AI Code Review
Qodo
Qodo reviews pull requests on GitHub, GitLab, Bitbucket, Azure DevOps, and Gerrit against your rules and repository context. Qodo Merge was the former name.
The 30-Second Take
Pick Qodo if one reviewer must enforce written standards across repositories on any of five Git platforms.
Qodo Review, formerly Qodo Merge, checks each pull request for bugs, rule violations, requirement gaps and cross-repository breaking changes. It runs on GitHub, GitLab, Bitbucket, Azure DevOps and Gerrit.
- Best fit
- Pull request review across several repositories and Git platforms, enforcing written team rules.
- Main constraint
- After the 14-day trial, every review draws from a paid credit pack; only qualified open-source projects get free access.
- First move
- A trial on one busy repository, with Review Standards written and an overage cap set before the trial ends.
Why
Watch the cost per review: about 18 reviews fit in a US$30 credit pack, by Qodo's own estimate, and every review is metered once the trial ends. Its Agentic Toolbox runs the same review inside coding agents before a pull request exists.
23 practitioners, 68 sources reviewed, Updated Oct 25, 2026How this is measured
- Operating stack
- Agentic Software Development
Comparisons
How does Qodo compare with the alternatives?
Qodo vs CodeRabbit
- AI Code Review
Choose Qodo for one credit pool per workspace or on-premises below CodeRabbit's 500-seat minimum, and CodeRabbit for a free tier and an hourly allowance per developer. Price one month of your own pull requests on each before you pick.
Qodo vs GitHub Copilot
- AI Code Review
Start with the code review in Copilot Business or Enterprise if you work on GitHub.com. Add Qodo when repositories also sit on GitLab, Bitbucket, Azure DevOps, or Gerrit, or when rules must hold across repositories.
Qodo vs Greptile
- AI Code Review
Both bill reviews from one shared credit pool with no seat fees. Choose Qodo for a monthly credit pack or code on Azure DevOps or Gerrit, and Greptile for prepaid US$1 credits with no plan fee. Both read beyond the diff and run on your own infrastructure on Enterprise plans.
Operator Insights
What are engineering leaders learning from deploying Qodo?
Liran BrimerSenior Tech Leadmonday.com
monday.com's R&D organization, with Qodo reviewing pull requests in CI alongside its existing linters and danger rules.
Qodo customer story, published Read the case study (opens Qodo customer story in a new tab)
Observation
monday.com made Qodo its default pull request reviewer, and Qodo's case study credits it with stopping issues before production.
- Takeaway
- Give the reviewer your rules. Before using the case-study numbers, ask how the team counted prevented issues and saved hours.
- What happened
- monday.com added Qodo to its CI pipeline after relying on static analysis, linter rules, and custom danger rules that matched patterns. Qodo used the organization's requirements to suggest code, detect issues, and describe pull requests. An early finding flagged environment variables exposed through a public API. Brimer reports that it revealed gaps in manual review. Qodo reports about 800 potential issues stopped each month and about an hour saved per pull request. The reviewer now runs by default across engineering.
- Vendor case study (Qodo, named customer)
- Vendor-reported metrics
- No model named
Deployment details
monday.com's R&D organization, with Qodo reviewing pull requests in CI alongside its existing linters and danger rules.
- Vendor case study (Qodo, named customer)
- Vendor-reported metrics
- No model named
- Team
- monday.com R&D, about 500 full-stack and DevOps developers
- Workload
- Pull requests across monday.com's platform code
- Product version
- Qodo in the CI pipeline: code suggestions, issue detection, and PR descriptions
- Measurement
- Issues prevented per month and time saved per pull request, as reported in Qodo's case study
Nils AmietSenior Security ResearcherKudelski Security
Security research on Qodo Merge Pro. Disclosed at Black Hat USA in 2025. Write-up published January 15, 2026.
Its own announcement, published Read the write-up (opens the announcement in a new tab)
Observation
Kudelski Security turned a pull request comment into code execution on Qodo Merge Pro's GitHub app and an AWS key with administrator rights.
- Takeaway
- Treat the GitHub app as a supply chain dependency. Check its write access, how comments reach its tools, and its response to past disclosures.
- What happened
- Amiet used a pull request comment to execute code on Qodo Merge Pro's production GitHub app server and expose an AWS administrator key. It was the second such leak after Amiet's 2024 findings. An attacker could have taken over Qodo's AWS infrastructure and gained write access to customer repositories. Kudelski reports that Qodo fixed every issue by October 2025.
- Public organization write-up (security research)
- Vulnerability disclosure, no usage metrics
- No model named
Deployment details
Security research on Qodo Merge Pro. Disclosed at Black Hat USA in 2025. Write-up published January 15, 2026.
- Public organization write-up (security research)
- Vulnerability disclosure, no usage metrics
- No model named
- Team
- Kudelski Security research
- Duration
- Findings from 2024 and 2025, all fixed by October 2025
- Workload
- Qodo Merge Pro's GitHub app and the AWS infrastructure behind it
- Product version
- Qodo Merge Pro
- Measurement
- Disclosure timeline: Qodo deployed a fix for the AWS key leak within hours of confirming the April 2025 report. It fixed the code execution bug reported September 30, 2025 on October 22, 22 days later. It rotated the AWS key on October 24.
Buying and deployment
What engineering leaders should verify before a broader rollout.
Sourced from Qodo documentation
Signals
What is the current evidence saying about Qodo?
A current read of public reports from engineering leaders, teams, maintainers, and individual developers about Qodo, Qodo Merge, and PR-Agent. Every finding links to its sources.
Practitioner sentiment, leaders and teams
+17 Mixed net
of 23 sources that take a side, each author counted once. Small sample.
How this figure is madeCurrent sentiment
Positive, mixed and negative sources
Of 23 team and maintainer accounts that give an opinion, 9 speak well of Qodo, 9 report both gains and problems, and 5 speak against it. All 7 team sources that discuss bug catches report real ones, and comment noise is raised by 8 of the 10 that discuss it. At Beko, developers resolved 73.8% of the reviewer's comments while average pull request closure time rose from 5 hours 52 minutes to 8 hours 20 minutes. Of the 8 teams that weighed keeping Qodo, 5 kept it and 3 dropped it.
Run a pilot on live pull requests to measure which comments engineers act on and which they dismiss.
Evidence field. All 68 sources, one mark each.
Arrange by
Each mark is one source: positive, mixed, negative, no opinion stated, or documentation (not counted).
| Group | Sources | Positive | Mixed | Negative | No opinion stated and not counted in the score | Documentation, checked and not counted |
|---|---|---|---|---|---|---|
| Positive | 9 | 9 | 0 | 0 | 0 | 0 |
| Mixed | 9 | 0 | 9 | 0 | 0 | 0 |
| Negative | 5 | 0 | 0 | 5 | 0 | 0 |
| Not counted | 1 | 0 | 0 | 0 | 1 | 0 |
| Documentation | 15 | 0 | 0 | 0 | 0 | 15 |
| Outside this group | 29 | 11 | 12 | 6 | 0 | 0 |
| Quarter | Sources |
|---|---|
| Q1 2025 | 1 |
| Q2 2025 | 2 |
| Q3 2025 | 2 |
| Q4 2025 | 6 |
| Q1 2026 | 7 |
| Q2 2026 | 5 |
| Q3 2026 | 26 |
| Q4 2026 | 4 |
| Documentation, checked | 15 |
By sentiment
15 documentation pages check facts and are not counted; 29 sit outside this group.
Hover a mark for a quick look, click it or press Enter to open its source.Tap a mark to open its source, then step to its neighbors with Previous and Next.
What practitioners praise
Top praise of 2. Each mark is a source on it; filled marks praise it.
Most common concerns
Top concern of 2. Each mark is a source on it; filled marks raise it.
All 68 sources behind these findings
- ci(review): pilot Qodo-first review with bounded rounds (vox-2q95)Jim Freeman, founder at Punt Labs (Punt Labs, open source tools for agentic software engineering teams, with AI agents opening most pull requests), GitHub pull request on punt-labs/vox, published Oct 23, 2026
- [build] automatically generate Qodo reviews from PRs by committersTitus Fortner, Technical Leadership Committee member at Selenium (Selenium browser automation project, multi-language monorepo with a committers team and outside contributors), GitHub pull request on SeleniumHQ/selenium, published Oct 12, 2026
- Qodo pricing & usageQodo (Official), Product documentation, checked Oct 12, 2026
- Qodo for Open Source ProjectsQodo (Official), Product documentation, checked Oct 12, 2026
- Deployment modelsQodo (Official), Product documentation, checked Oct 12, 2026
- Deployment models by Git providerQodo (Official), Product documentation, checked Oct 12, 2026
- How Qodo code review worksQodo (Official), Product documentation, checked Oct 12, 2026
- Severity thresholdsQodo (Official), Product documentation, checked Oct 12, 2026
- RelevanceQodo (Official), Product documentation, checked Oct 12, 2026
- Configuration fileQodo (Official), Product documentation, checked Oct 12, 2026
- Review StandardsQodo (Official), Product documentation, checked Oct 12, 2026
- Qodo code review analyticsQodo (Official), Product documentation, checked Oct 12, 2026
- Git provider feature supportQodo (Official), Product documentation, checked Oct 12, 2026
- Platform architectureQodo (Official), Product documentation, checked Oct 12, 2026
- Sunsetting legacy v1 commandsQodo (Official), Product documentation, checked Oct 12, 2026
- Agentic Toolbox overviewQodo (Official), Product documentation, checked Oct 12, 2026
- IntegrationsQodo (Official), Product documentation, checked Oct 12, 2026
- Docs policy: generated site output is committed, not hand-edited - Qodo rule 1255924 conflicts with .pr_agent.toml ignore globmyakove, mtv-api-tests collaborator (self-described: Red Hat QE, Migration Toolkit for Virtualization API test suite), GitHub issue, published Oct 8, 2026
- Lower the advisory quorum to 5: drop the three reviewers that produce no countable signal (re-file of #1894 AC #3)don-petry, fleet operator for the petry-projects organization (self-described: petry-projects repositories with an automated review quorum), GitHub issue, published Oct 1, 2026
- task: qodo-pr-agent - Validate pilot credential boundary and activationChris Vancoillie (eleshar), LightSpeed WordPress Development (self-described: LightSpeed (lightspeedwp), an organization-wide pilot of self-hosted PR-Agent with an Anthropic key capped at US$20 a month), GitHub issue, published Sep 24, 2026
- Great Cross-Repo PR Insights, Though Severity Flags Can Miss the MarkRahul S., reviewer on G2 (self-described: Team runs Qodo on all pull requests in its AI development lifecycle), G2 review, syndicated on AWS Marketplace, published Sep 24, 2026
- Compare Qodo and Greptile reviews and pick oneViktor Farcic (vfarcic), repository owner (self-described: dot-agent-deck open source repository), GitHub issue, published Sep 23, 2026
- Run PR-Agent from CI instead of the metered Qodo reviewVictor Lyuboslavsky (getvictor), Victor Lyuboslavsky, Fleet Device Management (RawTrail, formerly fleet-edr) (self-described: fleet-edr, a public repository that merged 227 pull requests in 30 days with Qodo reviewing every push), GitHub issue, published Sep 21, 2026
- chore: suppress empty Qodo review commentsFooftilly, repository owner (self-described: PRKS repository), GitHub pull request, published Sep 20, 2026
- review config: Qodo Rule 232249 contradicts CLAUDE.md's atomicity rule (and its own cited precedent #1028)cptkoolbeenz, DAQiFi firmware team member (self-described: DAQiFi Nyquist firmware (FreeRTOS on PIC32)), GitHub issue, published Sep 18, 2026
- Evaluate a replacement for qodo PR review (trial ended)blehnen, Maintainer of DotNetWorkQueue (self-described: DotNetWorkQueue, an open source .NET library below Qodo's 200-star open source threshold), GitHub issue, published Sep 17, 2026
- fix(.pr_agent.toml): contain Qodo skill-insight/cross-repo leak of private-repo contentekson73, repository owner (self-described: multi-agent-os repository with a private downstream repository), GitHub pull request, published Sep 14, 2026
- Qodo review bot has failed on every recent PR since Aug 29auroraxo, PR-Agent contributor (self-described: The PR-Agent repository, which runs Qodo's hosted review bot on its own pull requests), GitHub issue, published Sep 10, 2026
- Qodo No Longer Reviews This Repository, and Two Documents and the Review Script Still Assume It Doesptr727, repository owner (self-described: ProjectTemplate and sibling public repositories run by one maintainer), GitHub issue, published Sep 9, 2026
- Comment on: GPT-6 Astra in code review: Gains, privacy, and costoscarestudillom, Hacker News commenter (self-described: Team that added AI review because senior engineers kept repeating the same comments), Hacker News comment, published Sep 9, 2026
- A Huge Help for Code Reviews, Bug Catching, and Pull RequestsJavier C., reviewer on G2 (self-described: Reviews of their own code at work, alongside Copilot), G2 review, syndicated on AWS Marketplace, published Sep 3, 2026
- PR-Agent Learns from Past Merges and Integrates Seamlessly with GitHubDheeraj J., reviewer on G2 (self-described: Self-hosted PR-Agent on GitHub), G2 review, syndicated on AWS Marketplace, published Sep 1, 2026
- A Useful Extra Check Before Merging CodePratap J., reviewer on G2 (self-described: Reviews of their own changes before calling them finished), G2 review, syndicated on AWS Marketplace, published Aug 30, 2026
- Speeds Up Coding and Reviews, But Struggles with Complex CodeKarandeep S., reviewer on G2 (self-described: Reviews of their own code), G2 review, syndicated on AWS Marketplace, published Aug 27, 2026
- Big-Picture Code Reviews with Qodo, Great for Catching Logic and Dependency IssuesVivaan K., reviewer on G2 (self-described: Data engineer reviewing pipeline changes against team coding standards), G2 review, syndicated on AWS Marketplace, published Aug 25, 2026
- Qodo Gives My Code a Reliable Second Pair of EyesSagar K., reviewer on G2 (self-described: Fast-moving personal projects written with coding agents), G2 review, syndicated on AWS Marketplace, published Aug 23, 2026
- Invaluable for Code Quality and Repository TrackingZac O., reviewer on G2 (self-described: Reviews across several repositories), G2 review, syndicated on AWS Marketplace, published Aug 23, 2026
- Smart Multi-Agent Reviews That Deliver High-Quality FeedbackChanchal R., reviewer on G2 (self-described: Qodo multi-agent review with rules and indexed repository history), G2 review, syndicated on AWS Marketplace, published Aug 8, 2026
- Essential Tool for Code Review with Easy SetupAkash S., reviewer on G2 (self-described: Reviews of their own pull requests on larger features), G2 review, syndicated on AWS Marketplace, published Jul 31, 2026
- docs(process): qodo is BACK - check it on every PR, alongside codexkstruck, repository owner (self-described: MMPoolsV3 repository), GitHub pull request, published Jul 30, 2026
- Finds Bugs Fast, Lets Reviewers Focus on the Bigger PictureOrlando T., reviewer on G2 (self-described: Code review), G2 review, syndicated on AWS Marketplace, published Jul 29, 2026
- My Code Reviewer While Building sphragio.ai SoloReinfried B., reviewer on G2 (self-described: Solo founder of sphragio.ai, a Django and FastAPI SaaS), G2 review, syndicated on AWS Marketplace, published Jul 27, 2026
- Add Qodo acknowledgement actionSubhramit Basu Bhowmick, maintainer at JabRef (JabRef open source reference manager, a Java desktop app with a large share of AI-assisted outside pull requests), GitHub pull request on JabRef/jabref, published Jul 26, 2026
- Rename kanin-loop → review loop (multi-reviewer: CodeRabbit + Qodo)mbjorke, repository owner (self-described: timelog-extract repository with a multi-reviewer loop), GitHub issue comment, published Jul 22, 2026
- Fast and Confident, but Accuracy Falls Short on Larger TasksBen C., reviewer on G2, self-described, G2 review, syndicated on AWS Marketplace, published Jul 10, 2026
- Underwhelming Experience with Limited Features for the PriceMark H., reviewer on G2 (self-described: Team members joined through GitHub; context features unavailable), G2 review, syndicated on AWS Marketplace, published Jun 13, 2026
- Comment on: Open Code Review - An AI-powered code review CLI toollukeasrodgers, Hacker News commenter (self-described: Employer team), Hacker News comment, published Jun 5, 2026
- [Enhancement] Enable AI-powered PR code review and suggestions (PR-Agent via opensearch-build)Mohit Kumar, maintainer of cross-cluster-replication at OpenSearch (OpenSearch project repositories maintained by Amazon engineers, sharing reusable review workflows from opensearch-build), GitHub issue on opensearch-project/cross-cluster-replication, published May 7, 2026
- Understanding the Limits of Automated Evaluation for Code Review Bots in PracticeVeli Karakaya, Bilkent University, with Baykal Mehmet Uçar of Beko (self-described: Beko's production pull request workflow on Azure DevOps, where developers must label every bot comment before merge), Research paper, arXiv (EASE 2026), published Apr 27, 2026
- How I Added AI Code Reviews to Our GitLab Pipeline Using PR-AgentAmbrish Vadnerkar, Medium (self-described: Their team's GitLab project, PR-Agent as an advisory CI job on every merge request with OpenAI, then Gemini 2.5 Flash), Personal blog post, Medium, published Apr 6, 2026
- Comparing 9 Code Review Tools - Which is Best?Mike Cann, Convex (self-described: Ten seeded pull requests on a React, Vite, and Convex project, scored against nine review bots; video version published March 10, 2026), Engineering blog post, Convex Stack (Convex engineering blog), published Mar 10, 2026
- Comment on: A real-world benchmark for AI code reviewmdeeks, Hacker News commenter (self-described: Comparing review tools on price and quota), Hacker News comment, published Feb 4, 2026
- Comment on: A real-world benchmark for AI code reviewmattvv, Hacker News commenter (self-described: Team whose developers open many pull requests a day), Hacker News comment, published Feb 4, 2026
- We Ran 11 AI PR Bots (and kept 1)swishfishdemolish, Indie Hackers member (self-described: Team that ran 11 review bots on a production repository and kept Cursor Bugbot), Indie Hackers post, published Jan 29, 2026
- Is it possible to remember code suggestions from the previous push?dbudwin, PR-Agent user (self-described: Team running open source PR-Agent in GitHub Actions on every push, with Claude Sonnet 4.5 on Amazon Bedrock), GitHub issue, published Jan 27, 2026
- Comment on: Devin Review: AI to Stop Slopjoshgachnang, Hacker News commenter (self-described: CTO and founder of Flourish Health, adolescent mental healthcare), Hacker News comment, published Jan 21, 2026
- How We Exploited Qodo: From a PR Comment to RCE and an AWS Admin Key - Leaked TwiceNils Amiet, Senior Security Researcher at Kudelski Security (self-described: Security research on Qodo Merge and Qodo Merge Pro), Security research, Kudelski Security Research Center, published Jan 15, 2026
- Comment on: Graphite is joining Cursoroutofdistro, Hacker News commenter (self-described: Employer team), Hacker News comment, published Dec 20, 2025
- Comment on: Graphite is joining Cursorarchon810, Hacker News commenter (self-described: Employer repositories, several AI reviewers at once), Hacker News comment, published Dec 19, 2025
- Remove Qodo's PR agent CI workflow configlukhnos, OpenVanilla collaborator (self-described: OpenVanilla fcitx5-mcbopomofo input method project), GitHub pull request, published Dec 10, 2025
- Incorrect Inline Code Suggestion Formatting in Azure DevOpsspanwair, PR-Agent user (self-described: PR-Agent in an Azure DevOps pipeline), GitHub issue, published Nov 20, 2025
- Effortless Communication for Dev TeamsJonah V., reviewer on G2 (self-described: Development team that found code review a time sink), G2 review, syndicated on AWS Marketplace, published Nov 14, 2025
- Comment on a Hacker News thread (story no longer available)esafak, Hacker News commenter (self-described: Evaluating tools for own use), Hacker News comment, published Nov 10, 2025
- Comment on: Qodo CLI agent scores 71.2% on SWE-bench Verifiedlirantal, Hacker News commenter, self-described, Hacker News comment, published Aug 13, 2025
- Comment on: Qodo CLI agent scores 71.2% on SWE-bench Verifiedafro88, Hacker News commenter (self-described: Individual use), Hacker News comment, published Aug 12, 2025
- Better Code Reviews with AI? GitHub Copilot and Qodo Merge TestedViktor Farcic, DevOps & AI Toolkit (self-described: Hands-on comparison on one of their own pull requests, with Copilot code review as the existing reviewer), Video, YouTube (DevOps & AI Toolkit), published Jun 30, 2025
- Automated Code Review In PracticeUmut Cihan, Bilkent University, with co-authors from Beko (self-described: Beko, a multinational home appliance maker: about 238 practitioners across ten projects had a reviewer built on PR-Agent; three projects and 4,335 pull requests analyzed), Conference talk page, ICSE 2025 Software Engineering in Practice track, published May 2, 2025
- Comment on: Effective AI code suggestions: less is moregronky_, Hacker News commenter (self-described: Employer that had recently started using Qodo), Hacker News comment, published Jan 29, 2025
Jan 2025 to Oct 2026.
53 sources from practitioners, by month and sentiment.
Where It Fits
Where does Qodo belong in the stack?
Qodo is Core across Validate, supports Build and Ship, and touches Plan and Operate.
- Business area
- Product & Engineering
- Function
- Software Development
- Operating stack
- Agentic Software Development
- Primary role
- AI Code Review & Review Standards
Plan
Work planning: Touches
Work planning, touches. Qodo's review agent checks a pull request against its linked ticket or spec and reports requirement gaps. Planning stays in the issue tracker.
Build
Codebase context: Supports
Codebase context, supports. The Context Engine indexes repositories, dependencies, and pull request history. The Software Map and Codebase Wisdom skill give that context to reviewers and coding agents.
Coding: Touches
Coding, touches. Findings include suggested fixes and a fix command. A coding agent writes the feature.
Agent runtime: Touches
Agent runtime, touches. The Agentic Toolbox connects Qodo review to Claude Code, Codex, Kiro, and MCP clients. Qodo set October 30, 2026 as the IDE plugin's retirement date.
Tool execution: Supports
Tool execution, supports. Reviews pull context from ticketing, documentation, and design tools such as Jira and Figma. Qodo exposes tools through MCP and its CLI.
Validate
Debugging: Touches
Debugging, touches. Pull request chat answers questions about a change. Qodo has no runtime data, so it is not a debugging tool.
Testing: Touches
Testing, touches. Findings can point to missing tests. Qodo deprecated the v1 test generation command on September 1, 2026 with no replacement, so your test suite stays separate.
Code review: Core
Code review, core. This is Qodo's primary role. Its agents review each pull request for bugs, rule violations, requirement gaps, and cross-repository breaking changes, and rank findings by relevance learned from past reviews.
Application security: Supports
Application security, supports. Review agents flag security-relevant bugs and Review Standards can encode security rules. Qodo is not a SAST, secrets, or dependency scanner.
Ship
Source control: Supports
Source control, supports. PR Triage ranks open pull requests by priority and wait time across repositories. The Git platform remains the system of record.
CI/CD: Touches
CI/CD, touches. Qodo posts reviews to the pull request and does not build or deploy. Teams that gate merges on it report parsing comments because Qodo publishes no check run.
Operate
Observability: Touches
Observability, touches. Incident response stays outside Qodo, which has no production telemetry.
Market mapThe layers Qodo covers, and who else owns each one.
Code review & quality
Codebase context & intelligence
Tool execution & integrations
Application security
- Snyk
- Semgrep
Source control & change management
- GitHub
- GitLab
7 more layers on the full map. Core, Supports and Touches describe coverage. They say nothing about quality.

