AI Code Review Bots Compared (2026): Claude Code Review vs Copilot vs Codex vs Cursor

Between late September and mid-October 2026, every major AI coding vendor shipped or expanded an automated pull request reviewer. Cursor launched Security Review and Rollouts on September 23. At DevDay 2026, OpenAI extended Codex code review beyond GitHub pull requests to GitLab merge requests (beta). GitHub made Balanced the default Copilot review effort, added API access and new org billing controls, and took agentic autofix for code scanning to general availability. Anthropic moved Claude Code Review out of research preview on October 15.

If you lead an engineering team, the question is no longer whether to add an AI reviewer. It is which one fits your code host, your plans, your budget controls and your merge policy. This post compares Claude Code Review, GitHub Copilot code review, OpenAI Codex code review and Cursor's Bugbot plus Security Review on setup, depth controls, platforms, billing, plan eligibility and the one thing none of them will do. Every vendor detail is current as of October 26, 2026. Pricing and limits in this category change monthly, so check the linked docs before you commit budget.

The scope is the review bots built by the four major AI coding vendors. Standalone review products such as CodeRabbit, Greptile, Qodo or Graphite are not covered here. They deserve their own comparison, and their plans and pricing change on a different cycle.

This post also serves as our coverage of Claude Code Review's GA. For the broader agent comparison, see Claude Code vs OpenAI Codex and our roundup of the best AI coding tools in 2026.

At a glance: the four review bots compared

Sources for each row are linked in the vendor sections below.

Claude Code Review: GA, GitHub-only, priced on tokens

Anthropic announced general availability on October 15, 2026. Code Review is now out of research preview for Claude Team and Enterprise organizations. The headline changes from preview are speed and depth control. Anthropic says most reviews now take about 6 to 10 minutes, down from about 20 minutes in the preview. That is a vendor-reported figure, not an independent benchmark.

How a review works

According to Anthropic's documentation, each review runs on Anthropic infrastructure in four stages:

1. Find: several agents examine the diff and surrounding code in parallel.
2. Verify: a verification step checks candidate findings against the code and filters out false positives.
3. Rank: the remaining findings are deduplicated and ranked by severity.
4. Post: inline comments, a summary in the review body and a check run named Claude Code Review.

Findings carry one of three severities: Important (a bug that should be fixed before merging), Nit (minor, not blocking) and Pre-existing (a bug already in the codebase that this PR didn't introduce). The pre-existing label is useful in practice, because it keeps reviewers from blaming the PR author for old debt while still surfacing it.

By default the service focuses on correctness, meaning bugs that would break production, not formatting or missing tests. A review reads the diff and surrounding code but does not build or run it. Repository access inside a review is read-only, and it never pushes commits.

Setup and triggers

An Owner of the Claude organization enables Code Review in Claude Code settings, installs the Claude GitHub App and picks repositories. Each repository then gets a Review runs setting:

• Once after PR creation: runs when a PR is opened, reopened or marked ready for review.
• After every push: runs on each push. This is the default when you add a repo from the admin page, and it multiplies cost by the number of pushes.
• Manual: runs only on request.

Anyone with write access can comment @claude review for a one-off review, or @claude review always to subscribe a PR to push-triggered reviews. Automatic reviews skip drafts and PRs from forks. Customization lives in REVIEW.md and CLAUDE.md, and REVIEW.md is read from the base or default branch, never from the PR's own changes. A PR therefore can't rewrite its own review instructions.

Depth levels

Owners set one level for the organization and can override it per repository:

• Quick: a lighter pass, the fastest and cheapest.
• Standard: balanced depth, speed and cost. The default.
• Deep: the most thorough pass, the slowest and most expensive.

There is no model picker. Code Review chooses the Claude models itself, and the review level is the only thoroughness control.

Pricing and spend controls

As of October 2026, there is no flat per-review price. Reviews are billed on token usage through usage credits, separately from your plan's included usage, and charged to the organization rather than the developer. Cost per review scales with the review level, the size of the change, the complexity of surrounding code and how many candidate issues need verification. Per-review cost estimates from the research preview predate GA and the new depth levels, so don't budget from them.

Anthropic's recommended approach is a pilot. Set a monthly Code Review spend limit, enable a few representative repos on Once after PR creation or Manual, then read each repo's Average cost column in the admin settings and multiply. If the Code Review limit, the org spend limit or the credit balance runs out, reviews are skipped and developers see a comment on the PR naming the cause.

Eligible Claude Enterprise organizations can also claim at least $10,000 in Code Review credits by January 15, 2027. Credits expire 30 days after they are claimed, and terms apply.

Availability limits

• GitHub only for the managed service. For GitLab, Anthropic points you to running Claude in your own GitLab CI/CD instead.
• Not available with Zero Data Retention, the HIPAA configuration or customer-managed encryption keys, and not covered under Anthropic's BAA.
• You still need a Claude Team or Enterprise org even if your developers use Claude Code through Amazon Bedrock, Google Cloud or Microsoft Foundry.

Gate merges on Claude findings from your own CI

Because the check run never fails, teams that want a hard gate have to build it. Anthropic documents a severity line at the end of the check run's details text. These commands come from the docs, with OWNER, REPO and the IDs replaced by your values:

# 1. Find the Claude Code Review check run on the PR's head commit
gh api repos/OWNER/REPO/commits/<commit-sha>/check-runs --jq '.check_runs[] | {id, name}'

# 2. Read the severity counts, e.g. {"nit": 1, "normal": 2, "pre_existing": 0}
gh api repos/OWNER/REPO/check-runs/CHECK_RUN_ID --jq '
  (.output.text | split("\n") | last
    | scan("^<!-- bughunter-severity: (.*) -->$")[0] | fromjson)?
  // error("no severity line")'

The normal key counts Important findings, so failing the job when it's above zero gives you a merge gate. Two edge cases matter. A missing severity line means no verdict, not zero findings. And a title beginning Code review not repeated means earlier Important findings are still open even though there are no counts. Treat both explicitly.

GitHub Copilot code review: widest plan coverage, AI-credit billing

Copilot code review is the default choice for many teams simply because it's already in GitHub. As of October 2026, automatic reviews are available on Copilot Pro, Pro+, Max, Business and Enterprise. Copilot Free doesn't include code review, and the personal setting to auto-review your own PRs isn't available for managed user accounts. Business and Enterprise admins can also enable reviews for users without a Copilot license on GitHub.com.

What changed this fall

• Balanced became the default effort level on September 28, 2026, replacing Lite as the default for new and existing repos. Orgs that explicitly chose Lite keep it. In its code review docs, GitHub describes Lite as "fast, targeted feedback on common issues" and says Balanced routes PRs "to a higher-reasoning model for longer analysis of complex logic."
• API support (October 2): you can request a Copilot review through the REST and GraphQL APIs and set the effort level per request.
• Org billing options (October 8): by default, reviews bill to the member's own Copilot entitlement, and a review fails if that member's quota is exhausted. Orgs can switch to billing the repository's owning organization instead, which requires AI Credits paid usage and supports a budget. A new control restricts reviews to licenses issued by your org or enterprise, blocking personal licenses.
• Agentic autofix for code scanning reached GA on October 15. It isn't a PR reviewer. It remediates CodeQL alerts by proposing a fix, rerunning CodeQL to validate it and opening a draft PR. It requires GitHub Code Security or Advanced Security on GitHub Enterprise Cloud and consumes AI credits from your Code Security budget plus Actions minutes.

GitHub often announces Copilot changes around its Universe conference, so expect this section to move. We'll refresh it after the event.

How billing works now

GitHub's current docs say each Copilot review consumes AI credits, and agentic features also consume GitHub Actions minutes (self-hosted runners don't). GitHub's own per-review estimates, excluding Actions minutes, are about $0.05 to $1 for Lite and $0.25 to $5 for Balanced. By default, automatic reviews bill to the PR author and manual reviews bill to the requester.

Annual Pro and Pro+ subscribers who stayed on legacy premium-request billing after June 1, 2026 work differently. For them, each Copilot code review consumes 13 premium requests. Pro includes 300 premium requests a month and Pro+ includes 1,500, with extra requests at $0.04 each.

Configuration and approvals

Copilot reads .github/copilot-instructions.md, path-specific .github/instructions/**/*.instructions.md files, AGENTS.md and skills under .github/skills/. One detail security teams should note: Copilot reads these files from the PR's head branch, so a PR can change the instructions it's reviewed under. Claude Code Review reads REVIEW.md from the base branch, and Cursor reads bugbot.yaml from the base branch. If contributors outside your trust boundary can open PRs, factor that in.

By default, Copilot's reviews don't count toward required approvals. A public-preview Copilot approvals option lets Copilot submit an approving review that satisfies a required-approval rule, and new pushes dismiss it. It's the only bot in this comparison that can approve. Turn it on only with a clear policy for which repos and change types qualify.

Copilot skips dependency files such as package.json and Gemfile.lock, as well as log files and SVGs. It doesn't support model switching.

OpenAI Codex code review: GitHub plus GitLab merge requests

Codex already reviewed GitHub pull requests before DevDay 2026. At the event, according to InfoQ's coverage, OpenAI announced a code-review workflow covering GitHub pull requests and, newly, GitLab merge requests, which OpenAI's docs list as beta. Among the model vendors, that makes OpenAI the one with native GitLab MR review. Cursor's Bugbot also supports GitLab.

GitHub setup

Connect the repository to Codex, open the code review settings, choose the repo and turn on Automatic review. Changing these settings requires GitHub push or admin permission. For a one-off review, comment @codex review. You can narrow the focus inline, as in @codex review for issues in the database migration. On GitHub, Codex flags only P0 and P1 issues to keep comments focused on high-priority risks.

Review guidance goes in a ## Code Review Rules section of the AGENTS.md closest to the code it governs, with ### headings to group checks. OpenAI recommends starting with two or three concise rules and leaving formatting and lint to CI. If your team already maintains both AGENTS.md and CLAUDE.md, our AGENTS.md vs CLAUDE.md vs Cursor rules comparison covers how to keep them in sync.

## Code Review Rules

### Data access
- Flag any query built by string concatenation with user input.
- New tables need a migration and a rollback.

### API
- Breaking changes to public endpoints require a version bump.

Codex also offers a deeper Security Review in research preview, triggered automatically alongside code review or manually with @codex security review. Commenting @codex fix the P1 issue starts what OpenAI's docs call a legacy cloud chat, with the PR as context, and it can push a fix to the branch when it has permission.

GitLab (beta)

OpenAI's docs say GitLab support "is in beta and is available on all ChatGPT plans." It works with GitLab.com and with self-managed or Dedicated instances. Self-managed and Dedicated instances require a workspace-admin template. Codex also uses a service account with an API token (a personal access token with the api scope), granted Developer access only in the groups or projects where it should operate. On GitLab.com, a project environment is also required to enable reviews. Automatic reviews can run On MR open, On every push or on Smart Trigger (Experimental) and focus on P0/P1. Manual @codex review can include P2 findings. Group-level webhooks require GitLab Premium or Ultimate and GitLab 19.0 or newer, and group activity covers reviews only, not coding tasks.

Plans and billing

As of October 2026, OpenAI's Codex pricing page lists "GitHub code review and automatic PR reviews" on Plus ($20/month), Pro (from $100/month), Business ($20 per user per month billed annually, $25 monthly) and Enterprise/Edu. It's not available with API-key sign-in, which has no cloud features. OpenAI tracks reviews that Codex runs through GitHub as "Code Review usage". Reviews run locally or outside GitHub count toward your general usage limits. OpenAI doesn't publish a per-review price or a per-plan review quota.

Cursor: Bugbot for quality, Security Review for exploitable bugs

Cursor splits review into two bots. Bugbot reviews PR diffs for bugs, security issues and code quality, leaves comments with fix suggestions, and can spawn a Cloud Agent through Autofix to push fixes.

• Code hosts: the widest set in this comparison. GitHub (including Enterprise Server), GitLab (including self-hosted), Bitbucket (including Data Center), Azure DevOps Services and Cursor's own Origin.
• Triggers: runs on every PR update by default. Trigger it manually with cursor review or bugbot run.
• Rules: project rules live in .cursor/BUGBOT.md.
• Effort: Low, Default, High and Smart levels, available only on usage-based Bugbot plans.
• Plans and billing: as of October 2026, Cursor's pricing docs include Bugbot on Premium and higher, and the Plus tier excludes it. Teams bills from the team's prepaid credit. Each review is billed once, to the team or personal account that turned Bugbot on for the repository.

Security Review, launched September 23, 2026 on Teams and Enterprise, reads each PR in the context of the codebase and posts one review comment listing exploitable bugs. Each finding includes a severity, the attack path and a proposed fix. It skips draft PRs, leaves style and quality to Bugbot, and enforces team-specific rules on every PR. Dismissing a finding with a reason stops it from being raised again on that PR. Cursor included launch usage credits for the first 10 days after release, enough for roughly 50 changes on Teams and 500 on Enterprise. That window has closed, and Cursor hasn't published standard pricing for the bot in the announcement.

Rollouts, launched alongside it, isn't a code reviewer. It attaches a post-merge health monitor to each PR and reports per-environment verdicts. It can open a revert PR or hand off to a cloud agent, but Cursor says it doesn't merge or roll back on its own.

Worked cost example: a 20-engineer team

Assume a team opens 200 PRs a month with an average of 3 pushes per PR. Prices below are as of October 2026.

*The legacy row applies only to individual annual Pro and Pro+ subscribers who stayed on premium-request billing, not to a team on current billing. The 300 premium requests are shared with all other premium Copilot usage, so 23 reviews is a ceiling.

The Copilot ranges come from GitHub's own per-review estimates. Anthropic publishes no per-review figure, so A has to come from your pilot. To show the shape of the math: if a pilot showed a hypothetical average of $2 per review, every-push reviews would cost 600 × $2 = $1,200 a month, versus 200 × $2 = $400 for once per PR. The trigger setting moves your bill by 3x before you touch depth. Claude's default for newly added repos is After every push, so check that setting first. Codex review is included in ChatGPT plans with no published per-review price, and Cursor bills Bugbot per review at its published rates.

What none of them will do

No bot in this comparison merges code on its own. The details differ:

• Claude Code Review never approves or blocks. Its check run concludes neutral, never as a failure, and the merge decision stays with your team.
• Copilot doesn't count toward required approvals by default. The preview approvals option is the exception, and new pushes dismiss it.
• Codex posts a standard GitHub review. OpenAI's GitLab docs state that review rules "don't replace tests, branch protections, or required approvals."
• Cursor Bugbot publishes a check that defaults to neutral, so requiring the check alone doesn't block merges. Failing on unresolved issues is opt-in. Rollouts can open a revert PR but doesn't roll back by itself.

Every vendor also carries the same disclaimer. Anthropic's docs say a review with no findings "doesn't mean your code is error-free or secure." GitHub says Copilot "is not guaranteed to spot all problems or issues in a pull request." Claude's docs also state that its reviews work from reading the diff and surrounding code, without building or running it, so your tests remain the only thing that actually executes the change.

How to choose

• You're on GitHub and want the deepest configurable reviewer, with an org budget: Claude Code Review, if you're on Claude Team or Enterprise and don't need ZDR, HIPAA or CMEK. Use Deep on critical repos and Quick on routine ones.
• You want the lowest-friction default and already pay for Copilot: Copilot code review. Decide early whether reviews bill to members or the org, because member billing fails reviews when a quota runs out.
• You're on GitLab: Codex (beta) or Cursor Bugbot. Or run Claude in your own GitLab CI/CD if you want Claude models.
• You're on Bitbucket or Azure DevOps: Cursor Bugbot has the broadest host support. Copilot covers Azure DevOps in public preview.
• Your developers already live in ChatGPT: Codex review is included in Plus and above with no separate SKU to procure.
• You want a dedicated security pass: Cursor Security Review, Codex Security Review (preview), or Copilot autofix for CodeQL alerts if you already have GitHub Code Security.

Many teams run two bots: a general reviewer and a security-focused one. If you do, make sure their rules files agree, and watch for duplicate comments that train developers to ignore both.

Why review bots raise the bar for human reviewers

It's tempting to read "AI reviews every PR" as "humans can review less." In practice the opposite happens. The bots are good at the first pass: logic errors, missed edge cases, injection paths, race conditions in a diff. That removes the easy findings from a human's queue and leaves the hard ones. Is this the right design? Does the change match the product intent? Is the bot's suggested fix actually correct, or confidently wrong? Should this PR merge at all?

Those calls need engineers who understand the system and know how to supervise AI output. They have to tell a real Important finding from a plausible false positive, write REVIEW.md and AGENTS.md rules that cut noise, and recognize when an AI-authored PR passed an AI review for the wrong reasons. Every vendor here deliberately leaves the merge decision with your team. That only works if your team has senior reviewers who can own it. Our guides on vetting AI-augmented developers and hiring AI-native engineers cover how to test for that skill.

FAQ

Is Claude Code Review available on Claude Pro or Max?

No. The managed Code Review service is for Team and Enterprise organizations. On any plan, you can run /code-review locally in a Claude Code session, or run Claude in your own CI with GitHub Actions or GitLab CI/CD using an API key.

Does Claude Code Review support GitLab?

Not as a managed service, as of October 2026. It supports GitHub, GitHub Enterprise Server and GHE Cloud with data residency. For GitLab, Anthropic documents running Claude in GitLab CI/CD.

How much does a Claude code review cost?

There's no flat price. Reviews are billed on token usage through usage credits, and cost scales with review level, PR size and code complexity. Run a pilot and read the per-repo average cost in admin settings. Older per-review figures from the research preview predate GA.

How many premium requests does a Copilot code review use?

On legacy annual Pro and Pro+ plans that stayed on premium-request billing after June 1, 2026, each review consumes 13 premium requests. Current Copilot billing uses AI credits plus Actions minutes instead, and GitHub estimates $0.05 to $1 per Lite review and $0.25 to $5 per Balanced review.

Can any of these bots approve and merge a PR?

No. Only Copilot's public-preview approvals option can satisfy a required-approval rule; see What none of them will do above.

Do these bots review draft PRs?

Claude's automatic reviews and Cursor Security Review skip drafts. Bugbot's draft reviews are off by default but can be enabled in personal settings. Copilot has an option to review drafts. You can request a Claude review on a draft with @claude review.

Sources

• Code Review is now generally available (Anthropic)
• Code Review documentation (Anthropic)
• Code Review costs and usage (Anthropic)
• Read and request reviews on a pull request (Anthropic)
• About Copilot code review (GitHub Docs)
• Copilot requests, legacy billing (GitHub Docs)
• Copilot code review: API support and new default effort level (GitHub Changelog)
• Copilot code review: new organization billing options and controls (GitHub Changelog)
• Agentic autofix for code scanning alerts GA (GitHub Changelog)
• Codex GitHub integration and code review (OpenAI)
• Codex GitLab integration, beta (OpenAI)
• Codex pricing (OpenAI)
• Security Review and Rollouts (Cursor changelog)
• Bugbot documentation (Cursor)
• Models and pricing (Cursor)
• OpenAI DevDay 2026 coverage (InfoQ)

If you're rolling out AI review and need senior engineers who can own the final call on AI-generated and AI-reviewed code, Codersera can help you extend your team with vetted remote developers who are experienced in supervising AI output.