AI Code Review, What It Catches and Misses

AI code review is when a machine reads your code changes and comments on them the way a colleague would, flagging bugs, style slips, and risky patterns before the change gets merged. Some tools do it as a bot sitting on your pull requests. Some do it right in your editor. I use AI code review every week on real apps that strangers actually pay for, and here's the short version before the sales pages get to you. It's genuinely good at the boring, mechanical stuff and genuinely clueless about whether your change was a good idea in the first place. Treat it as a fast first pass and it earns its keep. Trust it as the final word and it'll happily wave through the one bug that actually matters.

That gap is the whole story, so the rest of this is me walking through where the line falls, with the tools and the prices I checked the day I wrote it.

What I Actually Use It For

Most weeks the loop looks the same. I finish a chunk of work on one of my apps, Apatero or Tool Index or my own site, and before I open a pull request I have an AI go over the diff first. Not the whole codebase. Just what changed. It reads the diff, tells me what looks off, and I fix the two or three real things it found while ignoring the five it invented.

That's the honest shape of it. The code itself mostly got written by the coding agents I lean on all day, so having a second model review the first model's work sounds circular, and kind of is. It still catches things. A left-in console.log. A function I duplicated because I forgot the helper already existed. An off-by-one in a loop I wrote at midnight. Small stuff, the stuff a tired human skims right past.

Here's Where It Earns Its Keep

The mechanical bugs are its home turf. Null checks you forgot. A variable used before it's set. The classic where you compare with a single equals instead of a double, or you await something that was never a promise to begin with. It's quick on anything with a known shape, because a known shape is exactly what a model trained on a mountain of diffs is built to recognize.

Style and consistency, too. It'll notice you named one thing in camelCase and its neighbor in snake_case. It'll flag the endpoint you left without error handling because the other nineteen routes have it and this one doesn't. And it's fine at the tedious security 101, the hardcoded key, the SQL string you built by pasting user input straight in, the auth check that's obviously missing. Those are pattern matches, and pattern matching is the one thing these tools do without breaking a sweat.

Where It Goes Quiet

Now the part the tool homepages skip, because "our bot missed the important bug" is a poor headline.

It has no idea what you meant. That's the gap in one line. An AI reviewer reads the code that's on the screen and cannot see the code you meant to write, so a change that runs perfectly and does the wrong thing sails through with a cheerful little checkmark. I shipped a change once that filtered a list by the wrong field. Correct syntax, clean style, not a single complaint from the reviewer, completely wrong result. No machine was going to catch that, because catching it meant knowing what the feature was for.

Architecture is the other blind spot. Ask it about a fifteen-line function and it's sharp. Ask it whether this new pattern is going to make the next six months miserable and it's got nothing, because that judgment lives in your head and your roadmap, not in the diff. It won't tell you the feature shouldn't exist. It won't notice you're solving a problem you invented last Tuesday. And the security holes that actually sink products, the auth logic that's subtly wrong rather than plainly absent, the payment webhook that fires twice, it tends to wave those through as well, because they're bugs of intent and context, not bugs of pattern.

What It Catches vs What It Misses

I kept a rough tally across a handful of real reviews, mine and the bots' both. This is the split as I've lived it, not a benchmark, so read it as one builder's map rather than a lab result.

The bottom row is the one that matters. Intent is where the machine is simply blank, and intent is usually what decides whether the change was worth shipping at all.

The Tools, and What They Actually Run You

People ask which one to buy, so here are the three that kept coming up when I looked, with prices I pulled on the day I wrote this. They change these constantly, so check before you trust me.

CodeRabbit reviews your pull requests and posts inline comments. It's free forever on public repositories, and its free plan is really a 14-day run at the top tier with no card required. Paid, it runs $24 per user a month on Pro billed annually, and $48 on Pro Plus, which mostly buys higher limits, up to ten PR reviews per developer an hour.

Greptile does a similar bot-on-your-PR thing and leans hard on reading your whole codebase for context. The free tier gives you fifty credits a month, one credit per standard review, for a single active developer. Pro is thirty bucks a seat monthly, with extra reviews at a dollar each once your credits run out. They knock 50% off for pre-Series A startups, and it's free for qualifying open-source projects.

GitHub Copilot does code review as one feature of the broader subscription rather than as a standalone thing. There's no code review on the free plan at all. It starts on Copilot Pro at $10 a user a month, then Pro+ at $39, and a $100 Max tier above that. If you already pay for Copilot, you've basically already got a reviewer sitting in your pull requests and might as well switch it on.

Honestly the free tiers are enough to work out whether you even like the experience, and I'd start there before handing anyone a card.

Even GitHub Won't Let Its Bot Sign Off

The detail that stuck with me is buried in GitHub's own docs.

Copilot can review your pull request, leave comments, and suggest fixes, usually inside thirty seconds. What it cannot do, by design, is approve the pull request or request changes. Its reviews don't count toward required approvals, and they won't block a merge. GitHub built one of the most-used coding AIs on the planet and then deliberately refused to let it be the one who says yes. A human still has to click approve.

That's close to the whole argument, made by the people with the most reason to claim otherwise. If the company shipping the tool won't wire it up as the final gate, you probably shouldn't either.

A Review Prompt You Can Paste In

You don't need a dedicated product to get most of this. If you already code with an agent, you can have it review its own work with a prompt. This is the one I use, roughly, before I open a PR. Drop it into Claude Code, Cursor, whatever you've got, pointed at your diff.

Review this diff like a senior engineer who has to approve it.
Only look at what changed, not the whole repo.

Flag, in priority order:
1. Bugs that will actually break at runtime
2. Security issues: secrets, injection, missing auth checks
3. Edge cases the change ignores (empty, null, duplicate, concurrent)
4. Anything that touches money, auth, or user data

For each finding: the file and line, why it matters, the fix.
Do NOT comment on style unless the style hides a bug.
If you're guessing, say you're guessing.
End with the single change you'd insist on before this merges.

The last two lines do more work than the rest. Making it admit when it's guessing takes a little air out of the confident-nonsense problem. And forcing it to name the one most important thing stops it burying the real issue under ten cosmetic nitpicks, which is the failure mode I hit most.

The Questions People Actually Search

A few of these come up over and over, so here are plain answers.

Is there a free AI code review tool? Yes, several, all with strings attached. CodeRabbit is free on public repos and free to trial. Greptile has a free tier for one developer. And the paste-a-prompt route above costs you nothing beyond whatever you already pay your coding agent. Free is fine to learn on. Just know the free tiers cap how much you can run before they ask for money.

Can AI replace code review? No, and the toolmakers keep saying so through their product decisions, GitHub included. What it replaces is the first, tedious pass a human would rather skip. The judgment at the end stays human, especially on anything with real users behind it. If you want the wider picture of where this fits into building software, I got into it over in what vibe coding actually is.

Is AI code review any good? For catching mechanical problems, yes, genuinely. For catching the problem that sinks the release, not so much, because that one is almost always about intent. It's a good junior reviewer who never gets tired and never once understands the stakes.

What about open-source or agent options? There are open-source review setups, and the paste-your-own-prompt approach, and both work without a monthly bill. You're still paying a model somewhere, whether that's your Copilot subscription or an API key you top up. The software being free doesn't make the tokens free.

So, Should You Use It

Short version, yes, with your eyes open.

Turn it on. Let it do the first read of every diff, catch your typos and the error handling you forgot on that one route, and spare you the tedium of the mechanical pass. Then do the part it can't. Read the change yourself, ask whether it does what you actually meant, and click approve like it's your name on the outage, because it is. The apps this reviewer has combed through have made me something like ten grand total across their whole lives, not per month, so I'm not writing this from a yacht. But they shipped, and they mostly hold up, and the AI reviewer was never once the reason a release was good or bad. It handled the first read. The decision was always mine, and I don't think a sharper model changes that, because what it's missing isn't skill. It's knowing what I was trying to do in the first place.