Kodus Review (2026)

Kodus Overview

Kodus is an AI code reviewer whose core has been AGPLv3 since September 2026 and which is free to self-host at any team size, with no seat minimum and no user cap (verified 2026-10-19). That single sentence is the reason it belongs on a shortlist, and it is the reason this page exists.

The question Kodus answers better than anything else we track is narrow and important: what do you install when your source code cannot leave your network? Most of this market cannot answer it. GitHub Copilot moved to an agentic architecture in March 2026 and can run validation on self-hosted Actions runners, but the review service itself stays in GitHub’s cloud. Semgrep’s Network Broker and Snyk’s Broker are both WireGuard-style tunnels to the vendor’s cloud, not on-premise deployments. CodeRabbit does offer self-hosting, but only to organisations with 500 or more seats. Kodus hands you a Docker Compose file or a Helm chart and gets out of the way.

Pair that with any OpenAI-compatible LLM endpoint and the whole loop can run in-network: serve an open-weights model with vLLM, Ollama, TGI or LiteLLM, point Kodus at it, and nothing crosses the perimeter. Kodus is also bring-your-own-key with zero markup on token spend if you would rather use Claude, GPT, Gemini, Llama, DeepSeek or Grok through the hosted path.

Two honest caveats up front, because they are the whole reason the rating is 4.2 and not higher. Kodus displays a SOC 2 badge with zero documents behind it - in our 26-vendor trust-centre check on 2026-10-18 we could not retrieve a report, a bridge letter, or even the name of the auditing firm. And no third-party benchmark has ever published a score for Kodus. Both are covered in detail below.

Feature Deep Dive

AGPLv3 core, self-hosted by Docker Compose or Helm. The licence change in September 2026 is the headline. Before it, “self-hostable AI code review” effectively meant PR-Agent or nothing. Now there are two credible options with genuinely open licences, which is still a short list. See self-hosted AI code review tools for the full deployment-level breakdown and open-source AI code review tools for the licence picture.

Any OpenAI-compatible endpoint, including in-network serving. vLLM, Ollama, TGI and LiteLLM are all named. This is the architectural property that matters for a regulated buyer: the model is a configuration value, not a vendor dependency. It also means you can change your mind. If an in-network Llama deployment reviews poorly on your codebase, switching to a frontier model is an environment variable, not a migration.

Kody Rules. A configurable rule layer that constrains what the reviewer will comment on. This is more valuable than it sounds. Review noise is the single most common reason teams abandon an AI reviewer, and most products in this category expose either nothing or a blunt severity dial - Qodo Merge’s lever, for instance, is [review_agent].inline_comments_severity_threshold, a severity rank of 1 to 3, not a confidence score. An explicit rule layer you control is a better instrument. The Community tier caps you at 10 Kody Rules and 3 active plugins, which is tighter than the headline free tier suggests.

Kody Learnings and Memory. Prior review decisions carry forward, so a finding your team dismissed once should not reappear on every subsequent PR. Available on Community.

Quality Radar. Issue tracking for code-quality findings outside the per-PR flow, unlimited even on the free tier.

Engineering metrics and cockpit. Paid tiers only. Standard caveat that applies to every DORA-style dashboard in this market: these metrics become counterproductive the moment they are used to compare individuals rather than systems.

Platform breadth. GitHub including Enterprise Server (listed as beta), GitLab including Self-Managed, Bitbucket including Data Center, Azure DevOps, and Forgejo or Gitea. The Forgejo and Gitea support is close to unique - almost nothing else in this category documents either forge.

Pricing and Plans

Three tiers, verified at Kodus’s own pricing page on 2026-10-19.

Plan	Price	Hosting	Key limits
Community	$0	Self-hosted or Kodus-hosted	Unlimited PRs and users, 10 Kody Rules, 3 plugins, Discord support only
Teams	$10/developer/month ($8 annual)	Kodus-hosted only	Unlimited rules and plugins, priority agent queue, email support
Enterprise	Custom	Self-hosted or Kodus-hosted	SSO, RBAC, audit logs, SOC 2 claim, 5 hours/month support

Three things to notice.

Model costs are always separate. Kodus is bring-your-own-key at every tier and states zero markup, so you pay the provider at list rates. That is more transparent than a bundled seat price, and it also means the sticker price is not the bill. For normalised pricing across the whole category see the AI code review price book, and what AI code review costs for team-level totals.

Teams is hosted only. The self-host option sits on Community and Enterprise. If you want self-hosting plus unlimited Kody Rules plus a support contract, that is an Enterprise conversation.

Teams at $10/developer/month is genuinely cheap against Sourcery at $12, Bito at $12, Korbit at $12 annual, and CodeRabbit Essentials at $24. The 14-day trial includes up to 35 PR reviews on Kodus-supplied tokens.

How Good Is It, Honestly

This is the weakest part of the page, and it should be.

There is no external measurement of Kodus at all. Its name does not appear in Martian Code Review Bench, GitHub ReviewBench, SWE-PRBench, CR-Bench, CRBugBench or c-CRAB (checked 2026-10-19). Kodus has also not published a self-benchmark, which is at least cleaner than the alternative - Greptile scored itself 82%, DeepSource scored itself 84.51% F1, Qodo 60.1%, Propel 64%, Macroscope 48.31%, CodeAnt runs a 300K-PR benchmark that recommends CodeAnt, and Entelligence publishes a benchmark it wins. Kodus has simply not entered that game. But “no self-serving number” is not the same as “a good number”, and buyers should not read it as one.

The standard caveat, which applies to every tool on this site: no party without a commercial stake has published a false-positive rate, precision figure or noise measurement for any shipping commercial AI code reviewer. SWE-PRBench and CR-Bench do publish false-positive data, but for bare models in fixed harnesses, not for products you can buy. See every AI code review benchmark compared for the full provenance map and our Noise Index methodology for the measurement we are running to close the gap.

The in-network quality question is open, and we are not going to invent an answer. No published benchmark measures self-hosted local-model review quality against cloud-tier models. The figure you will find repeated across this market - that local setups deliver 60 to 70 percent of cloud quality - is not a review-quality measurement. We traced it. It conflates three unrelated numbers: a local GPU covering 60 to 70 percent of a daily coding task mix, a TCO analysis routing 60 to 70 percent of traffic locally, and GPU spend being 60 to 70 percent of self-hosted TCO. None of the three is about review quality. Do not use it, and be suspicious of any page that does.

What we can say qualitatively: the documented weakness of smaller open-weights models is multi-file and cross-file reasoning, and that is precisely the capability that separates useful review from diff-quality commentary. If you go in-network, measure cross-file findings specifically.

The SOC 2 badge is the hard negative. We checked 26 vendor trust centres on 2026-10-18. Kodus’s badge had zero documents behind it - no report, no bridge letter, no auditor name. It is in company here: cubic.dev is SOC 2 Type I only, and Panto’s audit was still underway on the same date. But a badge you cannot stand a report up against will not survive a procurement review. See fake compliance certifications in dev tools for how often this pattern shows up, and always verify against the vendor’s own trust centre rather than any comparison table, including ours.

Who Should Use Kodus

A strong fit if: your code genuinely cannot go to a vendor cloud, for residency, contractual or classification reasons; you are on GitHub Enterprise Server, GitLab Self-Managed, Bitbucket Data Center or Forgejo; you want an in-network model loop with vLLM, Ollama, TGI or LiteLLM; you have the operations capacity to run a containerised service and keep it patched; or you want a cheap hosted tier with transparent bring-your-own-key token costs.

Look elsewhere if: AGPL is barred by policy at your company, in which case PR-Agent under MIT is the direct substitute; you need a retrievable SOC 2 report today, where CodeAnt holds SOC 2 and ISO 27001 and signs a HIPAA BAA; you have no operations capacity and want someone else to run it, where CodeRabbit or Gitar are easier; or you want the largest community and the most documented language-to-linter mapping, which is CodeRabbit.

A note on sizing. Below roughly 10 developers, Kodus’s own hosted Teams tier at $10 per developer per month is usually cheaper than self-hosting once you price GPU time and on-call. Self-hosting wins on control and on scale, not on cost at small sizes.

Kodus vs Alternatives

	Kodus	PR-Agent	CodeRabbit	GitLab Duo
Licence	AGPLv3	MIT	Proprietary	Proprietary
Free to self-host at any size	Yes	Yes	No, 500+ seats required	No
Entry paid price	$10/dev/mo hosted	$0 (self-run)	$24/dev/mo annual	Included in Premium/Ultimate plus Credits
In-network model serving	vLLM, Ollama, TGI, LiteLLM	Ollama and local models	No	vLLM, Azure OpenAI, AWS
GitHub Enterprise Server	Yes, listed as beta	Yes	Yes	Not applicable
GitLab Self-Managed	Yes	Yes	Yes	Native
Forgejo or Gitea	Yes	Gitea	No	No
Azure DevOps	Yes	Yes	Yes	No
Retrievable SOC 2 report	No, badge only	Not applicable	Yes	Yes
ISO/IEC 42001:2023	No	Not applicable	Not confirmed	Yes, certified 2025-09-04
Third-party benchmark score	None	c-CRAB, 23.1%	Martian, 51.2% F1	None

All cells verified 2026-10-19 except the ISO/IEC 42001 and trust-centre entries, which are from our 26-vendor check of 2026-10-18. “Not confirmed” means we could not verify it at the vendor’s trust centre on that date, not that it is absent.

The comparison that actually matters is Kodus against PR-Agent, and it comes down to one question: is your blocker the licence or the product? PR-Agent relicensed to MIT on 23 April 2026 and sits under independent community governance in The-PR-Agent org, which clears any AGPL policy objection outright. Kodus gives you more product on top - Kody Rules as an explicit noise lever, Learnings and Memory, Quality Radar, metrics, and an escape hatch to a hosted tier if you decide operating it is not worth your time. Neither has an independent benchmark score, so pick on licence policy, platform coverage and operations appetite, not on claimed quality.

Against GitLab Duo, Kodus is the answer for a GitLab Self-Managed shop that either will not buy Duo Enterprise seats or wants a reviewer it can read the source of. Duo is the native answer and holds ISO/IEC 42001:2023; Kodus is the auditable one.

Pros and Cons Deep Dive

The licence is the product. AGPLv3, free at any team size, no seat minimum. In a market where CodeRabbit gates self-hosting at 500 seats and Semgrep and Snyk ship cloud tunnels labelled as on-premise, Kodus is one of two genuinely self-hostable AI reviewers with an open licence. That is a structural advantage, not a feature.

The in-network loop is real and supported. Any OpenAI-compatible endpoint plus vLLM, Ollama, TGI and LiteLLM named in the docs. Compare SonarQube’s AI CodeFix, which is the other strong air-gap-plus-bring-your-own-model story in this market and is also badly under-covered.

Forgejo and Gitea coverage is close to unique. If you moved off the big three deliberately, your shortlist just got very short and Kodus is on it.

The free tier is narrower than the headline. 10 Kody Rules and 3 active plugins. Unlimited reviews and unlimited users, yes, but the rule layer - the feature we think is most valuable here - is where the cap lands.

The SOC 2 badge is unbacked and it will cost deals. Zero documents behind it as of 2026-10-18. For a product whose entire positioning is “trust us with code you cannot send anywhere”, that is the wrong gap to have.

There is no external evidence of quality, at all. Not a self-benchmark, not an independent one. You are buying an architecture you can audit rather than a quality level anyone has measured, and self-hosting at least makes measuring it yourself cheap.

Self-hosting is not free, it is differently paid. GPU, infrastructure, patching, on-call. Price it honestly against the $10/developer/month hosted tier before you assume open source is the cheaper path.

For the shortlist in context, see the best AI code review tools, the best AI PR review tools, and how to evaluate an AI code reviewer. If you are buying for a regulated environment, start with AI code review tools for regulated software teams.