How to Buy AI Code Review Software: The Full Procurement Path

Direct answer

Buy AI code review in this order: platform, deployment model, compliance, then price. Teams do it backwards and lose weeks shortlisting tools their code host rules out. Azure DevOps or Bitbucket Data Center cuts the field from roughly 16 vendors to 5 or 6. Self-hosting cuts it again, and CodeRabbit’s self-hosted option requires 500 or more seats. A signed HIPAA BAA exists at only 4 of 26 vendors we checked. Price is the last filter, not the first. Verified 2026-10-19.

This is the buyer’s page, not the developer’s. If you want the numbers, the AI code review price book has all 24 tools normalised three ways and what does AI code review cost has the worked totals. If you want the trial protocol, how to evaluate an AI code reviewer is the 14-day version. This page is about the process around those: the order of elimination, what the security review asks, how to get a number out of a vendor, and what is actually negotiable.

How to buy AI code review software for a company

Direct answer: Run four filters in strict order. One, code host and edition. Two, deployment model. Three, compliance artefacts you must have signed. Four, price. Each filter is cheaper to apply than the one after it, and each one eliminates more vendors. Doing price first is the single most common procurement mistake in this category. Verified 2026-10-19.

The reason order matters is that these filters are not independent and they are not equally expensive to run. Checking a code host takes ten minutes on a docs page. Checking whether a vendor will sign a Business Associate Agreement takes two weeks of email. If you negotiate price before you confirm deployment, you have spent your most expensive cycle on a vendor that legal will reject.

Here is the elimination order with what each step actually removes.

Step	The question you ask	Approximate field remaining	What it eliminates, by name
1. Code host	Which host and which edition?	16 on GitHub.com, 11 on GitLab, 9 on Bitbucket Cloud, 6 on Azure DevOps, 3 on Azure DevOps Server	Azure DevOps removes Greptile, Korbit, Sourcery, Bito, cubic, Graphite, Macroscope, Cursor Bugbot and Anthropic Code Review. Bitbucket Data Center removes cubic, Graphite, Macroscope, Cursor Bugbot, Sourcery
2. Deployment	Does the review itself run in our network?	2 free and unlimited, a handful of enterprise tiers	CodeRabbit self-hosted needs 500+ seats. Semgrep Network Broker and Snyk Broker are tunnels to the vendor cloud, not on-prem. Copilot’s review service stays in GitHub’s cloud
3. Compliance	Which artefacts must be signed before we can send code?	7 of 26 hold ISO/IEC 42001, 4 of 26 will sign a HIPAA BAA	A BAA requirement leaves Anthropic, Cursor Enterprise, Augment Code and CodeAnt AI. ZDR or CMEK on Claude disables Anthropic Code Review entirely
4. Price	What does it cost under our seat definition?	Whatever survived steps 1 to 3	Caps, not prices: Qodo dies at 30 users, Codacy Team at 30 developers, Gitar at 50, Ito Pro at 25 engineers, Entelligence Scale at 50

Read the right-hand column twice. At step one, an Azure DevOps Server shop is choosing from three documented options: Gitar, PR-Agent and Kodus. A GitHub.com shop is choosing from sixteen. Those are not the same procurement exercise, and no amount of price negotiation changes which one you are in.

Platform first, and be specific about the edition. “We use GitLab” is not an answer. GitLab.com and GitLab Self-Managed have different vendor support, and so do GitHub.com, GitHub Enterprise Cloud, GHEC with data residency and GitHub Enterprise Server. Two worked examples of how much the edition matters. Gitar supports GitLab SaaS, GitLab self-managed including the Free tier, Bitbucket Cloud, Bitbucket Data Center, Azure DevOps Services, Azure DevOps Server and AWS CodeCommit in preview, but its own platform support matrix lists GitHub Enterprise Server as not supported (verified at source 2026-10-19). And Codacy customers on GHES structurally cannot get its AI Reviewer, because the AI Reviewer is cloud-and-GitHub-only while GHES requires Codacy Self-hosted. Full matrix in AI code review for GitLab, Bitbucket and Azure DevOps.

Deployment second, and define the word. See the security review section below for why “self-hosted” is the most abused word in this category.

Compliance third. Not SOC 2 as a logo, but the specific artefact your legal team needs signed. AI code review for regulated teams has the per-framework detail.

Price fourth, and compute it against your own unit count rather than the sticker. The price book section on billable seats exists because six vendors define a billable developer six different ways.

Where to buy AI code review software for a company

Direct answer: Four channels. Self-serve on the vendor site with a card, which works to roughly 25 to 50 seats. Direct enterprise sales, the only route for 12 of 15 enterprise tiers because they publish no price. Your code host’s marketplace, which is how Copilot code review is bought. And a cloud marketplace listing, which routes spend through committed cloud spend you have already approved. Verified 2026-10-19.

The channel you pick changes your timeline more than your price. A card on a self-serve tier is same-day. A direct enterprise motion is four to twelve weeks. A cloud marketplace purchase against existing committed spend can skip vendor onboarding entirely, which is frequently the fastest path to a signed deal at a large company even when the per-seat number is slightly worse.

Channel	Who you buy from	Typical cycle	Who supports it	What it gets you
Vendor self-serve	The vendor, card payment	Same day	Nearly everyone with a published price	Speed. Hard caps: 30 users at Qodo and Codacy Team, 50 at Gitar, 25 engineers at Ito Pro
Vendor direct enterprise	Vendor sales, order form	4 to 12 weeks	All 15 enterprise tiers we checked	Custom terms, SSO, audit logs, self-hosting, a signed DPA
Code host marketplace	GitHub or Azure, on your existing invoice	Hours to days	GitHub Copilot code review; Copilot on Azure Repos bills to the linked Azure subscription	No new vendor. No new invoice. Metered on an account you already reconcile
Cloud marketplace	AWS, Azure or GCP marketplace	Days to weeks	CodeAnt publishes an AWS Marketplace listing; CodeRabbit Enterprise lists marketplaces as a purchasing option	Draws down committed cloud spend. Skips a vendor onboarding cycle

The code-host channel is underrated and nobody writes about it. If you already pay for GitHub Copilot, code review is included from Copilot Pro at $10 upward, and GitHub’s own documentation states it is available on “the Copilot Pro, Copilot Pro+, and Copilot Max plans, and with a Copilot Business or Copilot Enterprise license” (verified at source 2026-10-19). Only Copilot Free is excluded. That is a feature flag, not a purchase. Turn it on, measure it for two weeks, and only then decide whether you need a second reviewer. More in GitHub Copilot code review.

On Azure DevOps the same logic is even stronger: Copilot code review reached public preview for all Azure Repos customers in the sprint 279 update dated 4 September 2026, and billing runs through GitHub AI credits at 1 credit equals $0.01 charged to the Azure subscription linked to your Azure DevOps organisation. The marginal cost is a meter on a subscription you already reconcile.

What we could not verify about the marketplace channel: AWS Marketplace’s search results did not render for us on 2026-10-19, so the only AWS listing we can state from a primary source is CodeAnt’s, which our own price book sourced at $30 for a one-month seat contract. Treat the marketplace availability of other vendors as something to ask about rather than something we confirmed.

Where can I buy AI code review software?

Direct answer: Buy direct from the vendor for everything except GitHub Copilot code review, which you enable inside a Copilot licence you probably already hold. There is no reseller channel worth using in this category and no dominant marketplace. The practical answer at under 30 seats is a card on the vendor’s pricing page; above 50 seats it is a sales email. Verified 2026-10-19.

Three concrete routes, with the fastest first.

Already have Copilot? Enable code review at the organisation level and you have bought nothing. Then read the hidden cost section below, because the Actions-minutes consumption on private repositories since 1 June 2026 is real and GitHub publishes no per-review figure for it.

Under 30 developers and want it today? The cheapest credible self-serve seats on 2026-10-19 are Sourcery Pro, Korbit Pro and Bito Team at $12 per developer per month annual. The cheapest structure in the market is Qodo Pro Team at $30 a month flat for up to 30 users, which is not a seat price at all. The cheapest usage model is Macroscope at $0.025 per KB of diff in Budget mode with no seats, and every new workspace gets $100 of credit, so the evaluation costs nothing. Detail in cheapest AI code review tools.

One correction to make to older comparison pages, including ours. cubic has no free tier. Its live pricing page on 2026-10-18 showed only Team at $40, Pro at $99 and Max at $200 per developer per month, with no Starter plan and no free allowance. Plenty of pages in this category, this site included until we re-checked, still describe a free cubic Starter tier with 20 pull request reviews a month per GitHub organisation. Treat that as stale.

Need no purchase at all? PR-Agent has been MIT-licensed since 23 April 2026 under independent community governance, and Kodus has been AGPLv3 since September 2026. Both are free to self-host at any team size and cost you model tokens and ops time instead of a licence. That is a legitimate procurement answer, not a consolation prize, and for an Azure DevOps Server shop it is frequently the only answer. See open source AI code review tools and self-hosted AI code review tools.

One caution on the self-serve route. CodeRabbit Essentials at $24 links one repository. Team is 5, Advanced 10, Enterprise 20, confirmed on CodeRabbit’s own pricing page 2026-10-19. A four-developer team with forty services cannot use the $24 tier at any seat count. This is the single constraint that changes the right answer for the most teams, and almost no comparison page mentions it.

What the security review asks, and which answers kill the deal

Your security team will send a questionnaire. These are the seven questions that actually decide the outcome, and the answers that end the evaluation. Having the answers before the questionnaire arrives is worth about three weeks.

Question	The answer that kills it	What to ask for instead
Does our source code leave our network?	”Yes, and we cannot tell you where it is processed”	A named region list and whether sub-processors are in scope
How long is code retained?	”Indefinitely, for model improvement”	Retention period in days, a contractual deletion commitment, and whether a zero-retention mode exists
Will you sign our DPA?	”We have a standard DPA only, no redlines”	A signed DPA with your redlines, and whether it survives an acquisition
Can we see a SOC 2 Type II report under NDA?	”We have SOC 2” with no report, or a Type I only	The full Type II report with the audit window and any exceptions
Who are your sub-processors?	No published list, or “we use various LLM providers”	A named list with the model provider identified, plus notification rights on change
Is the model trained on our code?	Any ambiguity	An explicit contractual no-training clause
Does “self-hosted” mean the review runs in our network?	”Our runner is self-hosted”	A diagram of where inference happens

That last row is the one that costs people the most time, and GitHub Copilot is the clearest example in the market. Since the March 2026 move to an agentic architecture, Copilot code review can run validation on self-hosted GitHub Actions runners, but the review service itself stays in GitHub’s cloud. Your runner is yours; the inference is not. A security team that reads “self-hosted runners supported” as “the diff never leaves our network” has misread it, and that misreading surfaces in week six rather than week one.

Two more vendors sit in the same trap for the same reason. Semgrep’s Network Broker is a WireGuard tunnel to Semgrep’s cloud, and Snyk Broker is the same pattern. Both are legitimate engineering for getting at private resources without opening inbound access. Neither is on-premises deployment. We separate these into three levels in self-hosted AI code review tools, and the level that matters for a security review is the only one most pricing pages do not distinguish.

The compliance hard negatives, verified at source 2026-10-18 and re-checked 2026-10-19. cubic.dev is SOC 2 Type I only, not Type II. Panto’s SOC 2 audit is still underway. Kodus’s SOC 2 badge has no documents behind it. Aikido’s “FedRAMP Certified: Class C (Moderate)” is not standard FedRAMP terminology. Every FedRAMP claim in this market except Anthropic’s published FedRAMP High package is unverified. And “HIPAA certified” is not a certification scheme at all: HIPAA requires a signed BAA, and SOC 2 does not satisfy it. A real HIPAA BAA is offered by 4 of the 26 vendors we checked: Anthropic, Cursor at Enterprise, Augment Code and CodeAnt AI. We keep the full audit in fake compliance certifications in dev tools.

One regulated-team gotcha worth its own line. Anthropic’s Code Review is unavailable to organisations running zero data retention, the HIPAA configuration, or customer-managed encryption keys. The exact configuration that makes Claude Code PHI-eligible disables Code Review. It does support GitHub Enterprise Server, which Copilot code review does not. If you are in healthcare and both of those facts are news, your shortlist just changed.

And one for SOC 2 change management specifically: GitHub’s Copilot code review can submit an approving review that satisfies a required-approval rule, the same way a teammate’s approval would. It is off by default and configurable at enterprise, org or repo level. Anthropic’s Code Review never approves or blocks. If your SOC 2 control is “every change has an independent approver”, a machine that can satisfy a single-approval rule weakens that control rather than strengthening it. Say so to your auditor before they say it to you.

How do I get a quote for AI code review software?

Direct answer: Send one email containing seven facts: billable seat count under the vendor’s own seat definition, repository count, monthly merged pull request volume, code host and edition, deployment model, required certifications, and your decision date. Ask for list price, discounted 1-year and 3-year price, and overage rate as three separate numbers. Vague asks return a discovery call, not a quote. Verified 2026-10-19.

The reason most quote requests turn into a 45-minute discovery call is that they do not contain enough information to price. Give the seller everything they would ask for and they have no reason to schedule the call. Two templates follow. Fill in the brackets and send.

For a 50-developer team:

Subject: Pricing request - 50 developers, [your company]

Hi,

We are evaluating AI code review for a 50-engineer org and would like a
written quote. Our details:

- Billable units: 50 engineers total. 34 opened a pull request in the
  last 90 days. 41 committed to a private repo in the last 90 days.
  Please price against whichever of those three your billing definition
  uses, and tell me which one it is.
- Repositories: 38 private repos, all of which need review coverage.
- Volume: ~480 merged pull requests per month, median diff ~60 changed
  lines across 3 files.
- Code host: [GitHub.com / GitLab Self-Managed 17.x / Azure DevOps
  Services / Bitbucket Data Center].
- Deployment: [vendor cloud is acceptable / we require the review to run
  inside our network].
- Required before signature: signed DPA, SOC 2 Type II report under NDA,
  named sub-processor list, no-training clause.
- Timeline: decision by [date], 30-day pilot before that.

Please send, as three separate numbers:
1. List price per month at 50 seats.
2. Your best 1-year and 3-year committed price.
3. The overage rate and what triggers it.

Also please confirm: repository limit on the quoted tier, max files per
review, any hourly or weekly review rate limit, and whether SSO and audit
logs are included at this tier or require an upgrade.

Thanks,
[name, title]

For a 200-developer org, add the four things that only matter at scale:

Subject: Enterprise pricing request - 200 developers, [your company]

[same seven facts as above, at 200 seats / 140 PR authors / 164
private-repo committers / 310 repos / ~1,900 merged PRs per month]

Additional requirements:
- SSO via [Okta / Entra ID], SCIM provisioning, role-based access control
  and exportable audit logs. Please confirm the tier each is on.
- Monorepo: our largest repo is [N] GB with [N] active branches. Please
  confirm there is no repository size or file-count ceiling that applies.
- Contract: we will require assignment, continuity and price-protection
  clauses. Please confirm these are negotiable before we invest in a
  security review.
- Commercials: we need [net 30 / net 60] terms against a purchase order,
  and annual invoicing rather than card payment. Please confirm both.

Please also send a ramp proposal: we intend to onboard 40 seats in month
one, 120 by month three and 200 by month six, and would like the billing
to follow that curve rather than start at full count.

Three things about those templates that are doing real work.

Stating your three different unit counts forces the seller to name their meter. CodeRabbit bills developers who create pull requests, so reviewers and engineering managers are free. Greptile bills any developer who received a review that period, and its credits are per author and do not pool. Codacy bills every Git contributor who commits to a private repo. Snyk bills contributing developers by Git author email over a rolling 90 days, which means a leaver bills for a quarter. DeepSource bills every member and admin whether or not they commit. If you do not state the counts, you will be quoted against headcount, which is the highest of the three at nearly every org.

Asking for list and discounted price separately gives you a reference point that does not otherwise exist. In a market where 12 of 15 enterprise tiers are quote-only, you have no published anchor. Making the seller write down a list price creates one.

Asking about SSO and audit log tiering before the security review saves the review. At CodeRabbit, “custom roles and permissions, SSO, and audit logs” are Enterprise-tier only, confirmed on its own pricing page 2026-10-19. The same three are Enterprise-gated at Codacy, Qodo, Sourcery, Gitar, Graphite, DeepSource and Semgrep. Finding that out after you have priced the mid-tier is a restart.

How long does AI code review software procurement take?

Direct answer: Two days for a self-serve card purchase. Four to eight weeks for a mid-market deal with a security review. Eight to sixteen weeks for an enterprise deal with a DPA negotiation, a self-hosted deployment or a HIPAA BAA. The security review is the long pole in nearly every case, and it runs in parallel with nothing unless you start it in week one. Verified 2026-10-19.

The sequence that actually compresses the timeline is to start the security questionnaire before the technical trial, not after it. Most teams run a two-week bake-off, pick a winner, and then discover in week five that the winner holds SOC 2 Type I rather than Type II. Send the questionnaire to all three finalists on day one.

Phase	Realistic duration	What makes it longer	How to compress it
Requirements and platform filter	2 to 5 days	Not knowing your own host edition or repo count	Run git shortlog -sne --since="90 days ago" and count private repos first
Shortlist to 3	2 to 4 days	Listicles that did not check platform support	Filter on code host and deployment before reading any review
Trial	2 to 4 weeks	Running one tool at a time instead of all three in parallel	Run all finalists on the same repos in the same window
Security review	2 to 8 weeks	Starting it after the trial. DPA redlines. A missing sub-processor list	Send the questionnaire on day one of the trial
Pricing and negotiation	1 to 3 weeks	No stated decision date. No competing quote	Name a date. Get two quotes
Contract and legal	1 to 4 weeks	Assignment and price-protection clauses on a first pass	Flag the three clauses you need before the security review
Rollout	2 to 6 weeks	Turning it on everywhere at once	One team, then one business unit, then everyone

Two scheduling facts specific to this market. The 14-day trial is the near-universal default: CodeRabbit, Greptile, Sourcery, Korbit, Bito, Gitar, DeepSource, Qodo and CodeAnt all publish 14 days, and CodeRabbit, Bito, Gitar, DeepSource, cubic and CodeAnt require no card. cubic is 7 days. That means a three-way bake-off fits inside one 14-day window if you start them together, and does not if you run them sequentially. See AI code review tools with a free trial.

And a 14-day trial is shorter than your review latency. Our own measurement of 2,189 human-authored merged pull requests across 12 repositories found open-to-first-review at p50 8.7 hours but p90 at 212 hours and p95 at 482 hours. A two-week window captures your median pull request comfortably and barely captures your p90. If your decision depends on how the tool handles your slow, large, contentious changes, two weeks is not enough and you should ask for 30 days. Method and limits in pull request review time.

AI code review tool contract terms

Direct answer: Five terms are negotiable in practice: term length, ramp, seat true-up timing, overage caps and pilot credit. Three more matter specifically because this market is consolidating: assignment, continuity and price protection. With 12 of 15 enterprise tiers quote-only, no seller has a list price to defend, which is buyer leverage rather than seller leverage. Verified 2026-10-19.

Term	What to ask for	Why it is winnable	Rough value
Term length	1 year, with a 3-year option priced separately	Monthly costs you the 20 percent annual discount; 3 years at an unprotected rate is the real risk	The 20 percent annual discount
Ramp	Bill against your onboarding curve, not full seat count from day one	Vendors would rather have the logo than the first quarter’s revenue	20 to 40 percent of year one
Seat true-up timing	Annual true-up, not monthly	Monthly true-up on a growing team is an uncapped increase	Varies with hiring plan
Overage cap	A hard dollar ceiling per month, in writing	Usage-metered vendors already have the plumbing	Caps your tail risk
Pilot credit	The pilot period credited against year one	Costs the vendor almost nothing and closes faster	One month of fees
Price protection	Rate fixed for the term, renewal cap of CPI or a stated percent	This market repriced at least nine times between April and October 2026	The entire 3-year model
Assignment	Terms survive a change of control on identical commercial terms	Four of our tracked vendors changed owner in the last 14 months	The contract itself
Continuity	Notice period and data export on sunset or material change	Cursor removed the standalone Bugbot seat; CodeRabbit retired two plans	Migration cost
Deployment change	Right to move to self-hosted at a pre-agreed rate	Cheaper for the vendor to pre-agree than to renegotiate	Avoids a re-procurement

On the three vendors with a published enterprise rate card. Snyk publishes a credit model where 1 credit equals $1 and Snyk Code meters at 1.0 credit per active contributor per day. Gitar publishes Core at $20 per user per month annual, $25 monthly, and Pro at $40 annual, $50 monthly, both capped at 50 users, free for OSI-licensed public repos. Entelligence publishes Startup at $750 a month up to 15 engineers with 300 reviews and Scale at $2,500 a month for 16 to 50 engineers with 1,000 reviews, $1 per review after. Everyone else is custom: CodeRabbit, Greptile, Qodo, Codacy, Sourcery, cubic, Graphite, DeepSource, Korbit, Semgrep, Aikido and SonarQube all say Contact Us.

Use that asymmetry. When no price is published, the seller has nothing to defend and no precedent to cite. They also have no internal justification for refusing yours. Make the first number. Build it from the price book’s per-100-pull-request view, state the arithmetic in the email, and let them argue with the model rather than with you.

Entelligence’s pricing page puts the governing fact plainly, quoted verbatim from the page on 2026-10-19: commercial terms can vary by plan, billed seats, usage, product access, and deployment, and the values in your current workspace and signed order form are the source of truth. The order form, not the pricing page, is the contract. Read it line by line, because that is where the seat definition, the cap and the overage rate actually live.

Price protection is not optional in this market. At least nine material pricing changes landed between April and October 2026: CodeRabbit retired Lite and Pro Legacy on 8 June, renamed Pro to Essentials and Pro Plus to Team in September and added an Advanced tier at $72; GitHub retired Copilot annual billing entirely on 1 June, replaced premium requests with AI Credits at $0.01, and cut included Business credits from a promotional $30 per user to 1,900 credits and Enterprise from $70 to 3,900 on 1 September; Cursor removed the $40 standalone Bugbot seat at each customer’s first renewal after 8 June; Entelligence replaced per-seat pricing with flat bands. A 3-year total at list price without a price-protection clause is a budget line, not a forecast. Our change log is in the price book.

AI code review software that accepts purchase orders

Direct answer: Assume enterprise-only and ask, because almost nobody publishes a policy. Sourcery lists invoice billing as a named Enterprise plan feature, billed annually. CodeRabbit Enterprise lists custom purchasing options including marketplaces, vendor security reviews and negotiated contracts. No vendor we checked publishes net terms, a PO process or a minimum PO value anywhere on its site. Verified at source 2026-10-19.

This is the most consistently undocumented part of buying in this category, and it is worth knowing before you promise finance a timeline.

Vendor	Published purchasing statement	Our reading
Sourcery	”Invoice billing” listed as an Enterprise plan feature; Enterprise is billed annually	The clearest published invoice statement in the market. Still Enterprise-only
CodeRabbit	Enterprise tier lists “Custom purchasing options; including marketplaces, vendor security reviews, and negotiated contracts”	Purchasing is explicitly in scope at Enterprise. No net terms stated
GitHub Copilot	Invoiced billing exists for GitHub Enterprise accounts; card and PayPal customers were moved to upfront charging for assigned seats on 1 Oct 2026	If you already have a GitHub Enterprise agreement, this is the easiest PO path in the market
Entelligence	”The values in your current workspace and signed order form are the source of truth”	Order form implies invoicing at Enterprise. Not stated on the self-serve bands
Everyone else we checked	Nothing published	Assume card-only below Enterprise and ask in the first email

Three practical consequences.

If you need a PO, you are buying the Enterprise tier regardless of headcount. That is the same conclusion as needing SSO or audit logs, and it usually arrives as a surprise at a 30-person company whose finance team will not pay by card. Price the Enterprise tier from the start.

If you already have a GitHub Enterprise agreement, Copilot is the shortest procurement path to an AI reviewer that exists. It is included from Copilot Pro upward, it bills on an invoice you already receive, and there is no new vendor to onboard. Whether it is the best reviewer is a separate question with no settled answer, and we cover the evidence in AI code review benchmarks compared.

If you cannot get a PO and cannot use a card, the open source route is a real answer. PR-Agent under MIT and Kodus under AGPLv3 require no commercial relationship at all. The cost moves to model tokens on a provider account you already have and engineering time you have to allocate honestly.

The hidden costs that are not in the quote

Direct answer: Five line items sit outside every quoted price. CI minutes on Copilot private-repo reviews, which GitHub publishes no per-review figure for and which is therefore unmodellable. Metered overage. Re-review billing, which Macroscope charges for every time. File caps of 150 on CodeRabbit Essentials and 300 on Team and above. And linked-repository caps, where CodeRabbit Essentials covers one repository. Verified 2026-10-19.

CI minutes, and why we will not give you a number. Since 1 June 2026, GitHub Copilot code review on private repositories consumes GitHub Actions minutes in addition to AI credits, because the review runs on the agentic architecture that lives on Actions. GitHub’s own documentation estimates $0.05 to $1 of AI credits for a Lite review and $0.25 to $5 for the default Balanced review, and states explicitly that those estimates do not include Actions minutes. Linux 2-core runners are $0.006 per minute past your included allowance. GitHub publishes no figure for minutes consumed per review. That makes this line unmodellable from public data and we are going to say so rather than invent a figure. The mitigation is a self-hosted Actions runner, which consumes no GitHub minutes. Public repository minutes stay free. Detail in GitHub Copilot pricing.

Overage, by vendor. CodeRabbit charges $0.25 per reviewed file past its hourly limit and $0.40 per Cloud Coding Agent minute. Greptile charges $1 per extra credit, and its credits are per author and do not pool, which means a quiet month on one developer does not subsidise a busy month on another. Bito charges $5 per 1,000 reviewed lines past 5,000 lines per seat. DeepSource bills AI review separately from the seat at $8 per 10K processed lines on Standard and $15 per 10K on Advanced, with a $100 annual AI credit per user, which changes the real cost of the $24 seat materially. Qodo’s credits pool across the team but expire monthly with no rollover. Copilot’s AI credits pool enterprise-wide, expire monthly, and paid overage is on by default for organisations.

Re-review billing is the one people get wrong. Macroscope bills every review separately, including the ones triggered by a new push. A pull request that goes three rounds of commits is three charges. Before you model a usage-priced vendor, measure your actual rounds-per-pull-request, because that multiplier is the whole forecast.

Caps bite before the budget does. CodeRabbit caps at 150 files per review on Free and Essentials and 300 on Team and above, with usage-priced on-demand reviews hard-stopping above 300 files, which a vendored dependency bump will exceed. Linked repositories are 1 on Essentials, 5 on Team, 10 on Advanced, 20 on Enterprise. cubic attaches reviewed-line allowances to the seat at 40K, 80K and 160K lines per developer on Team, Pro and Max, and the allowance does not pool, so uneven contribution produces a per-person cliff rather than a team budget. Snyk meters in project counts on self-serve, 5 free and 100 on Team, which three developers with a microservice estate can exhaust on day one.

Self-hosting is a gate, not a discount. Bito charges $5 per seat on top of Professional. CodeRabbit’s self-hosted option requires 500 or more user seats, quoted verbatim from its own documentation on 2026-10-19: the self-hosted option is available for CodeRabbit Enterprise customers with 500 or more user seats. A 200-developer org that requires on-premises deployment cannot buy CodeRabbit self-hosted at any price. Sourcery, Gitar, Qodo, DeepSource and Semgrep all place self-hosting on Enterprise.

How we verified this

What we checked, and where, on 2026-10-19. We fetched four primary sources directly for this page. CodeRabbit’s pricing page, which confirmed the 1/5/10/20 linked-repository ladder, that custom roles and permissions, SSO and audit logs are Enterprise-only, and the verbatim Enterprise line about custom purchasing options including marketplaces, vendor security reviews and negotiated contracts. CodeRabbit’s self-hosted GitHub documentation, which states verbatim that the self-hosted option is available for CodeRabbit Enterprise customers with 500 or more user seats. Sourcery’s pricing page, which lists invoice billing as an Enterprise plan feature alongside self-hosting and SSO, confirms Pro at $12 annual and $15 monthly and Team at $24 and $30, and does not mention purchase orders or net terms anywhere. And Entelligence’s pricing page, which confirmed Startup at $750 a month up to 15 engineers with 300 reviews, Scale at $2,500 for 16 to 50 engineers with 1,000 reviews, $1 per review after, and the verbatim statement that the signed order form is the source of truth.

We also re-verified Gitar’s platform support matrix, which lists GitHub, GitLab including self-managed and Free, Azure DevOps Services and Server, Bitbucket Cloud and Data Center as supported, AWS CodeCommit in preview, and GitHub Enterprise Server as not supported. Gitar sponsors this site, and that last fact is the one a sponsor would least like published, which is exactly why it is here.

What we carried forward from dated research rather than re-fetching. The platform support matrix across 16 vendors, the compliance audit across 26 vendors including the 4 that sign a HIPAA BAA and the 7 holding ISO/IEC 42001:2023, the full pricing table, the GitHub Copilot entitlement wording, the Actions-minutes behaviour and the 2026 price-change log all come from our research pass dated 2026-10-18, published in the price book, regulated teams and GitLab, Bitbucket and Azure DevOps pages, each of which carries its own source list.

What we could not verify.

• AWS Marketplace listings beyond CodeAnt. The AWS Marketplace search results did not render for us on 2026-10-19. We can state CodeAnt’s listing from our earlier pass and CodeRabbit’s reference to marketplaces as an Enterprise purchasing option, and nothing more. Ask your vendor directly.
• Net terms at any vendor. Not one of the vendors we checked publishes net 30, net 60, a PO process or a minimum PO value. We are reporting an absence, which is the honest finding, not a gap in our research.
• Procurement cycle lengths. The 4-to-8 and 8-to-16 week ranges in the timeline table are our judgement from the published trial lengths, the security artefacts involved and the contract clauses needed. No vendor publishes an average sales cycle and there is no industry dataset for this category. Treat those ranges as a planning heuristic, not a measurement.
• Discount depth. No vendor publishes a volume curve. Every enterprise figure anywhere on this site is list price.
• GitHub Actions minutes per Copilot review. GitHub states its credit estimates exclude Actions minutes and publishes no minute figure. Unmodellable from public data.
• Whether assignment and continuity clauses are commonly granted. We can tell you to ask for them and why. We have no dataset on acceptance rates.

One correction to our own earlier research. An earlier internal note said Sourcery was the only vendor publishing anything about purchase orders. That is too strong. CodeRabbit’s Enterprise tier explicitly lists purchasing as in scope, in the verbatim wording above. Two vendors publish a purchasing statement, both Enterprise-only, and neither publishes net terms. Corrected here on 2026-10-19.

Disclosure. Gitar is a paying sponsor of this site. Ito is an unpaid editorial baseline partner. Sponsorship buys placement, never editorial treatment, and Gitar still has no published third-party review-quality benchmark, which we note wherever review quality comes up. On review quality generally: no party without a commercial stake has published a false-positive rate, precision figure or noise measurement for any shipping commercial AI code reviewer. Every benchmark of a buyable product in this market was published by a vendor that wins it. That is why this page ranks nothing on quality and sends you to AI code review benchmarks compared instead.

Recommendations

Criteria: shortest path to a defensible purchase, with platform and deployment filtered before price, and no quality claims we cannot source.

If you already pay for GitHub Copilot, start there and buy nothing. Code review is included from Copilot Pro at $10 upward per GitHub’s own documentation on 2026-10-19. Enable it at the org level, run it for two weeks, and measure. You now have a baseline that cost you nothing, which is the only honest reference point for whether a $24 or $48 seat is worth it. Accept that you cannot forecast the Actions-minutes line on private repositories, and move the workflow to a self-hosted runner if your Actions budget is tight.

If you are on Azure DevOps or Bitbucket Data Center, filter before you shop. Your field is 5 or 6 vendors, not 30. On Azure DevOps Services the documented options are CodeRabbit, Qodo, Gitar, PR-Agent, Kodus and CodeAnt plus Copilot in public preview. On Azure DevOps Server it is three: Gitar, PR-Agent and Kodus. Any listicle recommending cubic, Graphite, Macroscope or Cursor Bugbot to you did not check, because those four are GitHub-only.

If you need a signed HIPAA BAA, your shortlist is four names. Anthropic, Cursor at Enterprise, Augment Code and CodeAnt AI, out of 26 vendors checked. And if you run Claude with zero data retention, the HIPAA configuration or CMEK, Anthropic Code Review is unavailable to you, which removes the most capable name on that list. Start the BAA conversation in week one or it will define your timeline.

If you need SSO, audit logs, RBAC or a purchase order, price the Enterprise tier from day one regardless of headcount. All four are Enterprise-gated at CodeRabbit, confirmed on its own pricing page, and Enterprise-gated at Codacy, Qodo, Sourcery, Gitar, Graphite, DeepSource and Semgrep too. Pricing the mid-tier and discovering this in week five is the most common restart in this category.

If you are about to buy CodeRabbit Essentials and have more than one repository, stop. Essentials links one repository. Either price Team at $48, or price Greptile Pro at $30 and Gitar Core at $20, both of which advertise unlimited repositories. This single constraint changes the right answer for more teams than any price difference in the market.

Run all finalists in one 14-day window, not sequentially. Fourteen days is the published trial length at CodeRabbit, Greptile, Sourcery, Korbit, Bito, Gitar, DeepSource, Qodo and CodeAnt, and six of those need no card. Running three tools in parallel on the same repositories in the same fortnight is the only way to get a comparison rather than three impressions. Protocol in how to evaluate an AI code reviewer.

Send the security questionnaire on day one of the trial. It is the long pole. Nothing else in this process has an 8-week tail.

What I would not sign: a 3-year agreement at list price with no price-protection, assignment or continuity clause. Nine material pricing changes landed in this market in six months and four of the vendors we track changed owner in fourteen. Get the rate fixed in writing for the term, or stay monthly and pay the 20 percent. The consolidation case is laid out in AI code review vendors for large engineering organisations.

Next, by role: finance wants the price book and monthly versus annual billing. Security wants regulated teams and self-hosted options. Platform engineering wants AI code review for enterprise and the large organisation vendor view. And if your real constraint is budget rather than scale, cheapest AI code review tools.