CodeRabbit vs Cursor Bugbot: Cost Per PR and Fix Paths

Short answer: CodeRabbit is a cross-platform review platform. Cursor Bugbot is a PR bug hunter whose best affordance only works if the developer already sits in Cursor. In the only independent side-by-side test available, CodeRabbit posted 281 findings across 82 PRs at a 2.3% false-positive rate; Bugbot posted 128 across 50 PRs at 4.8% but carried more high-severity catches per finding (dev.to three-week study). Bugbot no longer costs $40 a seat. It moved to usage-based billing at roughly $1.00 - $1.50 per review in mid-2026, which invalidates most cost comparisons currently ranking.

Most CodeRabbit vs Cursor Bugbot pages you will read today are priced off a plan that no longer exists.

Disclosure: we resell nothing here and take no affiliate revenue from CodeRabbit, Cursor, Greptile, cubic, Qodo or Kodus. Where a number comes from a company that sells a competing product, we say so in the same sentence as the number.

Direct answer

A note on this page’s history. An earlier version of this comparison was titled as a head-to-head test and described as “tested”. We did not run that test. The page was held as a draft for that reason. It has been rewritten so that every figure is attributed to whoever published it, and the title no longer claims original testing. We published the open protocol we published for measuring it, and we have not run it - so no per-tool false positive figure on this site is ours. Corrected and published 2026-10-19.

Cursor Bugbot is no longer a standalone product. The $40 per seat plan was removed effective each customer’s first renewal after 8 June 2026, and Bugbot now sits from the Cursor Premium tier at $30 upward with usage billing at roughly $1.00 to $1.50 per PR review (verified 2026-10-19). CodeRabbit Essentials is $24 per developer per month annual and covers exactly 1 linked repository. Bugbot is GitHub-only. CodeRabbit covers GitHub, GitLab, Azure DevOps and Bitbucket. Verified 2026-10-19.

Three disputes on this page, now resolved

Direct answer: Three facts this page previously left open are settled (verified 2026-10-19). Bugbot is GitHub-only - the GitLab support claim from one source is not supported. The $40 seat is gone, removed at each customer’s first renewal after 8 June 2026, replaced by usage billing from Cursor Premium upward. And Cursor is independently certified: it holds ISO/IEC 42001:2023 and offers a HIPAA BAA on Enterprise, contradicting the not-independently-certified claim in the table below.

Dispute as published 4 Aug 2026	Resolved 2026-10-19
Bugbot GitLab support “disputed” across three sources	GitHub-only. No GitLab, no Bitbucket, no self-hosting
Bugbot pricing flagged “[VERIFY against Cursor’s live pricing page]“	Verified. Standalone $40 seat removed at first renewal after 8 Jun 2026; now from Cursor Premium $30 upward, usage billed at ~$1.00-1.50 per review, dash on Free and Plus
Bugbot “not independently certified” per Monterail	Cursor holds ISO/IEC 42001:2023 and offers a HIPAA BAA on Enterprise - one of only 4 vendors in our set to do so, and 1 of only 7 of 26 holding ISO/IEC 42001
CodeRabbit tier named “Essentials+“	The tier is Team at $48/dev/mo annual, $60 monthly. An Advanced tier at $72 was added Sept 2026
CodeRabbit Free “$0, per-seat”	Free no longer covers private repositories. Free reviews forever on public repos only; free accounts get 1 summary-only private review/hour, plus 3 IDE and 3 CLI reviews/hour
Bugbot config file	.cursor/BUGBOT.md was correct on this page and is wrong on most competing pages, which put it at the repo root. Also .cursor/config/bugbot.yaml with triggers.drafts, triggers.frequency (everyPush / oncePerPr), review.effort, review.incremental
Ownership	Cursor acquired Graphite on 19 December 2025, so Bugbot and Graphite Agent are now sibling products

Two of those deserve a line. The CodeRabbit 1-linked-repository cap on Essentials is the most consequential constraint in this comparison and it appears on neither vendor’s comparison page: Essentials covers 1 repository, Team 5, Advanced 10, Enterprise 20. A 6-service team on Essentials is not actually on Essentials. And the Graphite acquisition date must not be conflated with the separate retirement of the Diamond reviewer name on 8 October 2025, which happened over two months earlier and was not a consequence of the deal.

The 60-second CodeRabbit vs Cursor Bugbot verdict

Pick Bugbot if your whole team is standardized on the Cursor IDE, you’re on GitHub, and you want short, concretely-titled high-severity findings landing in about six minutes rather than a long list landing in forty.

Pick CodeRabbit if your engineers use mixed editors, you review on GitLab or Azure DevOps or Bitbucket as well as GitHub, or you want PR summaries and patches you can apply with one click from the GitHub UI.

Pick neither if you need on-prem deployment or bring-your-own-key model control. Neither vendor offers that shape today. Kodus (AGPLv3, self-hostable) and Qodo do, and we cover both in our self-hosted AI code review roundup.

Run both if you ship code where a missed cross-file bug is expensive. This is not a hedge. Across 617 distinct (file, line) coordinates flagged in the dev.to three-week parallel test, 576 of them, or 93.4%, were caught by exactly one of four reviewers. Zero were caught by all four. CodeRabbit and Bugbot co-flagged the same coordinate seven times in three weeks. They are complements dressed as substitutes.

The pricing headline, because it is the single most out-of-date fact on this search results page, and we have now verified it at source rather than through third parties: Cursor removed the $40 per seat Bugbot plan effective each customer’s first renewal after 8 June 2026. Bugbot is now listed from the Cursor Premium tier at $30 per month upward with usage billing at roughly $1.00 to $1.50 per PR review, and shows a dash on Free and Plus (verified 2026-10-19). There is no free tier, only a 14-day trial. Anyone quoting $4,800 a year for ten developers is quoting a plan that no longer exists. The current Cursor ladder is Free, Plus $8, Premium $30, Super $100, Ultra $200, Teams from $30 per user - detail in Cursor pricing.

Every number below is attributed to whoever produced it. Vendor-run benchmarks are labelled vendor-run, in the sentence that carries the number, not in a footnote.

Side-by-side at a glance

Master feature matrix. Every cell carries a source and a check date. Cells we could not source read “not publicly documented” rather than guessing.

Source dates for the table below: critique.sh checked 25 May 2026; Monterail and Kodus checked June 2026; dev.to test run over three weeks, n=146 PRs.

Dimension	CodeRabbit	Cursor Bugbot	Source
Primary surface	PR/MR review platform + IDE extension + CLI	PR bug review	critique.sh
Git platforms	GitHub, GitLab, Azure DevOps, Bitbucket	GitHub only. No GitLab, no Bitbucket	Verified 2026-10-19
IDE surfaces	VS Code-compatible extension (runs in Cursor, Windsurf)	Cursor (deep links, Cloud Agents)	critique.sh
PR summarization	Yes, plus sequence diagrams	No	Monterail
Fix mechanism	Unified diff + GitHub suggestion block; Autofix commits to branch or opens stacked PR	”Fix in Cursor” / “Fix in Web” deep links; Autofix via Cursor Cloud Agent VMs	dev.to; critique.sh
Config file	.coderabbit.yaml	.cursor/BUGBOT.md	critique.sh
Rules learning	Learnings from resolved comments	Project, team, repository, learned and user rule tiers	critique.sh
Findings per review event	1.80 mean, max 15	1.35 mean, max 9	dev.to
Self-host	Enterprise, 500+ seats	No on-prem, cloud only	Verified 2026-10-19
Pricing model	Per-seat: Essentials $24/dev/mo annual, 1 linked repo	No standalone seat since 8 Jun 2026. From Cursor Premium $30 up, ~$1.00-1.50/review	Verified 2026-10-19
Certifications	SOC 2 Type II, zero-retention (vendor-stated)	ISO/IEC 42001:2023; HIPAA BAA on Enterprise	Verified 2026-10-19
Context-fetching behaviour	Documented linter/SAST orchestration	Not publicly documented	cubic
Does badly	Noise in the middle severity band; 41-min P95 tail	Thin coverage on large PRs (unverified); zero GitHub-native one-click fixes	dev.to; cubic

Three ranking pages disagree about Bugbot’s platform support. We cover that fight properly two sections down rather than picking a winner.

What CodeRabbit actually is

Calling CodeRabbit a PR bot undersells the surface area, and that matters because the pricing and noise arguments later only make sense if you know what you’re buying. It reviews pull requests and merge requests, ships a VS Code-compatible IDE extension, exposes a CLI, runs dashboards, links issues, and orchestrates third-party linters and SAST tools such as ESLint, Ruff, golangci-lint, Semgrep and Gitleaks rather than replacing them.

The IDE extension runs inside Cursor and Windsurf. Read that twice if you are a Cursor shop, because it means adopting Cursor as your editor does not obligate you to Bugbot as your reviewer.

The public changelog, as catalogued by critique.sh (a competing vendor, checked 25 May 2026), lists Autofix, GitLab Autofix, Change Stack, semantic diff views, multi-repo analysis, GitLab project-level installs, automation triggers and enterprise private-network support. That is a platform release cadence, not a bot’s.

Its personality, described in numbers rather than adjectives: in the three-week live test it posted 281 findings across 82 PRs, or 3.4 per PR, the highest density of the four tools. It also re-ran on every commit, including the commits that fixed its own previous findings. A non-trivial PR could accumulate five or six review cycles.

Community signal, attributed rather than hand-waved. One Hacker News commenter, asked how many AI agents they run, answered: “I use CodeRabbit all the time but it has a swarm of dozens of sub-agents. So am i using 1 agent or 10+?” Another reports running it on GitLab MRs as their main AI review surface.

One footprint number with its caveat attached: coderabbitai/awesome-coderabbit sits at 459 stars, 13 open issues, CC0-1.0, last pushed 25 June 2026. That is a curated community list, not the product source. Read it as community activity and nothing else.

What Cursor Bugbot actually is

Bugbot reviews pull requests. It is not an IDE feature, despite the branding, and the distinction trips up buyers constantly.

Triggers: automatic on PR open and update when enabled, or manual by commenting cursor review or bugbot run on the pull request. Rules live in .cursor/BUGBOT.md, layered across project, team, repository, learned and user tiers (critique.sh).

Now the contradiction you will hit if you read three pages on this topic. Monterail states Bugbot is GitHub-only as of June 2026. Kodus says the same. critique.sh, checked in May, says Bugbot reviews on GitHub and GitLab. Those check-dates sit weeks apart, so this is not a simple staleness story. If GitLab support is load-bearing for you, confirm it against Cursor’s own docs before procurement, and treat every comparison page, this one included, as a pointer rather than an authority on it.

Fix paths: Fix in Cursor, Fix in Web, and Bugbot Autofix, which executes in Cursor Cloud Agent VMs.

The scope limit, stated plainly: no PR summaries, no general refactoring suggestions. It hunts bugs. Monterail cut it from their shortlist partly for that reason, which is a fair criticism only if you wanted a summarizer.

One name-collision warning, because the coderabbit vs cursor bugbot github searchers land on it: the GitHub repo Kingdragony/Tiger-Bugbot-Radiation (94 stars, 9 open issues, last push 8 April 2025) has nothing to do with Cursor. There is no public Cursor Bugbot source repository.

Pricing per merged PR, not per seat

Cost calculator. Inputs: PR authors, PRs per author per month, commits per PR, CodeRabbit tier. Outputs monthly spend for each tool and for both, plus the break-even PR volume adjusted for Bugbot’s 1.90 review events per PR.

Current price shapes, both checked against third-party reporting rather than memory. critique.sh figures checked 25 May 2026; Kodus and Monterail figures checked June 2026.

Plan	Price	Billing shape	Source
CodeRabbit Free	$0, public repos only	1 summary-only private review/hour	Verified 2026-10-19
CodeRabbit Essentials	$24/dev/mo annual, $30 monthly	Per-seat, 1 linked repo, $0.25/file overage	Verified 2026-10-19
CodeRabbit Team	$48/dev/mo annual, $60 monthly	Per-seat, 5 linked repos	Verified 2026-10-19
CodeRabbit Advanced	$72/dev/mo	Per-seat, 10 linked repos	Verified 2026-10-19
CodeRabbit Enterprise	By sales	Per-seat	critique.sh
Bugbot (current)	~$1.00 - $1.50/review	Usage-based, from Cursor Premium $30/mo upward. Dash on Free and Plus	Verified 2026-10-19
Bugbot (legacy)	$40/user/mo	Removed at each customer’s first renewal after 8 Jun 2026	Verified 2026-10-19

cubic’s alternatives page still runs the arithmetic on “$40 per user per month” and concludes that “for teams of 10 developers, that’s $4,800 annually.” That calculation no longer describes a new Bugbot customer, and cubic’s entire cost argument rests on it.

The naive break-even. CodeRabbit Essentials at $24/dev/month against Bugbot at ~$1.25/review: a developer opening 19 PRs a month is roughly cost-neutral. Below 19, Bugbot is cheaper. Above, CodeRabbit is.

That model is wrong, and here is why. Bugbot re-reviews on new commits. In the three-week test it averaged 1.90 review events per PR, with one PR hitting nine. Charge per review event, not per PR, and $1.25 becomes $2.38 per PR. The corrected break-even lands near 10 PRs per developer per month, not 19. If your team opens more than ten PRs per person monthly, per-seat CodeRabbit is likely the cheaper line item, and the gap widens fast with commit-heavy workflows.

There is an equal and opposite trap on the CodeRabbit side. A 20-person team where five engineers open most PRs has a completely different cost shape from one where all 20 push daily, and per-seat pricing bills you for the second shape regardless. Count PR authors, not headcount:

git log --since="90 days ago" --format='%aN' | sort -u | wc -l

Compare that to your HR headcount before you size a seat contract. Our CodeRabbit pricing breakdown runs the same calculation across every tier.

Hidden line items nobody quotes. Monterail budgets one to two weeks of .coderabbit.yaml tuning to get noise under control. At a loaded engineer cost of $120k/year, two weeks is roughly $4,600 of one-time spend, which is more than a 15-seat year of Pro. On the Bugbot side: Cloud Agent runtime for Autofix, CI minutes on GitHub Actions, and effort-level settings that move per-review cost in ways the invoice does not itemize well.

Which brings us to the billing complaint, attributed: the dev.to team reports Bugbot’s per-charge line items “didn’t cleanly map to dashboard activity” and that reconciling them required repeated support tickets. They cut the tool over packaging, not over review quality. Set an on-demand spend cap on day one, before your first PR.

Bug-catch quality and who paid for the benchmarks

Direct answer: No party without a commercial stake has published a false-positive rate, precision figure or noise measurement for any shipping commercial AI code reviewer (verified 2026-10-19). The neutral Martian Code Review Bench scored CodeRabbit at 51.2 percent F1 and 49.2 percent precision across roughly 300,000 PRs, and four vendors have each declared themselves number one on it. Entelligence put Bugbot at 50.0 percent F1 on Cal.com and placed itself first at 47.2 percent aggregate.

Almost every number circulating in the CodeRabbit vs Cursor Bugbot debate was produced by someone selling one of them. Sort the evidence before you weigh it.

The two benchmarks worth adding to the ladder below, because they are the least conflicted available (verified 2026-10-19):

• Martian Code Review Bench. Martian sells model routing, not a reviewer, which makes it the single best independent leaderboard this category has. It scored CodeRabbit at 51.2 percent F1 and 49.2 percent precision across roughly 300,000 PRs on 3 March 2026. Then Qodo claimed number one at 64.3 percent on 15 March and Baz claimed number one on 790 PRs. Four self-declared winners, one leaderboard. Note that Martian’s CodeRabbit figure is far below the precision numbers in the vendor tier below, which is the useful signal.
• Entelligence Code Review Benchmark 2026. Cal.com F1 scores: Codex 58.8, Claude 52.2, Bugbot 50.0, Greptile 47.4, CodeRabbit 46.0, Copilot 37.0, Graphite 0.0, and Entelligence first at 68.1. Entelligence sells a reviewer and wins its own benchmark at 47.2 percent aggregate. On this data Bugbot edges CodeRabbit, which is the opposite of what the practitioner run suggests - another reason to run your own.

One benchmark we are not going to let pass. The widely-circulating 40 to 70 percent false positive rate attributed to c-CRAB does not appear in that paper. No false-positive rate is reported for any reviewed tool in it; the phrase appears twice, both conceptually, and the one in section 4.2.1 is about tuning the authors’ own comment classifier, not about the tools. c-CRAB’s actual headline, quoted exactly: considering the union across all four tools, 97 out of the 234 tests were passed by at least one tool, 41.5 percent. Conflict disclosure: five of its six authors are academic but one lists SonarSource, and Sonar acquired Gitar, which is a paid sponsor of aicodereview.cc.

Provenance ladder. The same numbers you see everywhere else, sorted by who produced them and what they sell.

Claim	Number	Who ran it	Sells a competitor?
Precision, both tools	~95.9%, effectively tied; CodeRabbit ahead on true positives and critical bugs	Signal65	No (relayed via critique.sh, which does)
Findings, FP rate, latency	679 findings, 146 PRs, 4 tools, 3 weeks	Independent practitioner (Sentry employee, disclosed)	Employer’s product was in the test
Bugbot comment resolution rate	78.13%	Cursor, own public-repo analysis, April 2026	Vendor marketing
PRs reviewed / issues flagged	1M+ PRs, 1.5M issues, 50%+ resolved	Cursor blog, relayed by cubic	Vendor marketing, relayed by a competitor
Seeded-bug catch rate	Kody 79% (30/38) vs Bugbot 58% (22/38)	Kodus	Yes. Kodus sells the winner

Third-party tier. Signal65 reported roughly 95.9% precision for both CodeRabbit and Cursor Bugbot, with CodeRabbit catching more true positives and more critical bugs in that test. We found this relayed through critique.sh, which sells a competing reviewer. Go to the Signal65 study directly [VERIFY] before you cite it in a procurement doc.

Practitioner tier. Three weeks, 146 merged PRs, 446 review events, 679 findings, all four tools in default configuration. CodeRabbit: 281 findings, 2.3% false-positive rate. Bugbot: 128 findings across 50 PRs, 4.8% FP, 22 high-or-critical catches. The author discloses employment at Sentry, whose Seer product was one of the four. That disclosure is what handling evidence honestly looks like, and it is why this dataset is the strongest thing on the topic despite the conflict.

Vendor tier, which is marketing rather than findings. Cursor’s own April analysis reports a 78.13% Bugbot comment resolution rate on public repos. Cursor’s blog claims 1M+ PRs reviewed and 1.5M issues flagged with over half resolved. Kodus publishes Kody at 79% (30/38) versus Bugbot at 58% (22/38) on PRs drawn from Sentry, Cal.com, Grafana, Discourse and Keycloak, on a 38-item sample with no published methodology, no per-PR list and no reproduction path, by the company that sells the winner.

Two pieces of metric literacy worth more than any of those numbers. A resolved-comment rate rewards comments that are easy to accept: a docblock fix resolves faster than an authorization redesign, so the metric quietly favours triviality. And high precision says nothing about recall. A reviewer that posts three findings and gets all three right scores 100% precision while missing the SQL injection. On auth and payment paths, recall is the number you actually care about, and no vendor publishes it. Our map of every AI code review benchmark and who funded it works through the same trap in other tool categories.

CodeRabbit 281 findings at 2.3% FP; Bugbot 128 at 4.8% FP with 22 high-or-critical. Source: dev.to three-week test, n=146 PRs. Greptile and Sentry Seer greyed for context.

One qualitative difference the aggregate numbers hide. CodeRabbit’s finding titles are templated banners: “⚠️ Potential issue / 🟠 Major”. Bugbot’s are sentences about your code: “File action authorized via overly broad view policy”. “Catch block safety broken by throwing DB call”. A banner tells you a finding exists. A title tells you the bug. On a PR with fourteen comments, that difference is most of the triage cost.

Noise, and what tuning actually costs you

Numbers instead of adjectives. CodeRabbit averaged 1.80 findings per review event with a maximum of 15 in one event; Bugbot averaged 1.35 with a max of 9. CodeRabbit re-engaged on 49% of multi-commit PRs, Bugbot on 48%, so the felt difference is not re-engagement frequency.

The severity distribution explains it. Ninety-six percent of CodeRabbit’s findings sat at Major or Minor, with almost nothing at Critical or High. Sixteen percent of Bugbot’s sat at High. CodeRabbit is not wrong more often. It is loud in the middle of the severity range, and the middle is where taste lives.

The tuning tax is real and quantifiable: Monterail budgets one to two weeks of .coderabbit.yaml work and recommends treating the config as a living document rather than a one-time setup. Put that in the cost column, not the caveats section.

Three levers to pull first, in this order:

1. Path filters. Exclude generated code, vendored directories, lockfiles, migrations and snapshot tests. This alone removes the majority of low-value comments on most repos.
2. Review profile. Switch to the CHILL profile before you conclude the tool is too noisy in default config.
3. Severity and instruction overrides. Suppress style categories outright and write path-scoped instructions escalating anything touching auth, session handling or data access.

Bugbot’s noise control is coarser: directory-scoped .cursor/BUGBOT.md with no per-file or per-PR targeting, according to Kodus. That framing comes from a competing vendor. We checked it against the layered rule tiers documented via critique.sh, which suggests more granularity than Kodus implies. Verify against Cursor’s docs before you treat it as a limitation.

From finding to fix: who actually hands you a patch

Applyability, measured: 68.3% of CodeRabbit findings shipped a unified diff, and 27.8% additionally carried a GitHub one-click suggestion block nested inside. Bugbot shipped 0% one-click-in-GitHub fixes.

That 0% needs a footnote, and then the footnote needs a footnote.

Every Bugbot finding carries a “Fix In Cursor” deep link, so it is not prose-only. Click it in Cursor and you get an agent with the finding loaded. That affordance is invisible to anyone on VS Code, JetBrains, Neovim or Emacs, who sees prose and nothing else.

For a mixed-editor team, that is the single most decision-relevant fact on this page.

Same diff, three seeded bugs (null deref, cross-file contract mismatch, over-broad authorization check). CodeRabbit’s templated banner and unified diff on the left, Bugbot’s concrete title and Fix-in-Cursor link on the right, with callouts on the nested details block and the grey neutral check.

Agentic fix paths differ in where the work runs. CodeRabbit Autofix collects unresolved findings and either commits to the PR branch or opens a stacked PR. Bugbot Autofix executes in Cursor Cloud Agent VMs.

Both deserve the same caveat: a one-click AI patch still needs a human to run the test suite. And “68.3% applyable” is not “68.3% valuable”. Roughly two-thirds of CodeRabbit’s patches in the live test were mechanical (formatting, docblocks, naming), leaving about a third that fixed actual bugs. Adjust your expectations to roughly 23% of findings shipping a meaningful, applyable fix.

Rules and customization: .coderabbit.yaml vs .cursor/BUGBOT.md

CodeRabbit configures through YAML committed to the repo: path filters, review profiles, per-tool linter toggles, path-scoped instructions, plus separate config for the IDE extension and CLI surfaces.

Bugbot configures through natural-language rules in .cursor/BUGBOT.md, scoped per project or directory, layered across project, team, repository, learned and user tiers. The learned tier derives rules from team activity, GitHub backfills and inline comments (critique.sh). That is a genuine differentiator and worth testing rather than dismissing.

It also creates a direct contradiction on this results page. cubic asserts Bugbot’s “learning is static.” Cursor documents a learned-rules tier. One of those is out of date, cubic sells a competitor, and the resolution takes ninety seconds on Cursor’s docs page. Do that before you weight either claim.

Rule portability is the cost nobody prices. Kodus documents auto-detecting .cursorrules, CLAUDE.md, .windsurfrules and .github/copilot-instructions.md as rule sources. Neither CodeRabbit nor Bugbot advertises importing the other’s config. If you switch tools in twelve months, and this category has repriced twice in a year, your rule investment does not migrate. Budget the rewrite. Better: write team conventions in a tool-neutral markdown file that you then reference from both configs.

Two starter configs aimed at the same goal, which is suppressing style nits while escalating auth and data-access findings.

# .coderabbit.yaml
reviews:
  profile: chill
  path_filters:
    - "!**/dist/**"
    - "!**/*.generated.*"
    - "!**/vendor/**"
    - "!**/__snapshots__/**"
  path_instructions:
    - path: "**/auth/**"
      instructions: >
        Treat any change to permission checks, session handling or token
        validation as high severity. Flag missing authorization checks on
        new routes. Do not comment on naming or formatting in this path.
    - path: "**/db/**"
      instructions: >
        Flag unparameterized queries, missing transaction boundaries and
        any query inside a catch block.

<!-- .cursor/BUGBOT.md -->
# Review rules

Do not report formatting, naming or import-ordering issues. Our linter owns those.

Escalate to high severity:
- New or modified route handlers without an explicit authorization check
- Any database call inside a catch or finally block
- Permission scopes widened relative to the previous version of the file
- User input reaching a query, filesystem path or shell invocation unsanitized

Prefer one precise finding over three speculative ones.

Languages, monorepos and CI integration

Neither vendor publishes a language support matrix, which is the most common unanswered question we get on this comparison. Both are LLM-based rather than parser-based, so both will produce comments on anything textual: TypeScript, JavaScript, Python, Go, Rust, Java, Kotlin, Swift, Ruby, PHP, C#, C++, Terraform, SQL, Dockerfiles. Quality is not uniform across that list, and no public benchmark breaks results down by language. Test on your own stack.

Monorepo behaviour is the second gap. CodeRabbit documents multi-repo analysis and path-scoped instructions, which map onto a Turborepo or Nx layout reasonably well. Bugbot scopes rules per directory. Neither publishes a diff-size truncation threshold, and truncation is exactly where a large refactor loses its cross-file findings.

Ask both vendors this in the trial.

On CI, CodeRabbit’s CLI is the integration point, so it will run inside GitHub Actions, GitLab CI, CircleCI, Jenkins or Buildkite as a step. Bugbot is a GitHub App with a check run and no documented CLI, which limits you to the check-run surface. Notification routing (Slack, Microsoft Teams) and issue linking (Jira, Linear) sit on CodeRabbit’s side of the ledger today.

Platform coverage, IDE reality and the mixed-editor problem

Direct answer: Bugbot is GitHub-only - no GitLab, no Bitbucket, no Azure DevOps, no self-hosting (verified 2026-10-19, resolving the dispute this page previously left open). CodeRabbit covers GitHub, GitLab, Azure DevOps and Bitbucket, plus a VS Code-compatible extension that runs inside Cursor and Windsurf, plus a CLI. Being a Cursor shop does not obligate you to Bugbot. If your forge is not GitHub, this comparison has a one-line answer.

CodeRabbit covers GitHub, GitLab, Azure DevOps and Bitbucket, plus a VS Code-compatible extension that runs inside Cursor and Windsurf, plus a CLI. Being a Cursor shop does not obligate you to Bugbot.

Bugbot covers GitHub only. When this page was first published, three ranking comparison pages disagreed - critique.sh said GitHub and GitLab in May 2026, while Monterail and Kodus said GitHub-only at roughly the same check date - and we left the dispute open rather than pick a side. On 2026-10-19 it resolves as GitHub-only, with no GitLab, no Bitbucket, no Azure DevOps and no self-hosting or on-premise option. If you need Azure DevOps, the options are CodeRabbit, Kodus or Gitar - and note Gitar covers Azure DevOps Services and Server but not GitHub Enterprise Server, and Gitar is a paid sponsor of this site, which is exactly why we publish that gap.

The procurement question has also resolved, and in the buyer’s favour. The dev.to team cut Bugbot because enabling it required a paid Cursor IDE seat per developer regardless of which editor that developer actually used, and as of mid-2026 Cursor’s pricing page listed a Bugbot tier at $40 per user per month with a 200-PR monthly cap on Pro. Both of those are gone: the standalone seat was removed effective each customer’s first renewal after 8 June 2026, and Bugbot is now usage-billed from the Cursor Premium tier at $30 upward (verified 2026-10-19). The load-bearing question the testers flagged - whether non-Cursor-IDE developers can be enrolled standalone - is now moot, because there is no per-developer Bugbot enrolment at all. Cost scales with pull request volume. The email template below is kept only for anyone on a legacy contract working out what their renewal converts to.

Email Cursor sales this, verbatim:

Can developers who do not use the Cursor IDE be enrolled in Bugbot as reviewers on our repositories, without purchasing a Cursor editor seat for them? If yes, what is the per-review or per-user cost for those developers, and is there a PR-count cap? Please confirm in writing.

A day of waiting beats a quarter of assuming.

The counterpoint, so this is not one-sided: for teams already all-in on Cursor, the coupling is the feature. One Hacker News operator describes their standard stack as “Every engineer gets Cursor Pro (plus Bugbot)” across a monorepo of Next.js apps and Python workflows on GCP and Vercel. If that is already your bill, Bugbot’s marginal cost is small and its context is good.

Where each tool actually breaks, with receipts

Rule for this section: every weakness has a URL. Anything we could not source is marked unverified instead of asserted.

CodeRabbit: the runaway loop on a closed PR

A reported edge case has the bot stuck in an infinite retry loop generating unit tests on an already-closed PR, ignoring stop commands (issue #19, 3 reactions). Note where it was filed: the community awesome-list repo, not a product tracker. That is the finding. CodeRabbit has no public product issue tracker, so failure reports scatter across a curated-list repo, Discord and support email. If you hit something, support email is the path that reaches the vendor.

CodeRabbit: findings your audit tooling cannot see

CodeRabbit nests additional findings inside its review-body wrapper, in <details><summary> blocks. Those nested findings have no comment ID. They cannot be replied to through GitHub’s in_reply_to API. Any merge-readiness gate that queries inline review comments only will silently miss them, and report a clean PR.

The fix is one line of scope change: scan review bodies as well as inline comments, and parse the <details> sections for finding markers.

CodeRabbit: the flapping status check

Its check run flips through pending and success two to four times during a single review. The reporting team had to re-engineer their merge gate to wait a fixed window after each commit rather than trusting the first success. Mitigation: gate on a timer, not on the first green.

Cursor Bugbot: the grey-square trap

This one nearly shipped a broken PR and no ranking page mentions it.

Bugbot encodes “findings exist” as a neutral check-run conclusion. GitHub renders neutral as a flat grey square. A human scanning a checks list pattern-matches grey as “didn’t fail” and merges. The dev.to team came within a click of merging a clearly-failing PR because of it.

The fix is branch protection plus one job:

# .github/workflows/bugbot-gate.yml
name: bugbot-gate
on:
  check_run:
    types: [completed]
jobs:
  gate:
    if: github.event.check_run.name == 'Bugbot'
    runs-on: ubuntu-latest
    steps:
      - name: Fail on neutral or failure conclusion
        run: |
          CONCLUSION="${{ github.event.check_run.conclusion }}"
          echo "Bugbot concluded: $CONCLUSION"
          if [ "$CONCLUSION" != "success" ]; then
            echo "::error::Bugbot reported findings (conclusion=$CONCLUSION). Resolve before merge."
            exit 1
          fi

Then mark bugbot-gate as a required status check in branch protection. Grey now blocks. If required checks are new to you, start with our guide to automating code review.

Cursor Bugbot: the thoroughness ceiling

cubic reports user complaints that Bugbot’s reviews are “not exhaustive” and that “BugBot will catch 1-2 bugs and post its reviews, missing many others”, and that it can get overwhelmed on large PRs. Label that precisely: cubic sells a competing reviewer and is summarizing unnamed user reports. Treat it as a hypothesis, not a finding. The test costs you an hour. Take your three largest recent PRs, re-open them as drafts, and count findings against diff size. If findings flatline above a certain LOC threshold, you have reproduced it on your own codebase, which is the only place it matters.

Community signal on the CodeRabbit side

The highest-engagement item on the awesome-coderabbit tracker is a request for a Best Practices section (issue #4, 20 reactions). Low severity, but consistent with Monterail’s one-to-two-week tuning estimate: the configuration surface has outrun the onboarding guidance.

The operational details neither vendor documents

Latency to first finding. Source: dev.to three-week test. The shaded 15-minute context-switch band is an editorial annotation, not a measured statistic.

Tool	Mean time to first finding	P95
Sentry Seer	3.7 min	6.8 min
Greptile	4.9 min	38.0 min
Cursor Bugbot	6.1 min	13.3 min
CodeRabbit	9.5 min	41.3 min

The means are close. The tails are not. Bugbot’s P95 of 13.3 minutes means that even on a bad day, findings usually arrive while the code is still loaded in your head. CodeRabbit’s 41.3-minute P95 means one PR in twenty gets reviewed after you have opened a different branch, and the cost of that is not the waiting. It is the re-reading.

Review cadence compounds it. Bugbot averaged 1.90 review events per PR (max 9), CodeRabbit 1.89 (max 5). CodeRabbit’s default profile surfaces one to three new findings on a fix-push that just resolved the previous round. Your developers experience that as the review never ending. Your invoice, on the usage-based side, experiences it as multiplication.

Merge-gate recipe. Make Bugbot a required check via the neutral-blocking job above. Do not make CodeRabbit a required check while its status flaps. Instead run a gate job that waits a fixed window (600 seconds is a reasonable start given the P95) after the last commit timestamp, then queries both inline comments and review bodies for unresolved findings above your severity threshold. Advisory-only for CodeRabbit is a defensible choice at first. Blocking is not, until you have tuned the config.

What we could not verify for either tool, stated as unknown rather than filled in: published API rate limits, monorepo and large-diff truncation thresholds, behaviour on force-push, and whether a rebase re-bills a usage-based review. Ask all four in your trial, in writing.

Security, compliance and data residency

CodeRabbit is recorded as SOC 2 Type II with a zero-retention policy in Monterail’s evaluation, and enterprise private-network support appears in the changelog via critique.sh. Verify current attestation on CodeRabbit’s own trust page before publishing anything internal. Restating a third party’s compliance claim as your own is how procurement gets embarrassing.

Bugbot is recorded as “not independently certified” in Monterail’s table at time of testing, and Kodus states there is no on-prem deployment option. Both are third-party assertions about a competitor’s product. Flag them as claims to verify.

Model control: Bugbot routes through Cursor’s internal model selection with configurable effort levels and no BYOK, per Kodus (competing vendor). That is the trade for a managed experience. Neither vendor publishes a standing list of which model providers see your diff, which matters if your DPA enumerates sub-processors by name. Teams that need BYOK, EU-only processing under GDPR, or ISO 27001 evidence should look at Kodus (AGPLv3, Docker Compose), Qodo’s self-hosting tiers, or CodeRabbit’s self-hosted offering. SAML SSO and SCIM provisioning sit on enterprise tiers at both vendors and are worth confirming against your Okta or Entra ID rollout.

Paste this into the procurement email:

1. What is your retention window for source code sent for review, in days?
2. Do you train any model on customer code, and can that be contractually disabled?
3. List every sub-processor that receives customer code, including model providers.
4. Can processing and storage be pinned to a specified region?
5. Will you provide the full SOC 2 Type II report under NDA, not just the badge?

Should you just run both?

The overlap data makes the argument better than any vendor can. Across 617 distinct (file, line) coordinates flagged in the three-week test: 576 (93.4%) by exactly one reviewer, 37 (6.0%) by two, 4 (0.6%) by three, zero by all four. CodeRabbit and Bugbot co-flagged just seven times, the highest pair in the dataset, and still only seven.

Overlap across four reviewers on 617 coordinates. The lesson of the whole CodeRabbit vs Cursor Bugbot argument sits in the size of the non-overlapping regions.

Price it for a real team. Eight PR authors, 15 PRs each per month, 120 PRs total. CodeRabbit Essentials: 8 × $24 = $192/month. Bugbot at $1.25 × 1.90 review events × 120 PRs = $285/month. Both: $477/month, or $5,724 a year. One production incident that takes two engineers a day to diagnose and a day to fix costs roughly $3,700 in salaried time before you count customer impact [NEEDS SOURCE for incident cost benchmarks]. Two prevented incidents a year pays for the stack.

The cost the overlap data does not capture: doubled comment surface, two status checks, reviewer fatigue, and genuine ambiguity when the bots disagree. Handle that with a triage rule rather than hope. Bugbot’s check gates the merge. CodeRabbit’s output is advisory, read once before you request human review, and never blocks.

The division of labour the data supports: CodeRabbit for breadth, summarization and applyable patches. Bugbot for concrete, specifically-titled high-severity catches and a faster first response.

Run your own bake-off in one afternoon

Five questions: all-Cursor team? more than one Git host? on-prem requirement? PR volume above break-even? cross-file bug risk?

Protocol.

1. Pick 10 to 20 merged PRs from the last quarter, including at least three that were followed by a post-merge bug fix. Those are your known-positive cases.
2. Re-open each against a scratch branch as a draft PR.
3. Enable both tools in default configuration. Do not tune yet.
4. Capture every comment, including review bodies and nested <details> blocks.
5. Grade with the sheet below. The grader must be someone who did not write the PR.

PR ID	Tool	Finding	TP/FP	Severity	Human would catch?	Min to first finding	Fix applyable?	Fix correct?
#412	CodeRabbit
#412	Bugbot

The three-week study open-sourced its ingester and anonymized dataset (vlad-ko/pr-review-bench, referenced from the dev.to writeup). Use it rather than trusting anyone’s summary of a CodeRabbit vs Cursor Bugbot test, including ours.

Two ways this test will lie to you. Default config penalizes CodeRabbit, which is built to be tuned and will look noisier than it needs to be. And re-running historical PRs where the bug is already known biases the scorer toward crediting near-misses, which is why the grader must not be the author.

Decide on cost per trusted finding and cost per critical bug caught. Not on total comment count. Write the decision rule down before you start, or the exercise never terminates.

Final verdict by team profile

Your situation	Choose	Do this on day one
All-Cursor, GitHub, high PR volume, wants fast concrete titles	Bugbot	Set an on-demand spend cap; make neutral blocking in branch protection
Mixed editors, multiple Git hosts, wants summaries and applyable patches	CodeRabbit	Budget one to two weeks of .coderabbit.yaml tuning before judging its noise
Small team, under 10 PRs per author per month, cost-sensitive	Bugbot usage-based, or Greptile at the startup rate	Run the corrected break-even from the pricing section against your own git log
Regulated, on-prem requirement	Neither	Trial Kodus self-hosted (AGPLv3, free at any size) or PR-Agent (MIT since 23 Apr 2026)
Multi-repo team on a budget	Neither on entry tiers	CodeRabbit Essentials covers 1 linked repo; Bugbot has no repo cap but bills per review. Count repos before tiers (verified 2026-10-19)
Safety-critical code, high cross-file bug risk, budget exists	Both	Bugbot gates the merge, CodeRabbit stays advisory. The 93.4% unique-catch figure is the justification

The anti-recommendation matters as much as the recommendations: do not buy either tool on a vendor’s chart. Every number on this page, ours included, deserves a 10-PR replication on your own codebase before it touches a purchase order.

If neither wins, the alternatives worth a trial

Greptile, the precision play with the caveat attached. In the practitioner run: 120 findings, 0 percent observed false positives, roughly 92 percent bug-shaped, and the largest top-tier pool at 51 P1 findings of which 40 were unique to it. The author’s own caveat travels with the number: 0 percent means no false positive caught the eye, not that none exists, and Greptile posted the lowest volume of the four, so precision and recall trade off. Separately, Greptile’s own 82 percent catch rate is Greptile scoring Greptile on 50 PRs across 5 repos, and Augment’s re-run scored it 45 percent - an F-score at 45 percent precision and 45 percent recall, with Augment having rebuilt the answer key by reviewing each PR manually, so part of the gap is methodology rather than self-dealing. Augment sold a competing product and Harness acquired its Cosmos, Auggie CLI and Code Context Engine on 8 October 2026.

Pricing, verified 2026-10-19: Starter free for 1 active developer with 50 credits a month; Pro $30/seat with 50 credits and $1 per extra credit, per author and never pooled; Apex-depth reviews cost 10 credits each, a 10x per-review multiplier. The 50 percent pre-Series A discount for companies under $2M revenue takes a seat to roughly $15, plus free reviews for OSI-licensed public repos and special YC terms. Greptile covers GitHub, GitLab, Bitbucket Cloud, Bitbucket Data Center, Gitea and Perforce via P4 Code Review - uniquely documenting Perforce - but not Azure DevOps. Full modelling in Greptile pricing, and the head-to-head in Bugbot vs Greptile.

GitHub Copilot code review, the zero-marginal-cost baseline. If you already pay for Copilot, you already have this - and it is included from Copilot Pro at $10, not only on higher tiers (verified 2026-10-19 against GitHub’s own plan documentation, which lists it on Pro, Pro+ and Max and with a Business or Enterprise licence). Only Copilot Free lacks it. Several competing pages claim it needs Pro+ at $39; it does not. Three further facts that change the arithmetic: annual billing was retired entirely on 1 June 2026, so monthly is the only option; premium requests became AI Credits at $0.01 with included allowances cut on 1 September 2026 to 1,900 Business and 3,900 Enterprise, and paid overage is on by default for organisations; and private-repo reviews additionally consume GitHub Actions minutes with no published per-review figure, so that cost is unmodellable. Also note the 300-file and 20,000-line PR cap was removed on 27 August 2026, which invalidates any Copilot evaluation run before September 2026. Detail in GitHub Copilot code review and GitHub Copilot pricing. Amazon Q Developer occupies the same bundled slot for AWS shops; Gemini Code Assist’s free-tier status is genuinely unclear - one source says it stopped serving requests on 18 June 2026, another still advertises it - so we exclude it from tables rather than guess.

Anthropic Code Review, new since this page was written. It went GA on 15 October 2026 to Claude Team and Enterprise (verified 2026-10-19). Reviews take 6 to 10 minutes. It never builds or runs your code and never approves or blocks - which is the exact opposite of Copilot, where Copilot can be configured to submit an approving review that satisfies a required-approval rule, off by default. It supports GitHub Enterprise Server, which Copilot code review does not. It is not available on Pro or Max, and it is unavailable to orgs with ZDR, the HIPAA configuration or CMEK - the exact configuration that makes Claude Code PHI-eligible disables Code Review. Detail in Claude code review.

Sentry Seer, fastest response and narrowest output. 3.7 min mean and 6.8 min P95, and the only tool in the test using a critical label (6 of 6 correct, zero false positives at that tier). Against that: a 15.0% FP rate at its “high” tier and zero applyable patches.

Self-host and BYOK. Kodus publishes a rate card: Community $0, Teams $10/dev/month ($8 annual, Kodus-hosted only), Enterprise custom, with a 14-day / 35-review Teams trial. Community caps at 10 Kody Rules and 3 plugins, and Kodus is AGPLv3 so self-hosting is free at any team size, with BYO-key at stated zero markup on every tier. It also covers Bitbucket Data Center and Azure DevOps, and lists GHES as BETA, not GA (verified 2026-10-19). Note that its SOC 2 badge has no documents behind it and SOC 2 compliance is listed as an Enterprise feature - we report that without endorsing it. PR-Agent was relicensed to MIT on 23 April 2026 and moved to independent community governance under The-PR-Agent org, with Qodo remaining a sponsor; it covers GitHub, GitLab, Bitbucket, Azure DevOps and Gitea, and runs OpenAI, Claude, Gemini or local models via Ollama. Qodo is a flat team fee of roughly $30/month up to 30 users with credits at $0.012 each pooled across the team and no rollover, 14-day trial, no permanent free tier (verified 2026-10-19).

One correction to the Qodo Merge configuration advice circulating everywhere, ours included. There is no confidence threshold key. The published key is [review_agent].inline_comments_severity_threshold, a severity rank of 1 to 3, not a confidence score. Also comments_location_policy and per-tier comments_routing (verified 2026-10-19).

Deterministic tooling you should not replace. SonarQube, Semgrep, CodeQL, Snyk and Codacy still catch classes of defect that an LLM reviewer treats as optional opinion. Run them alongside, not instead. Our static analysis buyers guide covers the ordering.

The hybrid category. DeepSource’s Autofix Bot launch frames where this is heading: “AI coding agents have made code generation nearly free, and they’ve shifted the bottleneck to code review.” Static analysis plus AI, aimed at the volume problem rather than the accuracy problem. On the local end, LaReview pitches itself as a local CodeRabbit alternative that builds a risk-ordered review plan grouped by flow. Graphite Diamond and Ellipsis sit nearby, and we have not tested either.

One line each on cubic and Critique, with the incentive disclosed: both publish comparison pages ranking for this exact keyword, and both position their own product as the resolution. Their sourcing is often good. Their conclusions are load-bearing for their sales funnel.

Frequently Asked Questions

Is CodeRabbit better than Cursor Bugbot?

Neither wins outright. CodeRabbit is better for breadth: multi-platform support, PR summaries, and 68.3% of findings shipping an applyable diff. Bugbot is better for concise high-severity bug titles and faster first response in a Cursor-standardized team. Signal65 put both near 95.9% precision, with CodeRabbit ahead on true positives and critical bugs.

How much does Cursor Bugbot cost now?

Usage-based, roughly $1.00 to $1.50 per review depending on PR size and effort level, available from the Cursor Premium tier at $30 per month upward and showing a dash on Free and Plus (verified 2026-10-19). The standalone $40 per seat plan was removed effective each customer’s first renewal after 8 June 2026, so there is no longer a Bugbot seat to buy. The thing nobody mentions: Bugbot re-reviews on new commits at 1.90 review events per PR in the independent test, so per-PR cost is roughly double per-review cost. Set an on-demand spend cap before your first PR.

Does Cursor Bugbot require the Cursor IDE?

Not to read its findings. Bugbot reviews pull requests on GitHub, so any developer can read its comments in any editor. But its only fix affordance is a “Fix in Cursor” deep link, which does nothing on VS Code, JetBrains, Neovim or Emacs, and enabling Bugbot historically required a paid Cursor seat per developer regardless of editor. Confirm standalone enrollment with Cursor sales.

Can I use CodeRabbit inside Cursor?

Yes. CodeRabbit ships a VS Code-compatible IDE extension that runs inside both Cursor and Windsurf, plus a CLI usable in agent workflows (critique.sh, checked 25 May 2026). The practical implication is the useful part: adopting Cursor as your editor does not commit you to Bugbot as your reviewer, and the two decisions should be made separately.

Which has the fewest false positives, Greptile, CodeRabbit or Bugbot?

Greptile, in the only independent side-by-side available: 0% observed false positives across 120 findings, versus CodeRabbit’s 2.3% across 281 and Bugbot’s 4.8% across 128. The author’s caveat matters. Zero percent means no false positive was noticed, not that none is possible, and Greptile posted the lowest finding volume of the four. Precision and recall trade off.

How do you trigger a Bugbot review manually?

Bugbot runs automatically on PR open and update when enabled. To trigger it on demand, comment cursor review or bugbot run on the pull request. Review rules live in .cursor/BUGBOT.md (critique.sh). One cost note that follows directly from usage-based billing: every manual trigger bills as a review, so spamming the command on a large PR adds up.

What do developers on Reddit and Hacker News actually say?

Real quotes, with links. One HN operator standardizes on “Every engineer gets Cursor Pro (plus Bugbot)” across a GCP and Vercel monorepo. Another runs CodeRabbit on GitLab MRs daily. A third calls it “a swarm of dozens of sub-agents”. Public threads skew toward launch posts and anecdote, which is exactly why running your own bake-off beats reading them.

Do AI code reviewers replace human review?

No. In the independent test, 93.4% of findings were caught by only one of four reviewers, and false-positive rates climbed at the highest severity tiers, meaning the most consequential findings are precisely the ones needing human judgment. The merge decision stays with a human owner on security, architecture and any high-blast-radius change.

Which AI code reviewer supports GitLab, Bitbucket or Azure DevOps?

CodeRabbit supports all four: GitHub, GitLab, Azure DevOps and Bitbucket. Bugbot is GitHub-only (verified 2026-10-19), resolving the dispute this page previously left open between three sources checked weeks apart. For broadest coverage including self-managed, look at Kodus - which covers Bitbucket Data Center and Azure DevOps and lists GHES as BETA, not GA - and PR-Agent, which covers GitHub, GitLab, Bitbucket, Azure DevOps and Gitea under an MIT licence. Greptile is the only product documenting Perforce, but does not cover Azure DevOps. Gitar covers Azure DevOps Services and Server but not GitHub Enterprise Server, and Gitar is a paid sponsor of this site.

Treat the CodeRabbit vs Cursor Bugbot question as a local one rather than a leaderboard one. The pricing shape changed under everyone’s feet twice this year, and 93.4 percent of findings in the only independent test belonged to exactly one tool. Ten of your own PRs will tell you more than any of it.

---

How we verified this

What we checked, and where. The three-week practitioner dataset - 146 merged PRs, 446 review events, 679 findings across four tools in default configuration - was published by an independent practitioner who disclosed employment at Sentry, whose Seer product was one of the four. We did not re-run it, so every quality, noise, latency and findings-density figure on this page carries its original date and that disclosure. What we did re-check on 2026-10-19 was every price, platform, configuration and compliance fact, against the vendors’ own pages: the removal of Cursor Bugbot’s standalone $40 seat effective each customer’s first renewal after 8 June 2026; Bugbot’s availability from the Cursor Premium tier at $30 upward with a dash on Free and Plus; the roughly $1.00 to $1.50 per-review usage figure; the .cursor/BUGBOT.md path and the .cursor/config/bugbot.yaml keys triggers.drafts, triggers.frequency (everyPush / oncePerPr), review.effort and review.incremental; Bugbot being GitHub-only; Cursor’s ISO/IEC 42001:2023 certification and its Enterprise HIPAA BAA; the Cursor acquisition of Graphite on 19 December 2025 and the separate earlier Diamond rename on 8 October 2025; and CodeRabbit’s current ladder of Essentials $24 annual / $30 monthly, Team $48 / $60, Advanced $72 and Enterprise custom, with linked-repository caps of 1 / 5 / 10 / 20 and $0.25-per-reviewed-file overage.

What we corrected on this page. Seven things. The [VERIFY against Cursor's live pricing page] placeholder, now resolved. The grandfathered-$40 framing, which described a plan that no longer exists for new or renewing customers. The open GitLab-support dispute, now resolved as GitHub-only. The claim that Bugbot is not independently certified, when Cursor holds ISO/IEC 42001:2023 - one of only 7 of 26 vendors we checked - and offers a HIPAA BAA on Enterprise, one of only 4. The tier name Essentials+, which is actually Team, plus the missing Advanced tier added in September 2026. The CodeRabbit Free row, which no longer covers private repositories. And four broken internal links to pages that do not exist on this site.

What we could NOT verify, and are reporting as absences. No party without a commercial stake has published a false-positive rate, precision figure or noise measurement for any shipping commercial AI code reviewer. We could not open the Signal65 study at a primary source, so the roughly 95.9 percent precision figure for both tools remains relayed through critique.sh, which sells a competing reviewer - do not put it in a procurement document without the primary. We could not source CodeRabbit’s 150-file (Free and Essentials) and 300-file (Team and above) max-files-per-review limits or its fair-usage hourly degradation from the pricing page; docs.coderabbit.ai/reference/limits returned 404 when we checked. Bugbot’s context-fetching behaviour is not publicly documented at all. Neither vendor publishes a support SLA, net 30 or net 60 payment terms, or a purchase-order process - and that is market-wide, not specific to these two: zero vendors in our set of 51 publish any of the three. Only two publish any purchasing statement at all, both Enterprise-only: Sourcery (invoice billing) and CodeRabbit Enterprise, verbatim, custom purchasing options including marketplaces, vendor security reviews, and negotiated contracts. No vendor publishes per-language precision or recall, and no benchmark breaks it out, so nothing on this page claims either tool is stronger in any language. CodeRabbit does publish a full language-to-linter capability map with notable gaps - no Python type checker, and no Error Prone or SpotBugs for Java; Cursor Bugbot publishes no language list at all.

Conflicts we are disclosing. Gitar appears three times on this page and Gitar is a paid sponsor of aicodereview.cc - its unsupported-GHES status and its lack of any published third-party benchmark are stated anyway, because the sponsorship is worth less than the independence. Where we cite c-CRAB, one of its six authors lists SonarSource, and Sonar acquired Gitar. Kodus, cubic, critique.sh, Monterail, Entelligence and Augment all appear as sources and all sell or sold a competing product; Harness acquired Augment’s Cosmos, Auggie CLI and Code Context Engine on 8 October 2026. We name the funder of every number in the same sentence as the number. Method at standards.

Pricing, platform and compliance facts last verified 2026-10-19. Quality and noise figures last measured in the three-week practitioner run and not re-measured since. This page is re-verified quarterly. The category repriced twice in a year, so treat any cell older than 90 days as a lead, not a fact.

Further Reading

• BugBot vs Greptile: Tested on the Same PRs (2026)
• Greptile vs Claude Code: Which AI Reviewer Wins?
• CodeRabbit vs Greptile
• CodeRabbit pricing
• Cursor pricing
• Greptile pricing
• GitHub Copilot code review
• AI code review benchmarks compared
• AI code review tools with low false positives