AI Code Review & Security
Tools focused on reviewing, securing, and validating code, not generating it.
26 tools · 26 with full reviews · 12 free or open source · Updated
CodeRabbit Freemium
CodeRabbit CodeRabbit is an AI-powered platform designed to provide governance and control for agentic development workflows. It offers automated code reviews, security scanning, and triage features that help engineering teams manage high volumes of AI-generated code. Qodo Paid
Qodo Qodo is an AI-powered code quality and governance platform that uses specialized multi-agent systems to perform context-aware code reviews across pull requests and IDEs. It helps engineering teams enforce coding standards, detect risks, and manage dependencies with support for cross-repository analysis and various Git providers. Snyk Code Freemium
Snyk Snyk Code is a developer-focused static application security testing (SAST) tool that scans source code for vulnerabilities in real-time. It leverages an agentic architecture and a proprietary security knowledge base to provide actionable, auto-fix recommendations directly within IDEs and CI/CD pipelines. cubic Freemium
Cubic cubic is an AI-powered code review and security platform that integrates with GitHub to provide real-time pull request analysis and continuous whole-codebase scanning. It utilizes thousands of AI agents to detect bugs, enforce coding standards, and suggest fixes, while maintaining security through a no-training, SOC 2 compliant architecture. Kodus Freemium
Kodus Kodus is an open-source, model-agnostic AI platform for automated code review and engineering workflow optimization. It integrates directly into development pipelines to provide deep structural code analysis, enforce custom business logic, and track technical debt. Gito Open Source
Vitalii Stepanenko Gito is a vendor-agnostic, open-source AI code reviewer that identifies security vulnerabilities, bugs, and maintainability issues. It operates as a stateless, client-side tool that integrates into CI/CD pipelines or local development workflows. Bubo Open Source
MountainOwl Bubo is a self-hosted agentic AI code review tool that integrates with GitLab and GitHub. It uses an LLM of the user's choice to analyze code changes and posts findings as structured, actionable inline comments while redacting sensitive information. heygrc Freemium
ISMS Copilot / Better ISMS heygrc is a compliance-focused code review tool that acts as a GitHub App to audit pull requests against specific compliance frameworks like SOC 2, HIPAA, and GDPR. It grounds its findings in specific control clauses rather than general code quality, providing context for auditors and security teams. Mydentify AI Crawler Access Checker Free
Mydentify / Timothy Allard Mydentify AI Crawler Access Checker is a diagnostic utility that inspects how public web pages handle documented OpenAI and Anthropic crawler user agents. It evaluates robots.txt rules, page-level directives, and performs live HTTP requests to identify potential access barriers. Vercel Agent Freemium
Vercel Vercel Agent is an AI-powered suite of development tools integrated into the Vercel platform that reviews code, investigates production issues, and performs operational tasks. It leverages project context and secure sandboxes to validate suggestions and actions before they are executed. Graphite Freemium
Graphite Graphite is an AI-powered code review platform designed to help development teams ship high-quality code faster through stacked pull requests and automated agentic workflows. It integrates directly with GitHub to provide codebase-aware AI reviews, chat capabilities, and a stack-aware merge queue. Bito Paid
Bito Bito is an AI-powered code review and security agent that provides automated, context-aware feedback on pull requests and code changes. It integrates directly into developer workflows via Git providers, IDEs, and CLI to identify bugs, security vulnerabilities, and adherence to coding standards. security-audit Free
Cloudflare Security-audit is a coding-agent skill that transforms your existing AI coding agent into a structured security auditor by orchestrating isolated sub-agents. It performs a six-phase audit process including reconnaissance, coverage-led hunting, and adversarial validation to identify and verify security vulnerabilities within a codebase. Open Code Review Open Source
Alibaba Open Code Review is an AI-powered CLI tool that combines deterministic engineering with an LLM agent to provide structured, line-level code reviews. Originally an internal Alibaba tool, it uses a hybrid architecture that filters and bundles files to improve precision and reduce token usage compared to general-purpose coding agents. SkillSpector Open Source
NVIDIA SkillSpector is a security scanner designed to analyze AI agent skills for vulnerabilities before installation. It utilizes a two-stage detection pipeline combining fast static analysis with optional LLM-based semantic evaluation to identify risks like prompt injection, data exfiltration, and dangerous code patterns. Strix Freemium
Strix Strix is an autonomous security testing platform that uses AI agents to act like hackers by dynamically running code, finding vulnerabilities, and validating them with proof-of-concepts. It integrates directly into CI/CD pipelines to provide continuous security testing, auto-fixing, and coverage across web apps, APIs, and cloud infrastructure. ADR Open Source
Uber ADR (Agentic AI Detection and Response) is an enterprise security framework designed to discover, observe, and detect security risks within AI agents and Model Context Protocol (MCP) servers. It provides a standardized telemetry collection system and a two-tier hierarchical detector to identify malicious agent activity while maintaining operational efficiency. Codex Security Paid
OpenAI Codex Security is an application security agent that identifies, validates, and remediates vulnerabilities by building deep context about a project through a customizable threat model. It uses language-model reasoning and isolated environment validation to provide high-confidence findings and actionable patches instead of relying on traditional signature-based scanning. Plannotator Open Source
backnotprop Plannotator is a local, browser-based interface designed to let developers review, annotate, and provide structured feedback on plans and code generated by AI coding agents. It integrates directly with various agents to allow users to own the agent's decision-making process before and after code execution. PentAGI Freemium
VXControl PentAGI is a self-hosted, autonomous multi-agent platform designed for penetration testing that utilizes specialized agents to plan, execute, and report on security assessments. It operates within isolated Docker containers and integrates with over 20 professional security tools to conduct authorized tests against defined targets. HeyDeer Freemium
ETOILEE PTE. LTD. (submitted by HeyDeer's maintainer) HeyDeer is an independent AI code review and security tool that evaluates GitHub pull requests against your codebase and team standards. It features a validation mechanism that verifies potential issues against the code before reporting them to reduce false positives. farol Freemium
Winnin Farol is an AI-powered code review tool designed to provide deterministic risk assessment for pull requests. It analyzes codebases using compilers to identify reach, contract breaks, and security risks, helping developers prioritize human review efforts on the most critical changes. no-mistakes Open Source
kunchenguid no-mistakes is a local git proxy that gates every push with an AI-driven validation pipeline, ensuring code is reviewed, tested, documented, and linted before being forwarded to a repository. It operates in a disposable worktree, allowing developers to maintain their current workflow while automating quality checks and PR creation. Sphinx Open Source
parthh01 Sphinx is an open-source Git hook designed for agent-assisted development that pauses Git pushes to protected branches to verify a developer's understanding of the changes. It generates scenario-based questions from a separate reviewer model to ensure the human author understands the behavior, failure modes, and invariants of the AI-generated code. PR-Agent Open Source
PR-Agent community (donated by Qodo) PR-Agent is an open-source AI-powered code review tool that automatically reviews, describes, and improves pull requests. It integrates directly into development workflows via CLI, GitHub Actions, Docker, or webhooks, allowing teams to maintain control over their infrastructure and data. Stroq Open Source
Agybay Gibatollayev Open-source local security layer for AI coding agents that audits past Claude Code, Codex and Cursor sessions for injected commands and leaked keys, and installs pre-tool-call hooks that block or question risky actions next time. FAQ
What are the best Code Review tools?
The most complete Code Review listings on ai.dosa.dev include CodeRabbit, Qodo, Snyk Code. Every tool has a detail page with pricing, key features, and a verdict - see the full list of 26 tools below.
Are Code Review tools free?
12 of the 26 Code Review tools listed here are free or open source. Others offer freemium or paid plans - check each tool's detail page for current pricing.
How is this list curated?
ai.dosa.dev is manually curated from community submissions and editorial review. Entries are enriched with pricing, features, and reviewer notes, and the directory is updated continuously.