Best AI Code Review Tools for a Large Codebase (2026)

Direct answer

The thing that decides review quality on a large codebase is not the model. It is whether the reviewer indexes your repository or only reads the diff. A reviewer that sees only the patch produces patch-quality comments: it can tell you the change is internally wrong, never that it breaks a caller three files away. Greptile, Qodo, Augment and Sourcegraph index. Cursor Bugbot is documented as diff-only. Copilot and Claude retrieve agentically. Verified 2026-10-18.

Disclosure: Gitar is our AI code review category partner. Partners get a guaranteed entry in relevant lists, never a rating, a rank, or the removal of a criticism. Gitar publishes no third-party context-architecture detail and no independent review-quality benchmark, and we say so below.

Best AI code review tools for a large codebase

Direct answer: Shortlist on context architecture. Greptile and Qodo document full-repository indexing with retrieval, which is what cross-file reasoning requires. Pair either with a deterministic scanner, because in Augment’s 450,000-file monorepo test the only three production-viable tools of 10 were SonarQube, Semgrep and CodeQL - all rule-based. Cursor Bugbot is diff-only by design. Verified 2026-10-18.

This is the organising table of the page. Every entry is what the vendor documents, because no independent source validates any of these architecture claims.

Tool	Indexes full repo	Dependency / call graph	Expands context around the diff	Cross-repo reasoning	Monorepo mechanism	Basis of claim
Greptile	Yes. AST parse, recursive docstring generation, embeddings	Yes. Graph of files, functions, classes, dependencies	Yes. Agentic loop traverses callers, checks git history	Yes, documented for multiple indexed repos	Repo-level index, review depth tiers	Vendor docs + API
Qodo	Yes. Semantic database with language-aware chunking	Not documented	Yes. RAG retrieval, re-ranking, noise filtering	Yes, via rag_repo_list	best_practices.md, path-based matching, PR compression	Vendor engineering blog + docs
Augment Code Context Engine	Yes. Up to 400,000 files, real-time reindex	Yes. Function signatures, class hierarchies, import chains, API contracts	Yes. Retrieves a relevant slice into a 200K-token window	Yes, documented cross-repository relationships	Built for monorepos specifically	Vendor marketing. Assets acquired by Harness 8 Oct 2026
Sourcegraph Cody	Yes. Scheduled refresh cycles	Code intelligence / cross-repo search	Yes	Yes, its core product	Multi-repo code search	Vendor docs
CodeRabbit	Partial. Knowledge base of learned findings, not a published full index	Not documented	Yes. Pulls related files, runs linters and static analysers	Yes, via linked repos, capped 1 / 5 / 10 / 20 by tier	path_filters and path_instructions in .coderabbit.yaml	Vendor docs
GitHub Copilot	No prebuilt index. Agentic tool calls	No	Yes. Tool calls pull related files, directory structure, references	Not documented	Path-based content exclusion at repo, org or enterprise level	GitHub docs + changelog
Claude Code Review	No prebuilt index. Multi-agent exploration	No	Yes. Agents explore the repo, read-only	Not documented	REVIEW.md and CLAUDE.md, three depth settings	Anthropic docs
Cursor Bugbot	No. Documented as diff-only, incremental by default	No	Minimal. Changed files, PR comments, BUGBOT.md chain	No. Context stops at the repo holding the PR	Cumulative .cursor/BUGBOT.md walking up from changed files	Vendor docs + community forum. Cursor acquired Graphite 19 Dec 2025, so Bugbot and Graphite Agent share an owner
Macroscope	Not documented	Not documented	Not documented	No, GitHub cloud only	None documented	Vendor site
cubic	Not documented	Not documented	Not documented	No, GitHub only	None documented	Vendor site
PR-Agent	No. Diff plus compression	No	Limited	No	You script it	Open source. MIT since 23 Apr 2026, independent community governance under The-PR-Agent org
Gitar (partner)	Not documented	Not documented	Not documented	Not documented	Not documented	Vendor docs. No published architecture detail
SonarQube	Yes, deterministic whole-project analysis	Call graph for taint analysis	n/a, analyses the project not the diff	No	Project-per-module config	Vendor docs
Semgrep	Rule-based whole-repo scan	Cross-function dataflow on Pro rules	n/a	No	Per-path rulesets	Open source
CodeScene	Yes. Behavioural code analysis over git history	Change coupling, not a call graph	n/a	Multi-repo analysis	Hotspot analysis across the repo	Vendor docs

Read the “Basis of claim” column as the point of the table. Every architecture claim in this category is vendor-reported. There is no third-party audit of whether Greptile’s graph traversal does what Greptile says, or whether Augment’s Context Engine really reindexes in real time. What you can verify is the behaviour, and the test is cheap: open a PR that renames a widely-used function and see whether the reviewer mentions the call sites. Do that before you sign.

How do AI code review tools differ in codebase context?

Direct answer: Four architectures. Diff-only (Cursor Bugbot, most Action wrappers). Diff plus local expansion. Full-repository index built before review (Greptile, Qodo, Augment, Sourcegraph). Agentic retrieval during review (Copilot since March 2026, Anthropic Code Review, Greptile v3). Indexing costs upfront latency; agentic retrieval costs unpredictable tokens. Diff-only costs you cross-file bugs. Verified 2026-10-18.

Architecture 1: diff-only. The reviewer receives the patch and the file paths. That is it. It will catch a null check you forgot inside the changed function. It cannot catch that you changed the return shape and three callers now break, because it has never read the callers. Cursor Bugbot is the clearest example, and it is a deliberate design choice, not an oversight: Bugbot reads only what changed, is incremental by default so it reviews only the delta since its last pass, and reads earlier PR comments to avoid repeating itself. That makes it fast and cheap and gives it good precision on local defects. Bugbot vs Greptile is basically this architectural argument in product form.

Architecture 2: diff plus local expansion. The reviewer pulls in the definitions of functions the diff calls, the test files for the changed paths, recent commits touching the same files. Cheaper than indexing, catches a useful middle band of bugs. Most tools do some version of this without describing it.

Architecture 3: full-repository index. The repository is parsed and embedded, usually with a graph, before any review happens. Greptile’s approach, per its founders, deliberately goes past naive RAG: parse the AST, recursively generate a docstring for each node, embed the docstrings rather than the raw code, then layer vector search, keyword search and an agent that follows references. Qodo built a semantic database of its codebase with language-specific static-analysis-driven chunking, then added query pre-processing, result re-ranking and noise filtering because, in Qodo’s own words, search quality deteriorates as codebases grow.

The cost of architecture 3 is upfront and real. One hands-on account of Augment’s Context Engine describes roughly 25 minutes of indexing for a 400,000-plus-file monorepo before the first review. Greptile’s own API exposes an indexing endpoint you poll for status, file counts and the indexed commit SHA, which tells you indexing is a job with a duration, not an instant.

Architecture 4: agentic retrieval. No prebuilt index. The model issues tool calls during the review to search the repo, read files and follow references. GitHub moved Copilot code review to this architecture in March 2026, and GitHub’s own framing of the Actions-minutes billing change confirms what it costs: the agentic work of gathering context is why reviews now consume runner minutes. Anthropic’s Code Review is multi-agent in the same spirit, with Quick, Standard and Deep settings that are essentially a budget knob on how much exploration happens.

There is no free option. Pick which cost you prefer: indexing latency and a persisted copy of your code, or unbounded per-review token and minute spend.

Best AI code review tool for a monorepo

Direct answer: Greptile or Qodo on documented architecture; CodeRabbit if noise control matters more than cross-file depth, because path_filters and path_instructions are the best per-directory controls in the category. Watch CodeRabbit’s linked-repo cap: 1 / 5 / 10 / 20 by tier. The hard caveat: Augment’s August 2026 test of 10 open-source reviewers on a 450,000-file monorepo found none caught cross-service breaking changes. Verified 2026-10-18.

A monorepo breaks AI review in three specific ways, and the fixes are different for each.

It breaks retrieval. A 450,000-file index returns plausible-looking irrelevant results. This is exactly the failure Qodo documents and engineers around: filtering results to the PR’s language, deduplicating against code already in the PR, and diversifying across components to avoid overfitting to one area. If your vendor has not thought about this, their retrieval gets worse as your repo grows.

It breaks noise. The same boilerplate appears in forty packages, so the reviewer flags it forty times. CodeRabbit’s .coderabbit.yaml is the most practical answer available: path_filters to scope which files are reviewed at all, and path_instructions to apply different review rules per directory. A realistic monorepo config scopes services/auth/** to token-validation concerns, services/payments/** to decimal precision, packages/shared/** to backward compatibility, and excludes **/dist/**, **/node_modules/**, **/*.generated.* and lock files entirely. One trap worth knowing: if your path_filters exclude every path a PR touches, CodeRabbit has nothing to review and posts nothing. Our CodeRabbit monorepo guide and .coderabbit.yaml reference have the full syntax.

It breaks service boundaries. This is the one nobody has solved. Augment’s August 2026 evaluation put 10 open-source review tools through 40-plus hours of testing on a 450,000-file polyglot monorepo spanning Python, TypeScript, Java and Go. Its conclusion, verbatim: “Every tool reviews files in isolation. None of the tools tested caught cross-service breaking changes.” Only three of the ten were judged production-viable, and all three were rule-based rather than AI-powered: SonarQube Community Build, Semgrep Community Edition and CodeQL.

Treat that as the ceiling of the category, with the funding disclosed: Augment sells a competing product and chose which tools to include. It did not test CodeRabbit, Greptile, Qodo or Copilot in that run. But the finding is architectural rather than competitive, and it matches what the limits documentation implies.

On multi-repo linking, the numbers are concrete and worth budgeting around. CodeRabbit links 1 repository on Essentials, 5 on Team, 10 on Advanced and 20 on Enterprise. The number of repositories CodeRabbit will review is unlimited on every plan. Those are different features and the pricing page does not make it obvious. If your microservice estate is 60 repos, no CodeRabbit tier gives you full cross-repo context.

AI code review tools for large pull requests

Direct answer: A large PR and a large repo are different problems. A 2,000-line PR fails on context window and reviewer attention. A 450,000-file repo fails on indexing and retrieval. For large PRs: Copilot removed its 300-file / 20,000-line cap on 27 August 2026, Qodo applies explicit PR compression, Greptile offers Plus and Apex depths. CodeRabbit caps at 150 or 300 files by tier. Verified 2026-10-18.

The honest answer to “which tool handles my 2,000-line PR” is usually “none of them, well, and you should split it.”

The best-sourced number in code review comes from SmartBear’s 2006 study at Cisco: 2,500 reviews covering 3.2 million lines of code by 50 developers over 10 months, the largest case study of lightweight code review conducted. Three findings that still hold:

• Defect density drops sharply once a review passes about 200 changed lines, and the ability to find defects diminishes beyond 400.
• No review larger than 250 lines produced more than 37 defects per thousand lines of code.
• Reviewers working faster than 450 lines per hour had below-average defect density in 87% of cases.

Two caveats we will state because SmartBear does not. First, “defect density” means defects found per line reviewed, so the drop past 200 lines measures reviewer attention, not shipped bugs. No source we can find demonstrates that a 500-line PR is more likely to ship a defect than two 250-line PRs. Second, SmartBear sold the code review tool. The number is still the best available, and our pull request size best practices page works through how to act on it.

Why this matters for tool selection: an AI reviewer does not have an attention span, but it does have a context window, and both degrade non-linearly. The failure mode is not an error message. It is a review that looks complete and quietly ignored 40% of the diff.

Which AI code review tools handle large pull requests well?

Direct answer: By documented limits: GitHub Copilot (no size cap since 27 August 2026), Qodo (PR compression into a single LLM call), Greptile (Plus at 3 credits, Apex at 10 for complex PRs). CodeRabbit is the clearest ceiling at 150 files on Free and Essentials, 300 on Team and above, with usage-priced reviews hard-stopping above 300 files. Copilot also scored lowest of eight on the Entelligence benchmark. Verified 2026-10-18.

Tool	Max files per review	Documented PR size cap	Review-depth control	Throughput limits	Cost per extra review
GitHub Copilot	No documented cap since 27 Aug 2026 (was 300)	None since 27 Aug 2026 (was 20,000 lines)	Lite or Balanced effort level	Not published	AI credits at 1 credit = $0.01, plus Actions minutes on private repos since 1 Jun 2026
CodeRabbit	150 Free and Essentials, 300 Team and above, counted after path filters	Usage-priced reviews blocked above 300 files	Not a depth setting; configurable tools and instructions	5 / 8 / 10 / 12 reviews per hour by tier, degrading to 1/hour under fair-usage	$0.25 per reviewed file past the included limit
Greptile	Not published	Not published	Base 1 credit, Plus 3, Apex 10, or Auto	50 included credits per active dev per period	$1 per flex credit, per author, not pooled
Qodo	Not published	PR compression keeps large diffs in one LLM call	num_code_suggestions, extra_instructions	Not published	Flat team fee plus credits, ~$30/mo up to 30 users
Claude Code Review	Not published	Not published	Quick, Standard, Deep per repository	Not published	Token-based billing
Cursor Bugbot	Not published	Diff-only, incremental by default	Incremental review toggle	Not published	~$1.00 to $1.50 per PR review
cubic	Not published	Not published	Not published	Reviewed-line allowance per seat: 40K / 80K / 160K lines on Team / Pro / Max	Yearly $30 / $79 / $160 per dev (monthly $40 / $99 / $200)
Macroscope	Not published	Not published	Budget Mode or standard	Usage-only, no seat fees	$0.05 per KB reviewed with a $0.50 floor; Budget Mode $0.025/KB with a $0.25 floor. Published average review $0.95. Re-reviews are billed each time
PR-Agent	Your model’s limit	Compression strategy	num_code_suggestions in .pr_agent.toml	Your runner	Your model tokens plus Actions minutes

Three things in that table are easy to miss and expensive to discover.

CodeRabbit’s hourly limits degrade under sustained use. The 5 / 8 / 10 / 12 figures are base rates. Under the fair-usage policy a developer’s rate drops as weekly volume climbs: on Essentials from 5/hour down to 1/hour between 30 and 60 reviews in a rolling 7 days, on Team from 8 to 1 between 40 and 70, on Advanced from 10 to 1 between 50 and 80. On a busy monorepo with a release train, that is a real throttle.

Greptile’s Apex depth is a budget event, not a setting. Apex costs 10 credits against 50 included per active developer per billing period. Five Apex reviews exhaust a seat’s allowance; everything after that is flex at $1 per credit. Roughly $6 per review at Apex versus $0.60 at Base. And credits are per author and do not pool - Greptile’s billing docs state overages are per-author, not shared across the team, and a review is charged to the PR author rather than whoever requested it. On a team where one engineer opens half the PRs, that engineer generates the whole overage while teammates’ allowances expire unused. Cap it with the Flex Usage Limit in Organization Settings, after which Greptile skips reviews that would incur flex. Detail in Greptile pricing and CodeRabbit pricing.

cubic meters you by reviewed lines, which is the limit that bites hardest on a large codebase. Its allowances attach to seats at 40,000 / 80,000 / 160,000 reviewed lines per developer per month on Team / Pro / Max. On a repo where a single refactor PR can touch 20,000 lines, a 40,000-line monthly allowance is two large PRs. Macroscope’s usage-only model has the same shape from the other direction: $0.05 per KB reviewed with a $0.50 floor, a published average review cost of $0.95, and re-reviews billed every time - so a PR that gets pushed to eight times is billed eight times.

One ownership note that affects any Bugbot-versus-Graphite comparison you read: Cursor acquired Graphite on 19 December 2025 and the “Diamond” name was retired in favour of Graphite Agent. Cursor Bugbot and Graphite Agent now share an owner, so treating them as two independent data points in a bake-off overstates your sample.

Copilot’s cap removal is the single biggest 2026 change for large PRs. Before 27 August 2026, a 350-file dependency bump got a “exceeds the maximum number of files (300)” error, and users reported the check firing late - one waited roughly 8 minutes of review work before being told the PR was too big. The cap also ignored content exclusions and .gitattributes, so excluded generated files still counted toward it. All of that is gone, and bot-authored PRs are now reviewed too. If you evaluated Copilot on big refactors before September 2026, your evaluation is void.

Can AI code reviewers understand changes across multiple files?

Direct answer: Some do, architecturally rather than by model quality. Greptile traverses a graph from the changed symbol to its callers. Qodo retrieves and re-ranks semantically similar code from a pre-built index. Augment’s Context Engine maintains a dependency graph across up to 400,000 files. Cursor Bugbot’s documented context stops at the PR’s repository with no persistent index. The honest limit: none of 10 tools in Augment’s monorepo test caught cross-service breaking changes. Verified 2026-10-18.

The capability has a precise name worth using in vendor calls: call-graph traversal from the changed symbol. Ask for it by name and watch what happens.

Greptile is the most specific publicly. Its v3 release in 2025 moved it from a single-pass reviewer to agents running in a loop with tools to search the codebase and recall learned rules, recursively chasing nested function calls. When a PR modifies a function, the graph gives it every caller, every type depending on the return shape and every module affected.

Augment’s Code Context Engine documented a semantic dependency graph covering which functions call which, which classes inherit from which, and which modules import which, across up to 400,000 files, with a separate 200K-token context window for the slice it actually sends to the model. Important to say clearly: the index capacity and the context window are different numbers, and vendors conflate them. Indexing 400,000 files does not mean 400,000 files reach the model. The engine’s job is retrieval and slicing.

That entry now carries an asterisk. Harness acquired select Augment Code assets on 8 October 2026, specifically including Cosmos, the Auggie CLI and the Code Context Engine, with the team moving to Harness. Augment Code Computing Inc. remains a separate legal entity. If you are building a shortlist on Augment’s architecture, the architecture now belongs to a platform company, and that is a procurement fact, not a technical one.

The limit, again: cross-file reasoning inside one service is demonstrably achievable. Cross-service reasoning across a large monorepo is not demonstrated by anyone. We have looked for a counter-example and have not found one.

The benchmark evidence, with who paid for each

This is where vendor claims are thickest in the whole category, so here is every number we could source, with its funding attached.

Benchmark	Publisher	Method	Result	Funded by a vendor?
Greptile self-evaluation	Greptile	50 bug-fix PRs, 5 repos (Sentry, Cal.com, Grafana, Keycloak, Discourse). Catch rate: a bug counted if identified in a line-level comment with explained impact. False positives did not affect the score	Greptile 82%, Bugbot 58%, Copilot 54%, CodeRabbit 44%, Graphite 6%	Yes, by the winner
Augment re-run	Augment, pub 11 Dec 2025, upd 18 Jun 2026	Same 5 repos, 50 PRs, but a different answer key: “We expanded and corrected the golden comments by reviewing each PR manually.” Precision / recall / F. Raw data at github.com/ai-code-review-evaluations	Augment 59% F, Bugbot 49%, Greptile 45% precision / 45% recall / 45% F, Codex 41%, CodeRabbit 39%	Yes, by the winner - but it published its data
Entelligence 2026	Entelligence, Sept 2026. Entelligence sells a code reviewer	67 golden issues across 5 repos. Ground truth by ensemble of Claude Opus, Gemini 2.5 and GPT-5 with a GPT-4o arbiter, then human validation. Claude Sonnet 4.5 as similarity judge	Entelligence wins its own benchmark: 47.2% F1 aggregate, and 68.1% on Cal.com. Then Codex 45.4%, Claude 42.8%, Bugbot 39.4%, Greptile 36.9%, CodeRabbit 33.0%, Copilot 22.6%, Graphite 13.4%	Yes, by the winner. Mitigating credit: it publishes the full per-repo tables, which most vendors do not
c-CRAB	National University of Singapore. Sells nothing	234 validated human review comments converted to executable tests, across 184 PRs, curated down from 671 PRs and 1,313 raw comments	Quoting the paper exactly: “Taking the union across all four tools, 97 out of the 234 tests were passed by at least one tool (41.5%).” Per tool: Claude Code 32.1%, Devin 24.8%, PR-Agent 23.1%, Codex 20.1%	No
Augment 450K-file monorepo test	Augment, Aug 2026	10 open-source tools, 450,000-file polyglot monorepo, 40+ hours	3 of 10 production-viable, all rule-based: SonarQube, Semgrep, CodeQL. None caught cross-service breaking changes	Yes, though no Augment product was in the test set
Martian Code Review Bench	Martian, open-sourced. Martian sells model routing, not a code reviewer, which makes it the closest thing to a neutral leaderboard in this category	Live scoring over real pull requests at scale	CodeRabbit 51.2% F1 / 49.2% precision on ~300k PRs (3 Mar 2026). Qodo then claimed #1 at 64.3% (15 Mar 2026). Baz then claimed #1 on 790 PRs. Three different vendors have each announced #1 on this one leaderboard	No for the leaderboard itself. The #1 claims layered on top of it are vendor announcements
CRBugBench	CMU + Microsoft Research	1,800 tasks across 98 open-source repos plus 2 proprietary ones	claude-opus-5 at 79.6% pre-merge and 64.2% post-merge recall@5 at $2.97 per task; human plus agent 82.1%. Reports no precision at all	Academic but not disinterested: Microsoft co-authored it and used copilot-cli as the harness
ReviewBench	GitHub, 5 Oct 2026	219 PRs from 187 repos, 19 languages, sampled from 103.9M PRs, deliberately weighted toward mid-to-large PRs. Grounded and augmented metrics	Dataset, labels, severity annotations and a self-serve runner public at review-bench.ai	Yes, but the dataset is open

Four conclusions worth extracting.

The ranking is a function of the answer key, and the gap has two causes. Greptile’s 82% and Augment’s 45% are the same tool on the same five repositories. First, the metric differs: Greptile measured catch rate, where false positives are free by design, while Augment measured precision, recall and F - Greptile scored 45% on all three. Second, and the part most write-ups omit, Augment did not reuse Greptile’s answer key. It states it “expanded and corrected the golden comments by reviewing each PR manually”. So this is partly methodology and partly a different ground truth, not purely self-dealing, and Augment published its raw data. Neither vendor is lying. Each measured the thing it wins.

The illustration that makes the point better than any single number: on Martian’s leaderboard, which is the closest thing to a neutral scoreboard because Martian sells model routing rather than a reviewer, CodeRabbit held 51.2% F1 on roughly 300,000 PRs on 3 March 2026, Qodo announced #1 at 64.3% on 15 March, and Baz announced #1 on a 790-PR slice. Three vendors claimed the top of the same leaderboard inside a month.

No party without a commercial stake has published a false-positive rate for any shipping commercial AI code reviewer. (Two independent academic benchmarks, SWE-PRBench and CR-Bench, do publish false-positive data - but for bare models in fixed harnesses, not for products you can buy.) That is worth stating plainly because it is the number buyers most want and the one nobody has produced. Every false-positive figure in circulation - including Panto’s widely-repeated “Greptile 11 false positives per PR versus CodeRabbit 2”, which we can only label reported-not-confirmed - comes from a vendor comparing itself to a competitor. And the “40 to 70% false positive rate” attributed to c-CRAB is not in the paper: c-CRAB reports no false-positive rate for any tool it evaluated. Do not cite it, and discount pages that do. One disclosure, because we hold other publishers to it: c-CRAB is not conflict-free. Five of its six authors are academic (National University of Singapore, Zhejiang University), but one lists SonarSource as their affiliation (arXiv 2603.23448v3, verified 2026-10-18), and the paper carries a disclaimer that its conclusions do not represent SonarSource policy. Sonar sells SonarQube and acquired Gitar, which is a paid sponsor of this site. SonarQube is not among the four tools c-CRAB evaluates, which blunts the conflict considerably - but we are not going to call out vendor-funded benchmarks elsewhere and stay quiet about this one.

Nobody clears 50% F1 on a golden dataset. The best score in the Entelligence run is 47.2%. And c-CRAB’s 41.5% is a union across four agents, not any single tool’s score: the best individual agent, Claude Code, managed 32.1%. That low overlap is itself the finding, and it is the strongest published argument for running two reviewers rather than one. A reasonable planning assumption is that one AI reviewer surfaces somewhere between a quarter and a half of what a careful human reviewer would raise.

Results swing hard by repository and language, which is the finding that matters most for a large codebase. In the Entelligence per-repo tables, Codex scored 64.5% F1 on Grafana (Go) and 18.2% on Keycloak (Java). Greptile scored 52.6% on Keycloak and 24.5% on Sentry (Python). Entelligence’s own entry posted 100% precision with 33.3% recall on Grafana, finding 3 of 9 issues - a perfect-precision, mostly-blind result on a single repository. Same tools, same week, same methodology. The aggregate number tells you nothing about your repo. Run a two-week bake-off on your own code and count comments acted on versus dismissed. That ratio is the only benchmark that transfers.

For the wider field see best AI code review tools, the state of AI code review 2026, and CodeRabbit vs Greptile.

Static analysis still carries the load at scale

The uncomfortable finding from the 450,000-file test is that the tools which survived were the old ones. That is worth taking seriously rather than explaining away.

SonarQube does deterministic whole-project analysis and its core SAST engine runs fully on-prem. Do not conflate the two free offerings, because almost every comparison page does. SonarQube Community Build (self-hosted, free) analyzes the main branch only and does not include pull request analysis. SonarQube Cloud’s free tier does include PR analysis, up to 50,000 lines of code on private projects, and does not expire. So “free SonarQube cannot gate a PR” is true of the self-hosted build and false of the cloud tier. AI features are Enterprise-tier in both.

Semgrep runs as a GitHub Action with open-source rules, which makes it the cheapest deterministic gate to add to an existing pipeline, and its Pro rules add cross-function dataflow.

DeepSource has the architecture we would design if starting fresh: 5,000-plus deterministic rules across 30-plus languages run before the AI agent sees the code, so the LLM is reasoning about code that has already been filtered rather than rediscovering lint findings. Two caveats. DeepSource was acquired by Harness on 9 September 2026 and its roadmap is in flux. And its AI review is billed separately from the seat: $8 per 10,000 processed lines on Standard and $15 per 10,000 on Advanced, with a $100 annual AI credit per user. On a large codebase that changes the real cost of the ~$24 seat materially.

CodeScene is the odd one out and useful at scale for a different reason: it analyses git history rather than code semantics, surfacing change coupling and hotspots. On a large legacy codebase that tells you where to put review effort, which is a different and arguably more valuable question than what is wrong with this diff.

The pattern we would actually deploy on a large codebase is two layers: a deterministic scanner as a required status check, and one LLM reviewer for the things rules cannot express. More in best SAST tools and open-source AI code review tools.

How we verified this

Everything here was checked on 2026-10-18.

What we checked and where:

• Context architecture claims: each vendor’s own documentation and engineering blogs. Greptile’s indexing approach from its founders’ public description of AST parsing plus docstring embeddings, and from its Repositories (Indexing) API. Qodo’s RAG pipeline from its own engineering writeup covering query pre-processing, re-ranking and noise filtering, plus enable_rag and rag_repo_list. Cursor Bugbot’s diff-only behaviour and BUGBOT.md loading order from Cursor’s docs and a Cursor team member’s description in the community forum. Copilot’s agentic context gathering from GitHub’s docs and changelog.
• Documented limits: CodeRabbit’s 150 / 300 file caps, 5 / 8 / 10 / 12 hourly limits, fair-usage degradation thresholds, 1 / 5 / 10 / 20 linked repos and $0.25 per reviewed file overage. Greptile’s Base / Plus / Apex credit costs and the per-author, non-pooled overage rule from its billing docs. Copilot’s cap removal from the GitHub changelog of 27 August 2026.
• Benchmarks: the Entelligence 2026 benchmark including its full per-repository tables for Cal.com, Discourse, Grafana, Keycloak and Sentry; Augment’s re-run of the Greptile evaluation (published 11 December 2025, updated 18 June 2026, raw data at github.com/ai-code-review-evaluations); the c-CRAB paper from the National University of Singapore; the Martian Code Review Bench leaderboard; CRBugBench from CMU and Microsoft Research; Augment’s 450,000-file monorepo evaluation; and GitHub’s ReviewBench announcement of 5 October 2026. For each, we recorded whether the publisher sells a code reviewer. Only c-CRAB and Martian do not.
• PR size research: SmartBear’s 2006 Cisco MeetingPlace study, 2,500 reviews over 3.2 million lines by 50 developers across 10 months.
• Ownership changes: Harness acquiring DeepSource (9 September 2026) and select Augment Code assets including the Code Context Engine (8 October 2026); Cursor’s definitive agreement to acquire Graphite (19 December 2025); Sonar acquiring Gitar (21 May 2026).

What we could not verify:

• Any architecture claim independently. Nobody audits whether Greptile’s graph traversal, Qodo’s re-ranking or Augment’s real-time reindexing behave as described. We have labelled every row of the main table with its source for exactly this reason.
• Max PR size or file caps for Greptile, Qodo, Claude Code Review and Cursor Bugbot. None publish one. Absence of a published cap is not the same as absence of a cap.
• How many Actions minutes a Copilot review consumes. GitHub publishes no figure, so no cost-per-review number for Copilot on a large PR is citable.
• Whether Augment’s 400,000-file and sub-200ms figures are accurate. They are vendor-stated and widely repeated by third parties who are repeating the vendor. The 25-minute indexing time for a 400K-file monorepo comes from a single hands-on account, not a controlled test.
• Any independent false-positive rate for any AI code reviewer. None has ever been published. The “40 to 70% false positive rate” commonly attributed to c-CRAB is a miscitation: no false-positive rate is reported for any reviewed tool in that paper. Panto’s “Greptile 11 false positives per PR versus CodeRabbit 2” is reported but not confirmed - we could not open a primary Panto page carrying that exact pair, and the methodology described is 17 PRs with an o3-mini classifier.
• Any independent review-quality benchmark for Gitar, cubic, Macroscope or CodeAnt. None exists that we can find. Gitar is our category partner and publishes no context-architecture detail at all, which is why its row in the main table is almost entirely “not documented”. We are not filling those cells with inference.
• Whether anyone has solved cross-service review in a large monorepo. The only published test says no. We could not find a counter-example, and we would like to.

Recommendations

Criteria stated: documented context architecture, documented limits you can plan around, and a cost model that does not surprise you at 10x volume. Benchmark scores are deliberately the last filter, because the per-repository spread is wider than the gap between tools.

For a large single-service repository, 100K to 1M lines: Greptile. It is the only tool with a publicly described graph-plus-embeddings index and documented review-depth tiers, and it is the architecture that matches the problem. Two things to accept going in. Its own 82% and Augment’s 45% are the same tool, so plan on the lower number. And the credit model is per-author and does not pool, so set a Flex Usage Limit on day one and keep Apex off by default.

For a monorepo where comment noise is the adoption risk: CodeRabbit. path_filters and path_instructions are the best per-directory controls in the category, and on a monorepo noise is what kills pilots. Budget around two hard numbers: the 150-file cap on Essentials (300 on Team and above) and the linked-repo cap of 1 / 5 / 10 / 20. If you have more than 20 repositories needing cross-repo context, no tier covers you.

For a polyglot monorepo above roughly 100,000 files: do not buy one tool. Run a deterministic scanner as the required status check - SonarQube on a paid edition if you need PR analysis, or Semgrep if you want it cheap and in Actions - and add one LLM reviewer on top for the things rules cannot express. This is the configuration the only published 450,000-file test actually supports, and it is unglamorous for a reason.

If you need cross-file reasoning and your code cannot leave your network: PR-Agent or Kodus, and lower your expectations. Both are free to self-host (PR-Agent went MIT on 23 April 2026 and now sits under independent community governance; Kodus is AGPLv3 since September 2026), and both take local models. PR-Agent scored 23.1% on c-CRAB, second-lowest of the four agents tested. You are trading review depth for data control, which is a legitimate trade as long as you make it knowingly.

If your pull requests are routinely over 400 lines, fix that before buying anything. SmartBear’s Cisco data says defect-finding ability diminishes past 400 changed lines, and no tool in this article makes that go away. The highest-leverage change available to a team with large PRs is smaller PRs. Pull request size best practices covers how, and AI code review vs manual review covers what each layer is actually for.

Finally, on integration: none of this matters if the tool cannot connect to your Git host. If you are on GitHub Enterprise Server or a *.ghe.com data-residency tenant, start with the support matrix in AI code review tools that support GitHub, because that list is nine tools long and it is a shorter list than this one.