Self-Hosted AI Code Review Tools (2026): The 3 Levels

Direct answer

“Self-hosted” means three different things in this market and vendors use the strongest word for the weakest arrangement. Level 1 runs the application and the model inside your perimeter: PR-Agent, Kodus, SonarQube, Tabnine, DeepSource Enterprise Server. Level 2 is a self-hosted control plane behind a commercial gate: CodeRabbit at 500+ seats, Qodo at 30+ users, Greptile, GitLab Duo. Level 3 is private-network plumbing with cloud review - GitHub Copilot, Anthropic Code Review, Snyk Broker. Verified 2026-10-18.

AI code review tools available for self-hosting

Direct answer: Four tools self-host with no seat minimum: PR-Agent (MIT, v0.48.0, 2026-10-16), Kodus (AGPLv3), Semgrep CE, SonarQube. Five need an enterprise contract: CodeRabbit (500+ seats), Qodo (30+ users), Greptile, Tabnine, DeepSource Enterprise Server. GitLab Duo Code Review self-hosted models hit GA in GitLab 18.4. Copilot and Anthropic Code Review cannot be self-hosted. Verified 2026-10-18.

This whole article rests on one idea: the word “self-hosted” is doing three different jobs on vendor pages, and only one of them means what a security reviewer thinks it means.

The failure mode is specific and I have watched it happen. A team clears an AI reviewer through security on the understanding that it runs in their infrastructure, rolls it out to 400 engineers, and then discovers during SOC 2 readiness that source code has been leaving the network for eight months. The vendor did not lie. The vendor wrote “supports self-hosted runners” and the reader heard “self-hosted review.”

Level	What it means	Tools	Commercial gate	Air-gap documented
1. Fully self-hosted	You run the application and nominate the model, with no required egress.	PR-Agent, Kodus, SonarQube, Tabnine, DeepSource Enterprise Server, Semgrep CE engine	None for PR-Agent, Kodus, Semgrep CE, SonarQube server. Tabnine and DeepSource are paid Enterprise	Yes for Tabnine, DeepSource, SonarQube
2. Self-hosted control plane	The vendor’s agent runs in your infrastructure and calls an LLM endpoint you nominate.	CodeRabbit, Qodo, Greptile, GitLab Duo Code Review, Panto	CodeRabbit 500+ user seats. Qodo Enterprise, effectively 30+ users. Greptile Enterprise. GitLab: Duo Enterprise add-on	Yes for Qodo (SCM-restricted) and GitLab. Claimed without a runbook for Greptile
3. Private-network plumbing, cloud review	Credentials or context stay local. Inference does not.	GitHub Copilot code review, Claude Code Review, Snyk Broker, Semgrep Network Broker, Codacy AI Reviewer	Included in existing plans	No

If you remember one row, remember the third.

The three levels in detail

Level 1 - you run the application and the model

PR-Agent is now community-owned and is the only genuinely unrestricted option. Qodo relicensed it to MIT and handed it to independent community governance on 23 April 2026 - not August 2026, which is the date most comparison pages still carry. The repository moved to The-PR-Agent/pr-agent and the docs to docs.pr-agent.ai. Qodo remains a sponsor but no longer governs it. The repo description now reads “PR Agent: The Original Open-Source PR Reviewer. This project is not the Qodo free tier.” Latest release is v0.48.0, published 2026-10-16, at 13.4k stars, so it is actively shipping.

One licence correction. Qodo’s own handover blog post and most secondary coverage say the licence returned to Apache 2.0. The LICENSE file on main is MIT, copyright “The PR Agent” 2026, and GitHub’s API reports spdx_id: MIT (checked 2026-10-18). Cite the file, not the blog post.

It installs by pip install pr-agent[github], Docker (pragent/pr-agent, renamed from codiumai/pr-agent), a GitHub Action, or a webhook server, and it supports GitHub and GHES, GitLab including self-managed, Bitbucket Server and Data Center, Azure DevOps and Gitea. Model routing goes through LiteLLM, so Ollama, vLLM, HuggingFace TGI endpoints, Azure OpenAI and AWS Bedrock all work.

A second correction, this one aimed at a competitor’s page. Augment Code’s open-source roundup states that PR-Agent issue #2098 remains open and that the tool “silently fell back to OpenAI-hosted models despite the local endpoint configuration.” We read the issue. #2098 was closed as completed on 2026-08-06, and the resolution was that OPENAI__API_TYPE is not a model selector and nothing reads it. The fix is to name the model explicitly, in the form openai/qwen3-235b, with fallback models and token limits set. That is a documentation gap, not a silent-exfiltration bug. Set your fallbacks explicitly anyway - leaving a hosted default in the fallback chain is a genuine air-gap hazard even though the bug report was not.

Kodus has the best “no sales call” self-host story. AGPLv3 core with a separate enterprise licence file, which is why GitHub reports NOASSERTION. It deploys by Docker on a VM with Helm charts referenced for Kubernetes and OpenShift, accepts any OpenAI-compatible endpoint, and supports GitHub, GitLab, Bitbucket, Azure DevOps and Forgejo. The published minimum is 2 cores, 8GB RAM and 60GB disk - by a wide margin the lowest bar in this set. Default outbound traffic is an anonymous daily heartbeat, disabled with KODUS_TELEMETRY_DISABLED=true. We could not confirm a formal air-gap runbook in the repository, so treat the image-mirroring recipe as partially unverified.

SonarQube has the clearest air-gap statement of any vendor here, and almost nobody covers it. Sonar’s docs say that for fully self-hosted SonarQube Server configurations, AI CodeFix “is designed to operate without outbound internet access”. That is a change from the 2025.2-era docs, which still needed internet access to fetch prompts and rule descriptions. The AI layer takes four provider options: Sonar’s own OpenAI models, your Azure OpenAI service, AWS Bedrock, or a self-hosted LLM gateway, with Ollama, LiteLLM and vLLM named explicitly. There is even an Enforce Azure OpenAI EndPoint Domain setting.

Two caveats that matter more than the headline. AI CodeFix is Enterprise and Data Center editions only. And Community Build cannot analyse branches or pull requests at all - that capability starts at Developer Edition.

Do not conflate SonarQube Community Build with SonarQube Cloud’s free tier. The market conflates these constantly and it produces wrong advice in both directions:

	SonarQube Community Build	SonarQube Cloud free tier
Where it runs	Self-hosted, your infrastructure	Sonar’s cloud
Cost	Free	Free, never expires
Pull request analysis	No - main branch only	Yes
Private project limit	None	Up to 50k lines of code
Relevant to an air-gapped deployment	Yes	No

If you need free PR decoration and have no residency constraint, SonarQube Cloud’s free tier is the better answer and almost nobody says so. If you need offline operation, only Community Build qualifies, and you accept main-branch-only analysis. Those are the two real options and they are not interchangeable.

Sonar publishes no dollar prices; licensing is per instance per year by lines of code, with Developer “recommended for 100K+ LOC” and Enterprise “1M+ LOC”. Any specific SonarQube price you see quoted is unverified. One more licence note: the bundled analyzers moved to the Sonar Source-Available License v1.0 on 2024-11-29, so “open source SonarQube” is now only true of the LGPLv3 core. We cover the split in SonarQube Community vs Enterprise.

DeepSource Enterprise Server is the only product here where air-gap is a named install type, sitting alongside its standalone-cluster and existing-cluster methods in the self-hosted docs. It wants two servers at 16 cores and 32GiB each, one for application workloads and one for analysis. It supports GHES plus GitLab CE and EE, but not Bitbucket Data Center, Azure DevOps Server, Gerrit or Perforce. Its AI features are not documented in the self-hosted material, so treat DeepSource on-prem as a very good deterministic engine - 5,000+ rules across 30+ languages, running before any AI agent - rather than a self-hosted LLM reviewer.

Tabnine remains the most mature air-gap deployment, and it changed hands this year. Tricentis acquired Tabnine, announced 2026-07-30. Tabnine’s docs still publish a full air-gapped guide: Kubernetes on your hardware, metrics to your Prometheus, logs to your aggregator, the attribution database installable on-prem instead of calling attribution.tabnine.com, the JetBrains plugin served from your own custom plugin repository, and the entire documentation set bundled at /docs on the self-hosted admin console with offline search. Enterprise admins in private installations can connect Tabnine to internal model endpoints. Pricing is no longer published - tabnine.com/pricing/ now redirects to a Tricentis contact form, so every per-seat figure in circulation is unverified as of 2026-10-18. Note also that Tabnine is primarily an assistant, not a PR reviewer.

A correction on Tabby, because we have made this mistake too. Tabby appears on nearly every self-hosted AI code review list, including older pages of ours. It is a self-hosted coding assistant - completion, chat, answer engine, code browser - and there is no documented PR or code review feature. It does not belong on a review shortlist. Its LICENSE is Apache 2.0 with the ee/ directory licensed separately, which is where SSO and LDAP live, hence GitHub reporting NOASSERTION. Latest release is v0.32.0, published 2026-01-25, default branch last pushed 2026-06-30. The same correction applies to Refact.ai: an IDE agent, not a reviewer, now developed in a 71-star fork after the original repo was archived, with its cloud retired and its docs domain redirecting to a GitHub wiki that would not load for us.

Level 2 - self-hosted control plane on an enterprise tier

The vendor’s reviewer runs in your cluster and calls an LLM endpoint you control: your Azure OpenAI tenancy, your Bedrock account, or a local model. Your code stays inside the boundary. The catch is commercial.

CodeRabbit self-hosting requires 500 or more user seats. Stated plainly in its docs: “The self-hosted option is available for CodeRabbit Enterprise customers with 500 or more user seats.” It “ships as a container image that you run in your own environment - on a server, in a container platform, or as a serverless workload,” you “bring your own model,” and it supports GitHub Enterprise Server, GitLab self-managed, Azure DevOps and Bitbucket Data Center. Where your Git platform cannot accept inbound connections, CodeRabbit’s Reverse Tunnel keeps all connections outbound from your network. That is not an air-gap, but it is honest engineering and worth knowing about. At 500 seats and Essentials at $24 per developer per month annual, you are past $140,000 a year on list before any enterprise uplift. The floor is real.

Qodo has an effective 30-seat threshold and the most interesting air-gap restriction in the market. On-prem is Enterprise-only and deploys on Kubernetes. Qodo’s pricing page puts Pro Team at $30 a month “designed for up to 30 users” and Enterprise at “For 30+ users,” with on-prem and air-gapped listed under Enterprise. The restriction: air-gapped deployment is supported only for GitHub Enterprise, GitLab Self-Managed, Bitbucket Data Center and Gerrit. Bitbucket Data Center is on-prem only with no single-tenant option, and Azure DevOps Cloud has no on-prem path at all. Qodo does not document bringing your own model on its on-prem page, so treat that as unverified.

Greptile publishes the best self-host sizing data of any commercial vendor here. Enterprise tier only, with two documented paths: Docker Compose for up to 100 developers on a single Linux VM, or Kubernetes with Helm above that. A Terraform option provisions VPC, EC2, RDS Postgres and ElastiCache Redis and bootstraps Compose in one apply. Published sizing runs from 4 cores and 16GB for 5 to 10 developers up to 32 cores and 128GB at 100 developers on Compose, and 10 to 20+ nodes with 160 to 640+ cores at 500+ developers on Kubernetes. The index lives in Postgres with pgvector, with Redis for cache and Hatchet for orchestration, and the Helm charts are public at greptileai/akupara. Model providers: OpenAI, Anthropic, AWS Bedrock, Azure OpenAI and GCP Vertex AI across three slots - reasoning, fast, embeddings. A local OpenAI-compatible endpoint is not explicitly named, so that is unverified. Air-gap is named as a use case with no step-by-step runbook published. Pro is $30 per seat per month and no self-hosting seat minimum is published.

GitLab Duo Code Review with self-hosted models is the most under-covered option in this market. From the feature’s own version history: “Changed to be available on GitLab Duo with self-hosted models in beta in GitLab 18.3,” then “Changed to be generally available on GitLab Duo with self-hosted models in GitLab 18.4.” Supported families are Mistral, Meta Llama, Anthropic Claude and OpenAI GPT, served through vLLM (install v0.6.4.post1 or later, endpoint suffixed /v1), AWS Bedrock or Azure OpenAI. Since 18.3 a “general” model family accepts any OpenAI-API-compatible model. GitLab 18.4 also added GPT-5 on Azure OpenAI and GPT OSS 20B and 120B. GitLab 19.0 added four more open-weight models aimed squarely at air-gapped and regulated environments: Mistral Devstral 2 123B, GLM-5.1, Kimi-K2.6 and MiniMax-M2.7, plus group-level custom review instructions via .gitlab/duo/mr-review-instructions.yaml.

Two things to carry into a change ticket. Do not conflate GitLab Duo Self-Hosted with Duo Code Review on self-hosted models - the former went GA in 17.9, the latter in 18.4. And there is an upgrade landmine: in GitLab 19.2.0, the Duo Self-Hosted AI Gateway URLs are cleared on Linux package upgrade and self-hosted AI features stop working until re-entered. Fixed in 19.2.1 and later. Current GitLab is 19.5, released 2026-10-15.

If you already pay for Duo Enterprise on Self-Managed, this is the cheapest route to a compliant AI reviewer that exists, because the marginal cost is your own inference.

Panto documents self-hosting, but it is a sales-gated container drop. The docs describe being sent Docker image URLs with credentials, then health-checking http://<your_local_ip>:5001/health. No public images, no Helm chart, no compose file. You bring your own API keys for OpenAI, Claude, Gemini or DeepSeek; no local endpoint is documented. Air-gap is not mentioned at all, and deployments must stay within 30 days of the latest version, which cuts directly against air-gap practice.

Level 3 - private-network plumbing that is not self-hosted review

This is the level that gets security reviews reopened after the fact.

GitHub Copilot code review. Since GitHub moved it to an agentic architecture in March 2026, GitHub’s own docs state that “Copilot code review uses GitHub Actions to run the agentic capabilities, including full project context gathering and passing suggestions to Copilot cloud agent.” You can run that job on your own runners, and self-hosted runners do not consume Actions minutes. GitHub is explicit about the constraints: “ARC is the only officially supported solution for self-hosting Copilot code review. For security reasons, do not use non-ARC self-hosted runners”, and “Copilot code review is only compatible with Ubuntu x64 Linux runners.”

Here is the proof the review is not local. That same page instructs you to allow firewall connections to api.githubcopilot.com, uploads.github.com and user-images.githubusercontent.com. If inference were local, there would be nothing to allow. Three further facts that disqualify Copilot for this use case: model switching is explicitly not supported (“changing the model is likely to compromise reliability, user experience, and the quality of review comments”), the docs are versioned for GitHub.com and Enterprise Cloud only with no GHES support for the @copilot reviewer, and if Actions is unavailable reviews still generate but in a degraded, non-agentic mode.

The billing confirms the architecture. Since 1 June 2026, a Copilot code review on a private repository is charged twice - GitHub AI Credits for the model work and Actions minutes for the runner. GitHub estimates $0.25 to $5 of AI Credits for a Balanced review and $0.05 to $1 for Lite, with AI Credits priced at $0.01 each, included private-repo minutes at 2,000 on Free, 3,000 on Pro and Team, 50,000 on Enterprise Cloud, and $0.006 per minute for a standard Linux 2-core runner beyond that. Two further billing facts most pages miss: GitHub retired annual Copilot billing entirely on 1 June 2026, monthly only, and code review is not on every plan - on individual tiers it starts at Pro+ at $39 a month, with Free and Pro excluded. We break the maths down in GitHub Copilot pricing. Two meters is a reasonable architecture. It is not an air-gapped one.

Anthropic Code Review, GA 2026-10-15, is the inverse case and the docs are refreshingly blunt. It is three days old at the time of writing and one source still showed “research preview” in the docs on the GA date, so treat everything here as early and re-check before procurement. Anthropic is offering up to $50,000 in review credits to eligible Enterprise organisations, which tells you how hard it intends to compete. Anthropic states: “Where it runs: on Anthropic infrastructure, in a managed environment. Reviews don’t run in self-hosted environments.” The four stages - Find with parallel agents, Verify to filter false positives, Rank, Post - all execute on Anthropic infrastructure. It is a GitHub App with read-only repo access, not an Action; it does not push commits or run your code; and it reads REVIEW.md from the base or default branch never from the PR’s own changes, so a pull request cannot loosen the rules judging it. That last detail is a genuinely good security design that nobody writes about.

The inversion: Anthropic Code Review does support GitHub Enterprise Server and GitHub Enterprise Cloud with data residency, which Copilot code review does not. But the exclusions are hard. It is not available to organisations with Zero Data Retention, with the HIPAA configuration applied, or using customer-managed encryption keys, and it is not covered under Anthropic’s BAA. For a regulated buyer, that rules it out outright - which is exactly the overlap we unpack in AI code review tools for regulated software teams. A Claude Team or Enterprise organisation is required even if your developers reach Claude Code through Bedrock, Google Cloud or Microsoft Foundry, so an existing Bedrock tenancy does not get you Code Review. Anthropic does document a self-managed alternative: run Claude in your own GitHub Actions or GitLab CI/CD on your own runners with your own API key, on any plan. That is a different product posture and a legitimate Level 1-adjacent path.

Two security vendors sell private-network connectors that read as self-hosting and are not. Snyk Broker is “an open-source proxy that securely connects Snyk to on-premises and private-network systems,” Enterprise plans only. Credentials stay inside your perimeter; analysis runs in Snyk’s SaaS backend. Semgrep’s Network Broker is more explicit: it “creates a WireGuard VPN tunnel to the Semgrep backend and proxies inbound HTTP requests from Semgrep to the customer through the tunnel,” requiring outbound UDP 51820 to wireguard.semgrep.dev. Semgrep AppSec Platform has no on-prem edition at all - the Enterprise plan adds on-prem SCM support, not an on-prem platform. Both products are good engineering solving a real reachability problem. Neither keeps code inside your network.

And one structural contradiction worth flagging. Codacy Self-hosted exists and deploys by Helm on Kubernetes or MicroK8s. But the Codacy AI Reviewer is “currently only available on GitHub, for all Team and Business plans” - cloud only, not listed for Self-hosted - and Codacy requires its Self-hosted product for GitHub Enterprise Server 3.6.2 and above. The net effect is that GHES customers structurally cannot get Codacy’s AI review. Codacy also uses OpenAI via Amazon Bedrock with no bring-your-own-model option, and Self-hosted requires outbound connectivity to Docker Hub, so it is not air-gappable either.

Are AI code review tools safe for proprietary code?

Direct answer: For most proprietary code, yes - a cloud reviewer with SOC 2 Type II, a signed DPA and a contractual no-training commitment is accepted by most legal teams. It is not sufficient against a hard data-residency rule, export control such as ITAR, or an air-gap mandate, because those are network-egress rules no certification satisfies. Verified 2026-10-18.

The question is always asked as a vendor-trust question and almost always decided as a network-topology question. Those are different problems and conflating them wastes months of procurement time.

If your constraint is vendor trust, the controls that matter are a documented retention window, a written no-training commitment, SOC 2 Type II with an obtainable report, and a DPA. All of that is available from cloud vendors and verifiable in an afternoon. Self-hosting is a very expensive way to solve a problem a contract solves.

If your constraint is network egress, nothing on a trust centre helps. A tool can hold every certification in the catalogue and still be disqualified because the packet crosses the boundary. That is when Level 1 or Level 2 becomes mandatory rather than preferable.

The genuinely uncomfortable case is what is already in the repository. Test fixtures containing real customer records. Debug logs committed by accident. .env files that should never have been tracked. A cloud reviewer reads all of it and self-hosting does not fix it - it changes who is liable. Run a secrets scanner before you run an AI reviewer, whichever level you are on. The full threat model is in AI code review security.

One honest note on ceiling, and one miscitation to kill. The c-CRAB study from the National University of Singapore (arXiv 2603.23448) converted 234 validated human review comments across 184 PRs and 67 repositories into executable tests. Its headline, quoted exactly: “Taking the union across all four tools, 97 out of the 234 tests were passed by at least one tool (41.5%).” Per tool: Claude Code 32.1%, Devin 24.8%, PR-Agent 23.1%, Codex 20.1%. NUS sells no reviewer, which is why this is the safest number in the market. One disclosure, because we hold other publishers to it: c-CRAB is not conflict-free. Five of its six authors are academic (National University of Singapore, Zhejiang University), but one lists SonarSource as their affiliation (arXiv 2603.23448v3, verified 2026-10-18), and the paper carries a disclaimer that its conclusions do not represent SonarSource policy. Sonar sells SonarQube and acquired Gitar, which is a paid sponsor of this site. SonarQube is not among the four tools c-CRAB evaluates, which blunts the conflict considerably - but we are not going to call out vendor-funded benchmarks elsewhere and stay quiet about this one.

The miscitation: the widely-quoted “40 to 70% false positive rate” attributed to c-CRAB is not in that paper. No false positive rate is reported for any reviewed tool. The phrase appears twice and both are conceptual; the one in section 4.2.1 concerns tuning the authors’ own comment classifier, not the tools. If you see that figure cited to c-CRAB, the citation is wrong. More in AI code review vs manual review.

AI code review software for an on-premise setup

Direct answer: GitLab Self-Managed shops should use GitLab Duo Code Review with self-hosted models, beta in 18.3 and GA in 18.4. For a deterministic engine with a genuinely offline AI layer, SonarQube Enterprise is best documented. CodeRabbit ships a self-hosted container image at 500+ seats. Tabnine Enterprise is the most mature air-gap, though pricing stopped being published after the Tricentis acquisition. Verified 2026-10-18.

Your situation	What I would deploy	Why	Gate
GitLab Self-Managed, already paying for Duo Enterprise	GitLab Duo Code Review, self-hosted models	GA in 18.4, marginal cost is your own inference, no new vendor, 19.0 added four air-gap-oriented open models	Duo Enterprise add-on on Premium/Ultimate
Air-gapped, need a vendor contract and a written runbook	Tabnine Enterprise	Full published air-gap guide, offline docs bundled, on-prem attribution DB	Enterprise, price no longer published
Air-gapped, want deterministic depth over LLM commentary	DeepSource Enterprise Server or SonarQube Enterprise	Air-gap is a named install type (DeepSource); AI CodeFix “designed to operate without outbound internet access” (SonarQube)	Paid Enterprise both
Air-gapped, zero budget, strong platform team	Kodus (AGPLv3) + Semgrep CE with vendored rules	Free at any size, 2 cores / 8GB floor, telemetry opt-out flag	SSO/RBAC/audit logs sit behind the enterprise licence
500+ engineers, want the strongest cloud reviewer on-prem	CodeRabbit self-hosted	Container image, bring your own model, broadest self-managed Git support, Reverse Tunnel	500+ user seats
You run Gerrit	Qodo Enterprise	The only vendor whose docs name Gerrit for air-gapped installs	Enterprise, effectively 30+ users

What I would not do is build a custom on-prem reviewer. Dextra Labs quotes $500K to $1.2M initial plus $200K to $400K annually for custom development, with break-even against off-the-shelf at 1,500+ engineers. Dextra Labs sells exactly that custom development, so read the break-even as the most favourable reading of their own offer - and note that even their favourable reading puts almost everybody on the buy side.

Code review software that works with self-hosted Git repositories

Direct answer: CodeRabbit self-hosted covers GHES, GitLab self-managed, Azure DevOps and Bitbucket Data Center. PR-Agent adds Gitea. Kodus adds Forgejo. Qodo is the only vendor naming Gerrit. Greptile’s self-host docs name Perforce. Cloud support for a provider never implies self-managed support - read the deployment docs, not the pricing page. Verified 2026-10-18.

Tool	GHES	GitLab Self-Managed	Bitbucket Data Center	Azure DevOps Server	Gitea / Forgejo	Gerrit / Perforce
CodeRabbit self-hosted	Yes	Yes	Yes	Yes	Not stated	Not stated
PR-Agent	Yes	Yes	Yes (Server + DC)	Yes	Gitea	No
Kodus	Yes	Yes	Yes	Yes	Forgejo	No
Qodo on-prem	Yes	Yes	Yes (on-prem only)	No on-prem path	Not stated	Gerrit
Greptile self-hosted	Yes	Yes	Unverified	Not stated	Unverified	Perforce
DeepSource Enterprise Server	Yes	Yes (CE and EE)	No	No	No	No
GitLab Duo Code Review	n/a	Yes	n/a	n/a	n/a	n/a
GitHub Copilot code review	Not supported	No	No	Azure DevOps Cloud preview only	No	No
Anthropic Code Review	Yes	No	No	No	No	No
SonarQube	Yes	Yes	Yes	Yes	No	No
Codacy Self-hosted	Yes, but AI Reviewer is cloud-only	Yes	Bitbucket Server	No	No	No

“Not stated” means the vendor’s own self-hosting documentation did not list it as of 2026-10-18. That is not the same as unsupported - it means you must ask, and you should get the answer in writing before signing.

Two failure modes to design around. Webhook reachability runs in both directions: your Git server must reach the reviewer’s endpoint and the reviewer must reach your Git server’s API. CodeRabbit’s Reverse Tunnel exists precisely because this breaks. And SonarQube’s edition split means PR decoration needs Developer Edition or higher even though the core engine is free on Community Build.

Static analysis tools that work offline

Direct answer: Semgrep CE and SonarQube are the strongest offline options, both with caveats. Semgrep CE is fully local only with vendored rules via --config /path/to/rules; --config auto and semgrep ci both need the network. SonarQube’s engine is self-managed on every edition, but Community Build cannot analyse branches or pull requests at all. Both are deterministic, which auditors value. Verified 2026-10-18.

Tool	Licence / cost	Fully offline	PR analysis in free tier	Deterministic	The catch
Semgrep CE	LGPL-2.1, free, v1.181.0 (2026-10-14)	Yes, with vendored local rules	Via your own CI	Yes	--config auto, registry packs and semgrep ci all require the network. No on-prem platform exists
SonarQube Community Build	Free, LGPLv3 core; analyzers under SSALv1 since 2024-11-29	Yes	No - cannot analyse branches or PRs	Yes	PR analysis starts at Developer Edition; AI CodeFix is Enterprise/Data Center
SonarQube Enterprise	Per instance per year by LOC, price not published	Yes, explicitly, including AI CodeFix	Yes	Deterministic core, AI layer is not	No published price; “1M+ LOC” guidance
DeepSource Enterprise Server	Paid	Yes, air-gap is a named install type	Yes	Yes for the static layer	2 servers at 16 cores / 32GiB each; AI features not documented on-prem
Snyk Code	Paid; free capped at 5 projects	No - Broker is a proxy to Snyk’s SaaS	Limited	Yes	Analysis always runs in Snyk’s cloud
Codacy Self-hosted	Paid, v16.0.0 (2026-01-16)	No - needs Docker Hub egress	Yes	Yes	AI Reviewer is cloud-and-GitHub only

Why determinism is worth paying for. A SOC 2 or ISO 27001 auditor sampling your change-management evidence expects the same input to produce the same output. An LLM reviewer does not guarantee that. The best architecture I have seen in regulated environments runs the deterministic layer as the blocking gate and the LLM layer as advisory commentary - which is exactly what DeepSource does by design, running its static rules before the AI agent sees the code. More in open source AI code review tools and best code audit tools.

The honest trade-off: what self-hosting actually costs

Self-hosting does not remove cost. It converts a licence fee into GPU capacity, inference tokens and ops headcount, and the exchange rate is worse than most business cases assume.

The best independent evidence is unflattering to self-hosting. arXiv 2607.13080, “Inference Economics of Enterprise Coding Agents: A Case Study of Cloud vs. On-Premise LLMs” (Peng, Lin and Lee, submitted 2026-07-13), ran Claude Opus with Claude Code against a GLM configuration on Opencode on NVIDIA Blackwell hardware, over two 28-day periods on production code:

Metric	On-premise open weights	Cloud frontier API
Fix commit ratio (lower is better)	74.9%	45.9%
Repair odds vs cloud, every difficulty tier	2.6x to 4.9x higher	baseline
Effective inference cost	$2.83 per million tokens amortised	$0.57 per million tokens at a 99.3% cache hit rate
TCO under shared GPU allocation	40.1% cheaper	baseline
TCO under dedicated GPU reservation	43.8% more expensive	baseline

Read that twice. The local deployment was cheaper per month only when its GPUs were shared with other workloads, and it produced materially more rework - the paper describes “more work trapped in debugging spirals and a slower commit cadence.” The conclusion is that hybrid routing is a cost-quality trade-off, not a free win. Utilisation, not hardware choice, dominates self-hosted inference economics. Code review happens to be a comparatively favourable workload for self-hosting, because it is batchable and schedulable.

There is no published benchmark of self-hosted local-model review quality against cloud-tier review quality. We looked hard for one. The figure you will see quoted everywhere - that an air-gapped setup with a local model via Ollama delivers roughly 60 to 70% of cloud-tier review quality - is not a review-quality measurement at all. We traced it, and it is a conflation of three unrelated numbers:

1. A local GPU covering roughly 60 to 70% of a daily coding task mix in a 50-task blog benchmark, with the gap concentrated in multi-file refactoring.
2. A total-cost-of-ownership analysis recommending routing 60 to 70% of traffic to local models.
3. GPU spend being 60 to 70% of self-hosted TCO.

None of those measures review quality. Treat the figure as retired. Our direct competitor aicodereview.io only claims this gap qualitatively on its own self-hosted guide, so being precise costs us nothing and gains the reader an honest answer.

What we can say qualitatively, and it is the part that matters. The documented weakness of smaller local models is multi-file and cross-file reasoning - following a data path across service layers, noticing that a change to one module breaks an invariant asserted in another. That is precisely the class of finding that makes AI review worth paying for. Single-file lint-grade commentary is where local models hold up best and where they add least value.

The most quotable admission comes from an open-source review tool’s own docs. PR-Agent’s usage guide states that “based on our testing, local open-source models are suitable for experimentation and learning purposes (mainly for the ask command), but they are not suitable for production-level code analysis tasks,” naming structured output on large inputs as the failure mode. That text was originally written by Qodo, who sell commercial Qodo Merge, so they benefit from the conclusion - but it now sits in community-governed docs and the technical reasoning is specific. The same page flags a gotcha worth its own paragraph: Ollama defaults to a 2048-token context and needs OLLAMA_CONTEXT_LENGTH raised, which silently wrecks review quality on any realistic diff.

Model size is not the lever people think it is. arXiv 2606.15689, “Bigger Isn’t Always Better” (Kumar, Bararia and Raj, submitted 2026-04-09), evaluated five models across 150 samples and found the smaller Claude Haiku 4.5 beat the larger Claude Sonnet 4.6 on F1 (0.365 vs 0.343) with 18% higher recall at 3.2x lower cost per review. Two findings from that paper deserve to be on a wall: performance degraded 92% moving from synthetic injected bugs to real pull requests (F1 0.847 down to 0.066), and diff size was the dominant quality predictor, collapsing from 0.657 F1 on small diffs to 0.043 on large ones. All models showed near-zero recall on performance bugs.

The practical read: small diffs plus a deterministic gate buy more review quality than a bigger model does. True in the cloud, doubly true self-hosted.

The GPU bill, from a vendor requirements table rather than a marketing page. GitLab publishes hardware requirements for Duo Self-Hosted: a 7B model wants 1x A100 40GB and 35GB VRAM; 22B wants 2x A100 80GB and 110GB; Mixtral 8x7B wants 2x A100 80GB and 220GB; Mixtral 8x22B wants 8x A100 80GB and 526GB. Base host is 8 cores and 32GB minimum, 16+ cores and 64GB recommended. H100 and H200 are “expected to work but have not been tested.” That is the honest shape of the capital commitment, and it comes from a vendor who wants you to self-host.

Three more costs nobody prices in:

• SSO, RBAC and audit logs are often not in the free tier. Tabby puts SSO and LDAP in its separately licensed ee/ directory. Kodus uses the same dual-licence layout. Those are the exact controls an auditor asks about, so a free install can pass data residency and fail access control.
• Model upgrades become your problem. Cloud vendors swap in a better model and you get it free. Self-hosted, every upgrade is a capacity-planning and regression-testing exercise.
• Ops time. Augment Code estimates 0.25 to 0.5 FTE for ongoing maintenance of a self-hosted stack and quotes $1,000 to $2,900 a month for continuous GPU rental at RunPod and Lambda on-demand rates. Augment sells a competing cloud product, so treat both as directional rather than independent.

A decision tree keyed on your actual constraint

Answer the first question honestly and the rest follows.

1. Is there a written rule that source code cannot leave your network?

• Yes, and it is an air-gap or export-control mandate (ITAR, IL5/IL6, classified). Level 1 only. Shortlist: Tabnine Enterprise if you need a contract and a runbook, DeepSource Enterprise Server or SonarQube Enterprise if you want depth over LLM commentary, Kodus plus Semgrep CE with vendored rules if budget is zero. Budget for GPU and plan around the arXiv 2607.13080 quality gap.
• Yes, but it is a data-residency rule (EU-only, in-country). Level 2 is usually enough, and a regional cloud region often satisfies it with no self-hosting at all. Ask before you build.
• No, it is a preference or an unexamined policy. Go to question 2. Self-hosting on a preference is the most expensive way to feel better.

2. Do you need to control which model reads your code?

• Yes, for model-provenance or AI-governance reasons. Level 2 solves this cleanly and it is the option most teams overlook. GitLab Duo self-hosted models, CodeRabbit self-hosted against your own provider, SonarQube AI CodeFix pointed at your Azure OpenAI or a local vLLM gateway, or Greptile Enterprise on Bedrock. You get frontier-model quality through your own tenancy.
• No. Stay cloud and spend the saved budget on seats.

3. Is cost the driver?

Then do not self-host. Read the cost table again. Negotiate instead - this market is competing hard and CodeRabbit raised $143M at a $1.5B valuation specifically to buy share. Ask for the discount.

4. Do you have fewer than 100 engineers?

Self-hosting a model almost certainly loses on economics. Twenty developers on CodeRabbit Essentials annual is $5,760 a year; the low end of continuous GPU rental is around $12,000 before ops time. The exception is if you already run GPUs for something else, in which case utilisation improves, the marginal cost collapses, and Level 1 becomes genuinely attractive - which is exactly what the arXiv study measured.

What we could not verify

Stating this plainly is the point of the page.

• Tabnine Enterprise pricing. The pricing page now redirects to a Tricentis contact form. Every per-seat figure in circulation traces to third-party aggregators. Unverified as of 2026-10-18.
• Any specific SonarQube price. Sonar publishes no dollar figures, only per-instance-per-year by lines of code. Unverified.
• Greptile on Bitbucket Data Center and Gitea for self-hosted installs. Claimed on the pricing page’s Enterprise list; the deployment docs detail only GitHub, GitLab and Perforce. Unverified.
• Qodo bring-your-own-model on-prem. Not documented on the on-prem or deployment-models pages. Unverified.
• Greptile and Tabnine air-gap runbooks. Both name air-gap as a supported scenario. We have seen a published runbook only from Tabnine, DeepSource, GitLab and SonarQube.
• Kodus formal air-gap runbook. Telemetry opt-out and image mirroring are described; a complete offline install guide was not confirmed in the repository.
• Panto’s self-hosting tier gate. The self-hosted docs state no tier requirement. Enterprise-only gating is a marketing claim we could not confirm in docs.
• Amp self-hosting and bring-your-own-inference. The GitHub Code Review Agent repo moved from Sourcegraph to ampcode/cra-github and is archived, last pushed 2025-12-29. Amp was spun out of Sourcegraph as a separate company in December 2025. No current Amp documentation of self-hosted review deployment exists. Unverified.
• Refact.ai specifics. Docs domain redirects to a GitHub wiki that would not load. Unverified.
• Any published benchmark of self-hosted local-model review quality vs cloud-tier review quality. None exists that we could find. The widely repeated “60 to 70%” figure is a conflation of a coding-task-mix benchmark, a traffic-routing recommendation and a TCO breakdown. Retracted; do not cite it to us or to anyone.
• Gemini Code Assist’s free individual tier. Deliberately excluded from every table on this page. One source says it stopped serving requests on 18 June 2026; Google’s own docs still describe a GitHub app install granting 100 or more PR reviews a day, which would be the most generous free offer in the market if it still exists. We could not resolve the contradiction on 2026-10-18, so we left it out rather than guess.
• CodeRabbit’s free tier on private repositories. This changed recently: the pricing page now says free reviews forever for public repositories, with private repos not included - free accounts get one summary-only private PR review per hour plus three IDE and three CLI reviews per hour. Any page claiming unlimited free private reviews, including older posts of our own, is stale.
• Whether any self-hosted AI reviewer has been through DO-330 tool qualification. We found no evidence that any has. In DO-178C territory, see MISRA C:2012 rules and examples and assume your AI reviewer is advisory only.

How we verified this

Checked on 2026-10-18 unless otherwise dated. We read vendor documentation and repositories directly and deliberately excluded comparison listicles and AI-generated SEO sites from the factual claims.

Primary sources read directly:

• docs.coderabbit.ai/self-hosted for the 500-seat minimum, container delivery, bring-your-own-model, Reverse Tunnel and the self-managed Git list. Quoted verbatim.
• GitHub’s Copilot runner configuration docs and the code review concept page for the ARC-only requirement, the Ubuntu x64 restriction, the no-model-switching statement, and the firewall allowlist including api.githubcopilot.com.
• code.claude.com/docs/en/code-review for the “reviews don’t run in self-hosted environments” statement, the GHES support, and the ZDR / HIPAA / CMEK exclusions. Quoted verbatim.
• SonarQube’s AI CodeFix admin docs for the no-outbound-internet statement and the four model-provider options, plus sonarsource.com/license for the SSALv1 change.
• GitLab’s Duo Code Review docs, Duo Self-Hosted admin docs, the hardware requirements table, and the 18.4 and 19.0 release notes for the GA milestone, model families, GPU sizing and the 19.2.0 upgrade defect.
• Qodo’s deployment-model support matrix for the SCM-restricted air-gap list and the Azure DevOps Cloud gap.
• Greptile’s deployment options docs and the public greptileai/akupara Helm repo for sizing, Terraform and model providers.
• DeepSource self-hosted installation docs for the air-gap install type and hardware requirements.
• Tabnine’s deployment options docs for the air-gap guide, and the Tricentis acquisition announcement.
• Snyk Broker docs and Semgrep Network Broker docs for the proxy architecture and the WireGuard tunnel. Quoted verbatim.
• Codacy AI docs for the cloud-and-GitHub-only AI Reviewer limitation.
• GitHub’s REST API and raw LICENSE files for PR-Agent (MIT, v0.48.0, 2026-10-16), Tabby (Apache 2.0 with ee/ carve-out, NOASSERTION, v0.32.0 published 2026-01-25, last push 2026-06-30), Kodus (AGPLv3 core plus enterprise licence) and Semgrep (LGPL-2.1, v1.181.0, 2026-10-14).
• PR-Agent issue #2098 directly, which contradicts the widely repeated claim that it is still open.

Independent research cited: arXiv 2607.13080 for cloud-vs-on-premise cost and defect figures; arXiv 2606.15689 for model size, diff size and synthetic-vs-real degradation; c-CRAB, arXiv 2603.23448, for the ~41.5% collective issue-detection figure.

Sources used but discounted, with the conflict stated: Augment Code for GPU rental and FTE estimates and SSO gating findings - Augment sells a competing cloud product and one of its PR-Agent claims is out of date. Dextra Labs for TCO and break-even figures - Dextra Labs sells custom on-prem development. PR-Agent’s own warning about local models - originally authored by Qodo, who sell the commercial alternative. We report all three because the numbers are specific and useful, labelled with who benefits.

What we did not do: we did not run these tools in an air-gapped lab and watch the packets. Nobody publishing on this topic has, including us. Before certifying any install as air-gapped, put it behind a deny-all egress rule and confirm the review still completes. Also confirm offline licence validation explicitly - some commercial licences phone home, and that is a question you want answered in writing before the install, not after.

Recommendations

Criteria: can it run with zero required outbound inference calls, is the commercial gate reachable, are SSO and audit logs included, and does the vendor publish evidence rather than a claim.

If you are on GitLab Self-Managed: GitLab Duo Code Review with self-hosted models. GA in 18.4, your own inference through vLLM, Bedrock or Azure OpenAI, offline licence for isolated networks, four more open-weight models added in 19.0, and no new vendor to onboard. It is the most under-rated option in this market and the easiest change ticket to get approved. Watch the 19.2.0 AI Gateway URL defect on upgrade.

If you have an air-gap mandate and need a vendor contract: Tabnine Enterprise. Still the only product with a complete published air-gap guide, offline documentation and an on-prem attribution database. Get pricing in writing; Tricentis no longer publishes it.

If you want depth and reproducibility rather than LLM commentary: SonarQube Enterprise, or DeepSource Enterprise Server. SonarQube is the only vendor that states in docs that its AI layer operates without outbound internet access, and it lets you point that layer at your own Ollama, LiteLLM or vLLM gateway. DeepSource is the only one treating air-gap as a first-class install type. Either will give an auditor evidence they accept.

If budget is zero and you have a platform team: Kodus (AGPLv3) plus Semgrep CE with vendored rules. Free at any team size, a 2-core and 8GB floor, published telemetry opt-out. Price the enterprise licence key in anyway if you need SSO, RBAC or audit logs for an audit.

If you have 500+ seats and want the strongest reviewer on-prem: CodeRabbit self-hosted. Broadest self-managed Git coverage, bring your own model, container delivery, Reverse Tunnel for inbound-blocked environments. The 500-seat floor is real, not a formality.

Do not pick GitHub Copilot code review to satisfy a self-hosting requirement, and do not accept Snyk Broker or Semgrep Network Broker as self-hosting either. Self-hosted runners and private-network proxies are not self-hosted review. If a security review has already cleared any of them on that basis, reopen it.

Do not shortlist Tabby or Refact.ai for PR review at all. Neither documents a code review feature. They are self-hosted coding assistants, which is a different product.

Whichever level you land on, the compliance half of the same security review is waiting: which of these vendors will actually hand you a SOC 2 Type II report, sign a BAA, or produce an ISO/IEC 42001 certificate. We verified that separately in AI code review tools for regulated software teams, and the honest answer is that fewer can than the comparison tables suggest. Start there, then come back here and pick a deployment level. For the broader shortlist see best AI code review tools and AI code review for enterprise.