State of AI Code Review, Q4 2026: Consolidation Accelerates

Direct answer

Q4 2026 was the quarter AI code review stopped being a startup category. Anthropic took Code Review to general availability on 15 October 2026, CodeRabbit closed a $143M Series C at $1.5B, and five vendors were absorbed by larger platforms inside eleven months. Measurement improved too, with GitHub’s ReviewBench on 5 October 2026 - but no independent false positive rate exists for any reviewer. Verified 2026-10-18.

The state of AI code review in Q4 2026

Direct answer: Two forces defined the quarter. Frontier labs entered directly - Anthropic shipped Code Review to GA on 15 October 2026. And consolidation accelerated, with Harness alone buying DeepSource (9 Sept 2026) and Augment Code’s Cosmos, Auggie CLI and Code Context Engine (8 Oct 2026). Capital concentrated: CodeRabbit raised $143M at $1.5B. Verified 2026-10-18.

I wrote our March 2026 snapshot when this market still looked like a field of independent startups competing on review quality. Seven months later it looks like a shortlist of platforms competing on distribution, with a frontier lab shipping the feature for free inside a subscription enterprises already pay for.

That is a different market, and it changes what you should buy.

Here is the quarter, dated.

Date	Event	Why it matters
30 Jul 2026	Tricentis announces acquisition of Tabnine	A test-automation vendor absorbs an AI assistant. Tabnine’s pricing page now redirects to a Tricentis contact form, so no per-seat figure is quotable
12 Aug 2026	CodeRabbit raises $143M Series C at $1.5B, launches Agentic Change Management	The category’s capital leader reframes itself from reviewer to change-governance platform
27 Aug 2026	GitHub removes Copilot’s 300-file / 20,000-line PR cap	Invalidates any Copilot review benchmark run before September 2026
9 Sep 2026	Harness acquires DeepSource	A DevOps platform buys a code-quality vendor with 6,000+ customers. Every DeepSource comparison published before this date carries stale ownership
15 Sep 2026	Factory raises $200M at $5B, roughly tripling from $1.5B in April 2026	The adjacent agent market is repricing faster than the review market
5 Oct 2026	GitHub publishes ReviewBench	First vendor benchmark in this category with a public dataset and a self-serve runner
8 Oct 2026	Harness acquires select Augment Code assets (Cosmos, Auggie CLI, Code Context Engine)	Puts two of the most-cited benchmark publishers inside the same company
15 Oct 2026	Anthropic Code Review reaches general availability	A frontier lab now ships PR review as a bundled feature of a seat enterprises already buy

Every row above is sourced in How we verified this.

Anthropic shipped Code Review, and locked regulated teams out

Direct answer: Anthropic made Code Review generally available on 15 October 2026 to Claude Team and Enterprise, with reviews completing in 6-10 minutes versus roughly 20 in preview. Eligible Enterprise orgs can claim $10,000 to at least $10,000 in review credits (range reported up to $50,000, scaled by seat count) by 23:59 UTC on 15 January 2027. It is unavailable with Zero Data Retention, the HIPAA configuration, or CMEK. Verified 2026-10-18.

This is the most important product event of the quarter, and the most misreported.

The facts, from Anthropic’s own GA announcement (checked 2026-10-18):

• GA date: 15 October 2026. It had been in research preview for Team and Enterprise since 9 March 2026. Not on Pro or Max.
• Speed: most reviews finish in 6-10 minutes, down from about 20 minutes in preview, which Anthropic frames as roughly 3x faster.
• Three depth settings per repository: Quick, Standard (default), Deep. An admin sets this per repo, not per PR.
• Config lives in REVIEW.md, read from the pull request’s base branch or the default branch, never from the PR’s own diff. That is a deliberate design choice: a PR cannot loosen the rules it is judged by. It is also, quietly, the best-designed config surface in the category.
• It never approves or blocks a PR. Findings land as inline comments. Humans still merge.
• Credits: Anthropic’s page says “at least $10,000” for eligible Enterprise organisations; press coverage, including TheNextWeb, reports a range of $10,000 to $50,000 set at claim time based on active Claude Code seats. Credits expire 30 days after you claim them. Claim window closes 23:59 UTC 15 January 2027. Team plans get the feature but not the credits.

Hedge, stated plainly: this shipped three days before we published. One source still showed “research preview” language in docs on the GA date, and Anthropic’s own article does not mention REVIEW.md, the ZDR exclusion or GitHub Enterprise Server. The product behaviour described here is consistent across the help centre and multiple outlets, but it is 72 hours old. Re-check before you build a procurement case on it.

The regulated-team catch

Here is the detail that should drive your decision if you work in healthcare, finance or government.

Code Review is unavailable to organisations with Zero Data Retention enabled, with the HIPAA configuration applied, or using customer-managed encryption keys. It is not covered by Anthropic’s Business Associate Agreement.

Read that again in operational terms: the exact configuration that makes Claude Code PHI-eligible disables Code Review. You can have a compliant coding assistant or you can have the reviewer. Not both, not today.

Two more wrinkles. A Claude organisation is required even if your developers reach Claude Code through Amazon Bedrock, Google Cloud’s Agent Platform or Microsoft Foundry. And per reporting, connecting a GitHub Enterprise Cloud instance with data residency (a .ghe.com address) blocks the promotional credits for the entire organisation, including reviews on github.com - so EU-residency buyers get the product without the discount.

On the other side of the ledger: Code Review supports GitHub Enterprise Server, which Copilot code review does not. For self-managed GitHub shops without a ZDR or HIPAA requirement, that is a genuine differentiator, and it is the only place in this market where Anthropic is strictly ahead of GitHub on deployment surface.

What it does to everyone else’s pricing

Anthropic has not published a per-review price at GA. Reporting put research-preview reviews at $15-25 each, which is an order of magnitude above Cursor Bugbot at roughly $1.00-1.50 per review and above Macroscope’s published $0.95 average. If GA pricing lands anywhere near the preview figure, Anthropic is selling depth, not volume, and the $50,000 credit ceiling is a customer-acquisition subsidy rather than a price signal.

The strategic threat to standalone reviewers is not Anthropic’s price. It is that review is now a checkbox inside a seat the CTO already approved. That is the same dynamic that made Copilot code review the default for teams that never evaluated anything.

CodeRabbit hit $1.5B, and the funding data says the middle is dying

Direct answer: CodeRabbit raised $143M at a $1.5B valuation on 12 August 2026, co-led by Atomico and Smash Capital with BMW i Ventures and Datadog participating, on revenue up more than 5x year over year. In the adjacent AI coding assistant market, four rounds of $100M or more took over 92% of $1.629B across 12 deals. Verified 2026-10-18.

The headline is CodeRabbit’s. The structure underneath it is the story.

CodeRabbit’s Series C was announced on 12 August 2026 alongside Agentic Change Management, a repositioning from “AI code reviewer” to control layer for changes made by humans and agents. Three capabilities shipped with it: Triage (scores each PR on value, dependencies, urgency, risk and reviewer fit, then routes), Change Stack (blast-radius and architecture view), and a Security Agent (source plus IaC, dependencies, SBOMs and config). It also committed $10M over 12 months to keep the tool free for roughly 150,000 open source projects.

Note what that repositioning concedes. If review alone were a durable $1.5B business, you would not announce a new product category on the same day as the round. CodeRabbit is pricing in exactly the threat described above.

Comparative capital, for scale:

Company	Event	Date	Valuation
CodeRabbit	$143M Series C	12 Aug 2026	$1.5B
Factory	$200M round	15 Sep 2026	$5B, up from $1.5B in Apr 2026
Aikido	$60M Series B	14 Jan 2026	$1B
Greptile	$25M Series A (Benchmark)	Sep 2025	~$180M
Qodo	Series B, $120M total raised	30 Mar 2026	Not disclosed
Gitar	$9M seed (Venrock), acquired ~5 weeks later	Apr-May 2026	Not disclosed

The reported shape of the adjacent AI coding assistant market in the same period: $1.629B across 12 deals, with four rounds of $100M or more taking more than 92% of the total. The median round was about $19.5M against a $135.8M average. That gap between median and mean is the whole thesis. There is money for category leaders and seed money for new entrants, and almost nothing in between.

Tracxn counted 351 automated code review startups in October 2026, of which 85 are funded and only 37 have reached Series A or later. 314 companies are competing for the funding that 37 of them have. That is not a market, it is a queue for acquisition.

Consolidation is the quarter’s real story

Direct answer: Five acquisitions reshaped AI code review between December 2025 and October 2026: Cursor bought Graphite, Sonar bought Gitar, Tricentis bought Tabnine, and Harness bought both DeepSource and Augment Code’s core assets. Harness has now acquired 15 companies in total, including Codecov and ShiftLeft. Verified 2026-10-18.

Acquirer	Target	Announced	What changed for buyers
Sonar	AutoCodeRover	Feb 2025	Sonar’s first AI-agent acquisition
Aikido	Trag	Aug 2025	Trag folded into Aikido’s Deep PR Review. Aikido then raised $60M at $1B on 14 Jan 2026
Cursor	Graphite	19 Dec 2025	”Diamond” retired for Graphite Agent. Graphite and Cursor Bugbot now share an owner, so comparing them is comparing two products from one company
Sonar	Gitar	21 May 2026	Five weeks after Gitar left stealth with $9M from Venrock. Gitar continues standalone; a 2026-09-07 Sonar trust-centre update added Gitar SOC 2 Type 2 and a signed ISO 27001:2022 certificate
Tricentis	Tabnine	30 Jul 2026	Tabnine’s pricing page redirects to a Tricentis contact form. Do not quote Tabnine per-seat prices from any source
Harness	DeepSource	9 Sep 2026	Whole team joined Harness. 6,000+ customers. Workspaces and integrations continue, capabilities fold into Harness over time
Harness	Augment Code assets: Cosmos, Auggie CLI, Code Context Engine	8 Oct 2026	Cosmos becomes the Harness Cosmos Software Factory Agent. Augment’s founding team, including CTO Igor Ostrovsky, joined. Harness had raised $600M, Augment $252M

Harness is the acquirer to watch. Two review-adjacent deals in 29 days, on top of a 15-company acquisition history that already included Codecov and ShiftLeft. It is assembling a single pipeline from idea to production and treating code review as one stage inside it rather than a product. Whether that produces a better reviewer or a worse one is an open question, and I would not bet on the brands surviving as independent products through 2027.

The second-order effect nobody is pricing

Here is the consequence that matters most for anyone reading benchmarks.

Two of the most-cited benchmark publishers in this market, DeepSource and Augment Code, now sit inside the same company.

DeepSource published a self-scored benchmark putting itself at 84.51% F1 and a competitor at 36.19%. It also published an essay titled “Every AI code review vendor benchmarks itself, and wins” which listed six vendors and omitted its own 84.51%. Augment published the re-run that scored Greptile at 45% F against Greptile’s own 82%.

Those two datasets were the closest thing this market had to adversarial peer review. They now share a parent. Nobody has to be acting in bad faith for that to be a problem - it just means one fewer independent vantage point, at the precise moment the category needed more of them. Treat every pre-September-2026 DeepSource or Augment figure as a historical artifact with a new owner, and read our full benchmark comparison for who funded which number.

Pricing and packaging churn: what changed and what it costs you

Direct answer: Four pricing changes in 2026 invalidate most published comparisons. CodeRabbit’s free tier no longer covers private repos. GitHub retired annual Copilot billing on 1 June 2026. Cursor removed the standalone $40 Bugbot seat after 8 June 2026. CodeRabbit renamed Pro to Essentials and Pro Plus to Team in September 2026. Verified 2026-10-18.

Change	Date	Practical effect
CodeRabbit Lite and Pro Legacy retired	8 Jun 2026	Legacy plan holders had to move tiers
Cursor Bugbot standalone $40 seat removed	effective at first renewal after 8 Jun 2026	Now pure usage billing, listed from the Premium plan ($30/mo) up. Dash on Free and Plus. Still roughly $1.00-1.50 per review
GitHub retires annual Copilot billing	1 Jun 2026	Monthly only. Annual subscribers drop to Copilot Free at expiry unless they switch. Premium requests replaced by AI Credits at $0.01
Copilot private-repo reviews consume Actions minutes	1 Jun 2026	A second meter on the same review. Budget for both
Copilot 300-file / 20,000-line PR cap removed	27 Aug 2026	Bot-authored PRs now supported. Any Copilot benchmark run before Sept 2026 measured a different product
CodeRabbit plan rename, Advanced tier added	Sept 2026	Pro became Essentials ($24/dev/mo annual), Pro Plus became Team ($48), new Advanced at $72. Prices otherwise unchanged
CodeRabbit free tier drops private repos	2026	”Free reviews forever for public repositories.” Free accounts get 1 private PR review per hour, summary only, plus 3 IDE and 3 CLI reviews per hour

Two constraints that almost every comparison table omits, and that will decide your rollout:

CodeRabbit’s linked-repo cap. Essentials covers one repository. Team covers 5, Advanced 10, Enterprise 20. If you run a multi-repo service architecture, the $24 tier is not a real option regardless of what the per-seat price says. Hourly review limits are 5 / 8 / 10 / 12 by tier and degrade to 1 per hour under fair usage, with Essentials dropping at 30 and 60 reviews per rolling seven days. Max files per review is 150 on Free and Essentials, 300 on Team and above. See CodeRabbit pricing for the full breakdown.

Copilot code review is not on every Copilot plan. On individual tiers it starts at Pro+ at $39/mo. Free and Pro do not include it. Teams that assume “we already have Copilot” often have the assistant and not the reviewer. Copilot pricing detail here.

And a third, for anyone modelling cost per review: DeepSource bills AI review separately from the seat at $8 per 10K processed LOC on Standard and $15 per 10K on Advanced, against a $100 annual AI credit per user. That materially changes the economics of the ~$24 seat.

Licensing moved toward open

Direct answer: Two meaningful licence changes in 2026. PR-Agent relicensed to MIT on 23 April 2026 under independent community governance at The-PR-Agent/pr-agent, with v0.48.0 shipping 2026-10-16. Kodus moved to AGPLv3 in September 2026, free to self-host at any size. GitLab Duo Code Review with self-hosted models reached GA in GitLab 18.4. Verified 2026-10-18.

PR-Agent going MIT is the one to care about. The LICENSE file on main is MIT, even though Qodo’s own blog still says Apache 2.0, and governance moved to the The-PR-Agent organisation with Qodo remaining a sponsor rather than the owner. 13.4k stars. Runs as CLI, Docker image, GitHub Action or webhook server, against GitHub, GitLab, Bitbucket, Azure DevOps and Gitea, with OpenAI, Claude, Gemini or local models via Ollama.

Kodus on AGPLv3 is the other genuinely free-at-any-size option, supporting GitHub Enterprise Server, GitLab Self-Managed and any OpenAI-compatible endpoint, including in-network models via vLLM, Ollama, TGI or LiteLLM.

Three label corrections, because the mislabelling is everywhere:

• Qlty’s CLI is fair source under BSL 1.1. That is not open source. Do not put it in an open-source column.
• Tabby and Refact.ai are not code review tools. Neither has a documented PR or review feature. They are self-hosted coding assistants. They appear in self-hosted review roundups constantly, including, until recently, in some of ours.
• Semgrep’s Network Broker and Snyk Broker are tunnels to the vendor’s cloud, not on-prem deployments. Neither vendor has an on-prem platform. Semgrep Inc. is also explicitly not ISO 27001 certified per its own docs, contradicting several aggregator profiles.

If air-gapped review is the requirement, the strongest documented combination we have found is SonarQube’s AI CodeFix, which the docs describe as designed to operate without outbound internet access and which names Ollama, LiteLLM and vLLM. See open source AI code review tools for the full licence audit.

Measurement matured, and it is still not trustworthy

Direct answer: Q4 2026 produced the best measurement this category has had. c-CRAB found four review agents collectively catch 41.5% of issues across 184 PRs. GitHub’s ReviewBench published 219 PRs with a public runner. CRBugBench reports recall but no precision. And no party without a commercial stake has published a false positive rate for any shipping commercial reviewer. Verified 2026-10-18.

Benchmark	Publisher	Scope	Headline	Independence
c-CRAB (arXiv 2603.23448)	National University of Singapore	184 PR instances, 67 repos, 234 validated comments	”97 out of the 234 tests were passed by at least one tool (41.5%).” Per tool: Claude Code 32.1%, Devin 24.8%, PR-Agent 23.1%, Codex 20.1%	Independent. Sells nothing
ReviewBench	GitHub	219 PRs, 187 repos, 19 languages, calibrated against 103.9M PRs	Six metrics: grounded and augmented precision, recall, F1. 96.6% label agreement with independent human checkers	Auditable vendor research. Dataset and runner public at review-bench.ai
CRBugBench (arXiv 2610.13668)	CMU + Microsoft Research	1,800 tasks, 98 OSS + 2 proprietary repos	claude-opus-5 at 79.6% pre-merge / 64.2% post-merge recall@5 at $2.97/task; human plus agent 82.1%. No precision reported	Academic, not disinterested. Microsoft co-authored using copilot-cli as harness
Martian Code Review Bench	Martian	~300k PRs	CodeRabbit 51.2% F1 / 49.2% precision (3 Mar 2026). Then Qodo claimed #1 at 64.3%, then Baz claimed #1 on 790 PRs	Independent-ish. Martian sells model routing, not a reviewer
Entelligence Code Review Benchmark 2026	Entelligence	Multi-repo	Entelligence #1 aggregate at 47.2% F1 and #1 on Cal.com at 68.1% F1	Vendor. Entelligence sells a reviewer and wins its own benchmark
Greptile internal eval	Greptile	50 PRs, 5 repos	Greptile at 82%	Vendor
Augment re-run	Augment Code (now Harness)	Same 5 repos	Greptile at 45% precision / 45% recall / 45% F	Vendor, and Augment rebuilt the answer key: “We expanded and corrected the golden comments by reviewing each PR manually”

The single most useful number in the market is c-CRAB’s 41.5%. Take the union of what four review agents found across 184 pull requests, graded against executable tests derived from real human review comments, and together they catch fewer than half the issues. Not individually. Together. One disclosure, because we hold other publishers to it: c-CRAB is not conflict-free. Five of its six authors are academic (National University of Singapore, Zhejiang University), but one lists SonarSource as their affiliation (arXiv 2603.23448v3, verified 2026-10-18), and the paper carries a disclaimer that its conclusions do not represent SonarSource policy. Sonar sells SonarQube and acquired Gitar, which is a paid sponsor of this site. SonarQube is not among the four tools c-CRAB evaluates, which blunts the conflict considerably - but we are not going to call out vendor-funded benchmarks elsewhere and stay quiet about this one.

The single most misquoted number is also c-CRAB’s. The “40-70% false positive rate” attributed to that paper is not in it. The phrase “false positive” appears twice, both conceptual, and the instance in section 4.2.1 is about tuning the authors’ own comment classifier, not about the reviewed tools. No false-positive rate is reported for any tool. If you see that figure cited to c-CRAB, the citation is wrong.

ReviewBench is a new category, and I want to give GitHub credit for it. A vendor published a benchmark, then published the dataset, the labels, the severity annotations and a runner you can register your own agent container against - 25 PRs to test, then the full 219 three times for a final score. That is not independent, but it is auditable, which is a meaningful third thing between independent research and vendor marketing. GitHub also published its offline-versus-online validity deltas (+4.45% vs +8.00% precision, +12.88% vs +13.58% recall), which is the kind of disclosure that lets you discount the benchmark intelligently.

Two cautions on it. Third-party coverage reports GitHub Copilot ranking first on ReviewBench while Martian ranks Copilot fourth; we could not open a primary GitHub leaderboard with per-tool rankings, so treat the “Copilot #1” claim as reported, not confirmed. And the published materials are benchmark specifications from GitHub and Microsoft teams, not peer-reviewed research.

The hole that is still open: nobody independent has measured false positives. Every precision figure in the table above came out of a harness built by somebody with a product to sell. That is why our standing advice is to measure on your own repositories, and why we wrote a 14-day pilot protocol for doing it. Evidence for why the swing matters: in Entelligence’s own data, one tool posted perfect precision but 33.3% recall on Grafana (Go) while scoring completely differently on Cal.com. Same tool, same benchmark, two repositories, opposite conclusions.

For the fuller treatment, see AI code review tools with the lowest false positive rates, which is honest about what cannot be ranked.

What our March 2026 snapshot got wrong

I am going to do something most publishers in this space do not, which is tell you which of our own claims this article supersedes.

Our March 2026 state of AI code review post is still a good map of the four tool categories and of why LLM review struggles with business logic and architecture. Those parts hold. These parts do not:

• It said CodeRabbit offered unlimited free reviews on private repos. That ended in 2026. Private repos are no longer in the free tier.
• It described Cursor Bugbot as an IDE-side tool and treated it as a standalone product. The standalone seat was removed after 8 June 2026 and Bugbot reviews PRs on the platform.
• It treated DeepSource and Augment Code as independent vendors. Both are now Harness properties.
• It cited sub-10% false positive rates for CodeRabbit and DeepSource. Those figures were vendor-sourced. We should have labelled them. There is no independent measurement of either.
• It predicted consolidation would “begin” through 2027. It began in 2025 and five deals had closed by October 2026. We were directionally right and badly wrong on timing.
• Its market-size estimate of $2-3B was a range with no primary source attached. Treat it as an order of magnitude, not a figure.

We date every claim because facts in this market have a half-life of about one quarter. A page without a date on it is not being honest with you about how fast it goes stale.

What to watch in Q1 2027

Opinions, stated as such, with the test that would settle each one.

1. Whether Anthropic unlocks regulated teams. The ZDR, HIPAA and CMEK exclusions are the only thing keeping Code Review out of healthcare and finance. I think this changes within two quarters - the exclusion reads like a launch constraint, not a design one. Test: does the BAA coverage note change in Anthropic’s docs?

2. The 15 January 2027 credit cliff. Credits expire 30 days after claiming, and the claim window closes 15 Jan 2027. Teams that onboarded on free credits will get their first real invoice in Q1. I expect visible churn in February and March, and I expect at least one competitor to run a switching campaign against it.

3. Whether a public ReviewBench leaderboard appears with non-GitHub entrants. The runner is open. If three months pass and only GitHub has published a score, the openness was procedural. Test: any vendor other than GitHub publishing a ReviewBench number it did not choose the methodology for.

4. Whether Harness ships a merged product or lets the brands drift. DeepSource plus Cosmos plus the Code Context Engine is, on paper, the most complete review stack anyone owns: deterministic static analysis with 5,000+ rules running before an agent with a live codebase map. If Harness actually integrates it, that is the strongest technical position in the category. If DeepSource becomes a checkbox in a CI/CD upsell, 6,000 customers go shopping.

5. Whether anybody publishes a false positive rate they did not fund. This is the one I actually care about. c-CRAB measured recall. CRBugBench measured recall. ReviewBench measures both but GitHub built it. Until a party with no reviewer to sell publishes precision measured on repositories it did not choose, every “lowest false positives” claim in this market is marketing.

6. More acquisitions. 314 of 351 companies in Tracxn’s count have not reached Series A. Platform acquirers are active. Sonar, Harness, Aikido and Tricentis have all bought in this space within fifteen months. I would expect two to four more deals by mid-2027, and I would be cautious about signing a multi-year contract with a sub-Series-A reviewer without an asset-transfer clause.

How we verified this

Everything here was checked on 2026-10-18 unless a different date is stated inline.

Primary sources read directly:

• Anthropic’s GA announcement for Code Review at claude.com/resources/articles/code-review-is-now-generally-available, for the GA date, plan availability, 6-10 minute review time, Quick/Standard/Deep settings and the “at least $10,000” credit language.
• GitHub’s ReviewBench announcement on the GitHub Blog, for the 219 PR / 187 repo / 19 language scope, the 103.9M-PR calibration sample, the six grounded and augmented metrics, and the public runner at review-bench.ai.
• DeepSource’s own post announcing it joined Harness, and DeepSource’s essay on vendor benchmarks.
• Harness’s acquisition post for Augment Code’s Cosmos.
• CodeRabbit’s Agentic Change Management launch post and the Series C press release.
• Factory’s $5B round announcement.
• arXiv 2603.23448 (c-CRAB) Table 4 and section 4.4.2 for the 184 PR / 67 repo / 234 comment figures and the verbatim 41.5% sentence. arXiv 2610.13668 (CRBugBench) for recall@5 and the absence of precision.
• Augment’s seven-tool benchmark (published 11 Dec 2025, updated 18 Jun 2026) and its data at github.com/ai-code-review-evaluations.

What we could not verify, stated plainly:

• The exact Code Review credit ceiling. Anthropic’s own page says “at least $10,000.” Press reporting says $10,000 to $50,000 scaled by active seats. We report both and favour Anthropic’s wording.
• Anthropic’s GA per-review price. Not published. The $15-25 figure is from research-preview reporting, not a current price list.
• GitHub Copilot’s rank on ReviewBench. Third-party coverage says first. We could not open a primary GitHub leaderboard with per-tool rankings.
• The $1.629B / 12-deal AI coding assistant funding figure and the 92% concentration. Reported, consistent with the rounds we could verify individually, but we did not reconstruct the deal list from primary filings.
• Gemini Code Assist’s free tier status. One source says it stopped serving requests on 18 June 2026; Google docs still describe a GitHub app install getting 100 or more PR reviews per day. We exclude it from tables rather than guess.
• Tabnine pricing. The pricing page redirects to a Tricentis contact form post-acquisition. Every per-seat Tabnine figure in circulation is now unverifiable.
• Any independent false positive rate for any reviewer. Does not exist, as far as we can establish.

Disclosure: Gitar is a paying sponsor of aicodereview.cc and Ito is an unpaid editorial baseline partner. Neither influenced anything above. Gitar still has no published third-party benchmark, which we note here exactly as we would for any other vendor, and which is why it does not appear in the measurement table.

Recommendations

Criteria stated first: these are for a team choosing or re-choosing a reviewer in the next 90 days, optimising for review quality per dollar and for not being stranded by an acquisition.

If you already pay for Claude Team or Enterprise and have no ZDR, HIPAA or CMEK requirement, turn on Code Review before you buy anything. It is bundled, it supports GitHub Enterprise Server, the REVIEW.md base-branch config design is the best in the category, and eligible Enterprise orgs can claim credits until 15 January 2027. Budget for the renewal, not the trial.

If you are regulated, Anthropic is off the table today. CodeAnt AI and Cursor Enterprise offer real HIPAA BAAs, as do Anthropic (for Claude Code, not Code Review) and Augment Code. Verify at the vendor’s trust centre, not from a comparison table, and remember that “HIPAA certified” is not a real certification scheme - what you need is a signed BAA.

If you need self-hosted or air-gapped, PR-Agent under MIT or Kodus under AGPLv3 are the only genuinely free-at-any-size options, and SonarQube AI CodeFix is the strongest documented air-gap plus bring-your-own-model combination. Do not accept Semgrep’s or Snyk’s broker as on-prem.

If you are a small multi-repo team, check the repo cap before the seat price. CodeRabbit Essentials at $24 covers one repository. Greptile at $30/seat charges per review author with credits that do not pool. Macroscope at $0.05/KB with no seat fee is the cleanest pricing model in the market for bursty volume, and it bills re-reviews each time.

If you are evaluating anything at all, do not buy from a benchmark. Three of the numbers in our measurement table above contradict each other on the same tools, and the two datasets that used to check each other now share a parent company. Run the 14-day pilot protocol on two of your own repositories, with a decision rule written down before you start. Trial mechanics are in AI code review tools with free trials.

And if you want the ranked list with criteria attached, that is best AI code review tools. We will re-date it after Q1 2027, because by then at least two facts on this page will be wrong.