrix but no per-language one	No
Gitar	Not stated	Publishes a per-platform capability grid. No language list	No
Cursor Bugbot	Not stated	No published language list. Reads BUGBOT.md by walking up from changed files	No
Claude Code Review	Not stated	No language list. Multi-agent topology with a verification step. Never builds or runs your code	No
GitHub Copilot code review	Not stated	No language list. ReviewBench dataset covers 19 languages but scores are not broken out	No
PR-Agent	Model-dependent	Language support is whatever the configured model handles. MIT since 23 April 2026	n/a by design

The honest reading: “30-plus languages” and “40-plus languages” are not comparable numbers because nobody defines the threshold. Semgrep is the only vendor in this category that says out loud which languages are experimental, and it pays a marketing cost for that honesty. When you are comparing, ask one question: name the static analyser you run on my primary language. CodeRabbit, Semgrep and Codacy can answer it. The rest cannot.

A note on Qlty, since it comes up here: its CLI is fair source (BSL 1.1), not open source. Do not shortlist it as an open source multi-language option.

Best AI code review tools for mixed-language repositories

Direct answer: The hard work in a polyglot repo is not the AI reviewer, it is per-language linter configuration, and the tool that does it for you wins. CodeRabbit invokes a tool only when the repository contains files it understands, which is the correct default for a mixed repo. Qodo documents folder-specific and language or framework filtering. Expect your real cost to be config, not licence. Verified 2026-10-18.

A repository with Go services, a TypeScript frontend, Python data jobs, Terraform and SQL migrations has five deterministic toolchains, five config files, five sets of ignore rules and five CI jobs. That is the problem. The AI reviewer is the easy part.

What to look for, in order.

1. Automatic tool selection by file type. CodeRabbit’s docs state tools “are only invoked when the repository contains files they understand.” That removes the five-CI-jobs problem for the languages it covers.
2. Path-scoped configuration. Qodo documents folder-specific and language or framework filtering, with Gerrit the one provider where it does not work. Cursor Bugbot reads BUGBOT.md by walking up from the changed files, which is path-scoping by convention. Anthropic’s Code Review reads REVIEW.md from the base branch, never from the PR’s own diff, so a pull request cannot weaken its own review rules - the best-designed configuration model in this category.
3. Per-path severity. You want generated code, vendored directories and migrations treated differently from application logic. Qodo’s per-provider matrix notes that severity thresholds for inline comments are unavailable on Bitbucket and Gerrit, which is a real constraint if you are polyglot and on Bitbucket.
4. Monorepo awareness. Covered in AI code review for a large codebase rather than repeated here.

The cost shape bites harder in a mixed repo. CodeRabbit caps files per review at 150 on Free and Essentials and 300 on Team and above, with usage-priced on-demand reviews hard-stopping above 300 files. A polyglot change that touches a proto file, two generated clients, a migration and a Terraform module hits file counts fast. Macroscope bills $0.05 per KB reviewed with a $0.50 floor and four modes (Budget $0.025/KB, Balanced $0.05, Precise $0.06, Ultra $0.20 - an 8x spread inside one vendor), which is the most predictable shape for repos with wildly varying diff sizes. Full arithmetic in the AI code review price book.

AI code review software for mobile app teams

Direct answer: No benchmark covers Swift or Kotlin. Neither appears as a named language bucket in GitHub’s ReviewBench 219-PR split. CodeRabbit runs SwiftLint on Swift and detekt on Kotlin; Semgrep lists Kotlin as GA with cross-file dataflow and Swift as GA with cross-function only. Mobile CI economics change the calculus: build-and-verify review strategies are uneconomic when a verification run needs a macOS runner. Verified 2026-10-18.

Mobile is the clearest example of a stack where the generic advice is wrong.

The evidence vacuum is total. Swift and Kotlin are not in ReviewBench’s named language distribution (TS 68 / Py 41 / C# 25 / Go 19 / JS 15 / other 51). They are not separable in Entelligence’s per-repository tables. c-CRAB’s 67 repositories do not break out by language. There is zero published performance data on AI review of Swift or Kotlin code. Any page telling you tool X is best for iOS review is guessing.

The deterministic layer is mature and cheap, so use it. Swift: SwiftLint plus SwiftFormat plus Xcode’s static analyser. Kotlin: detekt plus ktlint plus Android Lint, and Android Lint in particular catches platform-specific classes (API-level misuse, resource leaks, manifest issues) that no general AI reviewer models. CodeRabbit runs SwiftLint and detekt; it does not document ktlint or Android Lint, so you still own those. Our deeper pages: Swift static code analysis tools and Kotlin static code analysis tools.

Why mobile CI changes the tool decision. Several reviewers in this market differentiate on verifying their findings by running code. Gitar operates fix, commit, run CI, commit only on green, with automatic follow-up repair if its own fix breaks the build - and Sonar’s own material states a green build is evidence, not proof. That loop is attractive on a Go service and expensive on an iOS app, where a verification run means a macOS runner and a multi-minute Xcode build per attempt. Gradle builds on Android are not much better. On mobile, prefer reviewers that reason statically over reviewers that build. Anthropic’s Code Review is explicit that it never builds or runs your code, which on mobile is a feature rather than a limitation.

The platform-specific risks a general reviewer will miss. Main-thread blocking, retain cycles and @MainActor misuse on Swift. Coroutine scope leaks, lifecycle-aware collection and lateinit on Kotlin. Build-variant and ProGuard or R8 configuration on Android. Privacy manifest and ATT changes on iOS, where a code change can break App Store review rather than the app. None of these are in any AI reviewer’s documented capability set, and all of them are in detekt, ktlint or Android Lint rule sets. That is the whole argument for determinism first on mobile.

AI code review for infrastructure as code

Direct answer: A different risk surface entirely: drift, over-broad IAM, public exposure and destructive plan operations, not logic bugs. The coverage is in the deterministic layer. CodeRabbit runs TFLint, Checkov and Trivy on Terraform, Hadolint, Checkov and Trivy on Docker, Checkov on JSON and YAML. Codacy documents Terraform, Kubernetes, Docker, CloudFormation and ARM templates. No AI reviewer in our matrix reads terraform plan output by default. Verified 2026-10-18.

Infrastructure code fails differently and the review has to be built differently.

The failure modes that matter. A security group opened to 0.0.0.0/0. An IAM policy with a wildcard action that enables privilege escalation two hops later. A lifecycle block removed so a stateful resource becomes destroy-and-recreate. A storage bucket whose public-access block is dropped. State drift between what the code says and what the account contains. Not one of these is a logic bug, and most are invisible in the diff alone.

The deterministic layer, which is where the real coverage is. Checkov and Trivy for misconfiguration policy, TFLint for provider-specific validity, terraform validate and terraform fmt as the baseline, Conftest/OPA or Sentinel for organisational policy as code. On Kubernetes: kube-linter, kubeconform for schema, Checkov or Trivy for workload security, Polaris for best practice. CodeRabbit runs Checkov and Trivy as multipurpose IaC-security tools across all languages, plus TFLint on Terraform specifically, plus actionlint and zizmor on GitHub Actions workflows - zizmor being a workflow-security auditor that catches the supply-chain class of CI misconfiguration. That is the single most useful IaC detail in CodeRabbit’s tool list and nobody writes about it.

What AI review adds, and the gap it does not close. AI is good at the cross-file question a policy scanner cannot ask: “this module now takes a public_access variable and three callers do not set it, so what is the default?” It is also good at spotting that a variable name no longer matches its use. What it does not do is read the plan. A two-line diff can produce a destroy-and-recreate on a database, and the diff gives no signal. If you want that caught, run terraform plan in CI and gate on the plan output with a policy tool. No AI reviewer in our matrix does this for you.

Semgrep’s position is worth knowing precisely. Terraform is in Semgrep’s generally-available tier but with cross-function rather than cross-file dataflow, so cross-module taint across a Terraform codebase is not what you are getting. Dockerfile and YAML are experimental. Codacy’s IaC coverage (Terraform, Kubernetes, Docker, CloudFormation, ARM) is the broadest named set we verified, though the Codacy AI Reviewer is cloud-and-GitHub-only, so GitLab, Bitbucket and GHES teams get the deterministic IaC analysis without the AI layer.

More on the security framing in AI code review for security.

Can AI review database migrations?

Direct answer: Technically yes, and most AI reviewers treat a migration as an ordinary diff, which is the problem. Migrations are frequently irreversible, so review matters more and the generic review helps less. CodeRabbit is the only tool in our matrix running a migration-specific linter: Squawk (alongside SQLFluff) on SQL. No AI reviewer reads your migration against the live schema. Verified 2026-10-18.

This is the highest-stakes diff your team ships and the least-reviewed by tooling.

Why migrations are different. A failed application deploy rolls back. A migration that drops a column, rewrites a 200-million-row table under an exclusive lock, or adds a NOT NULL column without a default does not roll back cheaply or at all. The risk is not in the SQL being wrong, it is in the SQL being correct and operationally catastrophic. A generic reviewer reading 12 lines of ALTER TABLE has no basis to know the table has 200 million rows.

The deterministic tools that exist, which almost nobody wires up.

• Squawk - a linter for Postgres migrations specifically. It flags the operations that take dangerous locks, require table rewrites, or break backward compatibility during a rolling deploy. CodeRabbit runs it on SQL files. This is a genuine differentiator and CodeRabbit does not market it.
• SQLFluff - dialect-aware SQL linting and formatting. Also in CodeRabbit’s list.
• Atlas and Sqitch for declarative schema management with their own lint passes.
• Framework-level: django-pg-zero-downtime-migrations, Rails’ strong_migrations, and ActiveRecord’s safety_assured escape hatch, all of which encode the same lock-safety rules.

What to require in review, independent of tool. Every migration gets: a stated expected lock type and duration, a row-count estimate for the affected table, an explicit backward-compatibility statement for the rolling-deploy window, and a documented rollback path or an explicit note that there is none. That is a pull request template, not an AI feature, and it will prevent more incidents than any reviewer on this page.

What to ask a vendor. Does your reviewer treat migrations/** differently from application code? Does it run a migration-specific linter? Can I set a higher severity floor or a required human reviewer on that path? As of 2026-10-18, the only vendor whose published tool list answers yes to the second question is CodeRabbit, and we could find no vendor marketing migration review as a capability. If this is your risk, build it yourself: Squawk in CI, a migration section in the PR template, and a human reviewer required on the migrations path.

How we verified this

Everything was checked on 2026-10-18 against vendor documentation and primary benchmark sources.

What we checked and where:

• Per-language tooling: CodeRabbit’s full tool list, which maps 50-plus linters to specific technologies. Every per-language tool attribution in this article comes from that page, including Squawk for SQL, Fortitude for Fortran, Verilator for Verilog, zizmor for GitHub Actions and Infer for both Java and C/C++. CodeRabbit’s tools overview for the statement that “tools are only invoked when the repository contains files they understand.”
• Semgrep maturity tiers: docs.semgrep.dev/supported-languages for 20 generally available, 2 beta and 19 experimental languages, the 8-language cross-file dataflow list, the cross-function-only list, and the 710-plus Python and 170-plus C# Pro rule counts.
• Greptile’s language claim: Greptile’s docs, verbatim: “All languages supported - Greptile works with any programming language in your codebase.” No list and no tiers on that page.
• Sourcery’s language claim: Sourcery’s code review docs, verbatim: it reviews code in “any language GitHub recognizes as a programming or markup language.”
• Codacy: supported languages and tools for the 40-plus figure and the named IaC set (Terraform, Kubernetes, Docker, CloudFormation, ARM templates).
• Korbit’s 21 languages: Korbit’s own site and marketplace material. We could not reach a docs.korbit.ai documentation site on 2026-10-18.
• Qodo’s per-provider matrix: git provider feature support, used here for the folder-specific and language or framework filtering capability and the Bitbucket and Gerrit severity-threshold limitation.
• Benchmarks: the Entelligence 2026 benchmark per-repository tables for the Grafana (Go) and Cal.com (TypeScript) figures, SWE-PRBench for the 15-31% detection band and the per-model false-positive rates, CR-Bench for the 27.01% recall at 3.56% precision figure, CRBugBench for the pre-merge versus post-merge recall split, c-CRAB for the per-tool figures and the 41.5% union, CRJudgeBench for the invalid-review-comment question, and GitHub ReviewBench for the language distribution, the 219-PR / 187-repo / 19-language dataset and the 96.6% human agreement figure. We classified each by whether the publisher sells a code reviewer.

What we could not verify:

• Any per-language precision or recall figure from any vendor, for any product. None exists. We searched vendor docs, vendor benchmark pages and the six published benchmarks. Entelligence’s per-repository table and ReviewBench’s dataset distribution are the closest anything comes, and neither is a per-language score. This is the central finding of this article and we would rather state the gap than fill it with an estimate.
• Whether the Grafana Go result generalises. One repository, one vendor-run study, one language. Perfect precision at 33.3% recall is a real number from a real run; whether it is a Go effect, a Grafana effect or a sampling artefact is not determinable from the published data.
• Per-language rule counts for DeepSource. DeepSource publishes 5,000-plus rules across 30-plus languages but not the split. Its documentation site returned 404 on the analyzer pages we tried on 2026-10-18, and it has been a Harness product since 9 September 2026, so the roadmap is in flux.
• Language lists for Qodo, Gitar, Cursor Bugbot, Anthropic’s Code Review and Copilot code review. None publishes one. For four of the most-recommended reviewers in this market, there is no document that says which languages are supported to what standard. We have recorded that as “no” in the verifiability column rather than inferring a list.
• Whether any AI reviewer path-scopes database migrations by default. We found no vendor documenting it and no vendor marketing it. Reported as absent, which for a change class this irreversible is the finding.
• Gemini Code Assist’s free tier. One source says it stopped serving requests on 18 June 2026, another still advertises it, and Google’s docs say a GitHub app install gets 100-plus PR reviews per day. We excluded it from every table rather than guess.
• Tabnine pricing or language support. Acquired by Tricentis, announced 2026-07-30; the pricing page now redirects to a contact form.

Recommendations

Criteria stated: a named static analyser for your primary language, published evidence where it exists, and an honest admission where it does not. Because no per-language performance data exists, we are ranking on documented capability, which is the only thing that can be checked.

If you want the broadest documented per-language coverage: CodeRabbit, and read the tool list before you buy. It is the only reviewer publishing a language-to-linter map, and that map is where its real value sits: golangci-lint on Go, Infer plus PMD on Java, Clippy on Rust, detekt on Kotlin, SwiftLint on Swift, Squawk on SQL migrations, zizmor on GitHub Actions workflows. Check your own language against that page before signing. Pricing is $24/dev/mo on Essentials annual, 1 linked repository, 150 files per review, with $0.25 per reviewed file past the hourly limit. Details in CodeRabbit pricing.

If security is the driver and your language is in the top tier: Semgrep, and budget for the Pro engine. Cross-file dataflow exists for C#, Go, Java, JavaScript, Kotlin, Python, TypeScript and C/C++ and nowhere else. Python gets 710-plus Pro rules. Know the licence wall going in: interfile taint is proprietary-only and Semgrep CE cannot do it. Semgrep Team is modular at Code $30, Supply Chain $30 and Secrets $15 per contributor per month, and semantic secrets analysis is excluded from the free tier. Also worth knowing: Semgrep Inc. is explicitly not ISO 27001 certified per its own docs, contradicting several aggregator profiles, and the Network Broker is a WireGuard tunnel to Semgrep’s cloud rather than on-prem deployment.

If you are a single-language team with discipline: spend on determinism first and treat AI review as the last 20%. Add mypy --strict or pyright on Python. Add Error Prone on Java. Add strict tsc plus typescript-eslint on TypeScript. Add golangci-lint on Go. Each eliminates a whole class of defect for free and permanently, and each makes your eventual AI reviewer’s findings more interesting because the mechanical ones are gone before it looks. DeepSource had the right architecture here - 5,000-plus deterministic rules run before the AI agent sees the code - and the ordering is worth copying whichever tools you use.

If you are polyglot: pick on automatic tool selection and path scoping, not on language count. CodeRabbit invokes tools only for file types present. Qodo supports folder-specific and language or framework filtering. Anthropic’s Code Review reads REVIEW.md from the base branch so a pull request cannot weaken its own rules, which is the best configuration design in this category. Budget your real cost as configuration time, not licence fees.

If you are a mobile team: SwiftLint, detekt, ktlint and Android Lint first, and prefer a reviewer that does not build. There is no published Swift or Kotlin review data, so do not let anyone sell you a mobile-specific claim. Anthropic’s Code Review never builds or runs your code, which suits mobile CI economics. Build-and-verify loops like Gitar’s fix-then-green-CI approach are strong on backend services and expensive when verification needs a macOS runner and an Xcode build per attempt.

If you ship infrastructure as code: the AI reviewer is the smallest part of the answer. Checkov plus Trivy plus TFLint on Terraform, kube-linter plus kubeconform on Kubernetes, Hadolint on Dockerfiles, and zizmor plus actionlint on your workflows. Then gate on terraform plan output with a policy tool, because the destroy-and-recreate risk is invisible in the diff and nothing on this page catches it for you.

If you ship database migrations: build the control yourself, today. Squawk in CI, a migrations section in the pull request template requiring expected lock, row-count estimate, backward-compatibility statement and rollback path, and a required human reviewer on the migrations path. CodeRabbit is the only vendor whose published tool list runs a migration linter, and no vendor markets migration review as a capability. For the single most irreversible change class your team ships, the tooling market has not shown up.

And the line to carry into every vendor call. No party without a commercial stake has published a false-positive rate, precision figure or noise measurement for any shipping commercial AI code reviewer - and nobody at all has published one broken out by language. SWE-PRBench and CR-Bench publish false-positive data, but for bare models in fixed harnesses, not products you can buy. Ask every vendor for per-language numbers. When they cannot produce them, you have learned the most important thing on the call. Then pick on host constraints too: AI code review for GitLab, Bitbucket and Azure DevOps covers the other half of this decision, and best AI code review tools is the overall shortlist.