AI Code Review Vendors for Large Engineering Organisations (2026)

Direct answer

Above roughly 200 developers this stops being the same purchase at a bigger number. A third of the market is not purchasable at all: Qodo caps at 30 users, Codacy Team at 30 developers, Gitar at 50, Ito Pro at 25 engineers. SSO, audit logs and RBAC are Enterprise-tier only at CodeRabbit, and self-hosting there needs 500 or more seats. And consolidation is now a contract term, not a market observation: four tracked vendors changed owner in 14 months. Verified 2026-10-19.

This page covers what changes at scale. For the process around it, read how to buy AI code review software. For the numbers, the AI code review price book. For the deployment-architecture detail, AI code review for enterprise.

AI code review vendors for enterprise teams

Direct answer: Eleven vendors are credibly purchasable above 200 developers: CodeRabbit, Greptile, Qodo, Codacy, DeepSource, Semgrep, SonarQube, Snyk, GitHub Copilot, Anthropic Code Review and CodeAnt, plus self-hosted PR-Agent and Kodus at no licence cost. The rest cap out below your headcount or publish no enterprise path. Verified 2026-10-19.

The useful filter at this size is not quality, it is whether the vendor can sell you the shape of thing you need. Here is the enterprise-relevant row for each candidate.

Vendor	Enterprise price published	Seat cap on self-serve	SSO, audit logs, RBAC	Self-hosting	Repository ceiling	Owner, and when it changed
CodeRabbit	No. Contact Us	None, but Essentials links 1 repo	Enterprise tier only	Enterprise, 500+ seats required	20 linked repos on Enterprise	Independent. $143M Series C at $1.5B, 12 Aug 2026
Greptile	No. Custom	None published	Enterprise	Enterprise	Unlimited	Independent. $25M Series A, Sept 2025
Qodo	No. Custom above 30 users	30 users	Enterprise	On-prem and VPC, Enterprise	Not published	Independent
Codacy	No. Business custom	30 developers on Team	Enterprise	Codacy Self-hosted; AI Reviewer is cloud-and-GitHub-only	100 private repos on Team	Independent
DeepSource	No. Custom	None published	Enterprise	Enterprise	Not published	Harness, 9 Sept 2026
Semgrep	No. Custom	None	Enterprise	No on-prem. Network Broker is a tunnel to Semgrep cloud	Unlimited	Independent
SonarQube	No. Custom above 50 devs	Priced on lines of code	Enterprise	Fully on-prem, Server editions	Unlimited	Sonar. Acquired Gitar May 2026
Snyk Code	Yes. Credit platform, 1 credit = $1	100 projects on Team	Enterprise	No on-prem. Snyk Broker is a tunnel	Project counts, not repos	Independent
GitHub Copilot	Yes. $39/user/mo Enterprise	None	GitHub’s own identity stack	No. Review service stays in GitHub cloud	None	Microsoft
Claude Code Code Review	Claude Enterprise $20/seat/mo annual, 20-seat min	None	Anthropic’s enterprise controls	No	None	Anthropic
CodeAnt AI	No. Custom	None published	Enterprise	Enterprise	Unlimited on Premium	Independent
Gitar	Yes. Core $20, Pro $40 annual	50 users on both tiers	Enterprise	Enterprise	Unlimited	Sonar, May 2026
PR-Agent	N/A. MIT licence	None	Yours to build	Yes, fully	Unlimited	Community governance since 23 Apr 2026

Read the cap column as the real shortlist mechanism. At 200 developers, Qodo, Codacy Team, Gitar Core and Pro, Ito Pro, Bito Team and Entelligence Scale are simply not purchasable self-serve at any price. That is not a pricing problem, it is a product-boundary problem, and it is the real reason “contact us” exists on so many pages. All the prices behind this table are in the price book.

AI code review vendors for large engineering organisations

Direct answer: Four things change above 200 developers and price is not one of them. Identity requirements decide your tier, because SSO, audit logs and RBAC are Enterprise-gated nearly everywhere. Repository topology beats seat count. Self-hosting has a seat floor rather than a price. And a multi-year contract in a consolidating market needs assignment, continuity and price-protection clauses. Verified 2026-10-19.

Seat economics stop being linear

At 20 developers the seat price is the decision. At 200 it is the least interesting variable, for three reasons.

Your billable count is not your headcount, and the gap grows with size. CodeRabbit bills only developers who create pull requests, which in most orgs is 60 to 70 percent of engineering headcount. At 200 headcount and 140 pull request authors, CodeRabbit Team at $48 is $241,920 over three years rather than $345,600. That is a $103,680 difference produced entirely by reading the seat definition. Greptile bills any developer who received a review in the period, which fluctuates month to month and whose credits are per author and never pool. Snyk bills contributing developers by Git author email over a rolling 90 days, so a leaver bills for a quarter. DeepSource bills every member and admin whether or not they commit, so dormant accounts cost full price. Run git shortlog -sne --since="90 days ago" against your private repositories and pull a distinct pull-request-author list before you price anything.

The caps bite before the budget does. See the table above. A third of the market is out at 200 seats.

And the price that matters is the delta against what you already own. If you hold GitHub Copilot Business at $19 or Enterprise at $39, code review is already included, so the question is not “what does CodeRabbit cost” but “what does CodeRabbit add over a reviewer we are already paying for”. Nobody in this market frames it that way because every vendor loses that framing.

Where usage pricing beats seats, and where it does not

The crossover is around 30 reviews per developer per month. Below it, usage pricing wins because you stop paying for dormant seats. Above it, seat pricing wins because the marginal review is free.

Model	200 devs, 10 PRs each (2,000 reviews/mo)	200 devs, 40 PRs each (8,000 reviews/mo)	Enterprise objection
Macroscope Balanced, $0.05/KB, $0.50 floor	~$1,900/mo at a 19 KB average diff	~$7,600/mo	Every re-review billed separately. No committed-spend anchor. Unpredictable line for finance
CodeRabbit Essentials $24	$4,800/mo at 200 seats, $3,360 at 140 PR authors	Same. Marginal review free	1 linked repo on this tier makes it unusable at scale anyway
CodeRabbit Team $48	$9,600/mo at 200, $6,720 at 140 authors	Same	5 linked repos
Snyk Enterprise credits, 1.0 credit/active contributor/day	~$4,000/mo at 200 contributors active 20 days	Same. Not volume-linked	Meters on activity, not review count. Hard to forecast against hiring
Copilot Enterprise $39 + credits + Actions minutes	$7,800/mo + credits + unmodellable CI	Same + more credits	Actions minutes per review are not published. Cannot be forecast
Self-hosted PR-Agent	$0 licence + tokens + ops	$0 licence + tokens + ops	You now own an internal product. Staff it honestly

The enterprise-specific point most usage-pricing advocacy skips: usage billing gives you nothing to negotiate. A seat-priced vendor with a committed-spend contract will trade term length for rate. A per-KB meter has no rate card to discount and no commitment to reward. If you go usage at scale, the one thing to get in writing is a hard monthly dollar cap, and the one thing to measure first is your rounds-per-pull-request multiplier, because Macroscope bills push-triggered re-reviews each time.

Multi-repo and monorepo caps are the constraint nobody models

CodeRabbit’s linked-repository ladder is 1 on Essentials, 5 on Team, 10 on Advanced and 20 on Enterprise, confirmed on its own pricing page 2026-10-19. A 300-repository estate exceeds the top tier. That is a conversation to have in the first email, not the fifth.

File caps bite the other way. CodeRabbit caps at 150 files per review on Free and Essentials, 300 on Team and above, with usage-priced on-demand reviews hard-stopping above 300 files. A vendored dependency bump or a generated-client regeneration exceeds that routinely. GitHub removed Copilot’s 300-file and 20,000-line pull request caps on 27 August 2026 and added support for bot-authored pull requests, which is a genuine advantage at monorepo scale and which also invalidates any Copilot evaluation run before September 2026. If a comparison page cites a Copilot large-PR result from mid-2026, it is measuring a product that no longer exists.

cubic attaches reviewed-line allowances to seats at 40K, 80K and 160K lines per developer on Team, Pro and Max, and the allowance does not pool, which on a monorepo team with uneven contribution is a per-person cliff rather than a team budget. Snyk meters in project counts, which on a microservice estate is the binding constraint long before developer count is.

SSO, audit logs and RBAC decide your tier before your seat count does

At CodeRabbit the pricing page lists “custom roles and permissions, SSO, and audit logs” together on the Enterprise tier, verified at source 2026-10-19. The same three are Enterprise-gated at Codacy, Qodo, Sourcery, Gitar, Graphite, DeepSource and Semgrep.

The practical consequence is that your identity and audit requirements, not your headcount, determine which tier you buy. A 60-person company with a hard SSO mandate buys Enterprise. A 300-person company that will accept email-and-password for a code review tool may not need to. Ask which tier each of SSO, SCIM provisioning, RBAC and exportable audit logs lands on, as four separate questions, because they are not always on the same tier and no vendor volunteers the split.

On audit evidence specifically: what you need for SOC 2 change management is an exportable, immutable record of who approved what and when, and the AI reviewer’s comments are supporting evidence rather than the control itself. The detail is in AI code review for regulated teams and AI code review security.

Self-hosting at scale is a seat floor, not a price

CodeRabbit’s self-hosted option is available to Enterprise customers with 500 or more user seats, quoted from its own documentation and verified 2026-10-19. A 200-developer organisation with a hard on-premises requirement cannot buy it at any price. That is the single most surprising enterprise constraint in this market and it is almost never in a comparison table.

The genuinely on-premises options at scale are narrower than the marketing suggests. SonarQube Server runs its core SAST engine fully on-premises, and SonarQube AI CodeFix is documented as designed to operate without outbound internet access with Ollama, LiteLLM and vLLM named in the docs, which is the strongest documented air-gap plus bring-your-own-model combination in the market. GitLab Duo Code Review reached GA with self-hosted models in GitLab 18.4, covering Mistral, Llama, Claude and GPT via vLLM, Azure OpenAI or AWS. Kodus is AGPLv3 and free to self-host at any size with in-network models via vLLM, Ollama, TGI or LiteLLM. PR-Agent is MIT and runs as a CLI, Docker image, GitHub Action or webhook server against OpenAI, Claude, Gemini or local Ollama models.

What is not on-premises, despite the impression: Semgrep’s Network Broker and Snyk Broker are both tunnels to the vendor’s cloud rather than on-prem deployments, and Copilot’s review service stays in GitHub’s cloud even when validation runs on your self-hosted Actions runners. Three levels, laid out in self-hosted AI code review tools.

One more worth knowing before a regulated rollout: Anthropic Code Review is unavailable to organisations running zero data retention, the HIPAA configuration or customer-managed encryption keys. The configuration that makes Claude Code PHI-eligible disables Code Review. It does support GitHub Enterprise Server, which Copilot code review does not.

Who you actually get for support

Nobody in this market publishes a support SLA on a pricing page. Not one vendor we checked. So the whole of it is an order-form negotiation, and you should ask for four things by name: a named technical account manager rather than a shared inbox, a written response-time commitment by severity with the severity scale defined, a dedicated private channel, and a named escalation path for a bad-review incident at scale.

The thing that predicts rollout survival better than any of those is internal: one named person owning the rule file. Every rollout we have seen described in public that died at month three died of unmanaged noise, and unmanaged noise is a staffing decision rather than a vendor failure.

AI code review software vendors for enterprise teams

Direct answer: Pick by constraint, not by ranking. On-premises with air-gap: SonarQube Server, GitLab Duo self-hosted models, Kodus or PR-Agent. Azure DevOps Server: Gitar, PR-Agent or Kodus, and that is the whole list. 500+ seats wanting self-hosted CodeRabbit: available. Already on GitHub Enterprise: Copilot code review is a toggle, not a purchase. Verified 2026-10-19.

Five constraint-first shortlists, because “best enterprise AI code reviewer” is not a question with an answer.

If the review must run inside your network. SonarQube Server, which runs its core engine on-prem and documents air-gapped AI CodeFix with Ollama, LiteLLM and vLLM. GitLab Duo Code Review with self-hosted models, GA in GitLab 18.4. Kodus under AGPLv3. PR-Agent under MIT. CodeRabbit self-hosted if and only if you have 500 or more seats. Qodo documents on-prem and air-gapped deployment at Enterprise. That is the field.

If you are on Azure DevOps. Six vendors document support: CodeRabbit, Qodo, Gitar, PR-Agent, Kodus and CodeAnt, plus GitHub Copilot code review which entered public preview for Azure Repos in the sprint 279 update dated 4 September 2026. On Azure DevOps Server on-premises the documented list is three: Gitar, PR-Agent and Kodus. Full matrix in AI code review for GitLab, Bitbucket and Azure DevOps.

If you need a signed HIPAA BAA. Four of 26 vendors checked: Anthropic, Cursor at Enterprise, Augment Code and CodeAnt AI. And if you run Claude with ZDR, the HIPAA configuration or CMEK, Anthropic Code Review is off the table, which removes the strongest name on that list. See AI code review for regulated teams.

If licence and dependency compliance is in scope. No AI pull request reviewer does open source licence compliance, because an LLM reading a diff has no view of your transitive dependency graph. That is a software composition analysis function. Snyk Open Source, Semgrep Supply Chain at $30 per contributor per month, Aikido, Veracode and Checkmarx document it. The working pairing is one SCA tool enforcing licence policy as a blocking check plus one AI reviewer commenting on logic.

If you are already a GitHub Enterprise customer. Turn Copilot code review on before you buy anything. It is included from Copilot Pro at $10 upward per GitHub’s own documentation verified 2026-10-19, it bills on an invoice you already receive, and the only new cost is AI credits at $0.01 plus Actions minutes on private repositories that GitHub publishes no per-review figure for. Then measure, and buy a second reviewer only against that baseline. Detail in GitHub Copilot code review.

Consolidation risk is now a procurement consideration

This is the section nobody in this market writes, because almost everyone writing about it is an acquisition target or an acquirer.

Date	Deal	What it means for a buyer
19 Dec 2025	Cursor acquired Graphite	Graphite and Cursor Bugbot now share an owner. Pricing them against each other is pricing one vendor. graphite.dev now redirects to graphite.com
Aug and Sept 2025	Aikido acquired Trag, Allseek and Haicker	There is no standalone Trag to buy. trag.ai no longer hosts the tool. It ships as Aikido Code Quality, and Deep PR Review consumes credits on Advanced and above
May 2026	Sonar acquired Gitar	Gitar continues standalone, with its rate card now hosted on sonarsource.com. Your reviewer vendor and your static-analysis vendor may now be the same company
30 Jul 2026	Tricentis acquired Tabnine	Tabnine’s pricing page redirects to a Tricentis contact form. Every per-seat figure in circulation is unverified. We quote none
9 Sept 2026	Harness acquired DeepSource	DeepSource is a Harness product with 6,000+ customers inherited. If you bought DeepSource standalone, your renewal is now a Harness conversation
8 Oct 2026	Harness acquired Augment’s Cosmos, Auggie CLI and Code Context Engine	Cosmos becomes Harness Cosmos Software Factory Agent. Augment’s founding team including CTO Igor Ostrovsky joined. Also relevant to benchmark provenance: the Greptile re-run came from a team that now sits inside Harness

Harness alone has acquired 15 companies, including Codecov and ShiftLeft alongside DeepSource and the Augment assets. Harness had raised $600M; Augment $252M before the deal.

And the structural number that frames all of it: per Tracxn in October 2026 there are 351 automated code review startups, 85 of them funded, and only 37 at Series A or beyond. That is 314 companies that are not at Series A. Most of them will not be here in three years, and some of the ones that are will be inside somebody else.

Say it plainly: a three-year contract in this market needs three clauses.

Assignment. The agreement survives a change of control on identical commercial terms, with your pricing, your deployment model and your DPA intact. Without it, your rate is renegotiable by whoever buys them.

Continuity. A defined notice period for sunset or material change to the service, plus a full data and configuration export right. Precedent exists: Cursor removed the $40 standalone Bugbot seat effective at each customer’s first renewal after 8 June 2026, and CodeRabbit retired Lite and Pro Legacy on 8 June 2026. Products in this category do get withdrawn under existing customers.

Price protection. The rate fixed for the term, with a stated cap on renewal increase. At least nine material pricing changes landed in this market between April and October 2026, including GitHub retiring Copilot annual billing entirely on 1 June and cutting included AI credits by 36.7 percent for Business and 44.3 percent for Enterprise on 1 September. The change log is in the price book.

There is one genuinely consolidation-proof option and it is worth naming: a permissively licensed self-hosted reviewer cannot be acquired away from you. PR-Agent is MIT since 23 April 2026 under independent community governance and Kodus is AGPLv3. You trade review quality and vendor support for the certainty that nobody can reprice or retire it. For a large organisation with platform engineering capacity, that trade is more defensible than it looks. See open source AI code review tools.

Which AI code review tool is easiest for developers to adopt?

Direct answer: GitHub Copilot code review, because for most large organisations it is an organisation-level toggle inside a licence they already hold from Copilot Pro at $10 upward, with no new vendor, no new UI and no new login. Among dedicated reviewers, CodeRabbit adopts fastest because it reads rule files your repositories already contain. Verified 2026-10-19.

Adoption friction at scale is almost never about the review quality. It is about four things.

Where the comments appear. Anything that is not an inline comment on the pull request in the host your developers already use loses. Every serious vendor here does inline comments on the host; the ones that also provide a separate dashboard tend to find the dashboard unused.

Whether it blocks. This is the real adoption variable and it splits the market. GitHub’s Copilot code review can submit an approving review that satisfies a required-approval rule, the same way a teammate’s approval would. It is off by default and configurable at enterprise, org or repository level. Anthropic’s Code Review never approves and never blocks, by design. For adoption, non-blocking wins every time in the first quarter. For your SOC 2 separation-of-duties argument, a machine that can satisfy a single-approval rule weakens that control rather than strengthening it, so if you enable Copilot approvals, raise required_approving_review_count above 1 at the same time. GitHub’s range is 0 to 6; GitLab’s maximum is 100.

Whether it reads the rules you already wrote. CodeRabbit’s knowledge_base.code_guidelines.filePatterns defaults include **/REVIEW.md, **/CLAUDE.md, **/AGENTS.md, **/.cursorrules, .github/copilot-instructions.md, **/GEMINI.md and **/.windsurfrules. It reads its competitors’ rule files out of the box. At a large organisation where teams have already written agent instructions, that is a meaningful head start on tuning and the reason day-one output is less noisy than it would otherwise be.

Whether it deadlocks your merge queue. This is the best CI gotcha in the category and it is not a vendor problem. GitHub’s merge-queue merge_group event is separate from pull_request and push. If a required AI-review job triggers only on pull_request, the merge queue stalls permanently, because per GitHub’s own documentation the status check will not be triggered and the merge will fail as the required status check will not be reported. If you run a merge queue, test this in wave one of your rollout, not in production. More in what is a merge queue and AI code review in CI pipelines.

AI code review tools that follow team coding standards

Direct answer: Six vendors publish a real rule surface. CodeRabbit reads natural-language guidelines from a configurable file-pattern list and supports cross-repository references as owner/repo:path with globs. Anthropic reads REVIEW.md from the base branch so a pull request cannot alter its own rules. Qodo Merge exposes a 1 to 3 severity threshold. Cursor Bugbot uses .cursor/BUGBOT.md. Semgrep and SonarQube let you ship your own rules. Verified 2026-10-19.

At enterprise scale this is the feature that determines whether the tool is still on in month six, so compare the configuration surface rather than the output.

Vendor	Rule mechanism	Scope control	Severity control	The detail that matters at scale
CodeRabbit	Natural-language guidelines from knowledge_base.code_guidelines.filePatterns; defaults read REVIEW.md, CLAUDE.md, AGENTS.md, .cursorrules, copilot-instructions.md, GEMINI.md, .windsurfrules	Path patterns plus cross-repo refs as owner/repo:path with globs	Via guidelines and per-tool toggles	Cross-repo references mean one golden standards repo can govern many services. Best multi-repo governance story in the market
Anthropic Code Review	REVIEW.md, read from the base branch, never the PR’s own diff	Subdirectory REVIEW.md files add path-scoped checks	Three admin-set depth tiers per repo: Quick, Standard, Deep	Fails closed. Severity-lowering, path-exclusion and nit-capping additionally require the root file on a protected default branch; if protection cannot be confirmed it reads no instruction files at all
Qodo Merge	[review_agent] config keys	comments_location_policy, per-tier comments_routing	inline_comments_severity_threshold, a severity rank 1 to 3	It is a severity rank, not a confidence score. Many writeups including an earlier version of our own research called it a confidence threshold. It is not
Cursor Bugbot	.cursor/BUGBOT.md with upward directory traversal	Directory placement	review.effort	Separate .cursor/config/bugbot.yaml holds triggers.drafts, triggers.frequency as everyPush or oncePerPr, and review.incremental
Semgrep	You write the rules. Custom rule packs	Per-rule path include and exclude	Per-rule severity	Cross-file taint is proprietary-only via interfile: true or --pro. Semgrep CE cannot do interfile. Cross-file dataflow exists in only 8 languages
SonarQube	Quality profiles and gates, custom rules	Per-project profiles	Rule severity and gate conditions	Community Build cannot analyse pull requests and excludes taint analysis. Developer Edition is the minimum for branch and PR analysis

A correction worth making about SonarQube’s free boundary, because it gets drawn in the wrong place constantly, including in an earlier version of our own research. SonarQube Community Build does include secrets detection, per Sonar’s own live language overview. What it excludes is C, C++, Dart, Objective-C, PL/SQL, PowerShell, R, Shell, Swift and T-SQL, plus taint analysis, plus pull request analysis entirely: Sonar’s docs state verbatim that Developer Edition is the minimum required for branch analysis and pull request analysis and that SonarQube Community Build cannot analyze pull requests. SonarQube Cloud’s free tier is different and does include pull request analysis, up to 50,000 lines of code on private projects with no expiry. Those two products get conflated in nearly every comparison. For a C or C++ shop, the free Community Build is a non-starter on language coverage before you even reach the pull request limitation. Verified 2026-10-19.

Two caveats that belong next to this table at enterprise scale.

Anthropic’s fail-closed behaviour is the right design and the wrong surprise. Reading REVIEW.md from the base branch rather than the pull request’s own diff means a change cannot soften the rules it is reviewed against, which is exactly what you want for a control you intend to show an auditor. But the path-exclusion and nit-capping directives additionally require the root file to sit on a protected default branch, and if that protection cannot be confirmed it reads nothing at all. If your rules appear to be ignored, check branch protection before you file a support ticket. Note also that the local /code-review command reads CLAUDE.md but not REVIEW.md.

No product does CODEOWNERS-based routing of individual findings. You cannot say “send auth findings to the security team and style findings to nobody” in any tool we checked. That is a genuine market gap at large-organisation scale, where the right reviewer for a finding is frequently not the author. Related: only three vendors are verified write-capable into an issue tracker, meaning they can create a ticket rather than just read context. CodeRabbit via chat.integrations.jira.usage, Semgrep with severity-gated auto-creation on Jira Cloud only, and Snyk via a manual button plus two API endpoints. PR-Agent, Qodo Merge, Copilot, Cursor Bugbot, Graphite and Anthropic are read-only. Semgrep is the only vendor honest enough to document the negative, stating it does not support bi-directional or two-way status syncing. Full matrix in AI code review integrations.

Rollout sequencing for a large organisation

Four waves, comment-only throughout the first three. The goal of each wave is a decision, not a vibe.

Wave one, one volunteer team, 2 weeks. Comment-only. The deliverable is a noise baseline: classify every comment the tool produced as correct-and-useful, correct-but-trivial, or wrong. That classification, not the vendor’s benchmark, is your number. The rubric is in how to evaluate an AI code reviewer.

Wave two, 3 to 5 teams across different languages and repository shapes, 3 to 4 weeks. The rule file now has a named owner and gets tuned weekly. This wave exists because no vendor publishes per-language precision or recall for its own product, and neither SWE-PRBench, CR-Bench, CRBugBench nor c-CRAB has a language breakout. There is no published data to substitute for running it on your own languages. Pick teams whose stacks differ most.

Wave three, one full business unit, 4 to 6 weeks. This is where the infrastructure problems appear: the monorepo file cap, the merge queue merge_group deadlock, the CI minutes bill, the linked-repository ceiling. Budget for one of these to be a genuine blocker.

Wave four, everyone, still comment-only. Only after that, consider making anything blocking, and consider it per-check rather than globally. A blocking security finding is defensible. A blocking style nit is how you lose the tool.

Two numbers to size expectations with. Our own measurement of 2,896 human-authored merged pull requests across 10 repositories found inline review threads per 100 changed lines fall from 1.55 on pull requests under 50 lines to 0.085 on pull requests over 1,000 lines, an 18-fold drop in scrutiny density, and 52 percent of merged pull requests over 1,000 lines carried zero inline review comments. The honest counterpoint is in the same dataset: absolute comment counts rise with size at Spearman rho +0.355, so large changes are not ignored, just reviewed far less per line. That is the gap an always-on reviewer is best placed to close, and it is a better argument for buying one than any vendor benchmark. Method in how big should a pull request be.

And on the bottleneck itself: the median pull request spends 52.7 percent of its open-to-merge life waiting for the first human, at 8.7 hours p50, 66 hours p75, 212 hours p90 and 482 hours p95, while first-review-to-merge is 6.7 hours at p50. Buy against the wait, not against the review. Detail in pull request review time.

How we verified this

What we fetched directly, on 2026-10-19. CodeRabbit’s pricing page, which confirmed the 1/5/10/20 linked-repository ladder and that “custom roles and permissions, SSO, and audit logs” sit on the Enterprise tier. CodeRabbit’s self-hosted GitHub documentation, which states verbatim that the self-hosted option is available for CodeRabbit Enterprise customers with 500 or more user seats. Gitar’s platform support matrix, which lists GitHub, GitLab including self-managed and Free, Azure DevOps Services and Server, Bitbucket Cloud and Data Center as supported, AWS CodeCommit in preview, and GitHub Enterprise Server as not supported. Entelligence’s pricing page, which confirmed the $750 and $2,500 bands and the statement that the signed order form is the source of truth. Sourcery’s pricing page, which lists invoice billing as an Enterprise plan feature.

What we carried forward from our dated research pass of 2026-10-18 rather than re-fetching: the platform support matrix across 16 vendors, the compliance audit across 26 vendors, the full price table, the configuration-surface details for CodeRabbit, Anthropic, Qodo Merge, Cursor Bugbot, Semgrep and SonarQube, the GitHub Copilot entitlement wording and billing changes, and the acquisition dates. Each is sourced on the page it was published on: the price book, regulated teams, self-hosted tools and GitLab, Bitbucket and Azure DevOps.

Our own original data, harvested from the GitHub GraphQL API on 2026-10-18 and the only measurements on this page that are ours: the pull request size and scrutiny dataset, n=2,896 human-authored merged pull requests across 10 repositories with 104 bots removed, created 17 April to 17 October 2026, published with method and limits in how big should a pull request be; and the review latency dataset, n=2,189 human-authored merged pull requests across 12 repositories with bot authors and reviewers and self-reviews excluded, published in pull request review time. Disclosed limits on both: only merged pull requests are in frame, which biases latency downward, and Kubernetes and Rust are Prow and bors artefacts and were excluded from the approver analysis.

What we could not verify.

• Any support SLA. No vendor in this market publishes a support response-time commitment on a pricing or documentation page. Every SLA statement on this page is a recommendation of what to ask for, not a report of what exists.
• Enterprise discount depth. No vendor publishes a volume curve. Every enterprise figure here is list price.
• Average sales cycle length. Not published by any vendor and no industry dataset exists for this category.
• GitHub Actions minutes consumed per Copilot review. GitHub states its credit estimates exclude Actions minutes and publishes no minute figure. Unmodellable from public data.
• Repository ceilings at Greptile, Qodo, DeepSource and CodeAnt. All advertise unlimited or publish nothing. We could not find a stated hard ceiling, which is not the same as confirming there is none.
• Whether assignment and continuity clauses are commonly granted. We can tell you to ask and why. We have no data on acceptance rates.
• Harness’s roadmap for DeepSource and the Augment assets. The acquisitions are confirmed and dated. What happens to the products is not public.

On review quality, and why this page does not rank on it. No party without a commercial stake has published a false-positive rate, precision figure or noise measurement for any shipping commercial AI code reviewer. SWE-PRBench and CR-Bench do publish false-positive and precision data, but they measure bare models in fixed harnesses rather than products you can buy. Every benchmark of a buyable product was published by a vendor that wins it: Greptile scored Greptile at 82 percent and Augment’s re-run on the same repositories scored it 45 percent as an F-score, with Augment also having expanded and corrected the golden comments by reviewing each pull request manually, so part of that gap is a different answer key rather than pure self-dealing. DeepSource scored itself at 84.51 percent F1. Entelligence won its own benchmark at 47.2 percent aggregate F1. Four different vendors have each declared themselves number one on the Martian Code Review Bench. The full provenance ledger is in AI code review benchmarks compared. One disclosure we repeat everywhere: c-CRAB is academic but one of its six authors lists SonarSource as his affiliation, and Sonar sells SonarQube and acquired Gitar, which sponsors this site. The paper carries a disclaimer that its conclusions do not represent SonarSource policy, and SonarQube is not among the four tools it evaluates.

Disclosure. Gitar is a paying sponsor of this site. Ito is an unpaid editorial baseline partner. Sponsorship buys placement, never editorial treatment. Gitar appears in the table above with its 50-user cap and its GHES gap stated, and it still has no published third-party review-quality benchmark, which we note wherever review quality is discussed.

Recommendations

Criteria: purchasable at your size, under your deployment and identity constraints, with contract terms that survive a change of owner. Not review quality, because the independent evidence to rank on does not exist.

If you are already on GitHub Enterprise, start with Copilot code review and buy nothing. It is included from Copilot Pro at $10 upward, it bills on an invoice you already have, GitHub removed the 300-file and 20,000-line caps on 27 August 2026, and it is the only reviewer in this market that needs no new vendor relationship. Measure it for a quarter. Then the question becomes what a dedicated reviewer adds over a baseline you already own, which is a much better question than the one vendors want you to ask.

If you need on-premises at 200 to 499 developers, CodeRabbit is not a candidate. The self-hosted option needs 500 or more seats. Your field is SonarQube Server, GitLab Duo with self-hosted models from 18.4, Qodo Enterprise on-prem or air-gapped, Kodus under AGPLv3 and PR-Agent under MIT. SonarQube has the strongest documented air-gap plus bring-your-own-model story, with Ollama, LiteLLM and vLLM named in its own docs.

If you have more than 20 repositories and are considering CodeRabbit, price Enterprise and ask about the ceiling in the first email. The published ladder tops out at 20 linked repositories on Enterprise. A 300-repo estate needs that answered before a security review, not after.

If your estate is Azure DevOps Server, accept that your shortlist is three names and that two of them are open source. Gitar, PR-Agent and Kodus. Any listicle that recommended cubic, Graphite, Macroscope or Cursor Bugbot to you did not check: those four are GitHub-only.

If you run fewer than 30 reviews per developer per month, model usage pricing seriously. At 200 developers and 10 pull requests each, Macroscope in Balanced mode is roughly $1,900 a month against $4,800 for CodeRabbit Essentials at full seat count. Measure your rounds-per-pull-request first, because re-reviews bill separately, and get a hard monthly dollar cap in the order form because a meter has nothing to negotiate.

What I would not sign at any size: a three-year agreement without assignment, continuity and price-protection clauses. Four of the vendors we track changed owner in fourteen months, nine material pricing changes landed in six, and Tracxn counts 351 companies in this category with only 37 at Series A or beyond. Those three clauses cost the vendor nothing today and are the only thing that makes a three-year number mean anything. If a seller will not discuss them before a security review, that is information.

And the hedge worth taking seriously at scale: keep one permissively licensed self-hosted reviewer running in parallel on a subset of repositories. PR-Agent under MIT cannot be acquired away from you, repriced, or retired under your feet. In a market this consolidated, a free fallback you have already operationalised is worth more than its review quality suggests.

Next: the procurement process end to end in how to buy AI code review software. The numbers in the price book and what does AI code review cost. Billing mechanics in monthly versus annual. The trial protocol in how to evaluate an AI code reviewer. The architecture view in AI code review for enterprise. And if the real constraint is budget, cheapest AI code review tools.