AI Code Review Tools That Support GitHub (2026): Checked

Direct answer

Every commercial AI code reviewer we track supports GitHub.com, so “supports GitHub” is not a useful filter. The question that actually filters is which GitHub product you run. GitHub.com, GitHub Enterprise Cloud, GHEC with data residency, and GitHub Enterprise Server are four different integration problems, and only nine tools document GHES. Separately, since 1 June 2026 Copilot code review consumes GitHub Actions minutes on private repos. Verified 2026-10-18.

Disclosure: Gitar is our AI code review category partner. Partners get a guaranteed entry in relevant lists, never a rating, a rank, or the removal of a criticism. Gitar still has no published third-party review-quality benchmark, and we say so below.

AI code review tools that support GitHub

Direct answer: All 15 tools in the table below support GitHub.com. GitHub Enterprise Server is the real dividing line: 9 document it, and 7 of those 9 gate it behind an Enterprise contract. cubic and Macroscope document GitHub Cloud only. GHEC with data residency (*.ghe.com) counts as self-hosted for most vendors, not as GitHub.com. Verified 2026-10-18.

The support matrix below is built from vendor documentation only, checked on 2026-10-18. Where a vendor’s own docs and a competitor’s comparison table disagree, we used the vendor’s docs and said so.

Tool	GitHub.com	GitHub Enterprise Cloud	GHEC + data residency (*.ghe.com)	GitHub Enterprise Server	Tier required for GHES
CodeRabbit	Yes	Yes	Yes, via the Self-Hosted GitHub flow	Yes, documented	Self-service connection on paid plans; fully on-prem agent needs 500+ seats
Greptile	Yes, all plans	Yes	Yes	Yes, documented	Enterprise, contact sales
Qodo	Yes	Yes	Yes	Yes	Enterprise; air-gapped on-prem available
GitHub Copilot	Yes	Yes	Yes	Varies by GHES release	Included on Pro ($10), Pro+ ($39) and Max ($100), plus Business ($19) and Enterprise ($39) licences (verified 2026-10-18). Not on Copilot Free. Review service stays in GitHub’s cloud
Claude Code Review	Yes	Yes	Yes	Yes	Claude Team or Enterprise. Not available with Zero Data Retention or the HIPAA configuration
Cursor Bugbot	Yes	Yes	Not documented	No	n/a, cloud only
Macroscope	Yes	Yes	No	No	n/a, cloud only
cubic	Yes	Yes	No	No	n/a, GitHub only, cloud only
Graphite	Yes	Yes	Yes	Yes, via IP allowlist	Graphite Enterprise, no self-serve
PR-Agent	Yes	Yes	Yes	Yes, you host it	None. MIT since 23 Apr 2026
Kodus	Yes	Yes	Yes	Yes, you host it	None. AGPLv3 since Sept 2026
Sourcery	Yes	Yes	Yes	Yes, documented quickstart	Enterprise
Bito	Yes	Yes	Yes	Yes, GHES 3.0+	Cloud review by default; self-hosting is a Professional add-on
Gitar (partner)	Yes	Yes	Reachability dependent	No - vendor matrix lists GHES unsupported	Enterprise for self-hosted code hosting
CodeAnt AI	Yes	Yes	Reachability dependent	Yes, connectivity dependent	Enterprise for on-prem or VPC

Two notes on honesty. “Supports GHES” and “runs inside your network” are different claims, and vendors blur them constantly. Bito’s own docs tell you to whitelist Bito’s gateway IPs if your network blocks external services, which confirms the review itself runs in Bito’s cloud even when the repo is on your GHES box. Same pattern for CodeAnt on its standard tier. Gitar does not support GHES at all per its own matrix (verified 2026-10-18).

And GitHub Copilot is not self-hosted, whatever your account team implies. Copilot moved to an agentic architecture in March 2026 and can run validation steps on self-hosted Actions runners, but the review service itself stays in GitHub’s cloud. If your requirement is “source code never leaves our network”, Copilot does not meet it and neither does any tool in that table except PR-Agent, Kodus, and the top-tier on-prem builds of Qodo, CodeRabbit, Sourcery and CodeAnt.

The three GitHub products are three different integration questions

Almost nobody draws this distinction, and it is the single most expensive thing to discover late.

GitHub.com. The vendor installs a GitHub App on your org. Five minutes. Every tool in this category supports it.

GitHub Enterprise Cloud. Still GitHub’s cloud, still github.com hostnames, so in practice this behaves like GitHub.com for integration purposes. The differences you will hit are policy, not plumbing: org-level Copilot policies, SAML, IP allow lists that can block vendor webhooks, and Enterprise Managed Users.

GHEC with data residency and EMU (*.ghe.com). This is where teams get caught. Your host is no longer github.com, so the vendor’s standard OAuth flow does not apply. CodeRabbit’s docs say it plainly: data-residency and Enterprise Managed Users customers on a host like https://example.ghe.com must use the Self-Hosted GitHub setup flow, where you create your own OAuth App and GitHub App and submit the credentials. Greptile lists GHEC with data residency under Enterprise, contact sales. If you are on an EU or Australian data-residency tenant, assume you are a self-hosted customer in every vendor conversation until told otherwise.

GitHub Enterprise Server. Your hardware or your VPC. Three sub-questions decide feasibility: can the vendor reach your instance, can your instance send outbound webhooks to the vendor, and will your security team accept IP allowlisting. CodeRabbit offers a reverse tunnel for locked-down networks, where a CodeRabbit-provided connector runs inside your network and dials out over WebSocket Secure. There is no self-service UI for that; it goes through sales.

If the answer to “can anything leave the network” is no, your shortlist collapses to the open-source self-hosted tools and the air-gapped enterprise builds. Our enterprise AI code review guide and open-source AI code review tools roundup cover that narrower set.

How to add an AI reviewer to GitHub pull requests

Direct answer: Three routes. Install a vendor GitHub App (5 minutes, needs org-owner rights, grants write on pull requests, checks, contents and commit statuses). Add a GitHub Actions workflow (you own the runner and the model key). Or enable native Copilot code review as a reviewer, per-user or org-wide via a branch ruleset. Then wire the reviewer into branch protection as a status check, not an approver. Verified 2026-10-18.

Route A: install a vendor GitHub App

This is the CodeRabbit, Greptile, Qodo, Claude Code Review and Cursor Bugbot path.

1. Sign in to the vendor with your GitHub account. You need organization owner permission to install an app org-wide, and repository admin for a single repo.
2. Choose repositories. Pick one repository, not “All repositories.” You want a two-week signal-to-noise read before the whole org sees bot comments.
3. Approve the permission request. Read it properly, because your security reviewer will.
4. Drop a config file on the default branch. CodeRabbit reads .coderabbit.yaml, Cursor Bugbot reads .cursor/BUGBOT.md, Anthropic’s Code Review reads REVIEW.md, Qodo reads best_practices.md and .pr_agent.toml.
5. Open a throwaway PR and confirm a review lands.

Here is the permission set a security reviewer will question, taken from CodeRabbit’s GitHub docs on 2026-10-18. It is representative of the category, not unique to CodeRabbit.

Scope	Access	Why the vendor asks for it	Why your security reviewer cares
Metadata	Read	Baseline for any GitHub App	Low risk
Pull requests	Read and write	Post review comments and inline suggestions	The core function. Can create, edit and delete its own PR resources
Checks	Read and write	Publish the review status check on the PR	Needed if you want it as a required status check
Commit statuses	Read and write	Report pass or fail per commit	Low risk
Contents (code)	Read and write	Apply committed fixes and agent edits	The big one. The installation token can clone the repo and push commits
Workflows	Read and write	Let agents create or update .github/workflows/ when fixing CI	The other big one. GitHub treats workflow files as a separate permission boundary because CI config is a supply-chain surface
Issues	Read and write	Open or comment on linked issues	Noise risk more than security risk
Actions, discussions, members, merge queues	Read	Context gathering and seat mapping	Low risk

Two things worth knowing. Several widely shared tutorials claim CodeRabbit “does not request write access to your repository contents”. That is wrong, and Kudelski Security’s 2025 research writeup on a CodeRabbit vulnerability independently confirmed the installation includes write scopes. Trust the vendor’s docs over blog tutorials, including ours - go read the permission screen.

Second: there is a separate OAuth consent step from the app install, covering read-only access to your organizations, teams and email addresses. Two approvals, two different scopes.

Route B: a GitHub Actions workflow

Use this when your security team will not grant a third-party app write access to contents, or when you want to hold the model key yourself. The trade is that you pay the Actions minutes and you own the prompt.

PR-Agent is the reference implementation. Relicensed to MIT on 23 April 2026 and transferred to independent community governance under The-PR-Agent org, with Qodo remaining a sponsor. 13.4k stars as of 2026-10-18. Runs as a CLI, a Docker image, a GitHub Action or a webhook server, and talks to OpenAI, Anthropic, Gemini or a local model via Ollama. A working workflow:

name: PR-Agent review
on:
  pull_request:
    types: [opened, reopened, ready_for_review, synchronize]
  issue_comment:
    types: [created]

permissions:
  contents: read
  pull-requests: write
  issues: write

concurrency:
  group: pr-agent-${{ github.event.pull_request.number || github.event.issue.number }}
  cancel-in-progress: true

jobs:
  review:
    if: >-
      github.event.sender.type != 'Bot' &&
      (github.event_name == 'pull_request' ||
       startsWith(github.event.comment.body, '/'))
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: PR-Agent
        uses: qodo-ai/pr-agent@main
        env:
          OPENAI_KEY: ${{ secrets.OPENAI_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          github_action_config.auto_review: "true"
          github_action_config.auto_describe: "true"
          github_action_config.auto_improve: "false"

Four details people get wrong in that file:

• The issue_comment trigger is what enables /review, /improve and /ask as PR comments. Without it you only get reviews on push.
• if: github.event.sender.type != 'Bot' stops the infinite loop where the action reviews its own comment.
• Dotted env keys are intentional. PR-Agent maps github_action_config.auto_review onto nested config. They are not typos.
• Pin the action. @main is a moving target. Pin a tag or a commit SHA in anything you care about.

The Anthropic equivalent, for an agentic reviewer you control:

name: Claude review
on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]

jobs:
  review:
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: "/review"
          claude_args: >-
            --allowedTools
            "mcp__github_inline_comment__create_inline_comment,Bash(gh pr diff:*),Bash(gh pr view:*)"

id-token: write is only needed for OIDC-based auth to Bedrock or Vertex. If you authenticate with an API key secret, drop it. Without the --allowedTools allowlist including the inline-comment MCP tool, you get one summary comment instead of line-level review. More on this in our GitHub Actions and Claude Code walkthrough and the broader AI code review in GitHub Actions guide.

Route C: native Copilot code review

Cheapest to turn on if you already pay for Copilot. The part teams get wrong is that the per-user toggle only affects pull requests you open. For team-wide behaviour you need a repository ruleset.

Per-user, for your own PRs: profile picture, Copilot settings, Code review, enable Automatic Copilot code review. Pick Lite or Balanced review effort. Org policy overrides this.

Team-wide, via a branch ruleset:

1. Repository Settings, then Rulesets, then New ruleset, then New branch ruleset.
2. Name it, set Enforcement Status to Active, set Target branches to Include default branch or a pattern.
3. Under Branch rules, tick Automatically request Copilot code review.
4. Optionally tick Review new pushes. Leave it off and Copilot reviews the PR once, on creation only.
5. Optionally tick Review draft pull requests.
6. Create. You may be asked to re-verify identity.

One sharp edge documented in GitHub community discussion #160286: the Copilot automatic review rule lives inside the “Require a pull request before merging” rule, so enabling the review rule enables PR-only changes on the targeted branches. That blocks direct pushes to those branches and interferes with stacked-PR workflows. The workaround is to scope the ruleset to main or develop and leave feature/* unprotected, accepting that stacked PRs between feature branches will not auto-trigger a review.

Manual trigger, any PR: gh pr edit <number> --add-reviewer @copilot.

Branch protection and required reviewers: the step people get wrong

The instinct is to make the AI reviewer a required approver. Don’t.

Make it a required status check instead. The app publishes a check run - this is what that checks: write permission is for - and you add that check’s name to the ruleset under required status checks. The merge is then gated on the review having run, not on a bot approving. That is the correct semantics: the AI’s job is to produce findings, a human’s job is to accept the risk.

Three specifics:

• Required approvals stay human. A GitHub App comment is not an approval and will not satisfy Require approvals: 1.
• Copilot now has PR approval capability. GitHub shipped it, and whether it should count toward branch protection is an open argument in the community. Verify the behaviour in your own org, and if you are in a regulated environment, assume your auditor will ask who approved the merge.
• Check the CODEOWNERS interaction. If you require code owner review and the AI app is not a code owner, nothing changes. If you add it as one, you have quietly made a bot a gatekeeper.

Our GitHub PR review guide covers the human side of the same ruleset.

Which AI code reviewer works best with GitHub Actions?

Direct answer: PR-Agent, if the criterion is running in your own runner with your own model key. MIT since 23 April 2026, official Action, supports OpenAI, Anthropic, Gemini and Ollama. anthropics/claude-code-action@v1 is the best agentic option in a workflow file. Semgrep is the best rule-based security gate. Copilot code review is not a workflow you control, yet still bills your Actions minutes on private repos. Verified 2026-10-18.

Tool	Official GitHub Action	Bring your own model key	Self-hosted runner	Who pays the minutes	Licence
PR-Agent	Yes, qodo-ai/pr-agent	Yes: OpenAI, Anthropic, Gemini, Ollama	Yes	You	MIT since 23 Apr 2026
Claude Code (claude-code-action)	Yes, anthropics/claude-code-action@v1	Yes, Anthropic key or Bedrock/Vertex OIDC	Yes	You	Action is open source, model is paid
Semgrep	Yes	n/a, rules not an LLM	Yes	You	Open source rules, paid platform
GitHub Copilot	No, it is a GitHub service	No	Validation steps only	You, since 1 June 2026, on private repos	Proprietary
Kodus	Self-host via container	Yes, any OpenAI-compatible endpoint	Yes	You	AGPLv3 since Sept 2026
CodeRabbit	No, GitHub App	No on cloud; BYO on self-hosted	Only in self-hosted mode	CodeRabbit, in its own cloud	Proprietary
Greptile	No, GitHub App	No	No	Greptile	Proprietary

The distinction that matters: a GitHub App reviewer runs on the vendor’s compute and a GitHub Action reviewer runs on yours. That decides your data path, your bill, and who you call when a review hangs. An App is faster to adopt and you cannot inspect the prompt. An Action is slower to adopt, and every token, timeout and retry is yours to debug.

The GitHub Copilot cost trap most comparison pages miss

Here is the dated, specific fact to take away from this page.

GitHub announced on 27 April 2026 that from 1 June 2026, Copilot code review consumes GitHub Actions minutes in addition to Copilot AI credits, on private repositories, across Copilot Pro, Pro+, Business and Enterprise. Source: the GitHub Changelog entry.

The specifics that decide whether this hurts:

• Public repositories are unaffected. Actions minutes are free there.
• Self-hosted runners consume no billable minutes.
• The two meters are independent. Actions minutes do not draw down AI credits, and AI credits do not cover Actions minutes. You are metered twice for one review.
• It applies to reviews from non-licensed users and to orgs on direct billing.
• AI credits are pegged at 1 credit = $0.01.
• GitHub’s stated reason is architectural: the review now runs as an agentic tool-calling loop on GitHub-hosted runners, so minutes are the natural unit.

Two further Copilot billing facts from the same 1 June 2026 change, both of which most comparison pages still have wrong:

Copilot retired annual billing entirely on 1 June 2026. Monthly is now the only option. Existing annual subscribers drop to Copilot Free at expiry unless they actively move to monthly. Premium requests were replaced by AI Credits at $0.01 each. Headline prices did not change: Pro $10, Pro+ $39, Max $100, Business $19, Enterprise $39, all per month.

Copilot code review is included from Copilot Pro upward, but not on Copilot Free. GitHub’s documentation states it “is available on the Copilot Pro, Copilot Pro+, and Copilot Max plans, and with a Copilot Business or Copilot Enterprise license” (verified 2026-10-18). So the entry point is Pro at $10/mo, with Pro+ at $39 and Max at $100 above it, and Business at $19 or Enterprise at $39 on the organisation side. Copilot Free does not include it.

Correction, 2026-10-18. An earlier version of this page said code review required Pro+ at $39 and that Pro did not include it. That was wrong, and we had it backwards while criticising other pages for the opposite claim. GitHub’s own documentation is the source above. We are leaving this note here rather than quietly editing, because a site whose argument is that you should not trust undated vendor claims does not get to silently revise its own. See GitHub Copilot pricing for the full breakdown.

This resolves a point that trips people up: GitHub’s April 2026 changelog lists Pro among the plans affected by the Actions-minutes change, and that is consistent - Pro genuinely does include code review, so there is genuinely something to meter.

GitHub explicitly does not publish how many Actions minutes a review consumes. We looked. There is no rule of thumb in the docs for how many minutes a typical review burns against repo size or runner class. That means you cannot forecast this line item from documentation - you measure it, on your repos, for a month. Set an Actions budget first. Org admins on Team and Enterprise can cap it.

There is an upside to pair with the cost. On 27 August 2026 GitHub removed Copilot code review’s old 300 file / 20,000 line PR size cap, and added automatic review of bot-authored PRs including its own cloud agent. So Copilot went from the tool most likely to silently skip your big refactor to one of the few with no documented size ceiling, in the same year it started billing twice. Our GitHub Copilot code review page tracks the detail.

AI code review tools for GitHub pull requests

Direct answer: Integration is solved; quality is not. Every vendor benchmark on GitHub PRs is won by its publisher - Greptile scored itself 82%, Entelligence scored itself #1 at 47.2% F1, and on Martian’s independent leaderboard three different vendors have each claimed #1. The non-vendor c-CRAB paper found four review agents pass, as a union, only 41.5% of tests derived from human review comments. No party without a commercial stake has published a false-positive rate for any shipping commercial AI code reviewer. (Two independent academic benchmarks, SWE-PRBench and CR-Bench, do publish false-positive data - but for bare models in fixed harnesses, not for products you can buy.) Verified 2026-10-18.

Once you are past the support matrix, the only question left is whether the comments are worth reading. The published evidence on that is thin and almost entirely vendor-funded, so here it is with the funding attached.

Benchmark	Who published it	Dataset	Headline result	Independent?
Greptile’s own evaluation	Greptile (vendor)	50 bug-fix PRs, 5 repos (Sentry, Cal.com, Grafana, Keycloak, Discourse)	Greptile 82% catch rate, Copilot 54%, CodeRabbit 44%, Graphite 6%	No. False positives did not affect the score
Augment’s re-run	Augment (vendor), pub 11 Dec 2025, upd 18 Jun 2026	Same 5 repos, 50 PRs. Augment wrote its own answer key: “We expanded and corrected the golden comments by reviewing each PR manually”. Raw data at github.com/ai-code-review-evaluations	Augment 59% F1, Bugbot 49%, Greptile 45% precision / 45% recall / 45% F, Codex 41%, CodeRabbit 39%	No
Entelligence Code Review Benchmark 2026	Entelligence (vendor), Sept 2026	67 golden issues, 5 repos	Entelligence wins its own benchmark: Entelligence 47.2% F1, Codex 45.4%, Claude 42.8%, Bugbot 39.4%, Greptile 36.9%, CodeRabbit 33.0%, Copilot 22.6%, Graphite 13.4%	No. Full per-repo tables are published, which is more than most vendors do
Martian Code Review Bench	Martian, open-sourced. Martian sells model routing, not a reviewer	Live leaderboard over real PRs	CodeRabbit 51.2% F1 / 49.2% precision on ~300k PRs (3 Mar 2026). Qodo then claimed #1 at 64.3% (15 Mar 2026). Baz then claimed #1 on 790 PRs	Yes for the leaderboard. The #1 claims on top of it are vendor press releases
c-CRAB	National University of Singapore	234 validated human review comments converted to executable tests, 184 PRs	Quoting the paper: “Taking the union across all four tools, 97 out of the 234 tests were passed by at least one tool (41.5%).” Per tool: Claude Code 32.1%, Devin 24.8%, PR-Agent 23.1%, Codex 20.1%	Yes
CRBugBench	CMU + Microsoft Research	1,800 tasks, 98 open-source repos plus 2 proprietary	claude-opus-5 at 79.6% pre-merge and 64.2% post-merge recall@5, $2.97 per task; human plus agent 82.1%. Reports no precision at all	Academic, but Microsoft co-authored it using copilot-cli as the harness
ReviewBench	GitHub (vendor), published 5 Oct 2026	219 PRs from 187 repos, 19 languages, sampled from 103.9M PRs	Reports grounded and augmented precision/recall. Dataset and runner public at review-bench.ai	No, but the dataset is open

Read that table as one finding: nobody is above 50% F1 on a golden dataset, and the ranking flips depending on who wrote the answer key. Greptile’s 82% and Augment’s 45% are the same tool on the same five repositories, and the gap has two causes, not one. Greptile measured catch rate, where false positives are free by design. Augment measured precision, recall and F - Greptile scored 45% on all three - and Augment also wrote a different answer key, stating it “expanded and corrected the golden comments by reviewing each PR manually”. So the 82-versus-45 gap is partly methodology and partly a different ground truth, not purely self-dealing. Augment published its raw data at github.com/ai-code-review-evaluations, which is more than most vendors do.

The most citable fact on this page: no party without a commercial stake has published a false-positive rate for any shipping commercial AI code reviewer. The widely-repeated “40 to 70% false positive rate” attributed to c-CRAB is a miscitation - the paper reports no false-positive rate for any tool it evaluated. Do not repeat it, and treat any page that does as unsourced. One disclosure, because we hold other publishers to it: c-CRAB is not conflict-free. Five of its six authors are academic (National University of Singapore, Zhejiang University), but one lists SonarSource as their affiliation (arXiv 2603.23448v3, verified 2026-10-18), and the paper carries a disclaimer that its conclusions do not represent SonarSource policy. Sonar sells SonarQube and acquired Gitar, which is a paid sponsor of this site. SonarQube is not among the four tools c-CRAB evaluates, which blunts the conflict considerably - but we are not going to call out vendor-funded benchmarks elsewhere and stay quiet about this one.

The per-repository spread in Entelligence’s data is the more useful signal for a buying decision, and it is usable despite the provenance because Entelligence published the full per-repo tables. On Cal.com (TypeScript) the top six tools clustered between 46.0% and 58.8% F1. On Grafana (Go), Codex hit 64.5% while Greptile fell to 31.6% - and Entelligence’s own entry posted 100% precision with 33.3% recall, finding 3 of 9 issues. Same tools, same week, wildly different results by language and repository. Benchmark your own repo. The published numbers tell you the ceiling, not your result.

For a head-to-head on the two most-compared tools, see CodeRabbit vs Greptile. For the full field, best AI code review tools.

How to add automated code reviews to pull requests

Direct answer: Choose the delivery model before the tool. No infrastructure and reviews today: install a GitHub App, scoped to one repository. No third-party write access permitted: a GitHub Actions workflow on a self-hosted runner with your own model key (PR-Agent or claude-code-action). Already paying for Copilot: enable it via a branch ruleset first. Then measure signal-to-noise for two weeks before expanding. Verified 2026-10-18.

The decision tree, in order:

1. Can source code leave your network? No means PR-Agent, Kodus, or an air-gapped enterprise build of Qodo, CodeRabbit, Sourcery or CodeAnt. That is the whole list.
2. What is your GitHub host? github.com means everything works. *.ghe.com or GHES means you are a self-hosted customer and your shortlist is nine tools.
3. Who holds the model key? You means an Actions workflow. Vendor means a GitHub App.
4. Are you already paying for Copilot? Then enable native Copilot review first, because the marginal cost is Actions minutes on private repos, and compare everything else against it as a baseline.
5. Gate on a status check, not an approval. Required approvals stay human.
6. Pilot on one repository for two weeks. Count the comments you acted on versus the comments you dismissed. That ratio, on your code, beats every benchmark on this page.

That sequence works on GitLab, Bitbucket and Azure DevOps too, with a different step 2. See AI pull request review for the cross-platform version and how to automate code review for the process side.

Anthropic’s Code Review went GA on 15 October 2026

This is the newest thing in the category and the reason to re-read any comparison page published before mid-October.

Anthropic made Code Review for Claude Code generally available on 15 October 2026, to Claude Team and Enterprise plans. It is a hosted multi-agent PR reviewer, not a CLI wrapper. Source: Anthropic’s announcement.

What is verified from Anthropic’s own page and launch coverage, checked 2026-10-18:

• Setup is an admin task. An org owner enables Code Review in Claude Code settings, installs the Claude GitHub App, and selects repositories. Developers add no configuration.
• Three depths per repository: Quick, Standard (default), Deep.
• Triggers: on PR open, on every push, or on request. Anyone with write access can trigger one by commenting @claude review.
• Draft PRs and forks are excluded from automatic review.
• Read-only repository access, running in a managed environment. It never builds or runs your code.
• It does not approve or block merges. Humans merge.
• REVIEW.md is read from the base or default branch, never from the PR’s own diff. That is a genuinely good design decision: a pull request cannot loosen the rules it is judged by.
• Speed: most reviews finish in 6 to 10 minutes, down from about 20 in preview.
• GitHub only, including GHES and GHEC with data residency. Not available to orgs on Zero Data Retention or the HIPAA configuration.
• Billing is token-based. Eligible Enterprise orgs can claim at least $10,000 in Code Review credits by 15 January 2027, and credits expire 30 days after being claimed.

Anthropic’s internal numbers, which are vendor-reported and not independently validated: the share of internal PRs receiving substantive review comments rose from 16% to 54% during the preview, and from June to September merged PRs more than doubled while revert share fell over 40%. Take the direction, not the decimals. Our Claude Code review page tracks this as it matures.

The strategic read: a frontier lab now ships native PR review as a first-party product on the Team and Enterprise plans that engineering orgs already buy. For the tools whose only moat was “we wrap a good model with a GitHub App”, that is a problem.

What else changed in 2026 that stale pages miss

Consolidation moved fast this year. If a comparison page does not mention these, it was not updated.

• Cursor acquired Graphite. Definitive agreement signed 19 December 2025, reportedly cash and stock well above Graphite’s ~$290M valuation. Stated plan: merge Graphite’s AI reviewer with Cursor’s Bugbot. The “Diamond” name was retired in favour of Graphite Agent, and Graphite and Cursor Bugbot now share an owner, which matters anywhere you see them compared as independent options. Graphite’s founders later shipped Cursor Origin, a Git hosting platform, which Greptile now lists as a supported code provider.
• Harness acquired DeepSource on 9 September 2026, folding it into the Harness platform. Existing workspaces continue to work.
• Harness also bought select Augment Code assets on 8 October 2026, including Cosmos, the Auggie CLI and the Code Context Engine. That is relevant to anyone citing Augment’s benchmarks, including us: the team behind that work now sits inside Harness.
• Sonar acquired Gitar on 21 May 2026. Gitar continues standalone.
• Aikido acquired Trag in August 2025, then raised a $60M Series B at a $1B valuation on 14 January 2026.
• CodeRabbit renamed its plans in September 2026: Pro became Essentials, Pro Plus became Team, and a new Advanced tier was added. Prices unchanged. Lite and Pro Legacy retired 8 June 2026.
• PR-Agent relicensed to MIT in August 2026 and is now community maintained, with the upstream repo presenting as The-PR-Agent/pr-agent separately from Qodo’s hosted product. The qodo-ai/pr-agent Action reference still works.

How we verified this

Everything in this article was checked on 2026-10-18, against primary sources where one exists.

What we checked and where:

• GitHub Copilot Actions-minutes billing: the GitHub Changelog entry of 27 April 2026, confirming the 1 June 2026 start date, affected plans, public-repo exemption and self-hosted-runner exemption.
• Copilot size limits: the GitHub Changelog entry of 27 August 2026, confirming the 300-file / 20,000-line cap was removed and bot-authored PRs are now covered.
• Copilot ruleset configuration: GitHub Docs for configuring code review by Copilot, plus community discussion #160286 for the ruleset-forces-PR-only-changes interaction.
• Anthropic Code Review GA: Anthropic’s own announcement page for the GA date, plan eligibility, three review depths, setup sequence, 6 to 10 minute review time, and the $10,000 credits offer with its 15 January 2027 deadline.
• GHES support: vendor documentation directly, specifically CodeRabbit’s GHES page and Greptile’s code providers page, which carries an explicit plan-requirement column.
• GitHub App permissions: CodeRabbit’s GitHub platform docs, cross-checked against Kudelski Security’s research writeup.
• Benchmarks: the Entelligence 2026 benchmark including its per-repository tables, Augment’s re-run (published 11 December 2025, updated 18 June 2026), the Martian Code Review Bench leaderboard, the c-CRAB paper from the National University of Singapore, and GitHub’s ReviewBench announcement of 5 October 2026. We classified each by whether the publisher sells a code reviewer.
• Workflow YAML: the anthropics/claude-code-action repository docs and PR-Agent’s GitHub Actions documentation.

What we could not verify:

• Minutes consumed per Copilot review. GitHub publishes no figure. Any page quoting a dollar-per-review number for Copilot code review is estimating, not citing.
• Anthropic’s ZDR and HIPAA exclusions for Code Review. Reported consistently in launch coverage, not stated on Anthropic’s own announcement page. Confirm with your account team if it applies to you.
• Whether a Copilot code review approval satisfies a required-approvals rule in every org configuration. The capability exists; the branch-protection semantics are being argued in public. Test it in your own org.
• Codacy and DeepSource self-hosted availability. Third-party sources contradict each other, and DeepSource was acquired by Harness on 9 September 2026, so its roadmap is in flux. We have marked neither as GHES-supported in the matrix above rather than guess.
• Gitar and GHES - corrected 2026-10-18. We originally reported Gitar as having a partial-support marker for GitHub Enterprise Server. Checking Gitar’s own platform matrix at docs.gitar.ai/connecting-code/platform-support shows GHES listed as not supported. Gitar does cover GitLab SaaS and self-managed including Free, Bitbucket Cloud and Data Center, Azure DevOps Services and Server, and AWS CodeCommit in preview. Gitar is our paid category partner, and we had the error in their favour. Correcting it visibly rather than quietly is the whole point of taking sponsor money on stated terms.
• Any independent third-party review-quality benchmark for Gitar, cubic, Macroscope or CodeAnt. None exists that we can find. The absence is the finding.

Recommendations

Criteria stated: documented GitHub support for your host, honest data path, and a cost model you can forecast. Review quality is deliberately not the first filter, because the published evidence does not separate the leaders cleanly enough to justify it.

If you are on github.com and already pay for Copilot at Pro or above: start with native Copilot code review. It is included from Pro ($10/mo) upward and on Business and Enterprise licences; only Copilot Free is excluded (verified 2026-10-18). Then enable it with a branch ruleset, set an Actions budget, and run it for a month. It is the only option where the marginal cost is minutes rather than a new seat line, it no longer has a PR size cap, and it gives you a baseline to judge everything else against. Its 22.6% F1 in Entelligence’s own benchmark is the worst of the eight tools measured, so treat it as a floor, not a destination.

If you are on github.com and want the best-documented commercial reviewer: CodeRabbit or Greptile, and pick on cost shape, not benchmarks. CodeRabbit is $24/dev/mo on Essentials with $0.25 per reviewed file past hourly limits. Greptile is $30/seat with 50 credits per author that do not pool. Those two pricing models fail in opposite directions, which is the real decision. CodeRabbit vs Greptile works through it.

If you are on GHES or *.ghe.com: Qodo or CodeRabbit, and budget four to six weeks. Qodo documents GHES plus air-gapped on-prem. CodeRabbit has a self-service Self-Hosted GitHub flow and a reverse tunnel for locked-down networks, though the fully on-prem agent needs 500+ seats. Both require a sales conversation. Start it before you build the business case, not after.

If code cannot leave your network at all: PR-Agent or Kodus. MIT and AGPLv3 respectively, free to self-host at any size, both accept local models via Ollama or any OpenAI-compatible endpoint. c-CRAB scored PR-Agent at 23.1%, the second-lowest of the four agents it tested, so you are trading review quality for data control. That is a legitimate trade. Make it knowingly.

If you want the newest architecture and you are a Claude Team or Enterprise customer: pilot Anthropic’s Code Review. GA since 15 October 2026, 6 to 10 minute reviews, REVIEW.md read from the base branch so a PR cannot weaken its own rules, and at least $10,000 in credits for eligible Enterprise orgs if you claim by 15 January 2027. It is three days old as a GA product at the time of writing and has no independent benchmark. Pilot it; do not standardise on it yet.

Whatever you pick, gate the merge on a status check and keep approvals human. And if your repository is large, read the companion to this page before you commit: best AI code review tools for a large codebase covers the diff-only versus full-repository-indexing split, which decides more about review quality than the GitHub integration ever will.