The ACR Standard

Direct answer

We verify 55 AI code review and static analysis tools against nine documented checks, record a verification date on every tool page, and publish what we could not confirm rather than filling the gap with a guess. We sell no code review tool. Tool pages were last verified between 1 March 2026 and 19 October 2026. 34 of 55 tool pages are currently older than 90 days and are queued for re-verification.

Why this page exists

Most of what is written about AI code review is written by companies selling AI code review. That is not a conspiracy, it is just how the category is funded. But it has a measurable consequence: when we traced every published benchmark in this market, each one had been produced by a vendor scoring itself, and several of them scored their competitors too.

So the useful question is not "which tool is best". It is "how would you know, and who paid for the number that told you". This page documents how we answer that, so you can check our work or disagree with our method.

The nine checks

Every tool page is held to these. A cell is either verified at a primary source with a date, or it is marked unverified with a date. There is no third option, and in particular there is no option where we infer a value because it seems likely.

1. Commercial terms

What we record: Entry price, full-capability price, billing basis, and what counts as a billable unit.

Why it matters: "Per developer" is not a comparable unit across vendors. CodeRabbit bills only developers who create pull requests. Greptile bills any developer who received a review. Snyk prices in project counts. Macroscope has no seats at all. Most comparison tables pretend these are the same number.

2. Free tier and trial

What we record: Whether a permanent free tier exists, whether it covers private repositories, trial length, and whether a card is required.

Why it matters: A free trial is a clock. A free tier is permanent. They are different buying decisions and the market uses one word for both.

3. Overage and caps

What we record: Overage mechanics, file caps per review, linked-repository limits, and rate limits.

Why it matters: These are where a predictable bill becomes unpredictable, and they are almost never on the pricing page.

4. Platform support

What we record: GitHub.com, GitHub Enterprise Server, GitLab SaaS, GitLab Self-Managed, Bitbucket Cloud, Bitbucket Data Center, Azure DevOps, and others where documented.

Why it matters: SaaS support does not imply self-managed support. This is where tools quietly drop out of a shortlist, and it is the first filter a buyer should apply rather than the last.

5. Deployment model

What we record: SaaS, self-hosted tier and its seat minimum, air-gapped capability, and bring-your-own-model support.

Why it matters: "Self-hosted" means three different things. Some vendors run the review in your network. Some only run the CI runner there while the review service stays in their cloud. We separate them.

6. Certifications

What we record: SOC 2 and its type, ISO 27001, ISO/IEC 42001:2023, a GDPR DPA, and whether a HIPAA Business Associate Agreement is actually offered.

Why it matters: HIPAA is not a certification scheme. It requires a signed BAA, and SOC 2 alone does not satisfy it. A tool can hold SOC 2 and still be unusable for protected health information.

7. Enterprise controls

What we record: SSO, audit logs, role-based access control, and which tier gates each one.

Why it matters: Compliance features are routinely behind the top tier. That changes the real cost of compliance, not just the feature list.

8. Review capability

What we record: Full-repository indexing versus diff-only review, the exact configuration filename, custom rule support, severity labels, autofix, and conversational review.

Why it matters: Diff-only review produces diff-quality comments. This is the architectural property that predicts output quality, and unlike a catch-rate claim it is verifiable from documentation.

9. Evidence provenance

What we record: Every benchmark figure attributed to the organisation that published it, and whether that organisation sells a competing reviewer.

Why it matters: Almost every performance number in this category was published by a company selling a reviewer. Reporting the figure without the funder is how a marketing claim becomes a fact.

What we count as a primary source

In descending order of weight:

  1. The vendor's own pricing page, documentation, or trust centre. If a price is rendered client-side and we cannot read it, we say so rather than quoting an aggregator as though it were the source.
  2. A certification register or an actual report. A badge on a marketing page is not a certification. We have found badges with no documents behind them, and we publish that.
  3. Peer-reviewed or preprint research, with conflicts disclosed. Including when the conflict is inconvenient for us.
  4. Our own measurement, published with the method, the sample size, and the raw data.
  5. Third-party comparison pages. Used for corroboration only, never as the primary source for a price or a certification.

Benchmark provenance

This is the rule that does the most work. Every performance figure we publish is attributed to whoever produced it, and we state whether they sell a competing product.

A worked example, because it shows why the rule matters. Greptile's own evaluation of 50 pull requests across five repositories scored Greptile at 82%. Augment re-ran it on the same five repositories and scored Greptile at 45%. Both numbers get quoted as though they settle something. In fact the 45% is an F-score rather than a catch rate, and Augment rebuilt the answer key rather than reusing Greptile's, so a large part of the gap is methodology rather than self-dealing. Augment also sells a competing product. Reporting either number alone would be misleading, so we report both with their provenance.

The claim we keep making, stated as precisely as we can: no party without a commercial stake has published a false-positive rate, precision figure, or noise measurement for any shipping commercial AI code reviewer. Two independent academic benchmarks do publish false-positive data, but for bare models in fixed harnesses rather than products you can buy. We are running the first measurement of the commercial products ourselves, and the method is published before the results exist so it cannot be tuned to a conclusion.

Ratings

Tool ratings on this site are editorial judgements, not measurements, and we would rather say that plainly than dress a 1 to 5 number up as science. A rating reflects the nine checks above plus hands-on use, and the pros, cons, and verdict on each tool page are where the actual reasoning lives. If a rating and the body text disagree, trust the body text and tell us.

What a rating is never influenced by: whether a vendor is a sponsor, whether they have contacted us, and whether we have any commercial relationship of any kind.

Independence and money

We sell no code review tool. That is the only reason our assessment of someone else's is worth anything, so we protect it carefully.

  • No affiliate links and no paid rankings. No vendor can buy a position, a rating, or the removal of a criticism.
  • Sponsorship buys placement units, never editorial treatment. Gitar is a paid partner and is labelled as such wherever it appears. A partner gets a guaranteed entry in relevant lists. It does not get a rank, a rating, or protection from a criticism.
  • We publish corrections against our own sponsors. We have corrected a platform-support claim that was wrong in a paid partner's favour, with a visible note on the page rather than a silent edit. If we would not do that, the independence would be decorative.
  • We disclose conflicts in our sources, not just in ourselves. One academic benchmark we cite has an author affiliated with a company that owns one of our sponsors. That disclosure appears on every page citing it.

Current coverage

Measure Count
Tools tracked 55
With a dated, sourced facts list 12 of 55
With structured buyer questions answered 6 of 55
With itemised pricing plans 55 of 55
Offering some form of free tier 41 of 55
Verified within the last 90 days 21 of 55

By category

Category Tools
AI pull request review 27
Code quality 10
Security 8
AI coding assistant 8
Static analysis 2

What we do not know

A standard that only lists what we verified is marketing. These are the gaps we currently cannot close, stated so you can weight our pages accordingly:

  • No independent false-positive rate exists for any shipping commercial reviewer. We are measuring it. Until we publish, treat every low-noise claim in this category as unverified, including claims by tools we rate highly.
  • No vendor publishes per-language precision or recall, and none of the academic benchmarks break results out by language. Review quality demonstrably varies by language, and nobody can currently tell you by how much for a specific product.
  • No vendor publishes run-to-run variance. Without a deterministic baseline, the same review run twice can produce different findings, which undercuts any single-run number including the ones we cite.
  • Most enterprise pricing is quote-only, so enterprise comparisons rest on what buyers report rather than published rate cards.
  • Most SOC 2 scopes are unreadable without signing an NDA. We can usually confirm a report exists. We frequently cannot confirm what it covers.
  • No vendor publishes a support SLA, so support quality is unverifiable before purchase.

Corrections

If a fact on this site is wrong, tell us and we will fix it with the date attached. We correct visibly rather than silently, including when the error was ours and including when the correction is awkward for a commercial relationship. A site arguing that you should distrust undated vendor claims does not get to quietly revise its own.

Reach us at the about page. Our broader process is in the editorial policy.