Code Review

Vital signs

Why it's on the table

On the table, Code Review (Cq) is seat 7 of 58, in the Build family. It is an emerging element — the job is real and here to stay, but the leaderboard still changes quarterly. Choose for this quarter, hold loosely, and watch the changelog. It is optional: plenty of companies run without it — until a specific trigger (scale, regulation, cost, or customers) makes it essential for them. It sits in the lowest paid band — lunch money against the hours it returns.

Code Review: the top 5 — v2026.Q3

Edition v2026.Q3 · ranking, pricing and status verified 2026-08-06.

1. 1CodeRabbitCodeRabbit Inc.

   Free tier (PR summaries, IDE/CLI reviews) · Pro $24/user/mo · Pro Plus $48 · Enterprise custom (self-host)

   Best for Teams shipping AI-speed code who want line-by-line PR review with linters, security checks, and chat — installed in minutes on GitHub/GitLab/Azure/Bitbucket.

   The standalone-category leader by every measure: ~$40M ARR in April 2026, up 700% from ~$5M a year earlier (Sacra est.); 15,000+ customers, 6M repositories, 75M defects found; most-installed AI app on GitHub and GitLab. The $60M Series B (Sep 2025, $550M valuation) was pitched explicitly on vibe-coding cleanup demand — the same 2.7x-vulnerability wave this element exists to tax.

   Watch Comment volume is the perennial complaint — tuning is required before it feels like a colleague rather than a lint firehose. ARR figures are Sacra estimates, not audited. Bundled reviewers (Copilot, Bugbot, Claude Code Review) are commoditizing baseline review from above.

   $40M ARR Apr 2026, +700% YoY from ~$5M (Sacra estimate) [src] · $60M Series B at $550M valuation, Sep 16, 2025 (Scale Venture Partners) [src] · 15,000+ customers · 6M repos · 75M defects found · most-installed AI app on GitHub and GitLab (vendor, Aug 2026) [src]
   Site →Docs →

2. 2Copilot code reviewMicrosoft / GitHub

   Included in all paid Copilot plans (Pro $10/mo → Enterprise $39/user) · consumes AI credits per review · not on Copilot Free

   Best for Teams already paying for Copilot who want a reliable first-pass review on every PR with zero new vendors, contracts, or apps.

   Distribution nobody can answer: 60M reviews since the April 2025 launch, 10x usage growth, and more than 1 in 5 of all code reviews on GitHub by March 2026, with 12,000+ orgs auto-reviewing every PR. Quality is climbing — 71% of reviews surface actionable feedback, and agent skills + MCP context went GA July 29, 2026.

   Watch Depth trails the specialists in most independent roundups — it reviews the diff well but reads the codebase less deeply than Greptile or CodeRabbit. GitHub-only. The 2026 shift to AI-credit billing makes per-review cost opaque, and reviews are blocked when credit budgets run out.

   60M reviews since Apr 2025; >1 in 5 of all GitHub code reviews (GitHub blog, Mar 5, 2026) [src] · 12,000+ orgs auto-review every PR; 71% of reviews surface actionable feedback (Mar 2026) [src] · Agent skills + MCP servers GA for code review, Jul 29, 2026 [src]
   Site →Docs →

3. 3GraphiteGraphite → Cursor/Anysphere (Dec 2025; → SpaceX pending)

   Hobby free · Starter $20/user/mo · Team $40 (unlimited AI reviews, merge queue) · Enterprise custom

   Best for Teams who want to fix the review process, not just add a bot — stacked PRs, merge queue, and the Diamond AI reviewer in one flow.

   The only top-5 pick that re-architects review itself: stacked PRs plus merge queue plus AI review (Diamond, launched with the $52M Accel-led Series B in March 2025 — Anthropic's Anthology Fund participated). Used by hundreds of thousands of engineers, and now the code-review arm of the Cursor empire after the December 19, 2025 acquisition — the strongest possible signal that review and generation are converging.

   Watch Ownership churn squared: acquired by Cursor, which is itself being acquired by SpaceX ($60B, close expected Q3 2026). Stacked-PR workflow has a real adoption cost for teams happy with plain PRs, and unlimited AI review requires the $40 Team tier.

   $52M Series B (Accel) + Diamond AI reviewer launch, Mar 19, 2025 [src] · Acquired by Cursor Dec 19, 2025; continues to operate independently [src] · Team $40/user/mo: unlimited AI reviews, merge queue, automations (Aug 2026) [src]
   Site →Docs →

4. 4GreptileGreptile (YC W24)

   Free 50 credits/mo · Pro $30/seat incl. 50 reviews, $1/extra review · Enterprise custom (self-host, SSO)

   Best for Complex codebases and monorepos — it indexes the whole repository graph so reviews catch cross-file breakage a diff-reader can't see.

   The context-depth play: full-codebase indexing rather than diff-only review, a v3 rewrite the company says catches 3x more critical bugs than v2, and a learning system that absorbs your engineers' review comments. Benchmark led the $25M Series A (Sep 23, 2025); customers include Brex, Substack, and PostHog, with 500M+ lines reviewed and 180k+ bugs prevented at announcement.

   Watch Per-credit pricing stacks up fast on high-throughput repos ($1/review beyond the included 50). Headline bug-catch numbers are self-published, not independently benchmarked. Smallest vendor in the top 5 — procurement-sensitive orgs will notice.

   $25M Series A led by Benchmark, Sep 23, 2025; v3 claims 3x more critical bugs vs v2 [src] · 500M+ lines of code reviewed, 180,000+ bugs prevented (Sep 2025) [src] · Pro $30/seat with 50 reviews included; extra reviews $1 (Aug 2026) [src]
   Site →Docs →

5. 5BugbotCursor/Anysphere (→ SpaceX pending)

   Usage-based $1.00–1.50/review since Jun 8, 2026 (was $40/seat/mo) · individuals draw from Cursor plan usage

   Best for Cursor-native teams who want a pure bug-hunter on every PR — logic errors and edge cases, not style commentary — with one-click fixes back in the editor.

   Rides the largest AI-coding install base on earth (Cursor: 1M+ paying users, $3B ARR by May 2026) and stays deliberately narrow: hard bugs only, with a claimed 80% resolution rate on flagged issues and a high-effort mode that finds 35% more bugs at the same precision (May 2026). The June 2026 move to $1–1.50 per review made it the cheapest credible entry point in the category.

   Watch Not a full reviewer — no summaries, style, or architectural feedback; you still need review process elsewhere. Pricing model changed twice inside a year, and the SpaceX acquisition adds the same ownership uncertainty as Graphite. GitHub-focused.

   Moved from $40/seat to usage-based $1.00–1.50/review, effective Jun 8, 2026 [src] · 80% resolution rate on flagged bugs; high-effort mode +35% bugs found (Cursor, May 2026) [src] · Distribution base: Cursor $3B ARR, 1M+ paying users (May 2026) [src]
   Site →Docs →

Code Review: the top 8 compared

Edition v2026.Q3 · ranking, pricing and status verified 2026-08-06.

How to choose your code review

If coding agents are writing most of your code and PRs pile up faster than humans can read them

CodeRabbit — the fastest install-to-value in the category, then spend a week tuning its noise down. Review is the tax on AI velocity; this automates the tax.

If you already pay for Copilot and procurement hates new vendors

Turn on Copilot code review org-wide — a 71%-actionable first pass for AI credits you already budget, with the honest caveat that it reads the diff, not your architecture.

If review latency is the bottleneck — big PRs rotting for days

Graphite — stacked PRs plus merge queue attacks the process, and Diamond handles the first pass. Accept the Cursor→SpaceX ownership uncertainty.

If you run a monorepo or a gnarly legacy codebase where diff-only review misses cross-file breakage

Greptile — full-codebase indexing is the whole product; budget ~$1/review beyond the included 50.

If you expect AI review to catch security holes

Don't — AI code stalls at a 56% security pass rate (Veracode, Jul 2026) and general reviewers are not SAST. Pair any pick with a real scanner (Snyk/Semgrep class) and, if on Claude, the free claude-code-security-review action.

Code Review: the whole field

23 more tools tracked in this category, including 6 dead, renamed, or sunsetting — a reference that hides the graveyard isn't one. Verified 2026-08-06.

Code Review: the category in numbers

Edition v2026.Q3 · ranking, pricing and status verified 2026-08-06.

• AI now authors ~half of committed code, but its security pass rate stalled at 56% (55% in 2025) — ~44% of AI code-generation tasks introduce vulnerabilities; top model (GPT-5.5) only 68% (Veracode 2026 GenAI Code Security Report, Jul 28, 2026, 100+ models) [src]
• Copilot code review passed 60M reviews and >1 in 5 of all code reviews on GitHub (Mar 2026) — bundled review is now the category's biggest player by volume [src]
• CodeRabbit: ~$5M → ~$40M ARR Apr 2025 → Apr 2026 (+700%, Sacra est.); $60M Series B at $550M (Sep 2025) raised explicitly on vibe-coding cleanup demand [src]
• Consolidation into codegen platforms: Cursor acquired Graphite Dec 19, 2025, then agreed to be acquired by SpaceX for $60B (Jun 2026) — putting two of the top five reviewers (Graphite, Bugbot) under one pending owner [src]
• Pricing is shifting seat → usage across the category in 2026: Bugbot $40/seat → $1–1.50/review (Jun 8), Qodo credits at $0.012, Claude Code Review $15–25/review, Copilot per-review AI credits [src]
• Free/community tiers in flux: Google shut its consumer Gemini Code Assist review agent Jul 17, 2026 (enterprise-only now); Qodo handed PR-Agent to community governance under Apache-2.0 (Apr 23, 2026) [src]

Code Review: method & sources

Ranking criteria: verified adoption/revenue, review depth (codebase context, false-positive control), platform breadth, and momentum — no affiliate consideration. On the tile's '2.7x vulnerability rate': we could not trace 2.7x to a primary study (it circulates via SEO aggregators like SQ Magazine without citation); the defensible anchor is Veracode's Jul 2026 finding that ~44% of AI code-generation tasks introduce vulnerabilities and the pass rate has stalled at 56% — treat 2.7x as directionally right, not citable. Conflicts resolved: CodeRabbit and Qodo ARR figures are Sacra/aggregator estimates, not audited — we cite them as estimates; ideaplan.io's '$420M category ARR / 140k paid users' market-share numbers are aggregator-only and excluded from signals; Greptile's '3x more bugs' and Bugbot's '80% resolution' are vendor-published. Claude Code Review sits in the field, not the top 5, because it is a research preview restricted to Team/Enterprise plans at $15–25/review — technically the most rigorous verification pipeline in the category, but not yet broadly buyable; revisit next quarter. Adjacent elements: coding agents that also review (Claude Code, Cursor, Copilot as assistants) → Ca; SAST/security scanners proper (Snyk, Semgrep, Veracode, Checkmarx) are security tooling, not this element — only review/SAST hybrids (CodeAnt, Sonar) get field entries; LLM-app evals → Ev. Graphite ownership stated as Cursor/Anysphere with SpaceX close pending Q3 2026. Ranking criteria: verified commercial traction, independent satisfaction surveys, agent benchmarks, and founder-fit (price floor, lock-in, surfaces). Editorial, never paid — the charter. Machine-readable twin: cq.json.

Our take

AI code carries a 2.7x vulnerability rate. Review is the tax you pay for velocity — automate the tax.

Combines with