# CodeRabbit Agent overview
Source: https://docs.coderabbit.ai/agent/index

CodeRabbit Agent brings AI-powered code investigation, planning, and action into the tools where your team already works.

<SlackBadge />

<DiscordBadge />

CodeRabbit Agent is an AI agent that works where your team already communicates. From a Slack message or a Discord channel, you can ask CodeRabbit to investigate your codebase, generate an implementation plan, and open a pull request — without switching to another tool.

The Agent understands your repositories, connected tools, and conversation history. It carries context across messages, retains knowledge over time, and lets multiple people steer the same task from the same thread.

## What the Agent can do

* **Investigate** — Browse repository context, trace features across merged PRs and issues, and cross-reference data from connected tools like Sentry, Datadog, or Linear.
* **Plan** — Generate a structured Coding Plan from a conversation thread and hand it off to a coding agent like Claude Code, Codex, or Cursor.
* **Act** — After the team agrees on a direction, ask CodeRabbit to prepare and open a pull request that incorporates the full conversation context.
* **Automate** — Schedule recurring tasks or trigger work from matching messages, so investigations and summaries run without manual prompting.

The Agent can also write [Skills](/agent/skills): reusable procedures that persist across sessions and guide future runs through established workflows.

## Available platforms

CodeRabbit Agent is available on two messaging platforms, targeting different audiences:

|                             | Agent for Slack                             | Agent for Discord                                                                                     |
| --------------------------- | ------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
| **Audience**                | Engineering teams and organizations         | Open-source communities and enabled GitLab Self-Hosted organizations                                  |
| **Repositories**            | Any repositories connected to the workspace | Eligible public GitHub Cloud repositories or repositories in enabled GitLab Self-Hosted organizations |
| **Availability**            | Early Access                                | Limited Availability                                                                                  |
| **Billing**                 | Billed separately by agent minutes          | Unpaid during launch, with usage caps                                                                 |
| **Pull request authorship** | Workspace-connected Git platform account    | Personal GitHub account or configured GitLab Self-Hosted credentials                                  |

## What's next

<CardGroup>
  <Card title="Durable skills" href="/agent/skills" icon="book-copy">
    Learn how the Agent writes, stores, and reuses procedures across sessions.
  </Card>

  <Card title="Agent for Slack" href="/slack-agent" icon="slack">
    Set up CodeRabbit Agent in your Slack workspace and start investigating, planning, and opening pull requests from Slack threads.
  </Card>

  <Card title="Agent for Discord" href="/discord-agent" icon="discord">
    Bring CodeRabbit into your community or organization's Discord server to investigate and contribute from public channels.
  </Card>
</CardGroup>


# Agent skills
Source: https://docs.coderabbit.ai/agent/skills

Learn how CodeRabbit Agent writes reusable procedures, stores them across sessions, and applies them to future work.

<EarlyAccessBadge />

An agent skill is a reusable procedure that CodeRabbit Agent writes for itself. A skill captures how to complete a repeatable task, including the steps, tools, checks, and output requirements that made the workflow successful.

Durable skills let the Agent reuse working procedures instead of reconstructing the same workflow in every conversation. They are useful for recurring operational tasks, team-specific processes, and multi-step work that benefits from a consistent sequence. A skill is the best tool when a job has multiple steps that must run in a particular order, or when it is a repetitive task that gets executed often and involves similar actions each time, such as triaging a class of incoming issues or running a standard release checklist.

## How to create a skill

You typically create a skill by asking the Agent to author one directly, for example after it works through a task you expect to repeat. The skill records the reusable process rather than the one-time result of the run. Skills persist across sessions, so a procedure remains available after the conversation or run that created it has ended.

<Frame>
  <img alt="CodeRabbit Agent authoring a durable skill" />
</Frame>

## Using a skill

In later runs, the Agent can invoke a stored skill automatically when a request matches its purpose, or you can explicitly ask the Agent to use a specific skill by name. The skill guides the Agent through the established procedure while the current conversation, repository, connected tools, and permissions provide the context for that specific run. Later runs include [automations](/slack-agent/automations), so scheduled or trigger-based recurring operational tasks can invoke the same stored skill as conversational runs.

### Skill availability in Slack

In Slack, durable skills follow the same privacy boundaries as durable facts.

| Slack surface                       | Skill availability                                                    |
| ----------------------------------- | --------------------------------------------------------------------- |
| Public channels and shared surfaces | Shared workspace skills are available across public-channel workflows |
| Private channels                    | Skills are isolated to that private conversation                      |
| DMs and group DMs                   | Skills are isolated to that DM or group DM                            |

<Info>
  Create the skill from the Slack surface where you intend to use it. Skills created in private channels, DMs, or group DMs are not available in public-channel workflows.
</Info>

## Viewing saved skills

Review saved skills in the web app under [**Slack** > **Knowledge base** > **Skills**](https://app.coderabbit.ai/slack/knowledge-base/skills), alongside the [durable facts](/slack-agent/knowledge-base) captured in the same workspace or private conversation.

Skills can be edited by asking CodeRabbit Agent in chat to update, correct, or remove the procedure.

## What's next

<CardGroup>
  <Card title="Automations" href="/slack-agent/automations" icon="repeat">
    Run saved skills on a schedule or in response to matching events.
  </Card>

  <Card title="Knowledge Base" href="/slack-agent/knowledge-base" icon="brain">
    Learn how durable facts give the Agent reusable knowledge alongside durable procedures.
  </Card>

  <Card title="CLI Skills" href="/cli/skills" icon="square-terminal">
    Install static SKILL.md packages for compatible coding agents.
  </Card>
</CardGroup>


# Audit Logs
Source: https://docs.coderabbit.ai/api-reference/audit-logs

get /v1/audit-logs
Returns a paginated list of organization-level audit log entries. Requires the Enterprise plan, Admin role, and a non-agentic API key.

<EnterprisePlanBadge />

Returns a paginated list of organization-level audit log entries. Use the `search`, `actions`, `resource_types`, `date_from`, and `date_to` query parameters to filter results. Unknown query parameters are rejected with a `400` error.

For a guided overview of the feature, see the [Audit Logs documentation](/management/audit-logs).


# Learnings
Source: https://docs.coderabbit.ai/api-reference/learnings-list

get /v1/learnings
Programmatic access to an organization's CodeRabbit learnings. Returns paginated JSON or a CSV download. Enterprise plan only. Mirrors the auth, rate-limit and response-size contract of the Metrics public API.

<EnterprisePlanBadge />

Programmatic access to an organization's CodeRabbit learnings. Returns paginated JSON or a CSV download. Use the `repository_ids`, `user_ids`, `organization_ids`, `limit`, and `cursor` query parameters to filter and paginate results.

## CSV Format

When using `format=csv`, the API returns a flat CSV structure with one row per learning. For the complete list of CSV columns and field descriptions, see [Data Export - Exported fields](/guides/data-export#exported-fields).

For a guided overview of learnings, see the [Learnings documentation](/knowledge-base/learnings).


# Metrics Data
Source: https://docs.coderabbit.ai/api-reference/metrics-data-api

get /v1/metrics/reviews
Access CodeRabbit metrics data programmatically via REST API.

<EnterprisePlanBadge />

Returns metrics for merged pull requests including complexity scores, review times, and comment breakdowns by severity and category.

## CSV Format

When using `format=csv`, the API returns a flat CSV structure with one row per pull request. The nested `coderabbit_comments` object is flattened into individual columns (e.g., `total_coderabbit_comments_posted`, `critical_comments_accepted`).

For the complete list of CSV columns and field descriptions, see [Data Export - Exported fields](/guides/data-export#exported-fields).


# Report generate
Source: https://docs.coderabbit.ai/api-reference/report-generate

post /api/v1/report.generate
DEPRECATED: Generate a developer activity report based on the provided parameters and date range. This endpoint may take up to 10 minutes to respond depending on the data volume.  Prompts cannot be used and this is only for testing purposes. We recommend creating a recurring report and triggering a preview via the UI instead.



# Create Role
Source: https://docs.coderabbit.ai/api-reference/roles-create

post /v1/roles
Creates an Enterprise custom role. If is_default is true, the new role becomes the subscription default and the previous default is cleared.

<EnterprisePlanBadge />

## Create Custom Role

Creates an Enterprise custom role. If `is_default` is true, the new role becomes the subscription default and the previous default is cleared.

You can either specify individual permissions or use `duplicate_from` to copy permissions from an existing role. When permissions are omitted and `duplicate_from` is not specified, permissions default to the `cr_member` role.

<Info>
  Requires **Admin** role. See [Role-based access](/management/roles) for details.
</Info>


# Delete Role
Source: https://docs.coderabbit.ai/api-reference/roles-delete

delete /v1/roles/{roleId}
Deletes an Enterprise custom role when it is not assigned to any organization members. System roles cannot be deleted.

<EnterprisePlanBadge />

## Delete Custom Role

Deletes an Enterprise custom role when it is not assigned to any organization members. System roles cannot be deleted.

<Info>
  Requires **Admin** role. See [Role-based access](/management/roles) for details.
</Info>


# Get Role
Source: https://docs.coderabbit.ai/api-reference/roles-get

get /v1/roles/{roleId}
Retrieves one built-in or Enterprise custom role.

<EnterprisePlanBadge />

## Get Role Details

Retrieves one built-in or Enterprise custom role. Use the `include_permissions` and `include_user_count` query parameters to include additional details in the response.

For more information, see [Role-based access](/management/roles).


# List Roles
Source: https://docs.coderabbit.ai/api-reference/roles-list

get /v1/roles
Lists built-in roles and Enterprise custom roles for the authenticated organization.

<EnterprisePlanBadge />

Lists built-in roles and Enterprise custom roles for the authenticated organization. Use the `role_type` query parameter to filter by role type, and include `permissions` or `user_count` in the response as needed.

For more information, see [Role-based access](/management/roles).


# Role permissions
Source: https://docs.coderabbit.ai/api-reference/roles-permissions

get /v1/roles/permissions
Lists the valid resource_id and access_type values that can be used when creating or updating Enterprise custom roles.

<EnterprisePlanBadge />

Lists the valid `resource_id` and `access_type` values that can be used when creating or updating Enterprise custom roles.

For more information, see [Role-based access](/management/roles).


# Update Role
Source: https://docs.coderabbit.ai/api-reference/roles-update

patch /v1/roles/{roleId}
Updates custom role metadata, permissions, or default status. System roles are immutable. Omitting is_default preserves the current default status; true clears any previous default; false unsets this role as default.

<EnterprisePlanBadge />

## Update Custom Role

Updates custom role metadata, permissions, or default status. System roles are immutable.

When updating `is_default`: omitting it preserves the current default status, `true` sets this role as default (clearing any previous default), and `false` unsets this role as default.

<Info>
  Requires **Admin** role. See [Role-based access](/management/roles) for details.
</Info>


# Assign roles
Source: https://docs.coderabbit.ai/api-reference/users-change-roles

post /v1/users/roles
Bulk change roles for up to 500 users. Returns partial success with details of which users succeeded or failed.

<EnterprisePlanBadge />

## Change User Roles

<Info>
  Requires **Admin** role. See [Role-based access](/management/roles) for details.
</Info>

<Info>
  **Self-hosted enterprise customers** using a workspace-wide API key can set `org_id` to `ALL` to apply the role change to every active organization on that instance. The write runs per organization and is not atomic, so a user is reported successful only if the change succeeds in every organization. Other key types and customers cannot use `ALL` and receive a `400` error.
</Info>


# Users
Source: https://docs.coderabbit.ai/api-reference/users-list

get /v1/users
List all users in your organization with optional filtering by seat assignment and role status. Supports cursor-based pagination.

<EnterprisePlanBadge />

## Users List

<Info>
  Requires **Admin** role. See [Role-based access](/management/roles) for details.
</Info>


# Seats
Source: https://docs.coderabbit.ai/api-reference/users-manage-seats

post /v1/users/seats
Bulk assign or unassign seats for up to 500 users. The request format depends on the type of API key used. **Organization and self-hosted instance API keys** address users by provider user ID with the `action` + `user_ids` format, where the `action` field determines the operation type. **Workspace API keys** address users by email or CodeRabbit user ID (`cr_user_id`) with the `members` format, where each entry declares its desired seat state via `seat_assigned`. Sending the `action` + `user_ids` format with a workspace API key (or the `members` format with an organization key) fails with an `INVALID_REQUEST` error.

<EnterprisePlanBadge />

## Manage Seats

<Info>
  Requires **Admin** role. See [Role-based access](/management/roles) for details.
</Info>

### Request format by API key type

The request body schema depends on the type of API key you authenticate with:

| API key type         | Request format        | Users addressed by    |
| -------------------- | --------------------- | --------------------- |
| Organization         | `action` + `user_ids` | Provider user ID      |
| Self-hosted instance | `action` + `user_ids` | Provider user ID      |
| Workspace            | `members`             | Email or `cr_user_id` |

<Warning>
  Workspace API keys do not accept the `action` + `user_ids` format — sending it fails with `INVALID_REQUEST: Invalid input: expected array, received undefined`. Use the `members` format instead, where each entry declares its desired seat state with `seat_assigned`.
</Warning>

```bash theme={null}
curl --request POST \
  --url 'https://api.coderabbit.ai/v1/users/seats' \
  --header 'x-coderabbitai-api-key: <workspace-api-key>' \
  --header 'content-type: application/json' \
  --data '{"members":[{"email":"user@example.com","seat_assigned":true}]}'
```

Each member entry is identified by `email` or `cr_user_id` (the `user_id` returned by [`GET /v1/users`](/api-reference/users-list)) — at least one is required, and `cr_user_id` takes precedence when both are provided. Use `cr_user_id` to address members who have no email; unknown IDs fail that entry with `USER_NOT_FOUND` in the response's `failed` array.


# Seat Assignment Mode
Source: https://docs.coderabbit.ai/api-reference/users-seat-assignment-mode

post /v1/users/seats/assignment
Update the seat assignment mode for the organization. Only accessible by fully self-hosted organizations with enterprise plans.

<EnterprisePlanBadge />

## Update Seat Assignment Mode

To retrieve the current seat assignment mode, use the [Users](/api-reference/users-list) endpoint. The seat assignment mode is included in the response.

<Info>
  Requires **Admin** role. See [Role-based access](/management/roles) for details.
</Info>

<Info>
  Only available for **fully self-hosted** organizations. See [Seat assignment](/management/seat-assignment) for details on assignment modes.
</Info>


# CodeRabbit API
Source: https://docs.coderabbit.ai/api/index

Authenticate with the CodeRabbit API and find endpoints for metrics, learnings, users, roles, and audit logs.

<EnterprisePlanBadge />

The CodeRabbit API provides programmatic access to review data and administrative operations. Use it to retrieve metrics and learnings, manage users and roles, or export audit logs.

## Base URL and authentication

Send API requests to `https://api.coderabbit.ai`. Authenticate with the `x-coderabbitai-api-key` header:

```bash theme={null}
curl "https://api.coderabbit.ai/v1/users" \
  -H "x-coderabbitai-api-key: $CODERABBIT_API_KEY"
```

The data and operations available to a request depend on the key's scope:

* **Organization-scoped API keys** are bound to one CodeRabbit organization.
* **Workspace API tokens** let Enterprise SSO workspace admins call supported endpoints across organizations in a workspace.
* **Self-hosted instance API keys** operate within a self-hosted CodeRabbit instance.

Review each endpoint's requirements before sending a request. Workspace API tokens have additional organization-scoping rules for some endpoints.

## Explore the API

<CardGroup>
  <Card title="Workspace API tokens" icon="key-round" href="/api/workspace-api-tokens">
    Create a workspace-scoped token and review its endpoint-specific request requirements.
  </Card>

  <Card title="Metrics and learnings" icon="chart-line" href="/api-reference/metrics-data-api">
    Retrieve pull request metrics and CodeRabbit learnings for reporting or analysis.
  </Card>

  <Card title="Users and seats" icon="users" href="/api-reference/users-list">
    List users, manage seats, and configure seat assignment.
  </Card>

  <Card title="Roles" icon="shield-check" href="/api-reference/roles-list">
    List, create, update, and assign roles.
  </Card>

  <Card title="Audit logs" icon="scroll-text" href="/api-reference/audit-logs">
    Export administrative activity for security and compliance workflows.
  </Card>
</CardGroup>

## What's next

<CardGroup>
  <Card title="Create a workspace API token" href="/api/workspace-api-tokens" icon="key-round">
    Set up one token for supported APIs across an Enterprise SSO workspace.
  </Card>

  <Card title="Open the API reference" href="/api-reference/metrics-data-api" icon="braces">
    Review endpoint parameters, request bodies, and response schemas.
  </Card>
</CardGroup>


# Workspace API tokens
Source: https://docs.coderabbit.ai/api/workspace-api-tokens

Create and use workspace-scoped API tokens for Enterprise SSO workspaces.

<EnterprisePlanBadge />

Workspace API tokens let Enterprise SSO workspace admins use one token across every organization in the workspace for supported public APIs.

## Availability

Workspace API tokens are available only in Enterprise SSO workspaces. Open **Workspace Settings** > **API Tokens** or go to `/workspace/api-keys` in the CodeRabbit app.

Only workspace admins can create, list, or delete workspace API tokens. Non-admin workspace members cannot manage tokens, and CodeRabbit re-checks workspace admin access every time a workspace token is used.

## Create a token

<Steps>
  <Step title="Open Workspace API Tokens">
    In the CodeRabbit app, open **Workspace Settings** > **API Tokens**.
  </Step>

  <Step title="Create the token">
    Choose **Create API token**, enter a name, and select an expiration date.
  </Step>

  <Step title="Copy the token">
    Copy the token value immediately. CodeRabbit shows the token only once.
  </Step>
</Steps>

Use the token with the `x-coderabbitai-api-key` header:

```bash theme={null}
curl "https://api.coderabbit.ai/v1/users" \
  -H "x-coderabbitai-api-key: $CODERABBIT_WORKSPACE_API_KEY"
```

## Supported APIs

Workspace API tokens are supported on these public APIs:

| API                                                          | Workspace token behavior                                                                                                    |
| ------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------- |
| [`GET /v1/users`](/api-reference/users-list)                 | Omit `org_id` for a workspace-wide people view, or pass `org_id` to return users for one organization.                      |
| [`POST /v1/users/seats`](/api-reference/users-manage-seats)  | Manage seats workspace-wide by email address. Do not pass `org_id`.                                                         |
| [`POST /v1/users/roles`](/api-reference/users-change-roles)  | Pass `org_id` in the request body to select the target organization.                                                        |
| [`/v1/roles`](/api-reference/roles-list)                     | Pass `org_id` in the query string for `GET` and `DELETE` requests, and in the request body for `POST` and `PATCH` requests. |
| [`GET /v1/audit-logs`](/api-reference/audit-logs)            | Omit `org_id` for workspace-wide audit logs, or pass `org_id` to scope the result to one organization.                      |
| [`GET /v1/metrics/reviews`](/api-reference/metrics-data-api) | Omit `org_id` for workspace-wide review metrics, or pass `org_id` to scope the result to one organization.                  |
| [`GET /v1/learnings`](/api-reference/learnings-list)         | Omit `org_id` for learnings across the workspace, or pass `org_id` to scope the result to one organization.                 |

## Organization scoping with `org_id`

`org_id` is the Git provider organization ID for an organization inside the token's workspace. It controls which organization a workspace token targets:

* **Endpoints that require `org_id`** (`POST /v1/users/roles` and the `/v1/roles` operations) act on the single organization you name. CodeRabbit returns `400` when a required `org_id` is omitted, `404` when the ID does not match an active organization in the workspace, and `403` when the token owner is no longer a workspace admin.
* **Endpoints that omit `org_id`** (users, seats, audit logs, review metrics, and learnings) operate workspace-wide across every organization. Pass `org_id` on the read endpoints to scope the result to one organization instead.

Other key types treat `org_id` differently:

* **Organization-scoped API keys** remain bound to their authenticated organization and ignore `org_id`.
* **Self-hosted instance API keys** ignore `org_id` on the workspace-token read and custom-role endpoints above. The one exception is `POST /v1/users/roles`, which accepts a self-hosted-only `"ALL"` sentinel—see [Assign roles](/api-reference/users-change-roles) for details.

## What's next

<CardGroup>
  <Card title="Review the API reference" href="/api-reference/users-list" icon="braces">
    Explore request parameters and response schemas for the supported public APIs
  </Card>

  <Card title="Manage custom roles" href="/management/custom-roles" icon="shield-check">
    Define role permissions for organizations in your Enterprise SSO workspace
  </Card>

  <Card title="Review audit logs" href="/management/audit-logs" icon="scroll-text">
    Track administrative activity across the workspace
  </Card>
</CardGroup>


# Claude Code integration
Source: https://docs.coderabbit.ai/cli/claude-code-integration

AI-powered code review in Claude Code through the CodeRabbit plugin. Let AI code, review, and fix issues autonomously without human intervention.

## Autonomous AI development workflows

The CodeRabbit plugin for Claude Code creates autonomous AI development workflows. Claude Code can trigger CodeRabbit reviews directly through simple commands, enabling you to build features, run code reviews, and fix issues without manual intervention.

This integration makes AI coding more independent, with built-in quality gates that catch issues before they reach production.

<Info>
  This guide covers integrating CodeRabbit CLI with Claude Code. For standalone
  CLI usage, see [CLI overview](/cli/).
</Info>

<Warning>
  **Windows users:** Claude Code requires WSL (Windows Subsystem for Linux) to
  run on Windows. See our [WSL on Windows guide](/cli/wsl-windows) for setup
  instructions before proceeding with this integration.
</Warning>

CodeRabbit analyzes your code changes and surfaces specific issues, then Claude Code applies fixes based on CodeRabbit's context-rich feedback.

## Why integrate these tools

<CardGroup>
  <Card title="Expert issue detection" icon="search">
    CodeRabbit spots race conditions, memory leaks, and logic errors that generic linters miss. Same pattern recognition that powers our PR reviews.
  </Card>

  <Card title="AI-powered fixes" icon="wand">
    Claude Code implements fixes with full context from CodeRabbit's analysis.
    Complex architectural changes handled intelligently.
  </Card>

  <Card title="Context preservation" icon="brain">
    CodeRabbit provides Claude Code with succinct context about issues,
    including location, severity, and suggested approaches.
  </Card>

  <Card title="Continuous workflow" icon="refresh-cw">
    Stay in development flow - run reviews, apply fixes, and iterate without switching tools or losing mental context.
  </Card>
</CardGroup>

## Video demo

See CodeRabbit CLI in action with Claude Code:

<iframe title="YouTube video player" />

## Installation

<Steps>
  <Step title="Install Claude Code">
    Install Claude Code following the platform-specific instructions. Ensure you can launch Claude Code from your terminal.
  </Step>

  <Step title="Install and authenticate CodeRabbit CLI">
    Install and authenticate the CodeRabbit CLI:

    <CodeGroup>
      ```bash Installation script theme={null}
      curl -fsSL https://cli.coderabbit.ai/install.sh | sh
      ```

      ```bash Homebrew theme={null}
      brew install coderabbit
      ```
    </CodeGroup>

    ```bash Authenticate theme={null}
    coderabbit auth login
    ```

    A browser window opens automatically. Sign in to CodeRabbit and the authentication completes in the browser.

    If you belong to multiple CodeRabbit organizations, the sign-in choice sets your default org only. Review attribution still depends on the current repository. See [Organization selection](/cli#organization-selection).
  </Step>

  <Step title="Install CodeRabbit plugin">
    In Claude Code, install the plugin using one of these methods:

    <CodeGroup>
      ```bash Claude Code theme={null}
      /plugin install coderabbit
      ```

      ```bash Command-line interface theme={null}
      claude plugin install coderabbit
      ```
    </CodeGroup>
  </Step>

  <Step title="Verify installation">
    The plugin will automatically verify your CodeRabbit CLI installation and authentication when first used. You can also test it with:

    ```bash theme={null}
    /coderabbit:review
    ```
  </Step>
</Steps>

## Usage

### Running code reviews

Use the [`/coderabbit:review`](#usage) command to trigger a review:

```bash theme={null}
/coderabbit:review
```

The command will:

* Verify CLI installation and authentication
* Run the code review
* Present findings grouped by severity

### Review options

Customize your review with these options:

```bash theme={null}
/coderabbit:review                    # Review tracked changes
/coderabbit:review committed          # Only committed changes
/coderabbit:review uncommitted        # Staged and tracked local edits
/coderabbit:review --include-untracked # Include raw untracked files
/coderabbit:review --base main        # Compare against main branch
```

### Natural language interface

You can also trigger reviews using natural language:

* "Review my code"
* "Check for security issues"
* "What's wrong with my changes?"

Claude Code will automatically invoke the CodeRabbit plugin to perform the review.

## Integration workflow

### Use CodeRabbit as part of building new features

<Steps>
  <Step title="Request implementation + review">
    Ask Claude Code to implement a feature and run a CodeRabbit review:

    ```text Sample prompt wrap theme={null}
    Please implement phase 7.3 of the planning doc and then review it with CodeRabbit. Fix any issues that are found.
    ```

    Key components:

    * **Implement the feature**: Claude codes the requested functionality
    * **Run CodeRabbit review**: Uses the plugin to analyze code
    * **Fix issues**: Claude addresses all problems CodeRabbit identifies
  </Step>

  <Step title="Claude implements and triggers review">
    Claude Code:

    1. Implements the requested feature
    2. Runs `/coderabbit:review` through the plugin
    3. Waits for the analysis to complete
  </Step>

  <Step title="CodeRabbit analysis and task creation">
    When CodeRabbit completes, Claude Code:

    1. Receives the review findings with file locations and severity
    2. Creates a task list addressing each issue
    3. Shows you the planned fixes before implementing them
  </Step>

  <Step title="Automated issue resolution">
    Claude Code systematically works through the task list, implementing fixes for each CodeRabbit finding. The cycle continues until all critical issues are resolved.
  </Step>
</Steps>

### Example: API integration implementation

This example shows the workflow implementing a webhook handler for payment processing:

<Steps>
  <Step title="Start implementation">
    ```bash theme={null}
    # Working on payment webhook feature
    git checkout -b feature/payment-webhooks
    ```
  </Step>

  <Step title="Run integrated workflow">
    Tell Claude Code to implement and review:

    ```
    Implement the payment webhook handler from the spec document.
    Then review it with CodeRabbit and fix any issues.
    ```
  </Step>

  <Step title="CodeRabbit analysis">
    CodeRabbit analyzes the webhook code and identifies issues:

    * Missing signature verification
    * Race conditions in payment state updates
    * Insufficient error handling for network failures
    * Webhook replay attack vulnerabilities
  </Step>

  <Step title="Claude Code fixes">
    Claude Code automatically applies fixes:

    * Adds HMAC signature verification
    * Implements database transactions for state consistency
    * Adds retry logic with exponential backoff
    * Includes idempotency key handling
  </Step>

  <Step title="Verification">
    The workflow continues until all critical issues are resolved. Claude Code
    reports completion.
  </Step>
</Steps>

## Advanced usage

### CLI review commands

When running the CodeRabbit CLI directly outside the plugin, use the review command that best fits your workflow:

```bash theme={null}
# Agent mode - structured JSON output for agent workflows
coderabbit --agent

# Default mode - detailed terminal output
coderabbit review

# Lighter local review policy
coderabbit --light
```

| Command             | Best for                                                              |
| ------------------- | --------------------------------------------------------------------- |
| `--agent`           | Claude Code and other agent integrations that consume structured data |
| `coderabbit review` | Human-readable terminal output during manual workflows                |
| `--light`           | Lighter local review for active development work                      |

The `/coderabbit:review` plugin command uses the appropriate mode automatically.

### Reviewing specific changes

Review only uncommitted changes:

```bash theme={null}
/coderabbit:review uncommitted
```

Review only committed changes:

```bash theme={null}
/coderabbit:review committed
```

### Comparing against different branches

Compare your changes against a specific branch:

```bash theme={null}
/coderabbit:review --base develop
/coderabbit:review --base master
```

### Combining with natural language

You can combine natural language requests with specific review options:

```
Review my uncommitted changes for security issues
```

Claude Code will interpret this and run the appropriate [`/coderabbit:review`](#usage) command with the correct options.

## Configuration

### Configure CodeRabbit for Claude Code

Pass your Claude context file with `coderabbit review -c CLAUDE.md` so CodeRabbit can include how code reviews should run, your coding standards, and architectural preferences.

<Info>This is a Pro paid plan feature.</Info>

## Troubleshooting

### Plugin not found

If the plugin isn't available:

1. **Verify marketplace access**: Ensure you've added the marketplace:
   ```bash theme={null}
   /plugin marketplace add coderabbitai/claude-plugin
   ```
2. **Check plugin installation**: Verify the plugin is installed:
   ```bash theme={null}
   /plugin list
   ```
3. **Reinstall if needed**: Remove and reinstall the plugin:
   ```bash theme={null}
   /plugin uninstall coderabbit
   /plugin install coderabbit
   ```

### CLI not authenticated

If you see authentication errors:

1. **Check CLI authentication**: Run `coderabbit auth status` in your terminal
2. **Re-authenticate**: Run `coderabbit auth login` to refresh your credentials
3. **Verify CLI installation**: Ensure the CLI is in your PATH and accessible from Claude Code's environment

### CodeRabbit not finding issues

If CodeRabbit isn't detecting expected issues:

1. **Check git status**: CodeRabbit analyzes tracked changes by default. Run `git status` to verify the scope; brand-new untracked files require `--include-untracked`.
2. **Specify review scope**: Use options to target specific changes:
   * [`/coderabbit:review uncommitted`](#reviewing-specific-changes) - staged and tracked local edits
   * [`/coderabbit:review committed`](#reviewing-specific-changes) - only committed changes
3. **Specify base branch**: If your main branch isn't `main`, use:
   * [`/coderabbit:review --base develop`](#comparing-against-different-branches)
   * [`/coderabbit:review --base master`](#comparing-against-different-branches)
4. **Review file types**: CodeRabbit focuses on code files, not docs or configuration

### Claude Code not applying fixes

If Claude Code isn't implementing CodeRabbit's suggestions:

1. **Provide explicit context**: Tell Claude Code to "fix the issues found by CodeRabbit" explicitly
2. **Check review completion**: Ensure the review has finished before asking for fixes
3. **Review findings manually**: Ask Claude to "show me the CodeRabbit findings" to verify they were received
4. **Iterate on specific issues**: Ask Claude to focus on fixing specific issues one at a time

### Review taking too long

CodeRabbit reviews may take 7 to 30+ minutes depending on the scope of changes:

1. **Review smaller changesets**: Adjust what you're reviewing to reduce analysis time:
   * Use [`/coderabbit:review uncommitted`](#reviewing-specific-changes) to review only uncommitted changes
   * Work on smaller feature branches compared to main
   * Break large features into smaller, reviewable chunks
2. **Configure the diff scope**: Control what changes are analyzed:
   * **Review uncommitted changes only**: Use the `uncommitted` option to analyze staged and tracked local edits
   * **Configure base branch**: Use `--base` to set the comparison point
   * **Use feature branches**: Work on focused feature branches instead of large staging branches

<Note>
  The integration creates a more thorough review process than either tool alone.
  Expect comprehensive analysis that catches issues that would otherwise reach
  production.
</Note>


# Use with self-hosted CodeRabbit
Source: https://docs.coderabbit.ai/cli/cli-with-self-hosted-CodeRabbit

Connect the CLI to your self-hosted CodeRabbit instance

Configure the CodeRabbit CLI to work with your organization’s self-hosted CodeRabbit instance. This setup gives you all the benefits of AI-powered code reviews while maintaining full control over your code and data.

## **Prerequisites**

Before connecting to your self-hosted instance, ensure:

<CardGroup>
  <Card title="CLI version" icon="download">
    CodeRabbit CLI version 0.3.5 or higher installed
  </Card>

  <Card title="Clean setup" icon="log-out">
    Log out of the extension if you were previously connected to the managed
    service (`coderabbit auth logout`)
  </Card>
</CardGroup>

## **Connect your self-hosted instance**

<Steps>
  <Step title="Install CLI">
    Download and install the CodeRabbit CLI to start reviewing code locally.

    <CodeGroup>
      ```bash Installation script theme={null}
      curl -fsSL https://cli.coderabbit.ai/install.sh | sh
      ```

      ```bash Homebrew theme={null}
      brew install coderabbit
      ```
    </CodeGroup>
  </Step>

  <Step title="Restart your shell">
    After installation, restart your shell or reload your shell configuration.

    ```bash theme={null}
    # Restart your shell or run:
    source ~/.zshrc
    ```
  </Step>

  <Step title="Authenticate">
    Link your CodeRabbit account to enable personalized reviews based on your team's patterns.

    ```bash theme={null}
    coderabbit auth login --self-hosted
    ```

    This is going to ask you for more details in the further steps.
  </Step>

  <Step title="Select your Git provider">
    Select the Git provider from the list using arrow keys to connect the CLI with.
  </Step>

  <Step title="Enter your self-hosted CodeRabbit url">
    Provide your self-hosted CodeRabbit's url: "your-self-hosted-coderabbit-url/". Verify the url validation.
  </Step>

  <Step title="Complete sign-in in the browser">
    A browser window opens automatically. Sign in via your Git provider and the authentication completes in the browser.
  </Step>
</Steps>


# Codex integration
Source: https://docs.coderabbit.ai/cli/codex-integration

AI-powered code review in Codex through the CodeRabbit plugin. Let AI code, review, and fix issues autonomously without human intervention.

## Get continuous code review with Codex

The CodeRabbit plugin for Codex creates autonomous AI development workflows. Codex can trigger CodeRabbit reviews directly through natural-language prompts, enabling you to build features, run code reviews, and fix issues without manual context switching.

This integration makes AI coding more independent, with built-in quality gates that catch issues before they reach production.

<Info>
  This guide covers using the CodeRabbit plugin with Codex. For standalone CLI
  usage, see [CLI overview](/cli/index).
</Info>

CodeRabbit analyzes your code changes and surfaces specific issues, then Codex applies fixes based on that review context.

## Why integrate these tools

<CardGroup>
  <Card title="Expert issue detection" icon="search-code">
    CodeRabbit spots race conditions, memory leaks, and logic errors that generic linters miss. Get the same pattern recognition that powers our PR reviews.
  </Card>

  <Card title="AI-powered fixes" icon="wand-sparkles">
    Codex implements fixes with full context from CodeRabbit's analysis. Complex architectural changes handled intelligently.
  </Card>

  <Card title="Context preservation" icon="brain">
    The plugin keeps review context inside Codex so findings can be turned into follow-up fixes without re-explaining the problem.
  </Card>

  <Card title="Continuous workflow" icon="refresh-cw">
    Stay in development flow - run reviews, apply fixes, and iterate without switching tools or losing mental context.
  </Card>
</CardGroup>

## Installation

<Steps>
  <Step title="Install Codex">
    Install Codex following the [platform-specific instructions](https://developers.openai.com/codex/cli). Ensure you can launch Codex from your terminal.
  </Step>

  <Step title="Install and authenticate CodeRabbit CLI">
    Install and authenticate the CodeRabbit CLI:

    <CodeGroup>
      ```bash Installation script theme={null}
      curl -fsSL https://cli.coderabbit.ai/install.sh | sh
      ```

      ```bash Homebrew theme={null}
      brew install coderabbit
      ```
    </CodeGroup>

    ```bash Authenticate theme={null}
    coderabbit auth login
    ```

    A browser window opens automatically. Sign in to CodeRabbit and the authentication completes in the browser.

    If you belong to multiple CodeRabbit organizations, the sign-in choice sets your default org only. Review attribution still depends on the current repository. See [Organization selection](/cli#organization-selection).
  </Step>

  <Step title="Install CodeRabbit plugin">
    <Tabs>
      <Tab title="Codex app">
        Open the [plugin marketplace](https://developers.openai.com/codex/plugins), search for `coderabbit`, and install the CodeRabbit plugin.
      </Tab>

      <Tab title="Codex CLI">
        Open the [plugin directory](https://developers.openai.com/codex/plugins#plugin-directory-in-the-cli) inside Codex using the `/plugins` command, then search for `coderabbit` and install the CodeRabbit plugin.

        ```text theme={null}
        /plugins
        ```
      </Tab>
    </Tabs>

    <Info>
      If the plugin does not appear immediately after installation, reload or restart Codex so it refreshes the local plugin catalog.
    </Info>
  </Step>

  <Step title="Verify installation">
    Ask Codex to run a CodeRabbit review:

    ```text theme={null}
    Review my current changes with CodeRabbit
    ```

    The plugin will verify your CodeRabbit CLI installation and authentication when first used.
  </Step>
</Steps>

## Usage

### Running code reviews

<Tabs>
  <Tab title="Natural language">
    Use natural language to trigger the plugin from Codex:

    ```text theme={null}
    Review my current changes with CodeRabbit
    ```
  </Tab>

  <Tab title="@ mention">
    Type `@` to invoke the plugin or one of its bundled skills explicitly. Use this when you want to be specific about which plugin or skill Codex should use.

    ```text theme={null}
    @coderabbit Review my current changes
    ```
  </Tab>
</Tabs>

The plugin will:

* verify CLI installation and authentication
* run the review
* summarize the diff first
* report how many findings CodeRabbit found
* present findings with severity, file path, impact, and recommended fix direction

Customize your review by being explicit about scope:

```text theme={null}
Review my committed changes with CodeRabbit
Review my uncommitted changes with CodeRabbit
Review this branch against main with CodeRabbit
Check my branch for security issues with CodeRabbit
What are the highest-risk issues in these changes?
```

For brand-new untracked files, ask Codex to include the `--include-untracked` flag when it runs CodeRabbit.

For longer reviews, Codex should wait quietly for completion rather than narrating intermediate polling or processing states.

## Integration workflow

### Use CodeRabbit while building new features

<Steps>
  <Step title="Request implementation + review">
    Ask Codex to implement a feature and run a CodeRabbit review:

    ```text Sample prompt wrap theme={null}
    Please implement phase 7.3 of the planning doc and then review it with CodeRabbit. Fix any issues that are found.
    ```

    Key components:

    * **Implement the feature**: Codex codes the requested functionality
    * **Run CodeRabbit review**: Uses the plugin to analyze code
    * **Fix issues**: Codex addresses the problems CodeRabbit identifies
  </Step>

  <Step title="Codex implements and triggers review">
    Codex:

    1. Implements the requested feature
    2. Runs the CodeRabbit plugin review flow
    3. Waits for the analysis to complete
  </Step>

  <Step title="CodeRabbit analysis and task creation">
    When CodeRabbit completes, Codex:

    1. Summarizes the changes in the diff
    2. Reports how many findings were found
    3. Works through each finding with severity, file path, impact, and fix direction
  </Step>

  <Step title="Automated issue resolution">
    Codex systematically works through the findings, implementing fixes and iterating until the important issues are resolved.
  </Step>
</Steps>

## Advanced usage

### CLI review commands

When running the CodeRabbit CLI directly outside the plugin, use the review command that best fits your workflow:

```bash theme={null}
# Agent mode - structured JSON output for agent workflows
coderabbit review --agent

# Human-readable review output
coderabbit review

# Lighter local review policy
coderabbit review --light

# Review only committed changes
coderabbit review --committed

# Review staged and tracked local edits
coderabbit review --uncommitted

# Also review files not added to Git
coderabbit review --include-untracked
```

| Command                     | Best for                                               |
| --------------------------- | ------------------------------------------------------ |
| `coderabbit review --agent` | Agent workflows and structured output consumers        |
| `coderabbit review`         | Human-readable terminal output during manual workflows |
| `coderabbit review --light` | Lighter local review for active development work       |

The Codex plugin chooses the appropriate review flow automatically, so direct CLI usage is mainly useful for debugging or manual review.

### Configure CodeRabbit for Codex

CodeRabbit automatically reads your `AGENTS.md` file, so you can add context there on how code reviews should run, your coding standards, and architectural preferences.

<Info>This is a Pro paid plan feature.</Info>

## Remove or turn off a plugin

To remove the CodeRabbit plugin, reopen it from the plugin browser and select **Uninstall plugin**.

<Info>
  Uninstalling the plugin removes the plugin bundle from Codex, but the CodeRabbit CLI remains installed and continues to work independently.
</Info>

To keep the plugin installed but disable it temporarily, set its entry in `~/.codex/config.toml` to `enabled = false`, then restart Codex.

## Troubleshooting

### Plugin not found

If the plugin isn't available:

1. **Reload Codex**: Restart or reload Codex after installation so it refreshes the plugin catalog
2. **Check plugin installation**: Confirm `CodeRabbit` appears in the Codex plugin marketplace and is enabled
3. **Reinstall if needed**: Remove and reinstall the plugin from the marketplace

### CLI not authenticated

If you see authentication errors:

1. **Check CLI authentication**: Run `coderabbit auth status --agent`
2. **Re-authenticate**: Run `coderabbit auth login --agent`
3. **Verify CLI installation**: Ensure the CLI is in your PATH and accessible from Codex's environment

### CodeRabbit not finding issues

If CodeRabbit isn't detecting expected issues:

1. **Check git status**: CodeRabbit analyzes tracked changes by default. Run `git status` to verify the scope; brand-new untracked files require `--include-untracked`.
2. **Specify review scope**: Ask Codex to review committed, uncommitted, or base-branch changes explicitly
3. **Review file types**: CodeRabbit focuses on code files, not docs or configuration
4. **Run the CLI directly**: Use `coderabbit review` if you want to inspect findings outside the plugin flow

### Review taking too long

CodeRabbit reviews may take several minutes depending on the scope of changes:

1. **Review smaller changesets**: Work on focused branches and smaller diffs
2. **Limit the scope**: Ask Codex to review only committed or uncommitted changes
3. **Set the right base branch**: Be explicit when your comparison point is not `main`
4. **Let the review finish**: Long-running reviews are expected; the plugin should wait quietly rather than reporting intermediate polling states

<Info>
  The integration creates a more thorough review process than either tool alone.
</Info>

## What's next

<CardGroup>
  <Card title="Claude Code integration" href="/cli/claude-code-integration" icon="bot">
    Compare the Codex plugin flow with the Claude Code plugin workflow and command surface.
  </Card>

  <Card title="Command-Line Review Tool" href="/cli/index" icon="terminal">
    Use the standalone CodeRabbit CLI directly when you want manual review workflows outside Codex.
  </Card>

  <Card title="CodeRabbit Skills" href="/cli/skills" icon="wand-sparkles">
    Explore the skill-based integration path for other AI coding agents that support Skills.
  </Card>
</CardGroup>


# Cursor integration: run CodeRabbit CLI reviews in your IDE
Source: https://docs.coderabbit.ai/cli/cursor-integration

Configure Cursor to run the CodeRabbit CLI on generated code, then automatically review, fix, and iterate on issues as part of an autonomous AI workflow.

<Info>
  This guide covers integrating CodeRabbit CLI with Cursor. For standalone CLI
  usage, see [CLI overview](/cli/).
</Info>

## Autonomous AI development workflows

CodeRabbit CLI + Cursor allows you to develop faster with code that gets reviewed for issues before it reaches the PR. Because Cursor executes CodeRabbit directly as part of its steps, code that gets made by Cursor can automatically be reviewed by CodeRabbit. Ask Cursor to implement a feature, run a code review, and fix any issues, as a natural part of agentic development.

## Video demo

<iframe title="CodeRabbit CLI + Cursor integration demo" />

## Why integrate these tools

<CardGroup>
  <Card title="Expert issue detection" icon="search">
    CodeRabbit spots race conditions, memory leaks, and logic errors that
    generic linters miss. Same pattern recognition that powers our PR reviews.
  </Card>

  <Card title="AI-powered fixes" icon="wand">
    Cursor implements fixes with full context from CodeRabbit's analysis.
    Complex architectural changes are handled intelligently.
  </Card>

  <Card title="Context preservation" icon="brain">
    CodeRabbit's `--agent` mode gives Cursor structured findings with file
    locations, severity, and suggested approaches.
  </Card>

  <Card title="Agentic development loop" icon="refresh-cw">
    Run a better agentic development loop - AI codes, runs reviews, applies
    fixes, and iterates before you even look at the code.
  </Card>
</CardGroup>

## Prerequisites

<Warning>
  **Windows users:** The CodeRabbit CLI requires WSL (Windows Subsystem for
  Linux) to run on Windows. See our [WSL on Windows guide](/cli/wsl-windows) for
  setup instructions before proceeding with this integration.
</Warning>

<Steps>
  <Step title="Install Cursor">
    Install Cursor and set up an account if needed.
  </Step>

  <Step title="Install CodeRabbit CLI">
    Install the CodeRabbit CLI globally on your system:

    <CodeGroup>
      ```bash Installation script theme={null}
      curl -fsSL https://cli.coderabbit.ai/install.sh | sh
      ```

      ```bash Homebrew theme={null}
      brew install coderabbit
      ```
    </CodeGroup>

    Restart your shell:

    ```bash theme={null}
    source ~/.zshrc
    ```
  </Step>

  <Step title="Authenticate CodeRabbit">
    Create an account or log in to CodeRabbit if you already have one by running this command in your terminal:

    ```
    coderabbit auth login
    ```

    A browser window opens automatically. Sign in to CodeRabbit and the authentication completes in the browser.

    If you belong to multiple CodeRabbit organizations, the sign-in choice sets your default org only. Review attribution still depends on the current repository. See [Organization selection](/cli#organization-selection).

    <Info>
      Free accounts get a limited set of reviews per hour, and less comprehensive reviews. Pro accounts get higher review limits, and more robust reviews. See [coderabbit.ai/pricing](https://www.coderabbit.ai/pricing) for more details.
    </Info>
  </Step>

  <Step title="Verify auth">
    Verify authentication was successful by running in your terminal:

    ```
    Run: coderabbit auth status
    ```

    Success shows your login status and confirms everything is set correctly.
  </Step>

  <Step title="Test that Cursor can run CodeRabbit">
    Open up the chat interface in Cursor (Command +L) and prompt it:

    ```text wrap theme={null}
    Let's verify you can run the CodeRabbit CLI. Run the terminal command: coderabbit auth status and tell me the output.
    ```

    Because prompts and agents are non-deterministic, meaning every response will vary, and we can't predict with certainty every outcome, sometimes Cursor (and other agents) will try to install CodeRabbit as a package, or try to run other commands to determine what CodeRabbit is. In this case, it's recommended that you create a Cursor Rule, covered in the step below.
  </Step>

  <Step title="Setup a Cursor Rule for CodeRabbit">
    Learn more about Cursor rules in their [documentation](https://cursor.com/docs/context/rules). Create a Cursor rule by running the Cursor rule command from the chat `@rule`. Enter this prompt or modify it to fit your development preferences:

    ```text wrap theme={null}
      # Running the CodeRabbit CLI

      CodeRabbit is already installed in the terminal. Run it as a way to review your code. Run the command: cr -h for details on commands available. In general, I want you to run coderabbit with the `--agent` flag. To review staged and tracked local edits (this is what we'll use most of the time), run: `coderabbit review --agent --uncommitted`.

      IMPORTANT: When running CodeRabbit to review code changes, don't run it more than 3 times in a given set of changes.
    ```
  </Step>
</Steps>

## Integration workflow

### Use CodeRabbit as part of building new features

<Steps>
  <Step title="Request implementation + review">
    Ask Cursor to implement a feature and run CodeRabbit, analyze the suggestions and apply fixes:

    ```
    Please implement phase 7.3 of the planning doc and then run coderabbit review --agent --uncommitted,
    let it run as long as it needs and fix any issues.
    ```

    Key components:

    * **Implement the feature**: Cursor codes the requested functionality
    * **Run CodeRabbit**: Uses `--agent` for structured findings Cursor can process directly
    * **Review uncommitted changes**: Uses `--uncommitted` so CodeRabbit reviews staged and tracked local edits instead of committed branch changes
    * **Fix issues**: Cursor addresses all problems CodeRabbit identifies. You can also tell it to fix critical issues and ignore nits.
  </Step>

  <Step title="Cursor implements and runs CodeRabbit">
    Cursor: 1. Implements the requested feature 2. Runs `coderabbit review --agent --uncommitted` 3. Waits, reviews may take anywhere from 7-30 minutes depending on the amount of changes.
  </Step>

  <Step title="CodeRabbit analysis and task creation">
    When CodeRabbit completes, Cursor: 1. Reads the `--agent` output (structured JSON for agent workflows) 2. Creates a task list addressing each issue CodeRabbit surfaced 3. Shows you the planned fixes before implementing them
  </Step>

  <Step title="Automated issue resolution">
    Cursor systematically works through the task list, implementing fixes for each CodeRabbit finding. The cycle continues until all issues are resolved or the limit of 3 times is reached which we set on a rule earlier.
  </Step>
</Steps>

### Example: API integration implementation

This example shows the workflow implementing a webhook handler for payment processing:

<Steps>
  <Step title="Start implementation">
    ```bash theme={null}
    # Working on payment webhook feature
    git checkout -b feature/payment-webhooks
    ```
  </Step>

  <Step title="Run integrated workflow">
    Tell Cursor to implement and review:

    ```
    Implement the payment webhook handler from the spec document.
    Then run coderabbit review --agent --uncommitted, review the suggestions then fix any critical issues. Ignore nits.
    ```
  </Step>

  <Step title="CodeRabbit analysis">
    CodeRabbit analyzes the webhook code and identifies issues: - Missing signature verification - Race conditions in payment state updates - Insufficient error handling for network failures - Webhook replay attack vulnerabilities
  </Step>

  <Step title="Cursor fixes">
    Cursor automatically applies fixes: - Adds HMAC signature verification - Implements database transactions for state consistency - Adds retry logic with exponential backoff - Includes idempotency key handling
  </Step>

  <Step title="Verification">
    The workflow continues until all critical issues are resolved or a set number of loops is reached. Cursor reports completion.
  </Step>
</Steps>

## Optimization tips

### Review commands for agent integration

When running CodeRabbit for agent use, choose the review command that best fits your workflow:

```bash theme={null}
# Structured JSON output
coderabbit review --agent

# Human-readable review output
coderabbit review

# Lighter local review policy
coderabbit review --light

# Review only committed changes
coderabbit review --committed

# Review staged and tracked local edits
coderabbit review --uncommitted

# Also review files not added to Git
coderabbit review --include-untracked
```

| Command                     | Best for                                                         |
| --------------------------- | ---------------------------------------------------------------- |
| `coderabbit review --agent` | Cursor and other agent integrations that consume structured JSON |
| `coderabbit review`         | Human-readable terminal output during manual workflows           |
| `coderabbit review --light` | Lighter local review for active development work                 |

Both output formats include specific file locations, problem descriptions, and suggested fix approaches.

### Configure CodeRabbit for Cursor

Pass Cursor guideline files with `coderabbit review -c .cursorrules .cursor/rules/team.mdc` so CodeRabbit can include how code reviews should run, your coding standards, and architectural preferences.

<Info>This is a Pro paid plan feature.</Info>

## Troubleshooting

### CodeRabbit not finding issues

If CodeRabbit isn't detecting expected issues:

1. **Check authentication status**: Run `coderabbit auth status`. Reviews require authentication through `coderabbit auth login` or an API key.
2. **Verify git status**: CodeRabbit analyzes tracked changes by default. Check `git status`; brand-new untracked files require `--include-untracked`.
3. **Choose a review scope**:
   * `coderabbit review` - tracked changes
   * `coderabbit review --uncommitted` - staged changes and tracked local edits
   * `coderabbit review --committed` - only committed changes
   * `coderabbit review --include-untracked` - also include files not added to Git
4. **Specify base branch**: If your main branch isn't `main`, use `--base`:
   * `coderabbit review --base develop`
   * `coderabbit review --base master`
5. **Review file types**: CodeRabbit focuses on code files, not docs or configuration

### Managing review duration

CodeRabbit reviews may take 7 to 30+ minutes depending on the scope of changes:

1. **Ensure background execution**: Configure Cursor to run CodeRabbit in the background so you can continue working
2. **Review smaller changesets**: Adjust what you're reviewing to reduce analysis time:
   * Use `--uncommitted` to review only staged and tracked local edits
   * Work on smaller feature branches compared to main
   * Break large features into smaller, reviewable chunks
3. **Configure the diff scope**: Control what changes are analyzed:
   * **Review uncommitted changes only**: Use `--uncommitted` to analyze staged and tracked local edits
   * **Configure base branch**: Use `--base develop` or `--base main` to set the comparison point
   * **Use feature branches**: Work on focused feature branches instead of large staging branches

<Info>
  The integration creates a more thorough review process than either tool alone.
</Info>


# Gemini integration
Source: https://docs.coderabbit.ai/cli/gemini-integration

Enable Gemini to execute CodeRabbit directly in your development workflow. Let AI code, review, and fix issues autonomously without human intervention.

## Overview

Use CodeRabbit with Google's Gemini CLI in a full agentic loop. Code with Gemini, review the changes with CodeRabbit, and fix the issues with Gemini. In this quick guide, you'll learn how to prompt Gemini, what CodeRabbit commands to run, and what to add to your Gemini.md file.

## Video demo

<iframe title="CodeRabbit CLI + Gemini integration demo" />

## Prerequisites

<Steps>
  <Step title="Install the Gemini CLI">
    Install the Gemini CLI following the [platform-specific instructions](https://geminicli.com/). Log in, and check that you can launch Gemini from your terminal.
  </Step>

  <Step title="Install CodeRabbit CLI">
    Install the CodeRabbit CLI globally on your system:

    <CodeGroup>
      ```bash Installation script theme={null}
      curl -fsSL https://cli.coderabbit.ai/install.sh | sh
      ```

      ```bash Homebrew theme={null}
      brew install coderabbit
      ```
    </CodeGroup>

    Restart your shell:

    ```bash Terminal command wrap theme={null}
    source ~/.zshrc
    ```
  </Step>

  <Step title="Log into CodeRabbit">
    Log into CodeRabbit by running the following command in your terminal:

    ```bash theme={null}
    coderabbit auth login
    ```

    A browser window opens automatically. Sign in to CodeRabbit and the authentication completes in the browser.

    If you belong to multiple CodeRabbit organizations, the sign-in choice sets your default org only. Review attribution still depends on the current repository. See [Organization selection](/cli#organization-selection).

    <Tip>
      Authentication persists across Gemini instances - you only need to do this once per machine.
    </Tip>
  </Step>

  <Step title="Verify authentication">
    Test that login was successful by running the following command in your terminal:

    ```bash Terminal command wrap theme={null}
    coderabbit auth status
    ```

    Success shows your login status and confirms you're logged into CodeRabbit.
  </Step>
</Steps>

## Use CodeRabbit as part of building new features

<Steps>
  <Step title="CodeRabbit usage instructions for Gemini CLI">
    Add the following to your Gemini.md file:

    ```Text Prompt for Gemini.md file wrap theme={null}
    Run the CodeRabbit CLI with `coderabbit review --agent --uncommitted`. It's a long running task and may take up to 30 minutes. Check every 2 minutes if it's complete and once it's done review and validate critical fixes and recommended fixes, while ignoring nits or unnecessary changes. Then fix those and run CodeRabbit again. You can run this loop up to 3 times. Let the user know the outcomes.
    ```

    Feel free to customize the prompt to your needs. In general you want to convey:

    * How to run CodeRabbit, i.e. using the `--agent` flag and that it's a CLI tool already installed.
    * That it's a long running task and may take a while. Otherwise it may time out.
    * Any guidelines for how you want Gemini to review and implement the changes. i.e. fix only critical issues.
    * Some agents run CodeRabbit multiple times, so let them know the total number of times it should run.
  </Step>

  <Step title="Request implementation + review">
    Ask Gemini to implement a feature and run CodeRabbit analysis with issue fixes:

    ```Text Prompt for Gemini wrap theme={null}
    Please implement phase 7.3 of the planning doc and then run CodeRabbit
    ```

    <Tip> Because we added how to run CodeRabbit to your Gemini.md file, Gemini should run it correctly, but it's non-deterministic, so you may need to remind it to reference the Gemini.md file for the instructions.</Tip>
  </Step>

  <Step title="Agentic step: Gemini implements feature and runs CodeRabbit">
    Gemini: 1. Implements the requested feature 2. Runs `coderabbit review --agent`
    3\. Checks CodeRabbit's progress periodically
  </Step>

  <Step title="Agentic step: CodeRabbit analysis and task creation">
    When CodeRabbit completes, Gemini:

    1. Reads the `--agent` output
    2. Reviews the issues CodeRabbit surfaced
    3. Implements the fixes
  </Step>

  <Step title="Agentic step: Loops to stop or resolution">
    Gemini will run CodeRabbit again to verify the fixes and to make sure no other issues were introduced. This loop will continue until all critical issues are resolved or the loop limit is reached.
  </Step>
</Steps>

## Optimization tips

### Review commands for agent integration

When running CodeRabbit for agent use, choose the review command that best fits your workflow:

```bash theme={null}
# Structured JSON output
coderabbit review --agent

# Human-readable review output
coderabbit review

# Lighter local review policy
coderabbit review --light

# Review only committed changes
coderabbit review --committed

# Review staged and tracked local edits
coderabbit review --uncommitted

# Also review files not added to Git
coderabbit review --include-untracked
```

| Command                     | Best for                                                         |
| --------------------------- | ---------------------------------------------------------------- |
| `coderabbit review --agent` | Gemini and other agent integrations that consume structured JSON |
| `coderabbit review`         | Human-readable terminal output during manual workflows           |
| `coderabbit review --light` | Lighter local review for active development work                 |

Both output formats include specific file locations, problem descriptions, and suggested fix approaches.

### Configure CodeRabbit for Gemini

Pass your Gemini context file with `coderabbit review -c GEMINI.md`. Add context on how code reviews should run, your coding standards, and architectural preferences. Note this feature is only available on the Pro paid plan.

## Troubleshooting

### CodeRabbit not finding issues

If CodeRabbit isn't detecting expected issues:

1. **Check authentication status**: Run `coderabbit auth status`. Reviews require authentication through `coderabbit auth login` or an API key.
2. **Verify git status**: CodeRabbit analyzes tracked changes by default. Check `git status`; brand-new untracked files require `--include-untracked`.
3. **Choose a review scope**:
   * `coderabbit review` - tracked changes
   * `coderabbit review --uncommitted` - staged changes and tracked local edits
   * `coderabbit review --committed` - only committed changes
   * `coderabbit review --include-untracked` - also include files not added to Git
4. **Specify base branch**: If your main branch isn't `main`, use `--base`:
   * `coderabbit review --base develop`
   * `coderabbit review --base master`
5. **Review file types**: CodeRabbit focuses on code files, not docs or configuration

### Managing review duration

CodeRabbit reviews may take 7 to 30+ minutes depending on the scope of changes:

1. **Ensure background execution**: Configure Gemini to run CodeRabbit in the background so you can continue working
2. **Review smaller changesets**: Adjust what you're reviewing to reduce analysis time:
   * Use `--uncommitted` to review only staged and tracked local edits
   * Work on smaller feature branches compared to main
   * Break large features into smaller, reviewable chunks
3. **Configure the diff scope**: Control what changes are analyzed:
   * **Review uncommitted changes only**: Use `--uncommitted` to analyze staged and tracked local edits
   * **Configure base branch**: Use `--base develop` or `--base main` to set the comparison point
   * **Use feature branches**: Work on focused feature branches instead of large staging branches


# Headless CLI integration
Source: https://docs.coderabbit.ai/cli/headless-cli-integration

Authenticate CodeRabbit CLI non-interactively in headless and bot-driven environments using an Agentic API key. Use this flow in CI runners, remote bots, or any automation pipeline where browser-based sign-in is not available.

## Before you start

<Steps>
  <Step title="Confirm plan access">
    The non-interactive API-key flow requires an **Agentic API key** from a CodeRabbit organization where the user has an assigned seat. CLI reviews use the assigned user's plan allowance first.

    Enable the [Usage-based Add-on](/management/usage-based-addon) if you want eligible over-limit reviews to continue with usage credits after the plan allowance is exhausted.
  </Step>

  <Step title="Create an Agentic API key">
    Go to [API Keys](https://app.coderabbit.ai/settings/api-keys) in the CodeRabbit dashboard and generate an **Agentic API key** for the organization that should power your CLI reviews.

    API-key authentication always uses that key's organization for billing and review behavior. Browser-based organization selection does not apply in this mode.
  </Step>

  <Step title="Store the key as a secret">
    Save the key in your automation platform as a secret such as `CODERABBIT_API_KEY`, then expose it as an environment variable wherever your automation runs.
  </Step>

  <Step title="Install the CodeRabbit CLI">
    Make the CLI available in the environment using your preferred install method.

    <CodeGroup>
      ```bash Installation script theme={null}
      curl -fsSL https://cli.coderabbit.ai/install.sh | sh
      ```

      ```bash Homebrew theme={null}
      brew install coderabbit
      ```
    </CodeGroup>
  </Step>
</Steps>

## Headless setup

<Tabs>
  <Tab title="Single command">
    Pass the key directly to the command:

    ```bash theme={null}
    coderabbit review --api-key "$CODERABBIT_API_KEY"
    ```
  </Tab>

  <Tab title="Authenticate first (chain of commands)">
    Authenticate once so that all later commands reuse the stored key automatically:

    ```bash theme={null}
    coderabbit auth login --api-key "$CODERABBIT_API_KEY"
    ```

    Verify authentication:

    <CodeGroup>
      ```bash Plain terminal output theme={null}
      coderabbit auth status
      ```

      ```bash Agent-readable checks theme={null}
      coderabbit auth status --agent
      ```
    </CodeGroup>
  </Tab>
</Tabs>

## Common automation patterns

Use `--agent` when another tool needs structured output:

```bash theme={null}
coderabbit review --agent
```

Plain-text output is the default. Use the default review command when you want readable logs in the workflow output:

```bash theme={null}
coderabbit review
```

If your workflow edits code in place and wants feedback on staged and tracked local edits, use `--uncommitted`.

```bash theme={null}
coderabbit review --uncommitted
```

If your workflow creates new files without staging them, add `--include-untracked`.

```bash theme={null}
coderabbit review --uncommitted --include-untracked
```

If your workflow compares a branch against a base branch, set the base explicitly:

```bash theme={null}
coderabbit review --agent --base main
```

`cr` is the short alias for `coderabbit`, so `cr review --agent` and `coderabbit review --agent` work the same way.

If the review scope has no file changes, the CLI exits cleanly. In `--agent` mode the `complete` event has `status: "review_skipped"` and `findings: 0`.

## Troubleshooting

<AccordionGroup>
  <Accordion title="User API key rejected">
    If authentication fails with a message saying user API keys are not supported, generate an **Agentic API key** instead. The CLI validates the key before storing it locally and rejects unsupported key types.
  </Accordion>

  <Accordion title="No stored API key found">
    If a later review step says no stored API key was found, make sure the `coderabbit auth login --api-key` step ran successfully earlier in the same environment and that the secret was exposed to that step.
  </Accordion>
</AccordionGroup>

## What's next

<CardGroup>
  <Card title="Usage-based Add-on" href="/management/usage-based-addon" icon="badge-dollar-sign">
    Enable credits, manage billing, and understand how CLI reviews consume usage
  </Card>

  <Card title="CLI Command Reference" href="/cli/reference" icon="terminal">
    Review authentication commands, review modes, and CLI options
  </Card>

  <Card title="Codex integration" href="/cli/codex-integration" icon="bot">
    Combine headless CLI authentication with Codex-driven implementation and review loops
  </Card>
</CardGroup>


# Command-Line Review Tool
Source: https://docs.coderabbit.ai/cli/index

Get AI code reviews directly in your CLI before you commit. Catch race conditions, memory leaks, and security vulnerabilities without leaving your development environment.

<OpenBetaBadge />

## Review local changes

The CodeRabbit CLI analyzes local Git changes using the same pattern recognition that powers our PR reviews. By default, it reviews tracked changes: committed changes, staged changes (including new files added with `git add`), and unstaged edits to tracked files. Use `--uncommitted` to review only staged and tracked local edits. Files not added to Git are skipped unless you pass `--include-untracked`.

```bash theme={null}
coderabbit review                       # Tracked changes
coderabbit review --committed           # Only committed changes
coderabbit review --uncommitted         # Staged and tracked local edits
coderabbit review --include-untracked    # Also review files not added to Git
```

## Key features

<Card title="Review local changes" icon="code">
  Catch bugs before they reach your repository. CodeRabbit scans committed and uncommitted Git changes for race conditions, null pointer exceptions, and logic errors.
</Card>

<Card title="Apply fixes in one step" icon="wand-sparkles">
  Fix simple issues like missing imports or syntax errors instantly. For complex architectural problems, send the full context directly to your AI coding agent.
</Card>

<Card title="Context-aware reviews" icon="brain">
  Paid plans unlock reviews powered by your team's codebase history: error handling conventions, architectural patterns, and coding preferences applied automatically to every review.
</Card>

<Card title="Install agent skills" icon="wand-sparkles" href="/cli/skills">
  Run `coderabbit skills` to preview and install or update verified CodeRabbit skills for supported coding agents.
</Card>

## Getting started

<Steps>
  <Step title="Install CLI">
    Download and install the CodeRabbit CLI using your preferred method.

    <CodeGroup>
      ```bash Installation script theme={null}
      curl -fsSL https://cli.coderabbit.ai/install.sh | sh
      ```

      ```bash Homebrew theme={null}
      brew install coderabbit
      ```
    </CodeGroup>

    After installation, restart your shell or reload your shell configuration:

    ```bash theme={null}
    source ~/.zshrc
    ```
  </Step>

  <Step title="Authenticate">
    Link your CodeRabbit account to enable personalized reviews based on your team's patterns.

    ```bash theme={null}
    # cr is the short alias for coderabbit — both work identically
    cr auth login
    ```

    A browser window opens automatically. Sign in to CodeRabbit and the authentication completes in the browser.

    If your account has access to multiple CodeRabbit organizations, choose your default organization during sign-in. That choice sets the login/default org for browser-based auth, but CLI reviews still resolve the current repository first. You can change the default later with `cr auth org`.

    If browser sign-in is blocked or unavailable, authenticate with an Agentic API key instead:

    ```bash theme={null}
    cr auth login --api-key "cr-************"
    ```

    API-key authentication uses the key's organization and is also the recommended flow for headless or bot-driven environments. Reviews use the assigned user's plan allowance first, then usage credits only for eligible over-limit reviews when the usage-based add-on is enabled.
  </Step>

  <Step title="Review your code">
    Analyze your Git repository for issues using the CodeRabbit CLI.

    <Info>
      **Git repository required**: The CLI must be run from within an initialized Git repository. The `--dir` flag changes the review directory, but that directory must also contain a Git repository.
    </Info>

    ```bash wrap theme={null}
    cr
    ```

    If your main branch is not `main`, specify your base branch:

    ```bash theme={null}
    cr --base develop
    # or for other base branches
    cr --base master
    ```

    CodeRabbit scans the selected Git changes and provides specific feedback with suggested fixes.
  </Step>

  <Step title="Verify local setup">
    If setup, authentication, or review startup fails, run the local diagnostics command:

    ```bash theme={null}
    cr doctor
    ```

    The command checks installation, local storage, authentication, Git repository state, and CodeRabbit service connectivity.
  </Step>

  <Step title="Apply suggestions">
    Review findings in your terminal and either apply quick fixes or send complex issues to your AI coding agent.
  </Step>
</Steps>

## Organization selection

The active CodeRabbit organization is the login/default org for browser-based CLI auth. It is used when the current repository resolves to that org, but it is not a silent billing fallback for unrelated local repositories.

During a review, CodeRabbit resolves the current repository first:

* If the repository matches the selected org, the review uses that org.
* If the repository matches a different org you can access, CodeRabbit switches attribution to that org.
* If the repository matches an installed public repo but you do not have access to the owning org, the review uses OSS behavior.
* If the repository cannot be matched to an installed accessible repo, the CLI falls back to limited/free review behavior until CodeRabbit is installed for that repo or org.

To change organizations later, run:

```bash theme={null}
cr auth org
```

`cr auth org` opens sign-in automatically if your local session is missing or expired. Organization switching is not available for self-hosted mode or API key authentication.

## Review modes

The CLI uses plain-text, human-readable output by default, with agent output and an optional lighter policy also available:

```bash theme={null}
# Default mode - detailed plain-text feedback with fix suggestions
coderabbit review

# Agent mode - structured JSON output for Skills and agent integrations
cr --agent

# Faster local review policy
cr review --light
```

The default plain-text mode displays a finding count and severity summary at the end of each run. No output flag is required. If the CLI detects a known agent environment, it suggests re-running with `--agent` for structured JSON output.

## Diagnostics

Run `cr doctor` at any time to verify your local setup. The command checks:

* CLI runtime and version
* Local CodeRabbit storage directory
* Authentication state and auth environment
* Current Git repository and branch metadata
* Auto-update policy
* CodeRabbit backend reachability
* CodeRabbit WebSocket reachability

```bash theme={null}
cr doctor
```

`cr doctor` exits with status code `1` when any check fails. Warnings appear in the report but do not cause a non-zero exit code.

## Review statistics

Use `cr stats` to inspect your review statistics from local review history:

```bash theme={null}
# Show stats (builds on first run)
cr stats

# Rebuild stats by rescanning review history
cr stats --rebuild
```

## Working with review results

CodeRabbit analyzes your code and surfaces specific issues with actionable suggestions. Each finding includes the problem location, explanation, and recommended fix.

Example findings include:

* **Race condition detected**: "This goroutine accesses shared state without proper locking"
* **Memory leak potential**: "Stream not closed in error path - consider using defer"
* **Security vulnerability**: "SQL query uses string concatenation - switch to parameterized queries"
* **Logic error**: "Function returns nil without checking error condition first"

### Browse and apply suggestions

In plain mode, read each finding in the terminal output and apply the suggested change in your editor or coding agent.

For simple issues like missing imports, syntax errors, or formatting problems, use the suggested fix directly. For larger changes, use `cr review --agent` so your coding agent can consume structured findings.

### Use AI coding agents

For AI agent integration, see the [AI agent integration](#ai-agent-integration) section for detailed workflow guidance and integration guides.

### Replay stored findings

Run `cr review findings` to read results from the most recent local review that produced findings, without re-running the full analysis. This is useful in multi-step agent loops where a downstream step needs to consume results from a prior review.

### Inspect AI prompts

Run `cr review --show-prompts` to print the AI prompts saved from the most recent local review without triggering a new review. Useful for tuning `--config` instructions or understanding why the model flagged a particular finding.

## AI agent integration

CodeRabbit detects the problems, then your AI coding agent implements the fixes.

<Info>
  **Claude Code users**: Claude Code now supports CodeRabbit through a native
  plugin. See the [Claude Code integration guide](/cli/claude-code-integration)
  for the recommended plugin-based setup using `/coderabbit:review` instead of
  the CLI commands shown below.
</Info>

### Integration guides

See detailed workflows for AI coding agents and workflows:

<Card title="CodeRabbit Skills" icon="wand-sparkles" href="/cli/skills">
  Run `coderabbit skills` to install agent-native Skills and trigger reviews with an explicit request such as "Run a CodeRabbit review."
</Card>

<CardGroup>
  <Card title="Claude Code integration" icon="bot" href="/cli/claude-code-integration">
    Automated workflow with background execution and task-based fixes
  </Card>

  <Card title="Codex integration" icon="terminal" href="/cli/codex-integration">
    Integrated code review and fix implementation with Codex CLI
  </Card>
</CardGroup>

<Card title="Headless CLI integration" icon="workflow" href="/cli/headless-cli-integration">
  Authenticate CodeRabbit non-interactively in GitHub Actions and other bot-driven automation
</Card>

### Example prompt for your AI agent

Here's a complete prompt you can use with Cursor, Codex, or other AI coding agents:

```text Sample prompt wrap theme={null}
Please implement phase 7.3 of the planning doc and then run cr --agent, let it run as long as it needs (run it in the background) and fix any issues.
```

### Components of a good prompt

Breaking down what makes an effective CodeRabbit + AI agent workflow:

<AccordionGroup>
  <Accordion title="1. Run CodeRabbit CLI">
    Tell your AI agent to run CodeRabbit with the `--agent` flag:

    ```bash theme={null}
    cr --agent
    ```

    You can also specify a review scope or base branch:

    ```bash theme={null}
    # Review staged and tracked local edits
    cr review --agent --uncommitted

    # With specific base branch
    cr --agent --base develop
    ```
  </Accordion>

  <Accordion title="2. Run in the background">
    CodeRabbit reviews can take 7-30+ minutes depending on the scope of changes. Instruct your AI agent to run CodeRabbit in the background and set up a timer to check periodically:

    ```text Prompt wrap theme={null}
    Run cr review --agent --uncommitted in the background, let it take as long as it needs, and check on it periodically.
    ```
  </Accordion>

  <Accordion title="3. Evaluate and implement fixes">
    Once CodeRabbit completes, have your AI agent evaluate the findings and prioritize:

    ```text Prompt wrap theme={null}
    Evaluate the fixes and considerations. Fix major issues only, or fix any critical issues and ignore the nits.
    ```

    This keeps your agent focused on meaningful improvements rather than minor style issues. If the `complete` event has `status: "review_skipped"`, there were no file changes in scope.
  </Accordion>

  <Accordion title="4. Verify with a second pass">
    Run CodeRabbit one more time to ensure fixes didn't introduce new issues:

    ```text Prompt wrap theme={null}
    Once those changes are implemented, run cr --agent one more time to make sure we addressed all the critical issues and didn't introduce any additional bugs.
    ```
  </Accordion>

  <Accordion title="5. Set loop limits">
    Prevent infinite iteration by setting clear completion criteria:

    ```text Prompt wrap theme={null}
    Only run the loop twice. If on the second run you don't find any critical issues, ignore the nits and you're complete. Give me a summary of everything that was completed and why.
    ```

    This ensures your AI agent completes the task efficiently and provides a clear report.
  </Accordion>
</AccordionGroup>

## Pricing and capabilities

See the [rate limits table on the Plans and pricing page](/management/plans#rate-limits) for current per-plan limits. To increase the limits, consider upgrading your plan or using the [Usage-based Add-on](#cli-with-usage-based-add-on).

<CardGroup>
  <Card title="Free tier" icon="heart">
    Basic static analysis with limited daily usage. Catches syntax errors, logic issues, and security vulnerabilities. Eligible Free users may see a Pro+ trial prompt after sign-in or when a CLI review reaches the rate limit.
  </Card>

  <Card title="Paid plans" icon="crown">
    Enhanced reviews powered by learnings from your CodeRabbit organization plus higher rate limits and more files per review. Paid users reviewing repositories connected to that organization get:

    * **Learnings-powered reviews**: Remembers your team's preferred patterns for error handling, state management, and architecture
    * **Full contextual analysis**: Understands your imports, dependencies, and project structure
    * **Team standards enforcement**: Applies your documented coding guidelines automatically
    * **Advanced issue detection**: Spots subtle race conditions, performance bottlenecks, and security vulnerabilities
  </Card>

  <Card title="Usage-based Add-On (Pay-as-you-Go)" icon="badge-dollar-sign">
    Continues eligible CodeRabbit CLI reviews after rate limits

    * Assigned-seat users use their plan allowance first
    * Credits are charged only for eligible over-limit reviews
    * Full control over usage and scaling through the dashboard
    * Flexible purchase options (one-time & monthly subscription)
  </Card>
</CardGroup>

Contact [sales@coderabbit.ai](mailto:sales@coderabbit.ai) for custom rate limits or enterprise needs.

## CLI with Usage-based Add-on

The usage-based add-on lets eligible CodeRabbit CLI reviews continue after the applicable review limit is reached. Authenticated CLI and agentic API-key reviews use the assigned user's plan allowance first. Credits are charged only when a review continues over that limit. Each reviewed file in the over-limit review costs **\$0.25** in credits. You can purchase credits as a one-time top-up or a recurring monthly subscription from the [Subscription and Billing](https://app.coderabbit.ai/settings/subscription) dashboard.

<Steps>
  <Step title="Enable the add-on and buy credits">
    Go to **[Subscription and Billing](https://app.coderabbit.ai/settings/subscription)** and open the **Usage-based add-on** tab to enable pay-as-you-go and purchase credits.

    For full setup details, see [Manage your subscription](/management/usage-based-addon).
  </Step>

  <Step title="Create an Agentic API key">
    Navigate to the [API Keys](https://app.coderabbit.ai/settings/api-keys) section and generate your **Agentic API key**. The key should be used by a user with an assigned CodeRabbit seat so CLI reviews can use the seat allowance first and usage credits only after the review is rate-limited.
  </Step>

  <Step title="Authenticate with your API key">
    You can pass `--api-key KEY` to any command directly, but if you plan to make multiple calls, it is more convenient to authenticate once with your CodeRabbit API key:

    ```bash theme={null}
    coderabbit auth login --api-key "cr-************"
    ```

    For GitHub Actions and other non-interactive environments, see [Headless CLI integration](/cli/headless-cli-integration).
  </Step>

  <Step title="Run a CodeRabbit review">
    After logging in, prompt your agent to run a CodeRabbit CLI review without passing the API key again:

    ```bash theme={null}
    coderabbit review
    ```

    If plan allowance is available, no usage credits are consumed. If the review is rate-limited, the add-on can continue the review only when pay-as-you-go is enabled, credits are available, and the review is attributed to an assigned-seat user.
  </Step>
</Steps>

## Command reference

See the [CLI Command Reference](/cli/reference) for a complete list of commands and options.

## Uninstall

Remove CodeRabbit CLI based on how you installed it.

```bash If installed using install script theme={null}
rm $(which coderabbit)
```

```bash If installed using Homebrew theme={null}
brew remove coderabbit
```


# CLI Command Reference
Source: https://docs.coderabbit.ai/cli/reference

Complete reference for all CodeRabbit CLI commands and options.

## Commands

`cr` is the short alias for `coderabbit`. Both work identically — use whichever fits your workflow.

| Command                     | Description                                                                                                                                                              |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `cr`                        | Run code review in non-interactive plain text mode (default)                                                                                                             |
| `cr --agent`                | Output structured JSON for agent-driven workflows                                                                                                                        |
| `cr review --light`         | Request a lighter CLI review for active local development                                                                                                                |
| `cr auth`                   | Authentication commands                                                                                                                                                  |
| `cr auth login`             | Authenticate via browser OAuth, [self-hosted](/cli/cli-with-self-hosted-CodeRabbit) (`--self-hosted`), or [API key](/cli/headless-cli-integration) (`--api-key "<key>"`) |
| `cr auth logout`            | Log out from CodeRabbit                                                                                                                                                  |
| `cr auth status`            | Show current authentication status                                                                                                                                       |
| `cr auth org`               | Choose or switch the login/default organization for browser-based auth                                                                                                   |
| `cr config validate [file]` | Validate CodeRabbit YAML syntax and settings against the current official schema                                                                                         |
| `cr stats`                  | Show review statistics                                                                                                                                                   |
| `cr doctor`                 | Check the CLI installation, local storage, authentication, Git repository state, update policy, and service connectivity                                                 |
| `cr review`                 | AI-driven code reviews with plain text or agent output                                                                                                                   |
| `cr review findings`        | Show review comments stored locally for the current review context                                                                                                       |
| `cr skills`                 | Install or update verified CodeRabbit skills for supported coding agents                                                                                                 |
| `cr update`                 | Check for and install the latest CLI version                                                                                                                             |

## Review modes

| Mode                       | Description                                                        |
| -------------------------- | ------------------------------------------------------------------ |
| Default (no flag required) | Detailed plain text feedback in the terminal                       |
| `--agent`                  | Structured JSON output for coding agents and automation            |
| `--light`                  | Faster local review policy for feedback on active development work |

## Review scope

`cr review` reviews tracked changes by default: committed changes, staged changes (including new files added with `git add`), and unstaged edits to tracked files.

| Command                         | Files reviewed                                          |
| ------------------------------- | ------------------------------------------------------- |
| `cr review`                     | Tracked changes                                         |
| `cr review --committed`         | Only committed changes                                  |
| `cr review --uncommitted`       | Staged changes and unstaged edits to tracked files      |
| `cr review --include-untracked` | Tracked changes plus non-ignored files not added to Git |

<Info>
  New files are included once staged with `git add`. To review them before staging, use `--include-untracked`. You can combine it with `--uncommitted`, but not with `--committed`. Contradictory scope flags, such as `--committed` with `--uncommitted`, are rejected before a review starts.
</Info>

## `--agent` review output

`cr review --agent` writes one JSON object per line to `stdout`. Read the stream line by line and handle events by their `type`.

Finding events use these fields:

| Field                 | Description                                                                 |
| --------------------- | --------------------------------------------------------------------------- |
| `type`                | Always `finding` for review results                                         |
| `severity`            | One of: `critical`, `major`, `minor`, `trivial`, `info`                     |
| `fileName`            | File path for the finding                                                   |
| `codegenInstructions` | Agent-oriented fix instructions                                             |
| `suggestions`         | Suggested fix commands or snippets                                          |
| `comment`             | Human-readable review comment, included when `codegenInstructions` is empty |

Other event types in the stream include `review_context`, `status`, `heartbeat`, `complete`, and `error`.

`heartbeat` events are periodic keep-alive signals — reset timeout timers on receipt and otherwise ignore them. For `finding` events, use `codegenInstructions` for agent fix logic and fall back to `comment` when it is absent.

When the selected review scope is skipped because it contains too many files, the review fails with an `error` event. The event can include these optional, additive fields:

| Field            | Description                                                                                                                                                                                                                                                                                                                                                                                         |
| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `candidates`     | Mutually exclusive narrower-scope suggestions computed from the submitted files. Suggestions can use `--committed`, `--uncommitted`, or up to five `--dir` scopes, and include an estimated local file count and a fit indicator relative to the server-reported limit. The estimate is intentionally conservative, so a candidate marked over the limit may still fit after server-side filtering. |
| `candidatesNote` | Guidance that accompanies the narrower-scope suggestions.                                                                                                                                                                                                                                                                                                                                           |

These fields do not change the existing error contract, so integrations do not need to handle them. Candidates are alternatives, not an automatic partition of the full change set. The CLI does not select a candidate or retry the review. The user or agent must choose one suggestion and rerun the narrower command manually.

In plain mode, the same failure can print a **Narrower scopes found in this diff** block with concrete commands, estimated file counts, and fit indicators. The CLI does not increase the limit, split the review, or retry automatically; choose one command and rerun it manually.

When the selected review scope has no file changes, `cr review --agent` still emits the `review_context` event, then emits a `status` event with `status: "review_skipped"` and a `complete` event with `status: "review_skipped"`, `findings: 0`, and `message: "No changes detected"`. Plain mode prints a no-changes message and exits without starting a review.

## Diagnostics

Run `cr doctor` when installation, authentication, or review startup fails. The command checks:

* CLI runtime and version
* Local CodeRabbit storage directory
* Authentication state and auth environment
* Current Git repository and branch metadata
* Auto-update policy
* CodeRabbit backend reachability
* CodeRabbit WebSocket reachability

`cr doctor` exits with status code `1` when any check fails. Warnings are shown in the report, but they do not cause a non-zero exit code.

## Configuration validation

Use `cr config validate` to check a CodeRabbit YAML file before committing or deploying it.

```bash theme={null}
# Validate .coderabbit.yaml or .coderabbit.yml at the repository root
cr config validate

# Validate a specific file
cr config validate path/to/config.yaml
```

Without a file argument, the command finds the Git repository root and checks `.coderabbit.yaml`, then `.coderabbit.yml`. With a file argument, it validates that path instead.

The command checks YAML syntax first, then fetches the [current official schema](https://www.coderabbit.ai/integrations/schema.v2.json) and validates the parsed configuration. Errors identify the affected line, configuration path, and expected value when available.

| Exit code | Meaning                                                                                                                 |
| --------- | ----------------------------------------------------------------------------------------------------------------------- |
| `0`       | The file is valid against the current schema                                                                            |
| `1`       | The file is missing or unreadable, contains invalid YAML or settings, or the current schema could not be loaded or used |

For browser-based validation, use the [interactive YAML validator](/configuration/yaml-validator).

## Skills command

Run `cr skills` in an interactive terminal to install or update CodeRabbit skills for detected Codex, Claude Code, Cursor, Gemini CLI, and GitHub Copilot setups. The command verifies the latest published skills release, previews every planned path and change, and asks once for confirmation with **No** selected by default.

```bash theme={null}
cr skills
```

The command has no installation flags or subcommands. Non-interactive invocations do not write files. It preserves externally managed ownership, leaves unsafe or ambiguous conflicts unchanged, and reports project-level copies without modifying them. See [CodeRabbit Skills](/cli/skills) for installation and ownership details.

## Stats command

| Command              | Description                             |
| -------------------- | --------------------------------------- |
| `cr stats`           | Show stats (builds on first run)        |
| `cr stats --rebuild` | Rescan review history and rebuild stats |

## Agent-friendly auth commands

| Command                  | Description                                                                                           |
| ------------------------ | ----------------------------------------------------------------------------------------------------- |
| `cr auth login --agent`  | Browser-based OAuth login with structured JSON events for agents                                      |
| `cr auth logout --agent` | Log out with structured JSON events for agents                                                        |
| `cr auth status --agent` | Return authentication status as structured JSON                                                       |
| `cr auth org --agent`    | Return organization data as structured JSON for agent workflows; starts browser OAuth first if needed |

For GitHub Actions and other non-interactive environments, use `cr auth login --api-key "<key>"` and follow the [Headless CLI integration](/cli/headless-cli-integration) guide.

`cr auth org` changes the login/default org for browser-based auth. Review attribution still depends on the current repository, while API-key auth always uses the API key's organization.

## Options

| Option                    | Description                                                                                                                                            |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `--agent`                 | Output structured JSON for agent-driven workflows                                                                                                      |
| `--light`                 | Request the lighter CLI review policy                                                                                                                  |
| `--committed`             | Review only committed changes                                                                                                                          |
| `--uncommitted`           | Review staged changes and unstaged edits to tracked files                                                                                              |
| `--include-untracked`     | Also review non-ignored files not added to Git                                                                                                         |
| `-c, --config <files...>` | Additional instructions for CodeRabbit AI (for example, `CLAUDE.md` or `coderabbit.yaml`)                                                              |
| `--base <branch>`         | Base branch for comparison                                                                                                                             |
| `--base-commit <commit>`  | Base commit on current branch for comparison                                                                                                           |
| `--api-key "<key>"`       | Agentic [API key](/cli/headless-cli-integration) for non-browser or headless authentication (auto-detected if logged in via `cr auth login --api-key`) |
| `--dir <path>`            | Review directory path (must contain an initialized Git repository)                                                                                     |
| `--show-prompts`          | Print saved AI prompts from the most recent local review without running a new review                                                                  |

<Info>
  `--agent` is supported in authentication workflows as well as reviews.
  `cr auth login --agent` applies to the browser-based OAuth login flow and is
  not used with `--self-hosted` or `--api-key` login.
</Info>

<Info>
  PR reviews and CLI reviews will differ, even if run on the same code. CLI
  reviews optimize for immediate feedback during active development, while PR
  reviews provide comprehensive team collaboration context and broader
  repository analysis.
</Info>


# CodeRabbit Skills
Source: https://docs.coderabbit.ai/cli/skills

Install agent-native skills to trigger AI-powered code reviews using natural language.

## Overview

**Skills** are a standardized format for packaging AI agent capabilities as structured Markdown files (`SKILL.md`). Each skill describes a capability — its purpose, usage triggers, and the steps the agent should follow to execute it. This gives AI agents a consistent, discoverable, interoperable way to understand and invoke external tools without manual configuration. You can learn more about the open standard at [agentskills.io](https://agentskills.io/what-are-skills).

CodeRabbit Skills are open-source, agent-installable capabilities built on this standard — browse and contribute at [github.com/coderabbitai/skills](https://github.com/coderabbitai/skills). With these skills, any compatible agent can trigger a full review without explanations on how to run specific console commands.

<Info>
  **Skills vs. manual CLI integration**

  Skills are a standardized, installable capability — a structured way for agents to discover and invoke tools. Manual CLI integration (covered in the [agent integration guides](/cli/index#integration-guides)) means directly prompting your agent to run `coderabbit` CLI commands. The two approaches are complementary: skills provide a consistent, zero-configuration trigger mechanism on top of the same underlying CLI.
</Info>

Skills complement the existing agent integrations documented in the [CLI section](/cli/index). You can use skills alongside manual CLI workflows or as a replacement when you want a more natural, language-driven interface.

## Prerequisites

Before installing skills, make sure the CodeRabbit CLI is installed and authenticated.

Install and authenticate the CodeRabbit CLI:

<CodeGroup>
  ```bash Installation script theme={null}
  curl -fsSL https://cli.coderabbit.ai/install.sh | sh
  ```

  ```bash Homebrew theme={null}
  brew install coderabbit
  ```
</CodeGroup>

```bash Authenticate theme={null}
coderabbit auth login
```

For full CLI setup instructions, see the [CLI overview](/cli/index).

## Supported agents

The CodeRabbit CLI detects and installs user-level skills for Codex, Claude Code, Cursor, Gemini CLI, and GitHub Copilot. The package-runner alternative supports 35+ compatible agents; see the [coderabbitai/skills repository](https://github.com/coderabbitai/skills) for the complete list.

<Info>
  If you prefer to configure agent integrations manually, see the dedicated guides for [Claude Code](/cli/claude-code-integration), [Cursor](/cli/cursor-integration), [Codex](/cli/codex-integration), and [Gemini CLI](/cli/gemini-integration).
</Info>

## Install or update skills

Use the first-party CodeRabbit CLI command for supported agents:

```bash theme={null}
coderabbit skills
```

The command:

1. Downloads the latest published `coderabbitai/skills` release and verifies its release manifest and checksums.
2. Detects supported coding agents already installed on your machine.
3. Shows every planned install or update, including the exact destination paths and anything it will leave unchanged.
4. Asks once for confirmation, defaulting to **No**, before writing any skill files.

Run `coderabbit skills` in an interactive terminal. It has no flags or subcommands that bypass confirmation, and a non-interactive invocation does not write files.

### Updates and existing installations

The CLI safely reconciles existing CodeRabbit skills:

* Missing and outdated, unchanged CLI-managed skills are offered for installation or update.
* Locally modified CLI-managed copies, package-runner installations, and plugin-managed skills are left unchanged.
* Project-level and generic, unverifiable, ambiguous, duplicate, or cross-owner installations are also left unchanged.

If a conflict is left unchanged, resolve it with the owning installer and run `coderabbit skills` again.

### Package-runner alternative

Use a package runner when you need project-scoped installation, agent-specific selection, or an agent outside the five supported directly by the CodeRabbit CLI:

<CodeGroup>
  ```bash npx theme={null}
  npx skills add coderabbitai/skills
  ```

  ```bash bunx theme={null}
  bunx skills add coderabbitai/skills
  ```

  ```bash pnpm theme={null}
  pnpm dlx skills add coderabbitai/skills
  ```

  ```bash yarn theme={null}
  yarn dlx skills add coderabbitai/skills
  ```
</CodeGroup>

#### Package-runner options

Customize how skills are installed with these flags:

| Flag           | Purpose                                                  |
| -------------- | -------------------------------------------------------- |
| `-g, --global` | Install to user directory instead of the current project |
| `-a, --agent`  | Target a specific agent (for example, `-a claude-code`)  |
| `-s, --skill`  | Install a particular skill by name                       |
| `--all`        | Install all skills to all agents without prompts         |

<CodeGroup>
  ```bash npx theme={null}
  # Install for all detected agents in the current project
  npx skills add coderabbitai/skills

  # Install globally to your user directory
  npx skills add coderabbitai/skills -g

  # Install only for Claude Code
  npx skills add coderabbitai/skills -a claude-code
  ```

  ```bash bunx theme={null}
  # Install for all detected agents in the current project
  bunx skills add coderabbitai/skills

  # Install globally to your user directory
  bunx skills add coderabbitai/skills -g

  # Install only for Claude Code
  bunx skills add coderabbitai/skills -a claude-code
  ```

  ```bash pnpm theme={null}
  # Install for all detected agents in the current project
  pnpm dlx skills add coderabbitai/skills

  # Install globally to your user directory
  pnpm dlx skills add coderabbitai/skills -g

  # Install only for Claude Code
  pnpm dlx skills add coderabbitai/skills -a claude-code
  ```

  ```bash yarn theme={null}
  # Install for all detected agents in the current project
  yarn dlx skills add coderabbitai/skills

  # Install globally to your user directory
  yarn dlx skills add coderabbitai/skills -g

  # Install only for Claude Code
  yarn dlx skills add coderabbitai/skills -a claude-code
  ```
</CodeGroup>

The package runner installs `SKILL.md` files into `~/.agents/skills` or the selected agent's designated skills directory. Its prompts, flags, and ownership remain separate from `coderabbit skills`.

## Available skills

### CodeRabbit review

The CodeRabbit review skill triggers a full CodeRabbit analysis of your current changes directly from an explicit natural-language request.

#### Triggering the skill

Activate the skill using natural language inside your AI agent:

* "Run a CodeRabbit review"
* "Review my changes with CodeRabbit"
* "Use CodeRabbit to check this branch"
* "Ask CodeRabbit to review my PR"

The agent reads the installed `SKILL.md` file and automatically invokes the CodeRabbit CLI.

#### How it works

When triggered, the agent will:

1. Check that the CodeRabbit CLI is installed and authenticated
2. Run the review on your current changes
3. Present findings grouped by severity — **Critical**, **Warning**, and **Info**
4. Optionally fix issues and re-review until the output is clean

#### CLI integration

The skill runs a CodeRabbit CLI review with structured agent output, selects the review scope from your request, and can compare changes against a base branch. The exact CLI flags are an implementation detail and may change independently of the skill's natural language interface.

#### Autonomous workflow

Skills enable a fully autonomous review-fix loop:

Implement → Review → Fix Critical/Warning issues → Re-review until clean

The agent continues iterating until no Critical or Warning issues remain, then provides a summary of everything that was fixed.

### `autofix`

The `autofix` skill fetches unresolved CodeRabbit review threads on your current branch's pull request and helps you apply fixes interactively or in batch.

<Info>
  The `autofix` skill additionally requires the [GitHub CLI (`gh`)](https://cli.github.com/) to locate pull requests, query review threads, and post comments. The skill will attempt to install `gh` automatically if it is not found, but GitHub authentication must be completed manually.
</Info>

#### Triggering the skill

Activate the skill using natural language inside your AI agent:

* "Autofix CodeRabbit comments"
* "Fix CodeRabbit review issues"
* "Review and fix CodeRabbit feedback"

The agent reads the installed `SKILL.md` file, finds your open PR, and pulls unresolved CodeRabbit review threads.

#### How it works

When triggered, the agent will:

1. Check local branch status and warn about uncommitted or unpushed changes
2. Locate the open pull request for the current branch
3. Fetch unresolved review threads authored by CodeRabbit
4. Extract issue metadata and fix prompts from each thread
5. Let you choose either review-each-fix mode or auto-fix-all mode
6. Apply selected fixes and create one consolidated commit
7. Prompt the user if the commit should be pushed upstream

#### CLI commands used by the skill

The skill relies on GitHub CLI plus Git commands:

| Command                                                                           | Purpose                                    |
| --------------------------------------------------------------------------------- | ------------------------------------------ |
| `gh pr list --head $(git branch --show-current) --state open --json number,title` | Find the open PR for the current branch    |
| `gh api graphql ... pullRequest.reviewThreads ...`                                | Fetch unresolved CodeRabbit review threads |
| `gh pr comment <pr-number> --body "<summary>"`                                    | Post a run summary after fixes are applied |
| `git add ... && git commit -m "fix: apply CodeRabbit auto-fixes"`                 | Create one consolidated commit             |

#### Fix modes

The skill supports two fix paths:

* **Review each issue**: See each proposed fix and approve, defer, or modify it.
* **Auto-fix all**: Apply all eligible fixes in batch, prioritized from highest severity first.

In both modes, the skill uses CodeRabbit's "Prompt for AI Agents" (the agent-ready fix instruction) guidance from each unresolved thread as the fix specification.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Skill not found">
    Verify that the skill has a `SKILL.md` file in the directory expected by your agent. Run `coderabbit skills` again for a supported CLI installation, or repeat the package-runner command that owns the existing installation.
  </Accordion>

  <Accordion title="Skill doesn't load in agent">
    Check two things:

    1. **Installation directory**: The skill file must be in the path your agent expects (see [Supported agents](#supported-agents)).
    2. **Frontmatter validity**: The `SKILL.md` file must have valid frontmatter. Run `coderabbit skills` to preview whether the CLI can safely update it; unverifiable or externally owned conflicts are left unchanged.
  </Accordion>

  <Accordion title="Permission errors during install">
    If you encounter permission errors when writing to the project directory, try installing to your user directory instead:

    <CodeGroup>
      ```bash npx theme={null}
      npx skills add coderabbitai/skills -g
      ```

      ```bash bunx theme={null}
      bunx skills add coderabbitai/skills -g
      ```

      ```bash pnpm theme={null}
      pnpm dlx skills add coderabbitai/skills -g
      ```

      ```bash yarn theme={null}
      yarn dlx skills add coderabbitai/skills -g
      ```
    </CodeGroup>
  </Accordion>

  <Accordion title="&#x22;NOT_INSTALLED&#x22; error">
    This error means the CodeRabbit CLI is not installed or not on your `PATH`. Reinstall the CLI and then restart your shell:

    <CodeGroup>
      ```bash Installation script theme={null}
      curl -fsSL https://cli.coderabbit.ai/install.sh | sh
      ```

      ```bash Homebrew theme={null}
      brew install coderabbit
      ```
    </CodeGroup>

    ```bash theme={null}
    source ~/.zshrc
    ```
  </Accordion>

  <Accordion title="Authentication failures">
    Re-authenticate the CodeRabbit CLI:

    ```bash theme={null}
    coderabbit auth login
    ```

    A browser window opens automatically. Sign in to CodeRabbit and the authentication completes in the browser.

    If you belong to multiple CodeRabbit organizations, the sign-in choice sets your default org only. Review attribution still depends on the current repository. See [Organization selection](/cli#organization-selection).
  </Accordion>
</AccordionGroup>

### Verification commands

Use these commands to confirm your CLI setup is working before filing a skills-related issue:

```bash theme={null}
# Check the installed CLI version
coderabbit --version

# Verify authentication status
coderabbit auth status
```

For detailed CLI troubleshooting, see the [CLI overview](/cli/index).


# WSL on Windows
Source: https://docs.coderabbit.ai/cli/wsl-windows

Install and configure the CodeRabbit CLI on Windows Subsystem for Linux (WSL) to bring AI code reviews to your Windows development environment.

## CodeRabbit CLI on WSL

The CodeRabbit CLI runs on Windows Subsystem for Linux (WSL), allowing you to access AI code reviews in your development environment. WSL provides a full Linux environment on Windows, making it ideal for running command-line tools like CodeRabbit.

## Video of install steps

<iframe title="CodeRabbit CLI on WSL for Windows" />

<Info>
  This guide covers installing and using CodeRabbit CLI on WSL. For integration
  with AI coding assistants, see [Claude Code
  integration](/cli/claude-code-integration), [Cursor
  integration](/cli/cursor-integration), or [Codex
  integration](/cli/codex-integration).
</Info>

## Why use CodeRabbit CLI on WSL

<CardGroup>
  <Card title="Native Linux environment" icon="linux">
    Run CodeRabbit in a genuine Linux environment on Windows without dual-booting or virtual machines.
  </Card>

  <Card title="Windows development workflow" icon="windows">
    Access your Windows files and integrate with Windows-based IDEs while using
    Linux command-line tools.
  </Card>

  <Card title="Expert issue detection" icon="search">
    CodeRabbit spots race conditions, memory leaks, and logic errors that generic
    linters miss. Same pattern recognition that powers our PR reviews.
  </Card>

  <Card title="Git integration" icon="git-branch">
    Work with git repositories in WSL, maintaining full compatibility with Windows-based git clients and IDEs.
  </Card>
</CardGroup>

## Prerequisites

<Steps>
  <Step title="Install WSL">
    If you haven't already installed WSL, open PowerShell or Windows Command Prompt as Administrator and run:

    ```powershell theme={null}
    wsl --install
    ```

    This installs Ubuntu by default. Restart your computer when prompted.

    For other distributions or manual installation, see [Microsoft's WSL installation guide](https://docs.microsoft.com/en-us/windows/wsl/install).
  </Step>

  <Step title="Launch WSL">
    Open your WSL distribution (e.g., Ubuntu) from the Start menu or by running `wsl` in PowerShell/Command Prompt.

    Set up your Linux username and password when prompted (first launch only).
  </Step>

  <Step title="Verify prerequisites">
    Ensure you have curl and unzip available (typically pre-installed in WSL):

    ```bash theme={null}
    curl --version
    unzip -v
    ```

    If curl or unzip are not installed:

    ```bash theme={null}
    sudo apt update && sudo apt install curl unzip
    ```
  </Step>
</Steps>

## Installation

<Steps>
  <Step title="Install CodeRabbit CLI">
    In your WSL terminal, install the CodeRabbit CLI globally:

    ```bash theme={null}
    curl -fsSL https://cli.coderabbit.ai/install.sh | sh
    ```

    The installer automatically detects your shell and adds CodeRabbit to your PATH.
  </Step>

  <Step title="Restart your shell">
    Reload your shell configuration:

    ```bash theme={null}
    # For bash (default in most WSL distributions)
    source ~/.bashrc

    # For zsh (if you've switched shells)
    source ~/.zshrc
    ```
  </Step>

  <Step title="Verify installation">
    Confirm CodeRabbit is installed and accessible:

    ```bash theme={null}
    coderabbit --version
    ```

    You should see the current version number.
  </Step>
</Steps>

## Authentication

<Steps>
  <Step title="Start authentication">
    Begin the authentication process:

    ```bash theme={null}
    coderabbit auth login
    ```
  </Step>

  <Step title="Complete sign-in in your browser">
    A browser window opens automatically in most WSL setups. If your terminal or browser configuration does not open it for you, use the URL displayed in the terminal to continue in your Windows browser.

    Sign in to CodeRabbit in the browser. Authentication completes automatically.
  </Step>

  <Step title="Verify authentication">
    Check your authentication status:

    ```bash theme={null}
    coderabbit auth status
    ```

    Success shows your login status and confirms authentication is working.
  </Step>
</Steps>

## Usage workflow

### Running code reviews

<Steps>
  <Step title="Navigate to your repository">
    In WSL, navigate to your git repository. This can be:

    * A repository in your Linux home directory (`~/projects/my-repo`)
    * A repository in your Windows filesystem (accessed via `/mnt/c/Users/YourName/projects/my-repo`)

    ```bash theme={null}
    cd ~/projects/my-repo
    # or
    cd /mnt/c/Users/YourName/projects/my-repo
    ```

    <Tip>
      WSL can access Windows files via `/mnt/c/`, `/mnt/d/`, etc. Performance is better with files in the Linux filesystem (`~`), but both work.
    </Tip>
  </Step>

  <Step title="Run CodeRabbit review">
    Analyze your code changes:

    ```bash theme={null}
    coderabbit
    ```

    CodeRabbit analyzes tracked changes and provides detailed feedback.
  </Step>

  <Step title="Review the output">
    CodeRabbit displays:

    * Issues found with severity levels
    * File locations and line numbers
    * Suggested fixes and improvements
    * Code quality insights
  </Step>
</Steps>

### Review options

Control what CodeRabbit analyzes:

```bash theme={null}
# Review tracked changes (default)
coderabbit review

# Structured output for coding agents
coderabbit review --agent

# Lighter local review policy
coderabbit review --light

# Review only committed changes
coderabbit review --committed

# Review staged and tracked local edits
coderabbit review --uncommitted

# Also review files not added to Git
coderabbit review --include-untracked

# Specify a different base branch
coderabbit review --base develop
```

## Working with Windows tools

### Using Windows-based IDEs

You can edit files in Windows IDEs (VS Code, Visual Studio, etc.) while running CodeRabbit reviews in WSL:

1. **Open your project in Windows**: Use your preferred Windows IDE
2. **Run reviews in WSL**: Keep a WSL terminal open for running CodeRabbit
3. **Seamless file sync**: Changes in Windows immediately reflect in WSL

<Tip>
  VS Code has excellent WSL integration via the "Remote - WSL" extension,
  allowing you to run the terminal in WSL while editing in the Windows UI.
  Install the extension from the VS Code marketplace to keep everything in sync
  between your Windows UI and WSL environment.
</Tip>

### Git configuration

If you use git in both Windows and WSL, you may need to configure line endings:

```bash theme={null}
# In WSL
git config --global core.autocrlf input
```

This prevents line-ending conflicts between Windows and Linux.

## Troubleshooting

### CodeRabbit command not found

If `coderabbit` isn't recognized after installation:

1. **Verify installation**: Check if the binary exists:

   ```bash theme={null}
   ls -la ~/.local/bin/coderabbit
   ```

2. **Reload shell configuration**:

   ```bash theme={null}
   source ~/.bashrc
   # or
   source ~/.zshrc
   ```

3. **Manually add to PATH** (if needed):
   ```bash theme={null}
   echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
   source ~/.bashrc
   ```

### Authentication URL not clickable

If the authentication URL isn't clickable in your terminal:

1. **Copy manually**: Select and copy the URL, then paste into your Windows browser
2. **Upgrade terminal**: Consider using Windows Terminal for better WSL integration
3. **Alternative authentication**: The authentication process is browser-based, so any modern browser works

### Slow performance on Windows files

If CodeRabbit runs slowly when working with files in `/mnt/c/`:

1. **Move repository to Linux filesystem**: Copy your project to `~/projects/` for better performance
2. **Use WSL 2**: Ensure you're running WSL 2 (check with `wsl -l -v` in PowerShell)
3. **Consider git clone in WSL**: Clone repositories directly in WSL's filesystem

<Note>
  File operations in `/mnt/c/` (Windows filesystem) are slower than in the Linux
  filesystem (`~`). For best performance, work with repositories in your WSL
  home directory.
</Note>

### CodeRabbit not finding issues

If CodeRabbit isn't detecting expected issues:

1. **Check authentication status**: Run `coderabbit auth status`. Reviews require authentication through `coderabbit auth login` or an API key.
2. **Verify git status**: CodeRabbit analyzes tracked changes by default. Check `git status`; brand-new untracked files require `--include-untracked`.
3. **Choose a review scope**:
   * `coderabbit review` - tracked changes
   * `coderabbit review --uncommitted` - staged changes and tracked local edits
   * `coderabbit review --committed` - only committed changes
   * `coderabbit review --include-untracked` - also include files not added to Git
4. **Specify base branch**: If your main branch isn't `main`, use `--base`:
   * `coderabbit --base develop`
   * `coderabbit --base master`
5. **Review file types**: CodeRabbit focuses on code files, not docs or configuration

## Advanced: WSL integration tips

### Access WSL from Windows Explorer

You can access your WSL files from Windows Explorer:

* Type `\\wsl$\` in the Explorer address bar
* Navigate to your distribution (e.g., `\\wsl$\Ubuntu\home\username\`)

### Run CodeRabbit from Windows PowerShell

You can invoke WSL commands from Windows PowerShell:

```powershell theme={null}
wsl coderabbit --version
wsl -e bash -c "cd ~/projects/my-repo && coderabbit"
```

### Set up VS Code Remote - WSL

For the best development experience:

1. Install the "Remote - WSL" extension in VS Code
2. Open a WSL terminal and navigate to your project
3. Run `code .` to open VS Code in WSL mode
4. Use the integrated terminal to run CodeRabbit commands


# AST-based path instructions
Source: https://docs.coderabbit.ai/configuration/ast-grep-instructions

Write structural code pattern rules using ast-grep to give CodeRabbit precise, syntax-aware review instructions.

<AllPlatformsBadge /> | <ProPlanBadge />

CodeRabbit supports review instructions based on Abstract Syntax Tree (AST) patterns, powered by [`ast-grep`](https://ast-grep.github.io) — a Rust-based tool that uses the tree-sitter parser to generate AST rules for popular languages, written by [Herrington Darkholme](https://twitter.com/hd_nvim). This feature has a learning curve and is recommended for users already comfortable with YAML configuration.

<Info>
  AST-based context is only available during the automated code review process, it is not available in the chat.
</Info>

**Further reading:**

* [Abstract Syntax Tree](https://en.wikipedia.org/wiki/Abstract_syntax_tree) — Wikipedia
* [`ast-grep` rule configuration guide](https://ast-grep.github.io/guide/rule-config.html)

## Setup

Use the [ast-grep Playground](https://ast-grep.github.io/playground.html) to design and test rules on source code snippets before adding them to your project.

<Steps>
  <Step title="Create rules directory">
    Create a directory to keep all the `ast-grep` rules in your project
    directory
  </Step>

  <Step title="Add rule files">
    Add individual `.yaml` files for each `ast-grep` rule within the newly
    created directory
  </Step>

  <Step title="Configure rules">
    Ensure that each `.yaml` file contains the necessary `ast-grep` rule
    configurations
  </Step>

  <Step title="Add message property">
    Ensure that all rules contain a `message` property that will be used during
    the review process
  </Step>

  <Step title="Update configuration">
    Add the rules' directory to the `.coderabbit.yaml` file under
    `tools.ast-grep` configuration
  </Step>

  <Step title="Add packages (optional)">
    Optionally, add a `packages` property to specify packages that should be
    installed before running the `ast-grep` tool
  </Step>
</Steps>

```yaml YAML lines wrap icon="code" theme={null}
reviews:
  tools:
    ast-grep:
      essential_rules: true # option to enable essential security rules
      rule_dirs:
        - "custom-name"
      packages:
        - "myorg/myawesomepackage" # custom package name following the format organization/repository
```

## The rule object

The rule object is the core concept of the `ast-grep` rule system — every other feature is built on top of it.

Below is the full list of fields in a rule object. Every field is optional and can be omitted, but at least one field must be present. A node matches a rule if and only if it satisfies all fields in the rule object.

```yaml YAML lines wrap icon="code" theme={null}
rule:
  # atomic rule
  pattern: "search.pattern"
  kind: "tree_sitter_node_kind"
  regex: "rust|regex"
  # relational rule
  inside: { pattern: "sub.rule" }
  has: { kind: "sub_rule" }
  follows: { regex: "can|use|any" }
  precedes: { kind: "multi_keys", pattern: "in.sub" }
  # composite rule
  all: [{ pattern: "match.all" }, { kind: "match_all" }]
  any: [{ pattern: "match.any" }, { kind: "match_any" }]
  not: { pattern: "not.this" }
  matches: "utility-rule"
```

## Rule categories

<CardGroup>
  <Card title="Atomic Rule" icon="atom">
    The most basic rule that checks if AST nodes match
  </Card>

  <Card title="Relational Rule" icon="link">
    Rules that check if a node is surrounded by another node
  </Card>

  <Card title="Composite Rule" icon="puzzle">
    Rules that combine sub-rules together using logical operators
  </Card>
</CardGroup>

These three categories can be composed together to create more complex rules.

<Tip>
  The rule object is inspired by CSS selectors but with more composability and
  expressiveness. Think about how CSS selectors work to better understand rule
  composition.
</Tip>

> Read the `ast-grep` [documentation](https://ast-grep.github.io/guide/rule-config.html) for detailed guides.

### Atomic rule

An atomic rule defines the most basic matching rule: whether a syntax node matches or not. There are three kinds: `pattern`, `kind`, and `regex`.

> Official documentation: [Atomic Rule](https://ast-grep.github.io/guide/rule-config/atomic-rule.html)

### Relational rule

A relational rule defines the relationship between two syntax nodes. There are four kinds: `inside`, `has`, `follows`, and `precedes`.

All four relational rules accept a sub-rule object as their value. The sub-rule matches the surrounding node; the relational rule itself matches the target node.

> Official documentation: [Relational Rule](https://ast-grep.github.io/guide/rule-config/relational-rule.html)

```yaml YAML lines wrap icon="code" theme={null}
rule:
  pattern: await $PROMISE
  inside:
    kind: for_in_statement
    stopBy: end
```

### Composite rule

A composite rule defines the logical relationship between multiple sub-rules. There are three kinds: `all`, `any`, and `not`.

**`all`** — matches if all sub-rules match:

```yaml YAML lines wrap icon="code" theme={null}
rule:
  all:
    - pattern: console.log('Hello World');
    - kind: expression_statement
```

**`any`** — matches if any sub-rule matches:

```yaml YAML lines wrap icon="code" theme={null}
rule:
  any:
    - pattern: var a = $A
    - pattern: const a = $A
    - pattern: let a = $A
```

**`not`** — applies negation; matches if the sub-rule does not match:

```yaml YAML lines wrap icon="code" theme={null}
rule:
  pattern: console.log($GREETING)
  not:
    pattern: console.log('Hello World')
```

> Official documentation: [Composite Rule](https://ast-grep.github.io/guide/rule-config/composite-rule.html)

## Reusing rules as utilities

`ast-grep` uses YAML for rule representation, which means rule objects cannot be directly reused across rule files. Utility rules solve this.

### Local utility rule

Local utility rules are defined in the `utils` field of the config file. `utils` is a string-keyed dictionary.

```yaml YAML lines wrap icon="code" theme={null}
utils:
  is-literal:
    any:
      - kind: string
      - kind: number
      - kind: boolean
rule:
  matches: is-literal
```

### Global utility rule

Global utility rules are defined in a separate file and are available across all rule configurations in the project.

To create global utility rules, create a `rules` directory and a `utils` directory at the root of your project:

```yaml YAML lines wrap icon="code" theme={null}
my-awesome-project   # project root
  |- rules           # rule directory
  | |- my-rule.yml
  |- utils           # utils directory
  | |- is-literal.yml
```

Add both directories to `.coderabbit.yaml` under `tools.ast-grep`:

```yaml YAML lines wrap icon="code" theme={null}
reviews:
  tools:
    ast-grep:
      essential_rules: true
      rule_dirs:
        - "rules"
      util_dirs:
        - "utils"
      packages:
        - "my-awesome-org/my-awesome-package" # public repository containing ast-grep rules
```

Example utility rule file:

```yaml YAML lines wrap icon="code" theme={null}
# is-literal.yml
id: is-literal
language: TypeScript
rule:
  any:
    - kind: "false"
    - kind: undefined
    - kind: "null"
    - kind: "true"
    - kind: regex
    - kind: number
    - kind: string
```

> Official documentation: [Utility Rule](https://ast-grep.github.io/guide/rule-config/utility-rule.html)

## Packages

A package is a collection of `ast-grep` rules that can be shared across multiple projects.

<CardGroup>
  <Card title="Built-in packages" icon="package">
    CodeRabbit provides packages you can use out of the box
  </Card>

  <Card title="Custom packages" icon="box">
    Create your own packages and share them with your organization or community
  </Card>
</CardGroup>

### CodeRabbit packages

<Card title="ast-grep-essentials" icon="shield" href="https://github.com/coderabbitai/ast-grep-essentials">
  **Essential security rules package**

  Because we value security, this package gets its own property in `.coderabbit.yaml` for easier installation without overwriting existing configurations.
</Card>

```yaml YAML lines wrap icon="code" theme={null}
reviews:
  tools:
    ast-grep:
      essential_rules: true
      packages:
        - "my-awesome-org/my-awesome-package"
```

### Custom packages

To use a public repository containing `ast-grep` rules as a package, add it to the `packages` field in `.coderabbit.yaml`.

<AccordionGroup>
  <Accordion title="Repository requirements">
    * Must be a public repository
    * Name must follow the format `organization/repository`
  </Accordion>

  <Accordion title="Content requirements">
    * Contains rules that follow the `ast-grep` rule format
    * Follows the required folder structure shown below
  </Accordion>

  <Accordion title="Folder structure">
    ```text theme={null}
    my-awesome-project   # project root
      |- rules           # rule directory
      | |- my-rule.yml
      |- utils           # utils directory
      | |- is-literal.yml
    ```

    <Info>
      `rules` and `utils` are reserved directory names and must be named exactly as shown. Inside each directory, the structure is flexible.
    </Info>
  </Accordion>
</AccordionGroup>

```yaml YAML lines wrap icon="code" theme={null}
reviews:
  tools:
    ast-grep:
      packages:
        - "my-awesome-org/my-awesome-package"
```

## Supported languages

<CardGroup>
  <Card title="Web Technologies" icon="globe">
    * JavaScript
    * TypeScript
  </Card>

  <Card title="Systems Languages" icon="microchip">
    * C
    * Rust
    * Golang
  </Card>

  <Card title="Enterprise Languages" icon="building">
    * Java
    * C#
    * Kotlin
    * Python
  </Card>
</CardGroup>

## Examples

### JavaScript — disallow imports without file extension

```yaml YAML lines wrap icon="code" theme={null}
id: find-import-file
language: js
message: "Importing files without an extension is not allowed"
rule:
  regex: "/[^.]+[^/]$"
  kind: string_fragment
  any:
    - inside:
        stopBy: end
        kind: import_statement
    - inside:
        stopBy: end
        kind: call_expression
        has:
          field: function
          regex: "^import$"
```

### TypeScript — no `console.log` except `console.error` in catch blocks

```yaml YAML lines wrap icon="code" theme={null}
id: no-console-except-error
language: typescript
message: "No console.log allowed except console.error on the catch block"
rule:
  any:
    - pattern: console.error($$$)
      not:
        inside:
          kind: catch_clause
          stopBy: end
    - pattern: console.$METHOD($$$)
constraints:
  METHOD:
    regex: "log|debug|warn"
```

### C — prefer plain function calls over struct method-style calls

In C, simulating OOP via struct function pointers introduces memory and indirection overhead. This rule flags the pattern and suggests a plain function call with the struct pointer as the first argument.

```yaml YAML lines wrap icon="code" theme={null}
id: method_receiver
language: c
rule:
  pattern: $R.$METHOD($$$ARGS)
transform:
  MAYBE_COMMA:
    replace:
      source: $$$ARGS
      replace: "^.+"
      by: ", "
fix: $METHOD(&$R$MAYBE_COMMA$$$ARGS)
```

## What's next

<CardGroup>
  <Card title="Path-based review instructions" icon="folder" href="/configuration/path-instructions">
    Apply free-text review guidance to specific file paths and directories using glob patterns.
  </Card>

  <Card title="Tools overview" icon="wrench" href="/tools/index">
    See all static analysis and linting tools that CodeRabbit integrates with, including ast-grep.
  </Card>
</CardGroup>


# Automatic review controls
Source: https://docs.coderabbit.ai/configuration/auto-review

Configure when and how CodeRabbit automatically reviews pull requests using the `reviews.auto_review` settings.

<AllPlatformsBadge />

The `reviews.auto_review` settings group in [`.coderabbit.yaml`](/getting-started/yaml-configuration) file gives you fine-grained control over when CodeRabbit runs automatic reviews. By default, `enabled` is `true` and CodeRabbit reviews every eligible PR automatically: draft PRs are skipped unless `drafts` is `true`, and `base_branches` defaults to only the repository's default branch unless you add more targets. You can disable reviews globally and re-enable them by keyword or label, apply them only to certain branches, skip draft PRs, and pause after a set number of commits.

<Info>
  Regardless of any auto-review configuration, you can always trigger a review manually by commenting `@coderabbitai review` (incremental) or `@coderabbitai full review` (from scratch) on a pull request.
</Info>

## Scope (which PRs qualify)

Configure which pull requests CodeRabbit will review by specifying branch targets, draft status, labels, and keyword-based opt-in.

### `base_branches`

Specify which target branches should receive automatic reviews.

```yaml theme={null}
reviews:
  auto_review:
    base_branches: []   # default — only the default branch
```

By default, CodeRabbit reviews PRs that target the repository's **default branch** (e.g. `main` or `master`). Use `base_branches` to add other branches.

Each entry is a **regex pattern**:

```yaml theme={null}
reviews:
  auto_review:
    base_branches:
      - "develop"
      - "release/.*"
      - "hotfix/.*"
```

Use `".*"` to match all branches and review every PR regardless of target.

<Info>
  The default branch is always included. `base_branches` extends the set of reviewed branches; it does not replace the default branch.
</Info>

### `drafts`

Include draft PRs in automatic reviews.

```yaml theme={null}
reviews:
  auto_review:
    drafts: false   # default
```

By default, CodeRabbit skips draft PRs. Set `drafts: true` to include them. This is useful for teams that use draft PRs as part of active development and want early feedback.

### `labels`

Control reviews using PR labels, including negative filters.

```yaml theme={null}
reviews:
  auto_review:
    labels: []   # default — no label filter
```

The `labels` array controls which PRs are reviewed based on their labels. Labels prefixed with `!` are **negative** matches (exclusions).

| Configuration        | Effect                                      |
| -------------------- | ------------------------------------------- |
| `[]` (empty)         | All PRs are reviewed (no label filter)      |
| `["bug", "feature"]` | Only PRs with the `bug` or `feature` label  |
| `["!wip"]`           | All PRs **except** those labeled `wip`      |
| `["bug", "!wip"]`    | PRs labeled `bug` but **not** labeled `wip` |

<Info>
  Positive label matches also trigger reviews when `enabled: false`. This lets you build label-driven opt-in workflows: disable automatic review globally, then add a configured positive label such as `review-ready` to request a review. Negative-only labels, such as `["!wip"]`, remain exclusion filters and do not opt PRs in by themselves.
</Info>

**Example — opt-in via label with auto-review disabled:**

```yaml theme={null}
reviews:
  auto_review:
    enabled: false
    labels: ["review-ready"]
```

Only PRs labeled `review-ready` will be reviewed. Later pushes to a PR that still has the label are eligible for incremental reviews when `auto_incremental_review` is `true`.

### `description_keyword`

Opt-in by PR description when automatic reviews are disabled.

```yaml theme={null}
reviews:
  auto_review:
    enabled: false
    description_keyword: "coderabbit:review"
```

When `enabled` is `false` and `description_keyword` is set to a non-empty string, CodeRabbit reviews any PR whose **description** contains that exact keyword string. PRs without the keyword are skipped.

Leave `description_keyword` empty (the default) to rely solely on label-based opt-in or manual `@coderabbitai review` commands.

***

## Exclusions

Configure rules to skip reviews completely for specific PRs based on title patterns or author. To skip specific **files** within a PR: lock files, generated code, or build artifacts - use [`reviews.path_filters`](/configuration/path-instructions#path-filters) instead.

### `ignore_title_keywords`

Skip reviews for PRs matching specific title keywords.

```yaml theme={null}
reviews:
  auto_review:
    ignore_title_keywords:
      - "WIP"
      - "DO NOT MERGE"
      - "[skip review]"
```

If the PR title contains **any** of these strings (case-insensitive), the review is skipped silently. This is the lightest-weight way to signal that a PR is not ready for review.

### `ignore_usernames`

Skip reviews for PRs from specific authors (bots, service accounts).

```yaml theme={null}
reviews:
  auto_review:
    ignore_usernames:
      - "dependabot[bot]"
      - "renovate[bot]"
      - "github-actions[bot]"
```

PRs authored by any username in this list are skipped silently — no review is posted.

**Username matching rules:**

* Exact match, **case-sensitive**
* No wildcard or regex support — each entry must be a full username
* Whitespace around entries is trimmed automatically
* Empty strings are ignored

**Common entries by platform:**

| Platform     | Example usernames                                         |
| ------------ | --------------------------------------------------------- |
| GitHub       | `dependabot[bot]`, `renovate[bot]`, `github-actions[bot]` |
| GitLab       | `gitlab-ci-token`, `project_123_bot`                      |
| Azure DevOps | Service account display names                             |

<Warning>
  Copy usernames directly from the PR author field on your Git platform to avoid typos. A single character difference means the PR will be reviewed.
</Warning>

Username skipping takes precedence over all other controls — if a PR author is in `ignore_usernames`, the review is skipped regardless of labels, `enabled`, or any other setting.

To force a review for a skipped author, comment `@coderabbitai review` on the PR.

***

## Incremental review

Configure how CodeRabbit handles updates and subsequent pushes to an existing PR.

### `auto_incremental_review`

Review updates on each new push (default enabled).

```yaml theme={null}
reviews:
  auto_review:
    auto_incremental_review: true   # default
```

When `true` (the default), CodeRabbit re-reviews a PR after each new push, focusing on the **commits added since the last review**. This keeps feedback timely without re-analyzing unchanged code.

Label-triggered opt-in follows the same setting: after a PR is reviewed because it has a configured positive label, later pushes are reviewed only when `auto_incremental_review` remains `true`.

Set to `false` to review only when a PR is first opened. Subsequent pushes will be ignored until you [trigger the review manually](#manual-review-commands).

### `auto_pause_after_reviewed_commits`

Pause automatic reviews after reaching a commit threshold.

```yaml theme={null}
reviews:
  auto_review:
    auto_pause_after_reviewed_commits: 5   # default
```

CodeRabbit automatically pauses incremental reviews after this many **reviewed** commits since the last pause. The counter resets each time the pause is lifted.

Set to `0` to disable the pause and always review, no matter how many commits accumulate.

This setting is useful for active feature branches where dozens of small commits would otherwise trigger redundant reviews. After the limit is reached, use `@coderabbitai review` to request a fresh review on demand.

<Warning>
  Automatic incremental reviews count toward the same per-developer PR review rate limit as manual PR reviews. Setting `auto_pause_after_reviewed_commits` to `0` can make active branches use review allowance quickly because every eligible push can trigger another review.
</Warning>

For teams trying to avoid unnecessary PR review limit hits, use automatic review controls to spend reviews only when the PR is ready for feedback. On active branches with frequent pushes, set `auto_pause_after_reviewed_commits` to `1` or `2` so CodeRabbit pauses automatic incremental reviews earlier, then use `@coderabbitai review` when the PR is ready for another pass. You can also pair this with [label-based opt-in](#labels), [title-based exclusions](#ignore_title_keywords), or `enabled: false` for repositories where manual reviews are a better default.

| Goal                                         | Recommended control                                                                                   |
| -------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
| Active PRs with many small commits           | Set `auto_pause_after_reviewed_commits` to `1` or `2`                                                 |
| Review only PRs that are ready               | Set `enabled: false` and add a configured label such as `review-ready` when the PR should be reviewed |
| Skip WIP, generated, or automation-heavy PRs | Add `ignore_title_keywords` exclusions                                                                |
| Stop automatic reviews entirely              | Set `enabled: false` and use manual review commands                                                   |

| Value      | Behavior                                                            |
| ---------- | ------------------------------------------------------------------- |
| `0`        | Never auto-pause — review every push                                |
| `1` or `2` | Pause early on active branches to avoid redundant automatic reviews |
| `5`        | Pause after 5 reviewed commits (default)                            |
| `N`        | Pause after N reviewed commits                                      |

### Manual review commands

When automatic incremental reviews reach their limits, you can use manual commands to control the review process:

* [`@coderabbitai review`](/reference/review-commands#coderabbitai-review) — Request an incremental review of new changes on demand
* [`@coderabbitai full review`](/reference/review-commands#coderabbitai-full-review) — Re-initiate a complete review of all files from scratch. Useful when many incremental updates have accumulated and you want fresh insights on the entire PR
* [`@coderabbitai pause`](/reference/review-commands#coderabbitai-pause) — Temporarily stop automatic reviews
* [`@coderabbitai resume`](/reference/review-commands#coderabbitai-resume) — Restart automatic reviews after a pause

***

## Complete `auto_review` example

```yaml theme={null}
reviews:
  auto_review:
    enabled: true
    auto_incremental_review: true
    auto_pause_after_reviewed_commits: 10
    drafts: false
    base_branches:
      - "develop"
      - "release/.*"
    ignore_title_keywords:
      - "WIP"
      - "[skip review]"
    labels:
      - "!do-not-review"
    description_keyword: ""
```

This configuration:

* Reviews all non-draft PRs automatically on each push
* Pauses after 10 reviewed commits
* Also reviews PRs targeting `develop` or any `release/*` branch
* Skips PRs titled with `WIP` or `[skip review]`
* Skips PRs labeled `do-not-review`

***

## What's next

<CardGroup>
  <Card title="Configuration reference" href="/reference/configuration#reviews" icon="book">
    See the full auto\_review schema with types, defaults, and constraints
  </Card>

  <Card title="Path instructions" href="/configuration/path-instructions" icon="file-text">
    Add per-path review rules to guide CodeRabbit on specific files or directories
  </Card>

  <Card title="Review commands" href="/reference/review-commands" icon="terminal">
    Trigger, pause, or override reviews on demand using @coderabbitai commands
  </Card>
</CardGroup>


# Central configuration
Source: https://docs.coderabbit.ai/configuration/central-configuration

Manage CodeRabbit settings across all repositories from a single central location, eliminating per-repository configuration updates.

Maintain CodeRabbit configuration for your entire organization in one dedicated repository. Create a `coderabbit` repository in your organization and add your `.coderabbit.yaml` file - CodeRabbit automatically applies these settings to any repository that doesn't have its own configuration.

<CardGroup>
  <Card title="Organization-wide consistency" icon="building-2">
    Single source of truth for code review standards across all repositories
  </Card>

  <Card title="Simplified management" icon="settings">
    Update settings once instead of modifying each repository individually
  </Card>
</CardGroup>

<Card title="Configuration hierarchy" icon="layers">
  Global overrides take precedence over everything, followed by repository
  configs, central configs, and organization defaults - giving admins
  enforcement power while keeping teams flexible
</Card>

## How configuration resolution works

CodeRabbit checks for configuration in this priority order:

<table>
  <thead>
    <tr>
      <th>Priority</th>
      <th>Source</th>
      <th>Location</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>0 (Highest)</td>
      <td><a href="/guides/configuration-overview#global-overrides">Workspace global overrides</a></td>
      <td>CodeRabbit UI - Workspace Settings - Global Overrides (Enterprise workspace customers)</td>
    </tr>

    <tr>
      <td>1</td>
      <td><a href="/guides/configuration-overview#global-overrides">Organization global overrides</a></td>
      <td>CodeRabbit UI - Organization Settings - Global Overrides</td>
    </tr>

    <tr>
      <td>2</td>
      <td><a href="/getting-started/yaml-configuration">Repository file</a></td>
      <td><code>.coderabbit.yaml</code> in the repository</td>
    </tr>

    <tr>
      <td>3</td>
      <td><a href="/configuration/central-configuration">Central repository</a></td>
      <td><code>.coderabbit.yaml</code> in <code>coderabbit</code> repository</td>
    </tr>

    <tr>
      <td>4</td>
      <td><a href="/guides/repository-settings">Repository settings</a></td>
      <td>CodeRabbit UI - Repository Settings</td>
    </tr>

    <tr>
      <td>5</td>
      <td><a href="/guides/organization-settings">Organization settings</a></td>
      <td>CodeRabbit UI - Organization Settings</td>
    </tr>

    <tr>
      <td>6</td>
      <td>Workspace settings</td>
      <td>CodeRabbit UI - Workspace Settings (Enterprise workspace customers)</td>
    </tr>

    <tr>
      <td>7 (Lowest)</td>
      <td><a href="/reference/configuration">Default settings</a></td>
      <td>CodeRabbit schema defaults</td>
    </tr>
  </tbody>
</table>

Global overrides are applied as the final layer, after all other sources (including the inheritance chain) have been resolved. This makes them the authoritative source of truth - any value set in global overrides wins over every other configuration layer. For Enterprise workspace customers, workspace global overrides apply after organization global overrides and win on conflicts.

The configuration source appears in the CodeRabbit comment on the pull request:

* **Repository file**: `Path: .coderabbit.yaml`
* **Central repository**: `Repository: coderabbit/.coderabbit.yaml`
* **UI settings**: `CodeRabbit UI`

For enforcing organization-wide policies that repositories cannot override, see [Global overrides](/guides/configuration-overview#global-overrides).

## Setup

<Warning>
  **Critical requirement**: You must install CodeRabbit on the central
  `coderabbit` repository. CodeRabbit needs access to read the configuration
  file.
</Warning>

<Steps>
  <Step title="Create the central repository">
    Create a repository named `coderabbit` in your organization. The location depends on your platform:

    * **GitHub**: `organization/coderabbit`
    * **GitLab**: `group/coderabbit` (or `group/subgroup/coderabbit` for nested
      groups)
    * **Azure DevOps**: `project/coderabbit`
    * **Bitbucket Cloud**: `workspace/coderabbit`
  </Step>

  <Step title="Add your configuration">
    Create a `.coderabbit.yaml` file in the repository root with your
    organization's settings:

    ```yaml .coderabbit.yaml theme={null}
    reviews:
      in_progress_fortune: false
      profile: chill
      request_changes_workflow: true
      high_level_summary: true
      poem: false
      review_status: true
      auto_review:
        enabled: true
        drafts: true
    chat:
      art: false
    ```
  </Step>

  <Step title="Install CodeRabbit">
    Install CodeRabbit on the central `coderabbit` repository through your
    platform's installation process.
  </Step>

  <Step title="Verify configuration">
    Check a repository that doesn't have its own `.coderabbit.yaml` file. The
    configuration source should show `Repository: coderabbit/.coderabbit.yaml`
    in the CodeRabbit UI.
  </Step>
</Steps>

## GitLab hierarchical configuration

GitLab supports team-specific configurations through its nested group structure. CodeRabbit automatically finds the closest `coderabbit` repository in your group hierarchy, allowing different teams to have their own settings while maintaining organization-wide defaults.

**Configuration inheritance example**:

| Project path                      | Configuration used                  |
| --------------------------------- | ----------------------------------- |
| `company/team-a/subteam/project1` | `company/team-a/subteam/coderabbit` |
| `company/team-a/project2`         | `company/team-a/coderabbit`         |
| `company/team-b/project3`         | `company/coderabbit`                |

This enables team-specific configurations with automatic fallback to parent group settings.

<Note>
  For configuration inheritance to work across the group hierarchy, CodeRabbit must be installed on the top-level group (for example, `company` in the table above). This grants CodeRabbit the access it needs to discover and read `coderabbit` repositories at every level of the hierarchy.
</Note>

## Platform limitations

* **Azure DevOps**: Each project requires its own `coderabbit` repository - no cross-project configuration sharing
* **Bitbucket Server**: Central configuration not yet implemented - use individual repository settings

## Repository overrides

Individual repositories can override central configuration by adding their own `.coderabbit.yaml` file.

```yaml Repository-specific config theme={null}
reviews:
  profile: assertive
  high_level_summary: true
  poem: true
  review_status: true
  auto_review:
    enabled: true
    drafts: false
chat:
  art: true
```

When a repository has its own configuration file, CodeRabbit uses that instead of the central configuration. Repository settings take precedence over central settings.

## Related topics

* [Configuration overview](/guides/configuration-overview) - Understanding CodeRabbit configuration options
* [Repository settings](/guides/repository-settings) - Configuring individual repositories
* [Organization settings](/guides/organization-settings) - Managing organization-level settings
* [Configuration reference](/reference/configuration#reference) - Complete configuration reference


# Configuration inheritance
Source: https://docs.coderabbit.ai/configuration/configuration-inheritance

Learn how CodeRabbit merges configuration settings across multiple levels, from repository files to organization defaults.

Configuration inheritance allows you to share common settings across repositories while still allowing individual repositories to customize specific values. When enabled, CodeRabbit merges configuration from parent levels instead of using only the highest-priority source.

<Info>
  Inheritance is **disabled by default**. You must explicitly enable it by
  adding `inheritance: true` to your configuration file.
</Info>

## Enabling inheritance

Add `inheritance: true` at the root level of your `.coderabbit.yaml` file:

```yaml theme={null}
inheritance: true
reviews:
  profile: chill
  auto_review:
    enabled: true
```

When inheritance is enabled:

1. CodeRabbit merges values from the parent configuration level
2. If the parent also has `inheritance: true`, the chain continues to the grandparent level
3. The chain stops at the first level where `inheritance:false` or not set

## Configuration hierarchy

CodeRabbit resolves configuration from multiple levels. Without inheritance, only the highest-priority source is used. With inheritance enabled, values merge across levels.

### Cloud/SaaS deployment

<table>
  <thead>
    <tr>
      <th>Priority</th>
      <th>Source</th>
      <th>Location</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>0 (Highest)</td>
      <td><a href="/guides/configuration-overview#global-overrides">Workspace global overrides</a></td>
      <td>CodeRabbit UI - Workspace Settings - Global Overrides (Enterprise workspace customers)</td>
    </tr>

    <tr>
      <td>1</td>
      <td><a href="/guides/configuration-overview#global-overrides">Organization global overrides</a></td>
      <td>CodeRabbit UI - Organization Settings - Global Overrides</td>
    </tr>

    <tr>
      <td>2</td>
      <td><a href="/getting-started/yaml-configuration">Repository YAML</a></td>
      <td><code>.coderabbit.yaml</code> in the repository</td>
    </tr>

    <tr>
      <td>3</td>
      <td><a href="/configuration/central-configuration">Central YAML</a></td>
      <td><code>.coderabbit.yaml</code> in <code>coderabbit</code> repository</td>
    </tr>

    <tr>
      <td>4</td>
      <td><a href="/guides/repository-settings">Repository UI</a></td>
      <td>CodeRabbit UI - Repository Settings</td>
    </tr>

    <tr>
      <td>5</td>
      <td><a href="/guides/organization-settings">Organization UI</a></td>
      <td>CodeRabbit UI - Organization Settings</td>
    </tr>

    <tr>
      <td>6</td>
      <td>Workspace UI</td>
      <td>CodeRabbit UI - Workspace Settings (Enterprise workspace customers)</td>
    </tr>

    <tr>
      <td>7 (Lowest)</td>
      <td><a href="/reference/configuration">Defaults</a></td>
      <td>CodeRabbit schema defaults</td>
    </tr>
  </tbody>
</table>

Global overrides are applied as the final merge layer, after the inheritance chain has been resolved, and take precedence over every other source. For Enterprise workspace customers, Workspace Settings provide the lowest configuration level above defaults, and workspace global overrides apply after organization global overrides. See [Global overrides](/guides/configuration-overview#global-overrides) for details.

### Self-hosted deployment

| Priority    | Source           | Location                                      |
| ----------- | ---------------- | --------------------------------------------- |
| 1 (Highest) | Repository YAML  | `.coderabbit.yaml` in the repository          |
| 2           | Central YAML     | `.coderabbit.yaml` in `coderabbit` repository |
| 3           | Environment YAML | `YAML_CONFIG` environment variable            |
| 4 (Lowest)  | Defaults         | CodeRabbit schema defaults                    |

## How inheritance works

When you enable inheritance, CodeRabbit walks up the configuration hierarchy and merges values. The merge behavior depends on the data type.

### How the inheritance chain works

```
Repository YAML (inheritance: true)
       ↓ merges with
Central YAML (inheritance: true)
       ↓ merges with
Organization UI (inheritance: false)
       ✗ chain stops here
```

* Each level with `inheritance: true` merges with its parent
* The chain stops at the first level where `inheritance:false` or unset
* Missing configuration levels are skipped automatically

### Merge behavior by type

| Type        | Behavior                                                                                                       |
| ----------- | -------------------------------------------------------------------------------------------------------------- |
| **Objects** | Deep merge - child properties override parent properties at each nesting level                                 |
| **Arrays**  | Child items first, then unique parent items appended (deduplicated by `path`, `label`, `name`, `id`, or `key`) |
| **Scalars** | Simple override - child value wins when defined                                                                |

### Example

This example demonstrates all three merge behaviors.

**Repository configuration** (`.coderabbit.yaml`):

```yaml theme={null}
inheritance: true
language: "de-DE"
reviews:
  profile: assertive
  auto_review:
    drafts: false
  path_instructions:
    - path: "src/**"
      instructions: "Use strict TypeScript settings"
    - path: "api/**"
      instructions: "Validate API contracts"
```

**Central configuration** (`coderabbit/.coderabbit.yaml`):

```yaml theme={null}
inheritance: true
language: "en-US"
reviews:
  profile: chill
  request_changes_workflow: true
  high_level_summary: true
  auto_review:
    enabled: true
    drafts: true
  path_instructions:
    - path: "src/**"
      instructions: "Follow our coding standards"
    - path: "docs/**"
      instructions: "Check for grammar and clarity"
    - path: "tests/**"
      instructions: "Ensure adequate test coverage"
chat:
  art: false
```

**Merged result**:

```yaml theme={null}
language: "de-DE" # scalar: child wins
reviews:
  profile: assertive # scalar: child wins
  request_changes_workflow: true # object: inherited from central
  high_level_summary: true # object: inherited from central
  auto_review:
    enabled: true # object: inherited from central
    drafts: false # scalar: child wins
  path_instructions: # array: child-first, then unique parent items
    - path: "src/**"
      instructions: "Use strict TypeScript settings" # from repo
    - path: "api/**"
      instructions: "Validate API contracts" # from repo
    - path: "docs/**"
      instructions: "Check for grammar and clarity" # from central (unique)
    - path: "tests/**"
      instructions: "Ensure adequate test coverage" # from central (unique)
chat:
  art: false # object: inherited from central
```

<Note>
  The `src/**` path instruction from central is excluded because the repository
  already defines the same `path`. Arrays deduplicate using the first available
  stable key: `path`, `label`, `name`, `id`, or `key`.
</Note>

## Verifying inherited configuration

After enabling inheritance, run `@coderabbitai configuration` on any pull request to see the fully-resolved YAML annotated with source comments. Each setting shows where it came from, so you can trace exactly which level in the merge chain supplied each value. The command identifies these sources:

* **Repository YAML** — `.coderabbit.yaml` in the repository
* **Central YAML** — `.coderabbit.yaml` in the `coderabbit` repository
* **Environment YAML** — `YAML_CONFIG` environment variable (self-hosted only)
* **Repository UI** — CodeRabbit UI repository settings
* **Organization UI** — CodeRabbit UI organization settings
* **Workspace UI** — CodeRabbit UI workspace settings (enterprise only)
* **Defaults** — CodeRabbit schema defaults
* **Global overrides** — organization or workspace overrides (enterprise only)

See the [`@coderabbitai configuration` command reference](/reference/review-commands#information-and-configuration) for usage details.

## Common use cases

### Organization-wide defaults

Set up common settings in your central `coderabbit` repository, then enable inheritance in individual repositories to use those defaults while customizing specific values.

**Central configuration** (`organization/coderabbit/.coderabbit.yaml`):

```yaml theme={null}
inheritance: true
reviews:
  profile: chill
  request_changes_workflow: true
  high_level_summary: true
  path_instructions:
    - path: "**/*.test.*"
      instructions: "Verify test coverage and edge cases"
chat:
  art: false
```

**Repository configuration** (`organization/my-repo/.coderabbit.yaml`):

```yaml theme={null}
inheritance: true
reviews:
  profile: assertive # This repo needs stricter reviews
  path_instructions:
    - path: "src/api/**"
      instructions: "Ensure backward compatibility"
```

The repository inherits all central settings but uses an assertive review profile and adds API-specific instructions.

### Team-specific configurations (GitLab)

GitLab's nested group structure allows team-specific configurations. Each team can have their own `coderabbit` repository with settings that inherit from parent groups.

```
company/coderabbit                     # Organization defaults
company/backend/coderabbit             # Backend team settings (inherits from company)
company/backend/payments/coderabbit    # Payments team settings (inherits from backend)
```

Each level can enable inheritance to merge with its parent while adding team-specific customizations.

## Related topics

* [YAML configuration](/getting-started/yaml-configuration) - Configuration file reference
* [Central configuration](/configuration/central-configuration) - Set up organization-wide configuration
* [Repository settings](/guides/repository-settings) - Configuring individual repositories
* [Organization settings](/guides/organization-settings) - Managing organization-level settings


# Configuration examples
Source: https://docs.coderabbit.ai/configuration/example/index

This section provides ready-to-use CodeRabbit configuration examples tailored to specific frameworks, languages, and project types. Each example demonstrates best practices and common patterns for configuring CodeRabbit to work effectively with your technology stack.

## What You'll Find Here

These configuration examples are curated from real-world usage and show how to:

* Set up framework-specific review instructions
* Configure path filters for common project structures
* Customize review behavior for different file types
* Apply best practices for your technology stack
* Handle platform-specific concerns (mobile, web, backend, etc.)

## How to Use These Examples

1. **Browse** the examples to find one that matches your project type
2. **Copy** the configuration that best fits your needs
3. **Customize** the settings to match your team's coding standards and preferences
4. **Add** the configuration to your repository as [`.coderabbit.yaml`](/getting-started/yaml-configuration) or with YAML editor in configuration UI.

## Available Examples

<CardGroup>
  <Card title="React Native + Expo" href="/configuration/example/typescript/expo">
    Mobile development configuration with Expo-specific best practices,
    performance optimization, and accessibility guidelines for React Native
    applications.
  </Card>

  <Card title="Python + Django" href="/configuration/example/python/django">
    Django web framework configuration focusing on model validation, queryset
    optimization, and comprehensive docstring requirements.
  </Card>

  <Card title="Mintlify Documentation" href="/configuration/example/other/mintlify-documentation">
    Documentation site configuration for Mintlify projects with MDX content
    validation, duplication detection, and navigation consistency checks.
  </Card>
</CardGroup>

## Contributing

These examples are part of a growing collection of [sample and community-contributed configurations](https://github.com/coderabbitai/awesome-coderabbit). More examples for different frameworks and use cases will be added over time.

Want to share your configuration? Check out the [awesome-coderabbit](https://github.com/coderabbitai/awesome-coderabbit) repository on GitHub to contribute your own examples and discover more configurations from the community.

<Note>
  Each configuration file includes inline comments explaining the purpose of
  each setting. Start with an example close to your stack and adjust as needed.
</Note>

## Next Steps

* Learn more about [YAML configuration](/getting-started/yaml-configuration)
* Explore the full [configuration reference](/reference/configuration)
* Understand [configuration inheritance](/configuration/configuration-inheritance)


# Sample configuration for Mintlify-based documentation website
Source: https://docs.coderabbit.ai/configuration/example/other/mintlify-documentation



````yaml .coderabbit.yaml theme={null}
# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
language: "en-US"
reviews:
  profile: "chill"
  request_changes_workflow: false
  high_level_summary: true
  poem: false
  review_status: true
  finishing_touches:
    docstrings:
      enabled: false
  path_filters:
    - "!**/node_modules/**"
    - "!**/.github/**"
    - "!**/.vscode/**"
    - "!**/pnpm-lock.yaml"
    - "!**/package-lock.json"
    - "!**/images/**"
    - "!**/*.svg"
    - "!**/*.png"
    - "!openapi.json"
  path_instructions:
    - path: "**/*.mdx"
      instructions: |
        - When reviewing MDX files, check for duplicated content across documentation pages. If rate limits, feature descriptions, or other factual information is updated in one file, verify if similar or duplicated content exists in other MDX files that may also need updating. Raise a warning if potentially related content is found in other files but not updated.
        - CodeRabbit can be configured via web interface or via `.coderabbit.yaml` configuration file. In the documentation, both ways should be explained using the Mintlify Tabs component. Good Example: 
          ```
          <Tabs>
            <Tab title="Using configuration file">
              ```yaml
              chat:
                integrations:
                  jira:
                    usage: enabled
              ```
            </Tab>
            <Tab title="Using the Web Interface">
              ![Jira configuration](images/assets/images/jira-integration-setup.png)
            </Tab>
          </Tabs>
          ```
        - Recommend using tabs for other cases when the content is a good fit. For example, when showing mutually exclusive instructions (windows/linux, jira/linear, etc.)
        - Every time a page (.mdx file) is created, renamed, or deleted, the `/docs.json` file should be checked for needed adjustments. Example:
          ```
          File `management/seats-licenses-billing-faq.mdx` was renamed to `management/seat-assignment.mdx`. In this case, it should be also adjusted in `docs.json`. If the file existed for some time already with the old name, a redirect should be added accordingly.
          ```
        - For Pro plan feature warnings, check if inline Info, Warning or Tip blocks mentioning "Pro plan" and "pricing page" are used. If found, recommend replacing them with the ProPlanInfo snippet: `import ProPlanInfo from "/snippets/ProPlanInfo.mdx"` and `<ProPlanInfo />` instead of inline Info blocks.
    - path: "docs.json"
      instructions: |
        Check that all referenced files exist. Flag any broken file references.
    - path: "changelog.mdx"
      instructions: |
        Verify changelog entries follow consistent formatting: date, clear title, and include relevant links. Check that new entries are added chronologically.
````


# Sample configuration for Django
Source: https://docs.coderabbit.ai/configuration/example/python/django



```yaml .coderabbit.yaml theme={null}
# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
language: "en-US"
early_access: false
reviews:
  profile: "chill"
  request_changes_workflow: false
  high_level_summary: true
  poem: true
  review_status: true
  collapse_walkthrough: false
  auto_review:
    enabled: true
    drafts: false
  path_instructions:
    - path: "**/*.py"
      instructions: |
        Review the following code using Python Django. Ensure that:
          - Ensure each method has a clear, detailed docstring explaining its purpose, parameters, and return values. Enhance existing docstrings for clarity and completeness.
          - Do not suggest adding type annotations.
          - Review Django querysets for potential performance improvements and suggest optimizations where applicable.
          - Ensure that for every model.save() there is a model.full_clean() that precedes it.
          - Avoid adding generic exception handling (e.g., `except Exception`) in test files. Each test failure should be addressed by the developer with specific exception handling or fixes.
          - Avoid adding comments relating to importing modules.
    - path: "tests/*.py"
      instructions: |
        - There is no sensitive information in the test files. All data handled is procedural/generic and non-sensitive.
chat:
  auto_reply: true
```


# Sample configuration for React Native + Expo
Source: https://docs.coderabbit.ai/configuration/example/typescript/expo



```yaml .coderabbit.yaml theme={null}
# Enables IDE autocompletion for this config file
# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

# Language for CodeRabbit's review comments
language: en

# Enable experimental features (currently not using any specific early_access features)
early_access: true

chat:
  # CodeRabbit will automatically respond to @coderabbitai mentions in PR comments
  auto_reply: true

reviews:
  auto_review:
    # Automatically trigger reviews when PRs are opened or updated
    enabled: true
    # Skip auto-review if PR title contains these keywords
    ignore_title_keywords:
      - "WIP"
    # Don't auto-review draft PRs
    drafts: false
    # Only auto-review PRs targeting these branches
    base_branches:
      - main
      - develop

  # Include a high-level summary at the start of each review
  high_level_summary: true

  # Generate sequence diagrams for complex code flows
  sequence_diagrams: true

  # Don't include poems in reviews (fun feature, but keeping it professional)
  poem: false

  # Show review completion status
  review_status: true

  # Keep the walkthrough section expanded by default
  collapse_walkthrough: false

  # Include summary of all changed files
  changed_files_summary: true

  # Don't automatically request changes on the PR (just leave comments)
  request_changes_workflow: false

  # Pre-merge checks to enforce before merging PRs
  pre_merge_checks:
    description:
      # Validate that PR has a proper description
      mode: warning # Options: off, warning, error
    docstrings:
      # Disable docstring coverage checks (let's assume we don't need them)
      mode: off

  # Exclude these paths from reviews (build artifacts and dependencies)
  path_filters:
    - "!**/node_modules/**" # npm dependencies
    - "!**/android/**" # Native Android build files
    - "!**/ios/**" # Native iOS build files
    - "!**/.expo/**" # Expo build cache
    - "!**/.expo-shared/**" # Expo shared config
    - "!**/dist/**" # Build output

  # Custom review instructions for specific file patterns
  path_instructions:
    # TypeScript/JavaScript files - main app code
    - path: "**/*.{ts,tsx,js,jsx}"
      instructions: |
        Mobile & Expo best practices:
        - Proper use of Expo APIs and hooks (useRouter, useFonts, useAssets)
        - Accessibility: touch targets min 44x44, screen reader support
        - Safe area handling and platform-specific code (iOS vs Android)
        - Memory leaks in useEffect and event listeners

        Performance:
        - Use FlatList/SectionList for lists (never ScrollView with .map)
        - StyleSheet.create instead of inline styles
        - React.memo, useMemo, useCallback where appropriate

        TypeScript:
        - Avoid 'any', use explicit types
        - Prefer 'import type' for type imports

        Security:
        - No exposed API keys or sensitive data
        - Use expo-secure-store for sensitive storage
        - Validate deep linking configurations

        Internationalization:
        - User-visible strings should be externalized to resource files (i18n)

    # Expo app configuration
    - path: "app.json"
      instructions: |
        Review Expo configuration for:
        - Proper app versioning (version and build numbers in sync)
        - Required permissions are justified and minimal
        - Splash screen and icon configurations are complete
        - Deep linking schemes are properly configured
        - EAS build configuration is production-ready
        - No exposed secrets or API keys in configuration

    # EAS (Expo Application Services) build configuration
    - path: "eas.json"
      instructions: |
        Review EAS Build/Submit configuration for:
        - Environment-specific configurations (development, preview, production)
        - Proper credential management
        - Build profiles are optimized for their purpose
        - iOS bundle identifiers and Android package names are correct
        - Distribution settings align with deployment strategy

    # Metro bundler configuration (React Native's JavaScript bundler)
    - path: "metro.config.js"
      instructions: |
        Review Metro bundler configuration for:
        - Asset extensions are properly registered
        - Transformer configuration is optimal for project needs
        - Source map generation is appropriate for environment
        - No security issues with resolver configuration

    # Test files
    - path: "**/*.test.{ts,tsx,js,jsx}"
      instructions: |
        Review test files for:
        - Comprehensive coverage of React Native component behavior
        - Proper use of @testing-library/react-native
        - Mock implementations for Expo modules and native APIs
        - Async behavior is properly tested
        - Accessibility testing is included

    # Asset files (images, fonts, etc.)
    - path: "assets/**/*"
      instructions: |
        Review asset files for:
        - Image optimization (size and format appropriate for mobile)
        - Proper @2x and @3x variants for different screen densities
        - SVG assets are optimized
        - Font files are licensed and optimized
```


# Path-based review instructions
Source: https://docs.coderabbit.ai/configuration/path-instructions

Customize how CodeRabbit reviews different parts of your codebase using glob patterns. Apply focused, context-aware instructions to controllers, tests, documentation, and more.

CodeRabbit provides two path controls. **Path filters** exclude files that don't benefit from review: lock files, binaries, and generated code. **Path instructions** apply targeted guidance to specific paths, such as security checks for API controllers, coverage requirements for tests, or clarity rules for documentation.

<Info>
  If your team already has coding guidelines and standards documented, point CodeRabbit to them using [Code Guidelines](/knowledge-base/code-guidelines).
</Info>

## Path instructions

Add custom review instructions for specific file paths using glob patterns. Instructions let you tell CodeRabbit exactly what to focus on for any part of the codebase.

### Configure path instructions

<Tabs>
  <Tab title="Configuration file">
    ```yaml .coderabbit.yaml lines icon="code" theme={null}
    reviews:
      path_instructions:
        - path: "src/controllers/**"
          instructions: |
            - Focus on authentication, authorization, and input validation.
            - Flag any direct database queries that bypass the ORM layer.
        - path: "tests/**"
          instructions: |
            Review the following unit test code written using the Mocha test library. Ensure that:
            - The code adheres to best practices associated with Mocha.
            - Descriptive test names are used to clearly convey the intent of each test.
            - Edge cases and error paths are covered.
        - path: "docs/**.md"
          instructions: |
            Check for clarity, accuracy, and completeness.
            Flag any references to deprecated APIs or outdated behavior.
    ```
  </Tab>

  <Tab title="Web UI">
    Configure path instructions in [Organization Settings → Reviews → Behavior](https://app.coderabbit.ai/organization/settings).

    <Frame>
      <img alt="Path instructions configuration in the CodeRabbit web UI" />
    </Frame>
  </Tab>
</Tabs>

<Info>
  Paths accept glob patterns. See the [minimatch](https://github.com/isaacs/minimatch) documentation for more information.
</Info>

<Warning>
  Path instructions only affect CodeRabbit's review guidance for matching files. They do not disable other features that inspect the same code. For example, suppressing docstring-related review guidance with `reviews.path_instructions` does not disable [Generate docstrings](/finishing-touches/docstrings) or the [Docstring Coverage pre-merge check](/pr-reviews/pre-merge-checks).
</Warning>

### When to add path instructions

CodeRabbit's built-in review logic covers a wide range of issues by default. Path instructions work best as a targeted supplement, not a replacement.

* Observe a few reviews first. If something is consistently missed or needs to be applied differently for a specific part of the codebase, that's a good candidate for a path instruction.

* When you identify a gap, consider which mechanism fits best:

  * **Path instructions** — rules scoped to specific files or directories in CodeRabbit's review.
  * **[Code guidelines](/knowledge-base/code-guidelines)** — existing standards documents (like `AGENTS.md` or `.cursorrules`) that CodeRabbit picks up automatically, and that also benefit AI coding agents.
  * **[Custom checks](/pr-reviews/custom-checks)** — pass/fail conditions you define that run as part of every review.

<Info>
  After CodeRabbit has reviewed several pull requests, it may have accumulated path-instruction suggestions. Post `@coderabbitai emit path instructions` as a PR comment to collect suggestions from the past 7 days and open a pull request that merges them into your `.coderabbit.yaml` without overwriting existing entries. See the [command reference](/reference/review-commands) for details.
</Info>

## Path filters

Path filters control which files CodeRabbit includes or excludes from review. Excluding irrelevant files, such as lock files, binaries, and generated code, keeps reviews focused and fast. CodeRabbit ships with sensible defaults, but you can extend the ignore list with your own patterns, or override defaults to force-include paths that would otherwise be skipped.

### Configure path filters

Patterns prefixed with `!` **exclude** paths from review (for example, `!dist/**` skips the `dist` folder). Patterns without `!` **include** paths explicitly, which is useful for overriding a default exclusion.

<Info>
  Path filters define CodeRabbit's review scope. Files excluded here, or skipped by the default ignored paths below, do not appear in CodeRabbit review surfaces such as the walkthrough or [Change Stack](/pr-reviews/change-stack). GitHub can still show those files in the pull request's full file list.
</Info>

<Tabs>
  <Tab title="Configuration file">
    ```yaml .coderabbit.yaml lines icon="code" theme={null}
    reviews:
      path_filters:
        - "!dist/**"
        - "!node_modules/**"
        - "src/**"
    ```
  </Tab>

  <Tab title="Web UI">
    Configure path filters in [Organization Settings → Reviews → Behavior](https://app.coderabbit.ai/organization/settings).

    <Frame>
      <img alt="Path filters configuration in the CodeRabbit web UI" />
    </Frame>
  </Tab>
</Tabs>

### Default ignored paths

By default, CodeRabbit intentionally skips certain file paths and extensions — things like lock files, binaries, generated code, and media assets. If you want CodeRabbit to review any of these, you can explicitly include them in your Path Filters configuration.

<Accordion title="Default ignored paths">
  <AccordionGroup>
    <Accordion title="Build and dependency directories">
      | Path Pattern          | Description                |
      | --------------------- | -------------------------- |
      | `!**/dist/**`         | Build output directory     |
      | `!**/node_modules/**` | Node.js dependencies       |
      | `!**/.svelte-kit/**`  | SvelteKit build directory  |
      | `!**/.webpack/**`     | Webpack build directory    |
      | `!**/.yarn/**`        | Yarn cache directory       |
      | `!**/.docusaurus/**`  | Docusaurus build directory |
      | `!**/.temp/**`        | Temporary files directory  |
      | `!**/.cache/**`       | Cache directory            |
      | `!**/.next/**`        | Next.js build directory    |
      | `!**/.nuxt/**`        | Nuxt.js build directory    |
    </Accordion>

    <Accordion title="Lock files">
      | Path Pattern            | Description        |
      | ----------------------- | ------------------ |
      | `!**/package-lock.json` | npm lock file      |
      | `!**/yarn.lock`         | Yarn lock file     |
      | `!**/pnpm-lock.yaml`    | pnpm lock file     |
      | `!**/bun.lockb`         | Bun lock file      |
      | `!**/*.lock`            | Generic lock files |
    </Accordion>

    <Accordion title="Generated code">
      | Path Pattern           | Description                            |
      | ---------------------- | -------------------------------------- |
      | `!**/generated/**`     | Generated code directory               |
      | `!**/@generated/**`    | Generated code directory (alternative) |
      | `!**/__generated__/**` | Generated code directory (alternative) |
      | `!**/__generated/**`   | Generated code directory (alternative) |
      | `!**/_generated/**`    | Generated code directory (alternative) |
      | `!**/gen/**`           | Generated code directory (alternative) |
      | `!**/@gen/**`          | Generated code directory (alternative) |
      | `!**/__gen__/**`       | Generated code directory (alternative) |
      | `!**/__gen/**`         | Generated code directory (alternative) |
      | `!**/_gen/**`          | Generated code directory (alternative) |
      | `!**/*.generated.*`    | Generated File Suffix                  |
    </Accordion>

    <Accordion title="Binary and compiled files">
      | Path Pattern  | Description             |
      | ------------- | ----------------------- |
      | `!**/*.app`   | Application bundle      |
      | `!**/*.bin`   | Binary file             |
      | `!**/*.class` | Java compiled class     |
      | `!**/*.dll`   | Windows dynamic library |
      | `!**/*.dylib` | macOS dynamic library   |
      | `!**/*.exe`   | Windows executable      |
      | `!**/*.o`     | Object file             |
      | `!**/*.so`    | Shared object file      |
      | `!**/*.wasm`  | WebAssembly file        |
    </Accordion>

    <Accordion title="Archives and compressed files">
      | Path Pattern | Description             |
      | ------------ | ----------------------- |
      | `!**/*.bz2`  | Bzip2 archive           |
      | `!**/*.gz`   | Gzip archive            |
      | `!**/*.xz`   | XZ archive              |
      | `!**/*.zip`  | ZIP archive             |
      | `!**/*.7z`   | 7-Zip archive           |
      | `!**/*.rar`  | RAR archive             |
      | `!**/*.zst`  | Zstandard archive       |
      | `!**/*.tar`  | TAR archive             |
      | `!**/*.jar`  | Java archive            |
      | `!**/*.war`  | Web application archive |
      | `!**/*.nar`  | NAR archive             |
    </Accordion>

    <Accordion title="Media files">
      | Path Pattern | Description     |
      | ------------ | --------------- |
      | `!**/*.mp3`  | MP3 audio       |
      | `!**/*.wav`  | WAV audio       |
      | `!**/*.wma`  | WMA audio       |
      | `!**/*.mp4`  | MP4 video       |
      | `!**/*.avi`  | AVI video       |
      | `!**/*.mkv`  | MKV video       |
      | `!**/*.wmv`  | WMV video       |
      | `!**/*.m4a`  | M4A audio       |
      | `!**/*.m4v`  | M4V video       |
      | `!**/*.3gp`  | 3GP video       |
      | `!**/*.3g2`  | 3G2 video       |
      | `!**/*.rm`   | RealMedia video |
      | `!**/*.mov`  | QuickTime video |
      | `!**/*.flv`  | Flash video     |
      | `!**/*.swf`  | Flash animation |
      | `!**/*.flac` | FLAC audio      |
      | `!**/*.ogg`  | OGG audio       |
    </Accordion>

    <Accordion title="Images and fonts">
      | Path Pattern  | Description            |
      | ------------- | ---------------------- |
      | `!**/*.ico`   | Icon file              |
      | `!**/*.svg`   | SVG image              |
      | `!**/*.jpeg`  | JPEG image             |
      | `!**/*.jpg`   | JPEG image             |
      | `!**/*.png`   | PNG image              |
      | `!**/*.gif`   | GIF image              |
      | `!**/*.bmp`   | BMP image              |
      | `!**/*.tiff`  | TIFF image             |
      | `!**/*.webm`  | WebM image             |
      | `!**/*.ttf`   | TrueType font          |
      | `!**/*.otf`   | OpenType font          |
      | `!**/*.woff`  | Web Open Font Format   |
      | `!**/*.woff2` | Web Open Font Format 2 |
      | `!**/*.eot`   | Embedded OpenType font |
    </Accordion>

    <Accordion title="Documents and data files">
      | Path Pattern    | Description             |
      | --------------- | ----------------------- |
      | `!**/*.pdf`     | PDF document            |
      | `!**/*.doc`     | Word document           |
      | `!**/*.docx`    | Word document           |
      | `!**/*.xls`     | Excel spreadsheet       |
      | `!**/*.xlsx`    | Excel spreadsheet       |
      | `!**/*.ppt`     | PowerPoint presentation |
      | `!**/*.pptx`    | PowerPoint presentation |
      | `!**/*.csv`     | CSV data file           |
      | `!**/*.tsv`     | TSV data file           |
      | `!**/*.dat`     | Data file               |
      | `!**/*.db`      | Database file           |
      | `!**/*.parquet` | Parquet data file       |
    </Accordion>

    <Accordion title="Development and system files">
      | Path Pattern         | Description         |
      | -------------------- | ------------------- |
      | `!**/tags`           | Tags file           |
      | `!**/.tags`          | Tags file           |
      | `!**/TAGS`           | Tags file           |
      | `!**/.TAGS`          | Tags file           |
      | `!**/.DS_Store`      | macOS system file   |
      | `!**/.cscope.files`  | Cscope files        |
      | `!**/.cscope.out`    | Cscope output       |
      | `!**/.cscope.in.out` | Cscope input/output |
      | `!**/.cscope.po.out` | Cscope output       |
      | `!**/*.log`          | Log file            |
      | `!**/*.map`          | Source map          |
      | `!**/*.out`          | Output file         |
      | `!**/*.sum`          | Checksum file       |
      | `!**/*.work`         | Work file           |
      | `!**/*.md5sum`       | MD5 checksum file   |
    </Accordion>

    <Accordion title="Game and 3D assets">
      | Path Pattern        | Description            |
      | ------------------- | ---------------------- |
      | `!**/*.tga`         | Targa image            |
      | `!**/*.dds`         | DirectDraw surface     |
      | `!**/*.psd`         | Photoshop document     |
      | `!**/*.fbx`         | FBX 3D model           |
      | `!**/*.obj`         | OBJ 3D model           |
      | `!**/*.blend`       | Blender file           |
      | `!**/*.dae`         | COLLADA 3D model       |
      | `!**/*.gltf`        | GL Transmission Format |
      | `!**/*.hlsl`        | HLSL shader            |
      | `!**/*.glsl`        | GLSL shader            |
      | `!**/*.unity`       | Unity scene            |
      | `!**/*.umap`        | Unreal map             |
      | `!**/*.prefab`      | Unity prefab           |
      | `!**/*.mat`         | Material file          |
      | `!**/*.shader`      | Shader file            |
      | `!**/*.shadergraph` | Shader graph           |
      | `!**/*.sav`         | Save file              |
      | `!**/*.scene`       | Scene file             |
      | `!**/*.asset`       | Asset file             |
    </Accordion>

    <Accordion title="Python-specific files">
      | Path Pattern   | Description           |
      | -------------- | --------------------- |
      | `!**/*.pyc`    | Python compiled file  |
      | `!**/*.pyd`    | Python dynamic module |
      | `!**/*.pyo`    | Python optimized file |
      | `!**/*.pkl`    | Python pickle file    |
      | `!**/*.pickle` | Python pickle file    |
    </Accordion>

    <Accordion title="Go-specific files">
      | Path Pattern     | Description                     |
      | ---------------- | ------------------------------- |
      | `!**/*.pb.go`    | Protocol buffer Go file         |
      | `!**/*.pb.gw.go` | Protocol buffer gateway Go file |
    </Accordion>

    <Accordion title="Terraform files">
      | Path Pattern           | Description            |
      | ---------------------- | ---------------------- |
      | `!**/*.tfstate`        | Terraform state file   |
      | `!**/*.tfstate.backup` | Terraform state backup |
    </Accordion>

    <Accordion title="Xcode-specific files">
      | Path Pattern                                 | Description                                      |
      | -------------------------------------------- | ------------------------------------------------ |
      | `!**/*.xcworkspace/contents.xcworkspacedata` | Xcode workspace metadata                         |
      | `!**/Package.resolved`                       | Swift Package Manager resolved-dependencies file |
    </Accordion>

    <Accordion title="Minified files">
      | Path Pattern       | Description                    |
      | ------------------ | ------------------------------ |
      | `!**/*.min.js`     | Minified JavaScript            |
      | `!**/*.min.js.map` | Minified JavaScript source map |
      | `!**/*.min.css`    | Minified CSS                   |
    </Accordion>
  </AccordionGroup>
</Accordion>

## What's next

<CardGroup>
  <Card title="AST-based instructions" icon="code" href="/configuration/ast-grep-instructions">
    Write review instructions using ast-grep rules for precise, syntax-aware review instructions.
  </Card>

  <Card title="Code guidelines" icon="book" href="/knowledge-base/code-guidelines">
    Point CodeRabbit to your existing coding standards documents: `AGENTS.md`, `.cursorrules`, and similar files.
  </Card>

  <Card title="Custom checks" icon="copy-check" href="/pr-reviews/custom-checks">
    Define pass/fail conditions that run as part of every review to enforce your team's standards automatically.
  </Card>
</CardGroup>


# YAML validator
Source: https://docs.coderabbit.ai/configuration/yaml-validator

Validate and edit YAML configuration files for CodeRabbit

Use this interactive YAML editor to validate and edit your CodeRabbit configuration files. The editor provides real-time syntax validation and error highlighting.

<iframe title="YAML Validator" />

## Common use cases

* Validate `.coderabbit.yaml` configuration files
* Check YAML syntax before committing changes
* Format and organize YAML structure
* Debug configuration issues

## What's next

<CardGroup>
  <Card title="Configuration examples" href="/configuration/example" icon="file-text">
    Browse ready-to-use CodeRabbit configuration examples tailored to specific frameworks, languages, and project types.
  </Card>

  <Card title="Configuration reference" href="/reference/configuration" icon="book">
    Explore the full list of available configuration options and their default values.
  </Card>
</CardGroup>


# CodeRabbit Agent for Discord
Source: https://docs.coderabbit.ai/discord-agent/index

Use CodeRabbit from public Discord channels in eligible communities and organizations.

<GitHubBadge title="GitHub Cloud" /> <GitLabBadge title="GitLab Self-Hosted" /> | <OpenBetaBadge title="Limited Availability" href="https://www.coderabbit.ai/discord" />

CodeRabbit Agent for Discord brings CodeRabbit's coding assistant into public Discord channels. Community members can ask CodeRabbit to investigate repository context, answer implementation questions, prepare code changes, and open pull requests from the conversation where maintainers are already coordinating work.

<Warning>
  CodeRabbit Agent for Discord is limited to public channel usage during launch.
</Warning>

## Availability

During launch, access is available to selected open-source communities with a GitHub repository that has at least 1,000 stars. Enabled GitLab Self-Hosted organizations can also use CodeRabbit Agent for Discord.

During this launch period, CodeRabbit Agent for Discord is unpaid, but usage is capped per user or organization. If your community reaches a cap, CodeRabbit may pause new Discord-initiated work until more usage is available.

## What you can do

* Ask questions about repository behavior, recent changes, or implementation options
* Turn a Discord discussion into an implementation plan
* Ask CodeRabbit to prepare a pull request after the community agrees on the direction
* Keep technical discussion in public community channels where maintainers and contributors can inspect the context

## Important limitations

| Area                    | Launch behavior                                                                                       |
| ----------------------- | ----------------------------------------------------------------------------------------------------- |
| Discord surfaces        | Public channels only                                                                                  |
| Direct messages         | Not supported                                                                                         |
| Private channels        | Not supported                                                                                         |
| Repository eligibility  | Eligible public GitHub Cloud repositories or repositories in enabled GitLab Self-Hosted organizations |
| Pull request authorship | Pull requests use the connected personal GitHub account or configured GitLab Self-Hosted credentials  |
| Pricing during launch   | Unpaid, with capped usage per user or organization                                                    |

## Manage Discord settings

After installation, the Discord settings area in the CodeRabbit dashboard is where authorized users manage the connected server and the surfaces CodeRabbit can use.

| Page           | What it does                                                                                                                                                                            |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Setup          | Connect Discord, link a supported Git platform, and complete launch eligibility checks.                                                                                                 |
| Scopes         | Configure which repositories, connections, and spend limits apply to public Discord channels.                                                                                           |
| Connections    | Add, edit, test, and delete external tool connections that Discord runs can use after they are assigned to scopes.                                                                      |
| Automations    | Create and manage scheduled, message-triggered, and webhook-triggered automations for supported Discord destinations.                                                                   |
| Knowledge base | Review and manage durable facts available to CodeRabbit Agent for Discord. Durable facts provide remembered context, while [durable skills](/agent/skills) provide reusable procedures. |
| Sandbox        | Manage the shared execution environment available to Discord-backed runs when sandbox access is enabled.                                                                                |
| Activity       | Inspect recent CodeRabbit Agent for Discord activity and run outcomes.                                                                                                                  |

## How pull request authorship works

Pull requests opened from Discord use the connected user's personal GitHub account or the credentials configured for the GitLab Self-Hosted organization and assigned scope.

Before asking CodeRabbit to open a pull request, make sure the relevant account or credential can create branches and pull requests in the target repository.

## What's next

<CardGroup>
  <Card title="Set up CodeRabbit Agent for Discord" href="/discord-agent/setup" icon="settings">
    Connect an eligible community and manage Discord settings from the CodeRabbit dashboard.
  </Card>

  <Card title="Usage and limits" href="/discord-agent/usage-and-limits" icon="message-circle-warning">
    Learn where CodeRabbit can respond in Discord and what launch limits apply.
  </Card>

  <Card title="CodeRabbit for Discord landing page" href="https://www.coderabbit.ai/discord" icon="external-link">
    Start from the product page and follow the dashboard deep link to Discord settings.
  </Card>
</CardGroup>


# Set up CodeRabbit Agent for Discord
Source: https://docs.coderabbit.ai/discord-agent/setup

Connect CodeRabbit to Discord for an eligible community or organization and manage the integration from the dashboard.

<GitHubBadge title="GitHub Cloud" /> <GitLabBadge title="GitLab Self-Hosted" /> | <OpenBetaBadge title="Limited Availability" href="https://www.coderabbit.ai/discord" />

Use the CodeRabbit dashboard to set up and manage CodeRabbit Agent for Discord. The [CodeRabbit for Discord landing page](https://www.coderabbit.ai/discord) includes a deep link into the dashboard's Discord settings page.

## Prerequisites

Before you start, make sure you have:

* An open-source GitHub repository with at least 1,000 stars, or an enabled GitLab Self-Hosted organization
* Permission to add apps or bots to the Discord server
* A public Discord channel where CodeRabbit should be used
* Git platform credentials with permission to create branches and pull requests in the target repository

## Setup steps

<Steps>
  <Step title="Open the Discord setup page">
    Go to the [CodeRabbit for Discord landing page](https://www.coderabbit.ai/discord) and follow the setup link into the CodeRabbit dashboard.
  </Step>

  <Step title="Sign in to CodeRabbit">
    Sign in with the CodeRabbit account that should manage the Discord integration for the community or organization.
  </Step>

  <Step title="Connect Discord">
    From the dashboard's Discord settings page, connect the Discord server and choose the public channel where CodeRabbit should be available.
  </Step>

  <Step title="Connect your Git platform">
    For GitHub, connect the personal account that CodeRabbit should use for pull request creation. For GitLab Self-Hosted, select the enabled organization and complete the credential setup shown in the dashboard.
  </Step>

  <Step title="Confirm eligibility and usage">
    Confirm that the repository or organization meets the launch eligibility requirement and review the applicable usage cap.
  </Step>
</Steps>

## Managing the integration

After setup, return to the dashboard's Discord settings area to manage the connected server, public channel access, Git platform connection, scopes, connections, automations, knowledge, sandboxes, activity, and usage state.

<Warning>
  Keep CodeRabbit in public Discord channels during launch.
</Warning>

## What's next

<CardGroup>
  <Card title="Usage and limits" href="/discord-agent/usage-and-limits" icon="message-circle-warning">
    Review supported Discord surfaces, pull request authorship, and launch usage caps.
  </Card>

  <Card title="CodeRabbit Agent for Discord overview" href="/discord-agent" icon="book-open">
    Share the high-level product behavior and eligibility requirements with maintainers.
  </Card>

  <Card title="Get support" href="/support" icon="life-buoy">
    Contact CodeRabbit if an eligible community or organization cannot complete setup.
  </Card>
</CardGroup>


# Usage and limits
Source: https://docs.coderabbit.ai/discord-agent/usage-and-limits

Understand where CodeRabbit for Discord can run, how pull request authorship works, and what limits apply during launch.

<GitHubBadge title="GitHub Cloud" /> <GitLabBadge title="GitLab Self-Hosted" /> | <OpenBetaBadge title="Limited Availability" href="https://www.coderabbit.ai/discord" />

CodeRabbit Agent for Discord runs in public Discord channels. During launch, this keeps CodeRabbit's work visible to the community or organization and aligned with repository permissions.

## Supported surfaces

| Discord surface  | Supported during launch |
| ---------------- | ----------------------- |
| Public channels  | Yes                     |
| Private channels | No                      |
| Direct messages  | No                      |

Use CodeRabbit in public channels where maintainers and contributors can see the request, context, and result.

## Repository eligibility

During launch, access is available to selected open-source communities with a GitHub repository that has at least 1,000 stars. Enabled GitLab Self-Hosted organizations can also use CodeRabbit Agent for Discord.

For GitHub, use the eligible repository as the setup anchor and make sure the connected personal account can create pull requests. For GitLab Self-Hosted, install repositories in CodeRabbit and assign the available repository set through Discord Agent scopes.

## Pull request authorship

Pull requests created from Discord use the connected user's personal GitHub account or the credentials configured for the GitLab Self-Hosted organization and assigned scope.

This means:

* The relevant account or credential must have permission to create branches and pull requests in the target repository
* CodeRabbit does not author Discord-initiated GitHub pull requests through a shared bot account during launch

## Usage caps

CodeRabbit Agent for Discord is unpaid during launch, but usage is capped per user or organization. Caps help keep the launch reliable while CodeRabbit supports open-source communities.

Agent billing is shared with Slack when both platforms are connected to the same subject. See [Agent for Slack billing](/slack-agent#billing) for details.

If usage is capped or paused, wait for more usage to become available or contact CodeRabbit support for help with an eligible community.

## Support

For setup issues, eligibility questions, or unexpected usage-cap behavior, use the [CodeRabbit support page](/support). Include the Discord server name, the public channel where CodeRabbit is configured, the repository URL, and the relevant GitHub account or GitLab Self-Hosted connection.

## What's next

<CardGroup>
  <Card title="Set up CodeRabbit Agent for Discord" href="/discord-agent/setup" icon="settings">
    Connect Discord and a supported Git platform from the dashboard's Discord settings page.
  </Card>

  <Card title="CodeRabbit Agent for Discord overview" href="/discord-agent" icon="book-open">
    Review the launch behavior, eligibility requirements, and public-channel model.
  </Card>

  <Card title="Get support" href="/support" icon="life-buoy">
    Get help when an eligible community or organization cannot use CodeRabbit for Discord.
  </Card>
</CardGroup>


# Early Access Program
Source: https://docs.coderabbit.ai/early-access

In CodeRabbit's dashboard, in the settings of a repository, there is the "Early access" toggle, which enables early access features. Early access is divided into two categories: "beta" and "experimental". Both are enabled by the same toggle, but should be differentiated by a warning whenever they are used.

## Beta

Beta features are ready for public testing.

* The documentation may be incomplete or outdated.
* The changelog may be missing.
* The feature may not be fully stable.
* Edge cases may not be fully covered.
* Some parts of the feature may not be implemented.
* They may not represent the end result of the planned feature and may not have a satisfactory user experience.

Whenever you use a beta feature, you may see a warning like this:

<Warning>This feature is in [beta](/early-access#beta).</Warning>

## Experiments

Experiments are ways for CodeRabbit's development team to gather more experience with in-development features.

* They are highly unstable and may not work at all.
* There is no guarantee that they will reach the beta stage and they may be cancelled at any time without any prior notice.
* They are not ready for public use and may not be sufficiently documented.
* We are not gathering feedback for experiments - the direction they take can vary widely.

Whenever you use an experiment, you may see a warning like this:

<Warning>This feature is [experimental](/early-access#experiments).</Warning>


# CodeRabbit FAQs: reviews, pricing, security, and setup
Source: https://docs.coderabbit.ai/faq

Answers to common CodeRabbit questions about triggering reviews, supported platforms, pricing, data privacy, self-hosting, and pull request automation.

## General Questions

### How to trigger a CodeRabbit Review?

Once installed, CodeRabbit automatically triggers a review when a pull request is opened against the main branch of any repository. We automatically detect the name of the primary branch (whether this be master, main, dev, etc). You have fine-grained control over what gets reviewed: target branches, draft PRs, labels, title exclusions, and more — through [automatic review controls](/configuration/auto-review).

You can also manually trigger a review at any time by commenting on a pull request with one of these commands (see [Commands](/guides/commands) for full list):

* `@coderabbitai review` - Triggers an incremental review of new changes only
* `@coderabbitai full review` - Triggers a full review of the entire pull request

### How to run a review from my IDE?

You can trigger CodeRabbit reviews directly from your IDE using our editor plugins:

* [VS Code Extension](/ide) - For VS Code, Cursor or Windsurf users

These plugins allow you to request reviews without leaving your development environment. See the individual plugin documentation for installation and usage instructions.

### How to install CodeRabbit?

View step by step instructions depending on your platform:

<Tabs>
  <Tab title="GitHub">
    See our [GitHub App installation guide](/platforms/github-com) for
    step-by-step instructions.
  </Tab>

  <Tab title="GitLab">
    Follow our [GitLab integration guide](/platforms/gitlab-com) to get started.
  </Tab>

  <Tab title="Bitbucket">
    Check out the [Bitbucket installation steps](/platforms/bitbucket-cloud) for
    detailed setup.
  </Tab>

  <Tab title="Azure DevOps">
    View our [Azure DevOps setup guide](/platforms/azure-devops) for complete
    installation instructions.
  </Tab>
</Tabs>

### How accurate is CodeRabbit?

> CodeRabbit demonstrates high accuracy in code reviews based on early adoption results. While 100% accuracy isn't guaranteed due to AI's evolving nature, our technology continuously improves through:

* Regular model updates
* Enhanced pattern recognition
* Growing language support
* Refined code analysis

### Language Support

CodeRabbit works with all programming languages, with varying proficiency based on:

* Language popularity
* Available training data
* Community usage patterns

### What's the difference between CodeRabbit Code Reviews and CodeRabbit Reports?

CodeRabbit offers two distinct features that serve different roles in your development workflow:

#### CodeRabbit Code Reviews

**Role**: Developer, QA, and Code Reviewer
**Access Level**: Full code access with comprehensive analysis capabilities

**Key Features:**

* **Complete Toolchain**: Runs all available analysis tools on your codebase
* **Static Analysis**: Can execute shell commands and perform deep static analysis against your codebase
* **Direct Code Access**: Has full access to code in issues and pull requests
* **Interactive Chat**: Provides chat features for real-time collaboration and questions
* **Comprehensive Review**: Analyzes code quality, security, performance, and best practices
* **Actionable Feedback**: Provides specific, line-by-line suggestions and improvements
* **Comment Interaction**: Engages with users through comments in pull requests and issues for clarifications and discussions
* **Available in All Tiers**: All features are available across Free, OSS, Pro, Pro+, and Enterprise plans

#### CodeRabbit Reports

**Role**: Project Manager and Communication Hub
**Access Level**: Summary-only access without direct code interaction

**Key Features:**

* **Summary Generation**: Creates convenient, formatted summaries of all your recent pull requests
* **Customizable Prompts**: Allows you to select or create your own summarization templates
* **High-Level Overview**: Focuses on project progress and changes without code details
* **Comment Analysis**: Reads and summarizes existing comments and discussions
* **No Code Access**: Operates only on summaries and metadata, not the actual codebase
* **Communication Tool**: Designed for stakeholders who need updates without technical details
* **Multi-Channel Delivery**: Sends reports through various communication channels:
  * Email notifications
  * Slack integration
  * Discord webhooks
  * Microsoft Teams updates
* **Pro Plan and Above**: Reports feature is available on Pro, Pro+, and Enterprise plans

**In Summary:**

* **Code Reviews** = Technical analysis with full code access for developers
* **Reports** = High-level summaries with no code access for project management

### Data Security

Your proprietary code remains confidential with CodeRabbit. CodeRabbit never uses customer code for model training. Data retention only controls whether CodeRabbit stores code-related data on our side to support features such as learnings and related review context. Data retention governs storage of code-related Knowledge Base data. Model output logging governs whether model outputs and reasoning from private-repository reviews may enter support troubleshooting logs.

<Tabs>
  <Tab title="Code Privacy">
    * Your code is shared with OpenAI and/or Anthropic for reviewing purposes only
    * Neither CodeRabbit, OpenAI, nor Anthropic uses your code to train our models
    * We adhere to rigorous privacy policies to guarantee the safety and confidentiality of your code
    * Complete data isolation for your proprietary code
  </Tab>

  <Tab title="Code Storage">
    * Caching of encrypted code and dependency archives for faster reviews
    * Code indexing in which we store vector representations of code for efficient code base context
    * Longer-lived review context such as Learnings (opt out available)
    * On self-hosted CodeRabbit (available for Enterprise), you can opt out of all data retention at any time
  </Tab>

  <Tab title="Training Data">
    * CodeRabbit never uses customer code for training
    * This remains true whether data retention is enabled or disabled
    * Data retention only affects storage of code-related data such as learnings and review context
  </Tab>

  <Tab title="Model output logging">
    Eligible **non-open-source** organizations can enable **Account > Settings > Model output logging**. The control is **off by default**, with no automatic opt-in. Organization Settings read access governs visibility, and Organization Settings write access is required to change it. Open-source organizations and organizations without a qualifying plan cannot enable the setting.

    When enabled, OpenAI and Anthropic model outputs and reasoning from **private-repository** reviews may be included in support troubleshooting logs. CodeRabbit excludes prompts, does not use logged data for training, and does not change existing logging behavior for public or open-source repositories.

    Changes apply to reviews started after the setting is saved.
  </Tab>
</Tabs>

### Organization Management

Switch between organizations easily:

1. Click organization name (top-left corner)
2. Select desired organization
3. Access organization-specific settings

<img alt="Organization Switcher" />

<img alt="Organization Switcher" />

### Comparison with Other Tools

> Code reviews remain essential, whether the code is written by a human or a bot. This is mainly because the perspective of the reviewer differs from that of the code generator, whether human or machine. This distinction is precisely why human peer reviews have been effective for so long. While AI-powered code-generation tools like GitHub Copilot hold immense potential, it's important to recognize that these generators are still in their early stages and may not be equipped to auto-generate meaningful code for moderately complex applications.

#### vs AI Code Generators

* Provides review perspective different from code generation
* Complements tools like GitHub Copilot
* Focuses on code quality and best practices

#### vs Traditional Review Tools

* Context-aware feedback
* Actionable suggestions
* Direct commit capabilities
* AI-powered intent understanding

## Usage and Configuration

### When Does CodeRabbit Review PRs?

* ✅ **New PRs**: Automatic review when created
* ✅ **New Commits**: Automatic review when pushed to any PR
* ⚡ **Older PRs**: Use `@coderabbitai review` to trigger manually

<img alt="CodeRabbit- Full-Review" />

### Customization Options

#### How to Add or Update Your Billing Email

To add or update your billing email, go to [**Subscription and Billing**](https://app.coderabbit.ai/settings/subscription), select **Billing Overview**, then edit **Billing information**. Update the billing email or additional invoice recipients, review the change, and save.

### Usage and Configuration

* **Language Settings**: Configure review language in repository settings
* **Review Rules**: Customize via [review instructions](/configuration/path-instructions)
* **Branch Selection**: Default branch reviews enabled by default (configurable)

### Access & Permissions

* Minimal repository access required
* Review permissions during installation
* Individual developer support available

### Interaction Guide

Interact with CodeRabbit by:

1. Replying directly to CodeRabbit comments
2. Tagging `@coderabbitai` in PR discussions
3. Adding review comments for specific lines
4. Customize via [review instructions](/configuration/path-instructions)

<Tip>
  When team members are active in PRs, use `@coderabbitai` to engage the bot.
</Tip>

### Usage Limits

During a trial, review limits follow the selected trial tier, such as Pro or Pro+. The default 14-day trial starts on Pro+, and the default Pro+ trial limits are documented on [Plans and pricing](/management/plans#default-pro%2B-trial-limits). Open-source plans have separate rate limits that vary by project community and popularity, while paid plans have higher limits. In all cases, limits use rolling windows rather than resetting all at once, so further reviews and conversations become available again as earlier usage ages out.

For Pro and Pro+ PR reviews, your plan includes a set number of PR reviews per developer, per hour. Pro includes 5 PR reviews per hour and Pro+ includes 10 PR reviews per hour. Additional reviews become available as earlier reviews age out of the rolling window rather than resetting all at once.

CodeRabbit uses recent PR review activity to decide when more reviews become available. Developers with typical PR review activity continue to see reviews become available normally for their plan. When one developer identity reaches the 95th percentile or higher of recent CodeRabbit PR review usage, CodeRabbit gradually spaces out additional reviews for that developer. Reducing or pausing review activity lets recent usage come down over time, which can restore faster review availability. Your plan allowance is not changed. To learn more, see our [Fair Usage Limits Policy](/management/plans#fair-usage-limits-policy). See [Rate limits](/management/plans#rate-limits) for the per-developer limits on each plan.

To reduce unnecessary PR reviews, tune [automatic review controls](/configuration/auto-review): pause automatic incremental reviews after 1 or 2 reviewed commits, turn off automatic reviews and add a configured ready-for-review label to opt PRs in, use title exclusions for WIP or generated changes, or request reviews manually. If your organization needs uninterrupted eligible over-limit reviews, you can purchase credits through the [Usage-based Add-on](/management/usage-based-addon). CLI and agentic API-key reviews also use assigned-seat allowance first, then usage credits only for eligible over-limit reviews.

### How can I check my remaining PR review limit?

You can comment `@coderabbitai rate limit` or ask an obvious question such as `@coderabbitai reviews remaining?` to check your PR review limit and next availability timing without consuming a review.

## Plans and Pricing

### What's the difference between Pro and Pro+?

The **Pro plan** includes all the features you need for AI code reviews — PR reviews, docstrings, autofix, built-in pre-merge checks, integrations, <Hint type="knowledge-base">Knowledge base</Hint>, and analytics. All ongoing improvements to review functionality are included in Pro.

The **Pro+ plan** includes everything in Pro, plus tasks and actions that happen upstream and downstream of the review process — [CodeRabbit Plan](/plan) and issue planning, [unit test generation](/finishing-touches/unit-test-generation), [simplify code](/finishing-touches/simplify), [merge conflict resolution](/finishing-touches/resolve-merge-conflict), and other pre/post-merge actions. Pro+ also offers higher [rate limits](/management/plans#rate-limits) and increased limits for [MCP connections](/integrations/mcp-servers) and [linked repository analysis](/knowledge-base/multi-repo-analysis).

See [Plans and pricing](/management/plans) for the full comparison.

### What billing details are required, and how are the emails used?

CodeRabbit collects account contact details (name, company, primary email, phone) and invoice details (billing email, billing address, optional Tax ID) when you start or update a paid subscription. See [Billing and changing plans](/management/billing#what-billing-details-are-required) for the full breakdown of required fields and how each is used.

### How do upgrades and downgrades work?

Upgrade-style changes (adding seats or moving to a higher plan) take effect immediately; downgrade-style changes are scheduled for the end of the billing cycle. See [Billing and changing plans](/management/billing#how-do-upgrades-and-downgrades-work) for the full behavior table.

### Is CodeRabbit Agent for Slack or Discord included in my subscription?

No. CodeRabbit Agent is billed separately from CodeRabbit review plans. Your CodeRabbit subscription covers pull request reviews, IDE and CLI reviews, and related features. CodeRabbit Agent usage is measured in **agent minutes** — the actual runtime each run spends working, and is charged independently.

You do not need a paid CodeRabbit review plan to use CodeRabbit Agent, and a paid review plan does not include Agent usage. Some Agent trials include a limited Agent Minutes grant; after the trial grant is exhausted or expires, an admin must activate the Agent plan before new Agent runs can continue. See the [Slack Agent overview](/slack-agent) and [Usage](/slack-agent/usage) for details.

## Integration Guide

### Prerequisites

* Organization admin access
* Domain allowlist (GitLab: add `coderabbit.ai`)
* Default branch configuration

### Quick Setup

1. Sign up at [coderabbit.ai](https://coderabbit.ai) using your GitHub account
2. Add your repository through the dashboard
3. That's it. CodeRabbit will automatically start reviewing your PRs

<Tip>
  Visit our [Support](/support) page for additional assistance or reach out to our team on [Discord](https://discord.gg/coderabbit).
</Tip>

#### Unable to View Repositories in GitLab

If you cannot view repositories in the CodeRabbit UI, please ensure that you
are added as a Developer in the primary group for GitLab Cloud or in the first
level group for Self-Hosted GitLab.

#### Unable to Enable Repositories in GitLab

If you're having trouble enabling the GitLab Repositories toggle, confirm that
you have Maintainer access in the primary group for GitLab Cloud or in the first
level group for Self-Hosted GitLab.

## Account Management

### How do I cancel my subscription?

If you can manage your organization's subscription, go to
[**Subscription and Billing**](https://app.coderabbit.ai/settings/subscription),
open your current plan, click **Cancel CodeRabbit paid plan**, and follow the
prompts to confirm.

If the page is read-only, ask an organization Admin or Billing Admin to make
the change. For the full flow, see [Canceling a paid subscription](/management/subscription-management#canceling-a-paid-subscription).

### How to troubleshoot CodeRabbit not functioning on certain repositories?

If CodeRabbit is not functioning on certain repositories, it is likely due to the repository not being accessible to CodeRabbit and you must reinstall the GitHub App or GitLab Integration.

For newly added GitHub organizations, first use **Refresh organization list** in CodeRabbit after returning from GitHub. If the organization or repositories are not visible immediately, refresh or retry the add flow; CodeRabbit preserves your place while setup is active. If setup is not completed promptly (about 30 minutes), restart **Add organization**.

To troubleshoot this issue, please attempt to reinstall the GitHub App or GitLab Integration by following the steps below:

<Tabs>
  <Tab title="General Instructions">
    1. Confirm that the author of a pull request has an active seat in CodeRabbit. If not please provide a seat to the user under [Subscription](https://app.coderabbit.ai/settings/subscription) page to enable CodeRabbit for the user. Then have the user close/reopen a new pull request for the change to see CodeRabbit active on the new user.

       <img alt="Seat Assignment" />
    2. Please ensure if not selecting all repositories, that you have added all repositories that you would like to enable to the selected list in the app configuration.
    3. If the repository is not in the list, you do not have to uninstall and reinstall the CodeRabbit App. Please add it to the list.

       <img alt="Select Repos" />
  </Tab>

  <Tab title="GitHub">
    1. Go to Repository settings
    2. Click **GitHub Apps** in the left sidebar under **Integrations**
    3. Select **Configure**

       <img alt="Select Repos" />
    4. Click **Uninstall** at the bottom of the app configuration page.

       <img alt="Uninstall" />
    5. Go into the [CodeRabbit App](https://github.com/apps/coderabbitai) and install it again with the **Add Repository** button.

       <img alt="Add Repository" />
  </Tab>

  <Tab title="GitLab">
    1. Remove OAuth App from User Settings > Applications
    2. Remove Webhook from Group > Project Settings > Webhooks
    3. Go into the [CodeRabbit App](https://gitlab.com/apps/coderabbitai) and install it again.

       <img alt="Install" />
  </Tab>
</Tabs>

### How do I delete my CodeRabbit account?

<Danger>
  Irreversible Account Deletion
  Deleting your CodeRabbit account is permanent and cannot be undone. This action will permanently erase:

  * Organization and Repository data
  * AI Bot learnings and insights
  * Subscriptions and billing information
  * All settings and configurations
  * Reports and recurring reports
  * Third-party service integrations

  Deleting the organization immediately cancels any active subscription rather than leaving it active through the end of the current billing term.
</Danger>

<Tabs>
  <Tab title="Account Deletion Steps">
    1. Sign into your CodeRabbit account
    2. Navigate to the [**Subscription and Billing**](https://app.coderabbit.ai/settings/subscription) page
    3. Select the **Danger Zone** tab
    4. In the **Delete account** section, click **Delete account**
    5. Review the deletion confirmation drawer and acknowledge the required warnings
    6. Type `delete <your-organization-name>` to confirm
    7. Complete platform-specific cleanup on the tab above.

    <Info>
      The **Danger Zone** tab and **Delete account** action are only visible to admin users.
    </Info>

    A confirmation drawer will appear explaining the consequences of account deletion. You can expand each section for detailed information.
  </Tab>

  <Tab title="GitHub Cleanup">
    After account deletion, you must:

    **Remove OAuth App:**

    1. Go to Organization settings
    2. Click **OAuth Application Policy**
    3. Find **coderabbitai** and click the pencil icon
    4. Click **Revoke**

    **Uninstall GitHub App:**

    1. Go to Organization settings
    2. Click **GitHub Apps**
    3. Select **Configure**
    4. Click **Uninstall**
  </Tab>

  <Tab title="GitLab Cleanup">
    Complete these steps:

    1. Remove OAuth App from User Settings > Applications
    2. Remove Webhook from Group > Project Settings > Webhooks
    3. Remove Bot User from Group > Manage > Members
  </Tab>

  <Tab title="Azure DevOps Cleanup">
    1. Go to Project Settings > Service Hooks
    2. Delete CodeRabbit webhooks
    3. Remove CodeRabbit user or delete associated Personal Access Token
  </Tab>

  <Tab title="Bitbucket Cleanup">
    1. Go to Project Settings > Webhooks
    2. Delete CodeRabbit webhooks
    3. Remove CodeRabbit user or delete associated App Passwords
  </Tab>
</Tabs>

<Warning>
  The platform-specific cleanup steps are necessary to completely remove CodeRabbit access. Without completing these steps:

  * CodeRabbit may retain some platform permissions
  * Signing back in will recreate minimal account data
</Warning>


# Autofix: apply CodeRabbit code fixes to pull requests
Source: https://docs.coderabbit.ai/finishing-touches/autofix

Use CodeRabbit Autofix to automatically implement code changes for unresolved review findings in your pull request as a commit or stacked PR.

<GitHubBadge /> <GitLabBadge /> <AzureBadge /> <BitbucketBadge title="Bitbucket Cloud" /> | <ProPlanBadge />

Autofix helps you resolve review feedback faster by applying code changes for unresolved CodeRabbit findings in your pull request. Use Autofix when you want CodeRabbit to implement fixes automatically, then review the resulting commit or stacked PR.

## Usage

You can trigger Autofix from a pull request comment on GitHub, GitLab, Azure DevOps, or Bitbucket Cloud. On supported GitHub pull-request flows, you can also use the `Finishing Touches` Autofix checkbox in CodeRabbit's PR <Hint type="walkthrough" />.

```text Open a separate stacked PR with fixes theme={null}
@coderabbitai autofix stacked pr
```

```text Apply fixes to your current PR branch theme={null}
@coderabbitai autofix
```

<Info>
  GitHub, GitLab, Azure DevOps, and Bitbucket Cloud support `@coderabbitai autofix` for direct commits to the current branch and `@coderabbitai autofix stacked pr` for a stacked pull request. The interactive **Autofix** checkbox is currently available on supported GitHub pull-request flows only.
</Info>

### GitHub checkbox triggers

On supported GitHub PR flows, CodeRabbit renders an expanded **Autofix** section with interactive checkboxes in the pull request review comment (alongside actionable comments).

* **Push a commit to this branch:** Runs Autofix and commits fixes to the current PR branch.
* **Create a new PR with the fixes:** Runs Autofix and opens a stacked PR with the generated changes.

These checkbox actions map to the same Autofix execution paths as the PR comment commands.

## How it works

<Steps>
  <Step title="Trigger autofix">
    Comment `@coderabbitai autofix` in the pull request thread, or `@coderabbitai autofix stacked pr` to request a separate stacked PR. On supported GitHub pull-request flows, you can also use the **Autofix** checkbox section in the pull request review comment.
  </Step>

  <Step title="Collect fix instructions">
    CodeRabbit scans unresolved review threads started by CodeRabbit and gathers fix instructions from the **Prompt for AI Agents** blocks.
  </Step>

  <Step title="Generate and verify fixes">
    The coding agent applies fixes, then runs a repository setup + build verification step. Even if verification fails, the generated changes are still delivered so you can continue iterating.
  </Step>

  <Step title="Deliver the result">
    CodeRabbit either pushes a commit to the current branch or opens a stacked PR, depending on which command or checkbox option you selected.
  </Step>
</Steps>

## Output options

<Card title="Commit to current branch" icon="git-commit-vertical">
  Use `@coderabbitai autofix` to push a commit directly to your current branch. This is the fastest path when you want fixes in the same review, and it is supported on GitHub, GitLab, Azure DevOps, and Bitbucket Cloud.
</Card>

<Card title="Create stacked PR" icon="git-pull-request-create-arrow">
  Use `@coderabbitai autofix stacked pr` to open a new branch off your working branch and submit a separate stacked pull request, which lets you review the generated changes independently.
</Card>

## Configuration

Autofix is enabled by default. To turn it off for a repository, set `reviews.finishing_touches.autofix.enabled` to `false` in your `.coderabbit.yaml`:

```yaml theme={null}
reviews:
  finishing_touches:
    autofix:
      enabled: false
```

| Field     | Required | Default | Description                                           |
| --------- | -------- | ------- | ----------------------------------------------------- |
| `enabled` | No       | `true`  | Set to `false` to disable Autofix for the repository. |

When Autofix is disabled:

* The **Autofix** checkboxes are hidden from the pull request review comment.
* The `@coderabbitai autofix` command is removed from the CodeRabbit help output.
* CodeRabbit declines any `@coderabbitai autofix` request and points to this setting.

Autofix also requires a **Pro plan or higher**. The configuration toggle only controls availability once your plan already supports Autofix.

## Scope and limitations

* Autofix runs only on pull request events.
* Autofix only processes unresolved CodeRabbit review threads with valid fix instructions.
* When the pull request has merge conflicts, Autofix exits without making changes. [Resolve the conflicts](/finishing-touches/resolve-merge-conflict) against the base branch, then trigger Autofix again.
* If no valid unresolved instructions are found, Autofix skips execution and reports that no fixes were applied.
* Autofix may be rate-limited. If limits are exceeded, CodeRabbit responds with a wait time before retrying.

## Command reference

```text theme={null}
@coderabbitai autofix
@coderabbitai autofix stacked pr
```

Also supported aliases include `auto-fix` and `auto fix` forms, with or without `stacked pr`.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Autofix says no fixes were found" icon="circle-alert">
    Autofix only acts on unresolved CodeRabbit review comments that include structured fix instructions. Resolve state, missing instruction blocks, or non-CodeRabbit threads can lead to no-op runs.
  </Accordion>

  <Accordion title="Autofix completed but verification failed" icon="triangle-alert">
    Build/verification can fail after code edits. In this case, CodeRabbit still keeps and delivers the generated autofix changes so you can continue iteration.
  </Accordion>

  <Accordion title="Autofix says the review has merge conflicts" icon="git-merge">
    Autofix stops before cloning or generating changes when the platform reports that the pull request is not mergeable. Resolve the conflicts with the base branch, then run Autofix again.

    CodeRabbit will also suggest running `@coderabbitai resolve merge conflict` from the Autofix reply. See [Resolve merge conflicts](/finishing-touches/resolve-merge-conflict) for details.
  </Accordion>

  <Accordion title="Stacked PR creation failed" icon="git-pull-request-closed">
    Stacked PR creation may fail due to platform or API limitations. If this happens, use `@coderabbitai autofix` to apply the fixes as a direct commit to your current branch instead.
  </Accordion>

  <Accordion title="Autofix commands and checkboxes are missing" icon="eye-off">
    If the **Autofix** checkboxes are absent, the command is missing from help, or CodeRabbit replies that Autofix is disabled for the repository, Autofix has been turned off in your configuration. Set `reviews.finishing_touches.autofix.enabled` to `true` in your `.coderabbit.yaml` (see [Configuration](#configuration)). Autofix also requires a Pro plan or higher.
  </Accordion>
</AccordionGroup>

## What's next

<CardGroup>
  <Card title="Finishing Touches overview" href="/finishing-touches" icon="sparkles">
    See all available finishing touches and how to trigger them from any PR
  </Card>

  <Card title="Custom recipes" href="/finishing-touches/custom-finishing-touches" icon="scroll">
    Define reusable, named recipes that encode your team's repeated tasks into one-click agentic actions
  </Card>

  <Card title="Resolve merge conflicts" href="/finishing-touches/resolve-merge-conflict" icon="git-merge">
    Let CodeRabbit analyze the intent behind conflicting changes and commit a clean resolution to your branch
  </Card>
</CardGroup>


# Custom Finishing Touch recipes
Source: https://docs.coderabbit.ai/finishing-touches/custom-finishing-touches

Define reusable, named recipes that run agentic code changes on your pull requests.

<GitHubBadge /> <GitLabBadge /> | <OpenBetaBadge /> <ProPlusPlanBadge />

Custom recipes let you encode your team's repeated finishing-touch tasks — things like enforcing import ordering, tightening TypeScript types, or applying project-specific conventions — into named, reusable instructions. Once defined, anyone on your team can trigger a recipe with a single comment on GitHub or GitLab, or with a checkbox click on GitHub. CodeRabbit's agent will carry out the work inside a sandbox and open a PR with the result.

## How it works

<Steps>
  <Step title="Define recipes in your config">
    Add named recipes under `reviews.finishing_touches.custom` in `.coderabbit.yaml`. Each recipe has a `name` and a freeform `instructions` field.
  </Step>

  <Step title="Trigger a recipe">
    Comment `@coderabbitai run <recipe name>` in a GitHub pull request or GitLab merge request. On GitHub, you can also check the corresponding recipe checkbox in the CodeRabbit Walkthrough under **✨ Finishing Touches**.
  </Step>

  <Step title="Agent execution">
    CodeRabbit clones your repository into a sandbox, provides the agent with full PR context (title, description, summary, coding guidelines), and runs your instructions using the Claude Agent SDK.
  </Step>

  <Step title="Receive the output">
    By default, CodeRabbit opens a new pull request against your branch containing the agent's changes. You review and merge it like any other PR.
  </Step>
</Steps>

## Platform support

<CardGroup>
  <Card title="GitHub" icon="github">
    Use a PR comment command or the CodeRabbit Walkthrough checkbox.
  </Card>

  <Card title="GitLab" icon="gitlab">
    Use a merge request comment command.
  </Card>
</CardGroup>

## Configuration

Add custom recipes to `.coderabbit.yaml`:

```yaml theme={null}
reviews:
  finishing_touches:
    custom:
      - name: "cleanup stale imports"
        instructions: |
          Scan the changed files for unused imports and remove them.
          Preserve imports used in type positions.
          Do not reorder existing imports; only remove stale ones.

      - name: "tighten types"
        instructions: |
          Replace `any` types in the changed files with the most specific
          TypeScript type that is correct given the surrounding context.
          Add explicit return types to exported functions that are missing them.

      - name: "enforce error handling"
        instructions: |
          Audit all async functions in the changed files.
          Ensure every awaited call is wrapped in try/catch or has a .catch() handler.
          Use the project's existing error logger pattern when catching errors.
```

### Recipe fields

| Field          | Required | Limits                | Description                                                                                                        |
| -------------- | -------- | --------------------- | ------------------------------------------------------------------------------------------------------------------ |
| `name`         | Yes      | Max 100 characters    | Identifier used in run commands. Case-insensitive. Must be unique across your recipes.                             |
| `instructions` | Yes      | Max 10,000 characters | Freeform description of what the agent should do. The agent receives full PR context alongside these instructions. |
| `enabled`      | No       | —                     | Set to `false` to temporarily disable a recipe without removing it. Defaults to `true`.                            |

Custom recipes are available on the **Pro+ plan and above**. See [Plans and pricing — Custom Finishing Touch recipes](/management/plans#custom-finishing-touch-recipes) for current limits.

Recipe names are matched case-insensitively, so `"Cleanup Stale Imports"` and `"cleanup stale imports"` refer to the same recipe.

## Triggering recipes

### PR comment

```
@coderabbitai run cleanup stale imports
```

Recipe names can include spaces. Quoting is optional:

```
@coderabbitai run "tighten types"
```

The command is matched case-insensitively and can appear anywhere in a comment, including multi-line comments.

### Ad hoc evaluation (without a saved recipe)

To try out a finishing touch without committing it to your config, use the evaluate command directly in a PR comment:

```
@coderabbitai evaluate custom finishing touch --name <name> --instructions <text>
```

For example:

```
@coderabbitai evaluate custom finishing touch --name "sort imports" --instructions "Sort all import statements alphabetically within each import group in the changed files."
```

The agent runs exactly as it would for a saved recipe — with full PR context — but the recipe is not persisted anywhere. This is useful for one-off tasks or for iterating on instructions before adding them to `.coderabbit.yaml`.

### Finishing Touches checkbox

On GitHub, each enabled recipe appears as a checkbox in the **✨ Finishing Touches** section of the CodeRabbit Walkthrough comment. Checking it triggers the recipe with the Create PR output mode.

## What the agent receives

When a recipe runs, CodeRabbit provides the agent with:

* Your **recipe instructions**
* **PR title and description**
* **CodeRabbit's PR summary** (walkthrough and objectives)
* **Global coding guidelines** from `reviews.path_instructions` in your config
* Full **repository access** via Read, Write, Edit, Glob, Grep, and Bash tools

This means your recipes can reference project conventions, coding standards, and PR intent without you needing to repeat that context in every recipe.

## Example recipes

**Remove console statements:**

```yaml theme={null}
- name: "remove console logs"
  instructions: |
    Find and remove all console.log, console.warn, and console.error calls
    from the changed files. Leave intentional logging that uses the project's
    logger utility (e.g. logger.info, logger.error) untouched.
```

**Add missing test coverage:**

```yaml theme={null}
- name: "add edge case tests"
  instructions: |
    Review the changed source files and identify edge cases not covered
    by the existing tests. Add focused unit tests for those cases using
    the project's existing test framework and patterns.
```

**Enforce naming conventions:**

```yaml theme={null}
- name: "fix naming conventions"
  instructions: |
    Check the changed files for variables, functions, or classes that
    do not follow the project's naming conventions (camelCase for variables
    and functions, PascalCase for classes and interfaces). Rename where needed
    and update all references in the same files.
```

## What's next

<CardGroup>
  <Card title="Finishing Touches overview" href="/finishing-touches" icon="sparkles">
    See all available finishing touches and how to trigger them from any PR
  </Card>

  <Card title="Autofix" href="/finishing-touches/autofix" icon="wrench">
    Automatically implement fixes for unresolved CodeRabbit review findings
  </Card>

  <Card title="YAML configuration" href="/getting-started/yaml-configuration" icon="settings">
    Set up .coderabbit.yaml to define custom recipes and other review settings
  </Card>
</CardGroup>


# Generate docstrings
Source: https://docs.coderabbit.ai/finishing-touches/docstrings

Automatically generate comprehensive docstrings that match your existing format, delivered through PR workflow for complete review control

<OpenBetaBadge />

<ProPlanBadge />

Writing documentation for every function is time-consuming, but undocumented code creates bottlenecks during code reviews. You spend cycles explaining what functions do instead of focusing on business logic and architecture decisions.

CodeRabbit generates docstrings for functions missing documentation in your PRs. Comment `@coderabbitai generate docstrings` or check the box in your PR walkthrough to trigger generation.

The system scans your changes with ast-grep, identifies functions needing documentation, and generates docstrings that match your codebase's existing format. Depending on platform support, CodeRabbit either opens a follow-up PR with the generated docstrings or posts them back as a PR comment for manual application.

This handles the initial documentation grunt work while keeping you in control through the standard PR review process.

## How it works

<Steps>
  <Step title="Trigger generation">
    Comment `@coderabbitai generate docstrings` in your PR or check **Generate
    Docstrings** in the CodeRabbit Walkthrough
  </Step>

  <Step title="Function analysis">
    ast-grep scans your PR changes to identify functions missing docstrings or
    with incomplete documentation
  </Step>

  <Step title="Format-aware generation">
    AI analyzes your existing docstrings to detect format patterns (JSDoc,
    Google-style, Sphinx) and generates matching documentation
  </Step>

  <Step title="PR workflow">
    Generated docstrings are committed to a new branch with a PR opened against
    your original branch for review and merge (typically 30-60 seconds)
  </Step>
</Steps>

<img alt="Docstrings PR example showing generated documentation in a pull request" />

You review the generated PR like any other code change. CodeRabbit preserves existing docstrings and only documents functions that genuinely need it.

<Tip>
  CodeRabbit automatically detects your docstring format by analyzing existing
  documentation patterns. It matches JSDoc, Google-style, Sphinx, custom
  formats, or even Go's doc comment conventions without any configuration.
</Tip>

## Platform support

<CardGroup>
  <Card title="GitHub" icon="github">
    Docstrings are committed to a new branch and a follow-up PR is opened against your original branch for review and merge.
  </Card>

  <Card title="GitLab" icon="gitlab">
    Docstrings are committed to a new branch and a follow-up PR is opened against your original branch for review and merge.
  </Card>

  <Card title="Azure DevOps" icon="microsoft">
    Docstrings are committed to a new branch and a follow-up PR is opened against your original branch for review and merge.
  </Card>

  <Card title="Bitbucket Cloud / Server" icon="bitbucket">
    Docstrings are posted as a PR comment for manual application. Branch-and-PR workflow is not supported on this platform.
  </Card>
</CardGroup>

## Language support

Docstring generation supports 18+ languages via [ast-grep](https://ast-grep.github.io/):

Bash, C, C++, C#, Elixir, Go, Java, JavaScript, Kotlin, Lua, PHP, Python, React TypeScript, Ruby, Rust, Swift, TypeScript

Language support is provided by `ast-grep`. If your language is missing, consider making a contribution following the `ast-grep` [language addition guide](https://ast-grep.github.io/contributing/add-lang.html#add-new-language-to-ast-grep).

## Configure per-directory styles

Different parts of your codebase need different documentation approaches. Use path-based instructions to match your team's standards:

```yaml .coderabbit.yaml wrap theme={null}
code_generation:
  docstrings:
    path_instructions:
      - path: "src/**/*.ts"
        instructions: |
          Use TSDoc format with @param, @returns, and @example tags.
          Include code examples for public API functions.
          Focus on behavior and edge cases.
      - path: "**/*test*"
        instructions: |
          Describe test purpose and expected behavior.
          Keep docstrings concise - focus on what is being tested.
      - path: "scripts/**/*.py"
        instructions: |
          Use Google-style docstrings with Args and Returns sections.
          Include usage examples for utility scripts.
      - path: "models/**/*.py"
        instructions: |
          Document database models with field descriptions and relationships.
          Include example queries and common usage patterns.
```

Path patterns use [minimatch](https://github.com/isaacs/minimatch) syntax to target specific directories, file types, or naming conventions.

### Common configuration examples

```yaml Frontend components wrap theme={null}
- path: "components/**/*.tsx"
  instructions: "Document props, usage examples, and accessibility considerations"
```

```yaml API endpoints wrap theme={null}
- path: "api/**/*.{js,ts}"
  instructions: "Document request/response formats, status codes, and error handling"
```

```yaml Utility functions wrap theme={null}
- path: "utils/**/*"
  instructions: "Focus on input validation, return types, and edge case behavior"
```

```yaml Database models wrap theme={null}
- path: "models/**/*.py"
  instructions: "Document fields, relationships, and include example queries"
```

## Reviewing generated docstrings

When CodeRabbit opens a docstring PR, focus your review on:

**Content accuracy:**

* Parameter descriptions match actual function behavior
* Return value documentation reflects real outputs
* Edge cases and error conditions are correctly described

**Format consistency:**

* Generated format matches your codebase conventions
* Examples use appropriate syntax for your language
* Terminology aligns with your project's vocabulary

**Completeness:**

* All parameters are documented with appropriate detail
* Complex functions include usage examples
* Error conditions and exceptions are covered

Most generated docstrings need minimal adjustment. Common tweaks include refining parameter descriptions or adding project-specific terminology.

## Technical implementation

CodeRabbit uses [ast-grep](https://ast-grep.github.io/) for precise code parsing across different programming languages and coding styles. This enables accurate function detection while respecting your code structure and automatically detecting your preferred docstring format.

## What's next

<CardGroup>
  <Card title="Finishing Touches overview" href="/finishing-touches" icon="sparkles">
    See all available finishing touches and how to trigger them from any PR
  </Card>

  <Card title="Autofix" href="/finishing-touches/autofix" icon="wrench">
    Automatically implement fixes for unresolved CodeRabbit review findings
  </Card>

  <Card title="Custom recipes" href="/finishing-touches/custom-finishing-touches" icon="scroll">
    Define reusable, named recipes that encode your team's repeated tasks into one-click agentic actions
  </Card>
</CardGroup>


# Fix CI failures
Source: https://docs.coderabbit.ai/finishing-touches/fix-ci

Automatically fix failing CI checks with a stacked pull request or a direct commit.

<GitHubBadge /> | <ProPlusPlanBadge /> <OpenBetaBadge />

Failing CI checks stall a pull request and often send you digging through job logs to find what broke. When CI fails on a PR, you can ask CodeRabbit to investigate the failing checks and fix them for you. It reads the failing checks and their output, works through the fix in a sandbox, and opens a stacked pull request by default. You can instead request a direct commit to the current branch.

## Platform support

Fix CI failures is available on GitHub only.

<CardGroup>
  <Card title="GitHub" icon="github">
    GitHub Cloud and GitHub Enterprise Server (self-hosted).
  </Card>
</CardGroup>

## Usage

On supported GitHub pull requests, CodeRabbit can show two **Fix failing CI** delivery options in the **✨ Finishing Touches** section of the <Hint type="walkthrough" /> comment when it detects failing CI checks:

* **Create stacked PR:** Open a pull request containing the generated fixes, targeting the current pull request branch.
* **Commit on current branch:** Commit the generated fixes directly to the pull request branch.

The options are mutually exclusive; selecting either one starts a single Fix CI run.

You can also trigger either delivery mode by commenting on a pull request that has failing CI checks:

<Tabs>
  <Tab title="Stacked pull request">
    ```text theme={null}
    @coderabbitai fix-ci
    ```
  </Tab>

  <Tab title="Direct commit">
    ```text theme={null}
    @coderabbitai fix-ci commit
    ```
  </Tab>
</Tabs>

Both delivery modes run the same investigation and generation flow. Only the destination for the generated fixes changes.

You can also ask CodeRabbit to fix CI in natural language. CodeRabbit opens a stacked pull request by default; if you explicitly ask it to commit directly, commit to the current branch, or avoid a stacked pull request, it uses the direct-commit path instead.

<Info>
  The checkbox options appear only when CodeRabbit detects failing CI checks during or shortly after review. If they are not present and the commands are available, use `@coderabbitai fix-ci` or `@coderabbitai fix-ci commit` manually. If neither trigger is available, see [Troubleshooting](#troubleshooting).
</Info>

## How it works

<Steps>
  <Step title="Trigger">
    Choose **Create stacked PR** or **Commit on current branch** in the Walkthrough comment. You can also comment `@coderabbitai fix-ci` for a stacked pull request or `@coderabbitai fix-ci commit` for a direct commit. CodeRabbit collects the checks reported as failing on the PR's head commit.
  </Step>

  <Step title="Investigate">
    CodeRabbit clones the repository into a sandbox and gathers context for the failing checks: the available failure output and the relevant CI configuration for the jobs that ran. This tells the agent what failed and how each job is invoked, rather than guessing from the check name alone.
  </Step>

  <Step title="Fix">
    A coding agent works directly in the repository, reading files and editing code to address the failures. It focuses on the code under test: infrastructure and configuration files (CI and build config, lock files, and other dependency manifests) are left out of the change and surfaced separately so you can apply them yourself if they are genuinely needed.
  </Step>

  <Step title="Deliver">
    CodeRabbit either opens a stacked pull request targeting the current branch or commits the fix directly to that branch, based on the selected checkbox or command. The status comment lists the failing checks it addressed and the files it changed.
  </Step>
</Steps>

Your project's real CI runs against the resulting commit or stacked pull request. That run is the source of truth for whether the failures are actually resolved.

## Re-running the fix

Re-running Fix CI behaves like a retry, and where the changes land depends on which pull request you trigger it from:

* **Stacked pull request:** Use `@coderabbitai fix-ci` or **Create stacked PR** on the original pull request to open a separate pull request for the current failures.
* **Direct commit:** Use `@coderabbitai fix-ci commit` or **Commit on current branch** to add the next fix to the current pull request branch.
* **Retry on a CodeRabbit-created stacked pull request:** CodeRabbit commits the next fix directly to that pull request instead of creating an endlessly growing stack.

## Scope and limitations

* **GitHub only.** Fix CI failures is not available on GitLab, Azure DevOps, or Bitbucket.
* **Delivery options depend on repository access.** Direct commit requires permission to write to the pull request branch. Stacked delivery requires permission to create a branch and pull request.
* **Target-branch CI filters can affect stacked pull requests.** If your CI only runs on pull requests targeting specific branches (for example `main`), it may not run on the stacked pull request itself. Merge the stacked pull request into your branch so CI validates on the original pull request.
* **Infrastructure and dependency files are not committed.** Changes the agent makes to CI/build config, lock files, or other dependency manifests are excluded from the delivered changes and listed in the status comment so you can apply them manually.
* **Workflow files are excluded.** CodeRabbit cannot commit changes under `.github/workflows/`. If a fix requires editing a workflow file, it is surfaced in the status comment for you to apply.

## Command reference

```text theme={null}
@coderabbitai fix-ci
@coderabbitai fix-ci commit
```

The stacked-pull-request command also accepts `@coderabbitai fix ci` and `@coderabbitai fixci`. Add `commit` to any of these commands to request a direct commit.

## Configuration

Fix CI failures is enabled by default for eligible repositories. To turn it off, set the following in your `.coderabbit.yaml`:

```yaml theme={null}
reviews:
  finishing_touches:
    fix_ci:
      enabled: false
```

## Troubleshooting

<AccordionGroup>
  <Accordion title="The fix-ci command or checkbox isn't available" icon="circle-alert">
    Fix CI failures requires a Pro Plus plan and is available on GitHub only. Confirm the repository is on a Pro Plus plan and that the pull request is on GitHub. If it was turned off in configuration, set `reviews.finishing_touches.fix_ci.enabled` to `true`. The checkbox options appear only when CodeRabbit detects failing CI checks during review or shortly after the review finishes. If your CI fails later, the options may not appear; use `@coderabbitai fix-ci` or `@coderabbitai fix-ci commit` manually if the commands are available.
  </Accordion>

  <Accordion title="The agent only changed configuration files" icon="triangle-alert">
    Infrastructure, CI/build config, and dependency files are intentionally left out of direct commits and stacked pull requests. If the only changes the agent produced were out of scope, no fix commit or pull request is created; the status comment lists the files it touched so you can apply them manually.
  </Accordion>

  <Accordion title="The stacked PR's CI still fails" icon="git-pull-request-closed">
    The stacked pull request runs your real CI, which may surface remaining or new failures. Trigger Fix CI on the stacked pull request to have CodeRabbit commit another fix directly to it, or use `@coderabbitai fix-ci` on your original pull request to open a fresh stacked pull request. You can also choose one of the **Fix failing CI** delivery options when available or resolve the remaining failures manually.
  </Accordion>
</AccordionGroup>

## What's next

<CardGroup>
  <Card title="Finishing Touches overview" href="/finishing-touches" icon="sparkles">
    See all available finishing touches and how to trigger them from any PR
  </Card>

  <Card title="Autofix" href="/finishing-touches/autofix" icon="wrench">
    Automatically implement fixes for unresolved CodeRabbit review findings
  </Card>

  <Card title="Resolve merge conflicts" href="/finishing-touches/resolve-merge-conflict" icon="git-merge">
    Let CodeRabbit analyze the intent behind conflicting changes and commit a clean resolution to your branch
  </Card>
</CardGroup>


# Finishing Touches overview
Source: https://docs.coderabbit.ai/finishing-touches/index

One-click agentic actions that polish and extend your pull requests or merge requests: fix review findings, resolve merge conflicts, generate unit tests, simplify code, run any custom recipes.

<ProPlanBadge />

<ProPlusPlanBadge />

Finishing Touches are a set of post-review actions that CodeRabbit can perform on your behalf. After a review completes, you can trigger a finishing touch by posting a command in the review conversation and, on supported GitHub flows, by checking a box in the Walkthrough comment. CodeRabbit runs the action in a sandboxed environment and delivers the output as a commit or a follow-up pull request, depending on the action and platform.

Look for the **✨ Finishing Touches** section in the CodeRabbit <Hint type="walkthrough" /> comment; it lists every action available for the current review. If a specific Finishing Touch is not present, it might not be available on your platform or included in your plan (some Touches require <ProPlusPlanBadge />).

## Available finishing touches

<CardGroup>
  <Card icon="wrench" href="/finishing-touches/autofix">
    ### Autofix<GitHubBadge /> <GitLabBadge /> <AzureBadge /> <BitbucketBadge title="Bitbucket Cloud" /> | <ProPlanBadge />

    Automatically implement fixes for unresolved CodeRabbit review findings.
    Push a commit to your branch or open a stacked pull request.
  </Card>

  <Card icon="list-checks" href="/finishing-touches/fix-ci">
    ### Fix CI failures<GitHubBadge /> | <ProPlusPlanBadge /> <OpenBetaBadge />

    Investigate failing CI checks, then open a stacked pull request or commit the fixes directly.
  </Card>

  <Card icon="book" href="/finishing-touches/docstrings">
    ### Generate docstrings<AllPlatformsBadge /> | <ProPlanBadge />

    Scan your PR for functions missing documentation and generate format-aware
    docstrings delivered as a separate PR. Supports 18+ languages.
  </Card>

  <Card icon="git-merge" href="/finishing-touches/resolve-merge-conflict">
    ### Resolve merge conflicts<GitHubBadge /> <GitLabBadge /> | <ProPlusPlanBadge />

    Detect and resolve merge conflicts by analyzing the intent behind both sets
    of changes, then commit the result as a proper merge commit.
  </Card>

  <Card icon="test-tube" href="/finishing-touches/unit-test-generation">
    ### Generate unit tests<GitHubBadge /> <GitLabBadge /> | <ProPlusPlanBadge />

    Analyze your code changes and produce comprehensive unit tests, including
    edge cases and error conditions, using your project's existing frameworks.
  </Card>

  <Card icon="sparkles" href="/finishing-touches/simplify">
    ### Simplify code<GitHubBadge /> | <ProPlusPlanBadge />

    Review your changed code for opportunities to simplify, improve reuse,
    quality, and efficiency, then apply targeted improvements automatically.
  </Card>

  <Card icon="scroll" href="/finishing-touches/custom-finishing-touches">
    ### Custom recipes<GitHubBadge /> <GitLabBadge /> | <ProPlusPlanBadge />

    Define reusable, named recipes in your config that encode your team's
    repeated tasks: import ordering, type tightening, changelog entries, and more.
  </Card>
</CardGroup>

## Platform support

| Platform              | Available finishing touches                                                                                                |
| --------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| GitHub                | Autofix, Fix CI failures, Generate docstrings, Resolve merge conflicts, Generate unit tests, Simplify code, Custom recipes |
| GitLab                | Autofix, Generate docstrings, Resolve merge conflicts, Generate unit tests, Custom recipes                                 |
| Azure DevOps          | Autofix, Generate docstrings                                                                                               |
| Bitbucket Cloud       | Autofix, Generate docstrings                                                                                               |
| Bitbucket Data Center | Generate docstrings                                                                                                        |

## How to trigger

Available triggers depend on the feature and platform:

| Method             | How                                                                                        | Where                                                        |
| ------------------ | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------ |
| **Review comment** | Comment a command like `@coderabbitai generate docstrings`                                 | Supported command-capable platforms for that Finishing Touch |
| **Checkbox**       | Check the box in the **✨ Finishing Touches** section of the CodeRabbit Walkthrough comment | GitHub PRs                                                   |

See each feature page for the exact commands and platform support details.

## Quick reference

| Finishing touch         | Trigger                                                                   | Output                                                                                 |
| ----------------------- | ------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
| Generate docstrings     | `@coderabbitai generate docstrings`                                       | New pull request with docstrings                                                       |
| Generate unit tests     | `@coderabbitai generate unit tests` or GitHub checkbox                    | Pull request or commit on branch                                                       |
| Simplify code           | GitHub checkbox                                                           | New pull request or commit on branch                                                   |
| Autofix                 | `@coderabbitai autofix`                                                   | Commit on branch or stacked pull request                                               |
| Fix CI failures         | `@coderabbitai fix-ci`, `@coderabbitai fix-ci commit`, or GitHub checkbox | Stacked pull request or commit on branch                                               |
| Custom recipes          | `@coderabbitai run <recipe name>` or GitHub checkbox                      | Stacked pull request by default; direct commit when the recipe explicitly asks for one |
| Resolve merge conflicts | `@coderabbitai fix merge conflict`                                        | Merge commit on branch                                                                 |

## What's next

<CardGroup>
  <Card title="Autofix" href="/finishing-touches/autofix" icon="wrench">
    Automatically implement fixes for unresolved review findings and push them as a commit or stacked pull request
  </Card>

  <Card title="Custom recipes" href="/finishing-touches/custom-finishing-touches" icon="scroll">
    Define reusable, named recipes that encode your team's repeated tasks into one-click agentic actions
  </Card>

  <Card title="Resolve merge conflicts" href="/finishing-touches/resolve-merge-conflict" icon="git-merge">
    Let CodeRabbit analyze the intent behind conflicting changes and commit a clean resolution to your branch
  </Card>
</CardGroup>


# Resolve Merge Conflicts
Source: https://docs.coderabbit.ai/finishing-touches/resolve-merge-conflict

Automatically detect and resolve merge conflicts in pull requests with a single click or comment.

<OpenBetaBadge />

<ProPlusPlanBadge />

Merge conflicts interrupt review momentum and often require context-switching between branches to understand what each side was trying to accomplish. CodeRabbit detects conflicts during PR review and can resolve them automatically: it analyzes the intent behind both sets of changes and commits the result as a proper merge commit to your branch.

## Platform support

Merge conflict resolution is available on the following platforms:

<CardGroup>
  <Card title="GitHub" icon="github" />

  <Card title="GitLab" icon="gitlab" />
</CardGroup>

## Usage

When CodeRabbit detects conflicts, it adds a resolution option to the PR summary comment.

<CardGroup>
  <Card title="PR comment command" icon="message-square-code">
    Comment `@coderabbitai resolve merge conflict` in any PR or merge request to trigger resolution on GitHub and GitLab
  </Card>

  <Card title="Finishing Touches checkbox" icon="square-check-big">
    On GitHub, check the **Resolve merge conflicts** box in the CodeRabbit Walkthrough for one-click resolution
  </Card>
</CardGroup>

Both methods commit the resolved changes directly to your branch.

<Info>
  Resolve Merge Conflicts is enabled by default. Repository administrators can disable it by setting `reviews.finishing_touches.resolve_merge_conflict.enabled` to `false`. When disabled, CodeRabbit removes the checkbox and command and declines direct requests. Set the option back to `true` to re-enable it.
</Info>

## How it works

<Steps>
  <Step title="Detection">
    During PR review, CodeRabbit simulates the merge in a sandbox without modifying your working tree. If conflicts are found, they are listed in the summary comment alongside the resolution trigger.
  </Step>

  <Step title="Intent analysis">
    When resolution is triggered, CodeRabbit clones the repository and examines each conflicting file. For each file, it determines what problem the changes on each branch were solving (not just what changed, but why), so the resolution reflects the actual goals of both sides.
  </Step>

  <Step title="Resolution">
    CodeRabbit uses an AI agent that reasons through each conflict from first principles. Rather than applying rules, it reads both versions of the conflicting code alongside the full context of what each branch was trying to accomplish, then makes a judgment call about what the correct unified outcome should be.

    The agent works directly inside the repository: inspecting git state, reading files, running git commands, and editing code. It can make changes beyond the conflict hunks themselves if the resolution requires it, for example, restructuring code to accommodate both sets of changes rather than just picking one. Where the correct resolution is genuinely ambiguous or involves security-critical logic, the agent explicitly declines and flags the conflict for manual review instead of guessing.
  </Step>

  <Step title="Validation">
    CodeRabbit verifies that no conflict markers remain, that the merge index is fully cleared, and runs the repository's build and lint commands to surface any errors introduced by the resolution.
  </Step>

  <Step title="Commit">
    The resolved changes are committed to your branch as a proper merge commit with two parents (your branch and the base branch), so git history accurately reflects the merge.
  </Step>
</Steps>

## When CodeRabbit won't auto-resolve

CodeRabbit will decline to resolve a conflict if doing so incorrectly could cause serious harm:

* **Security-critical code:** authentication logic, encryption, secrets handling, or access control
* **Fundamentally incompatible business logic:** where both changes make mutually exclusive architectural decisions that a human needs to decide

When this happens, the entire resolution attempt is aborted and no commit is created for any files. CodeRabbit posts a comment identifying which file it declined and the specific reason.

The bar for declining is intentionally high. CodeRabbit will attempt to resolve the vast majority of conflicts automatically.

## Command reference

```text theme={null}
@coderabbitai resolve merge conflict
```

## Configuration

Resolving merge conflicts is enabled by default for eligible repositories. To turn it off, set the following in your `.coderabbit.yaml`:

```yaml theme={null}
reviews:
  finishing_touches:
    resolve_merge_conflict:
      enabled: false
```

When disabled, the **Resolve merge conflicts** checkbox is hidden from the Walkthrough, the `@coderabbitai resolve merge conflict` command is removed from `@coderabbitai help`, and CodeRabbit declines resolution requests.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Resolution failed: branch was updated during the process" icon="git-branch">
    If your branch receives a new commit while resolution is running, CodeRabbit aborts to avoid overwriting the incoming changes. Wait for the branch to stabilize, then trigger resolution again.
  </Accordion>

  <Accordion title="Some conflicts were not resolved" icon="circle-alert">
    If CodeRabbit declines to resolve any file, no commit is created, not even for the files it could resolve. Check the resolution comment for the declined files and the specific reason for each. Resolve those files manually, push the changes, then trigger resolution again for the remaining conflicts.
  </Accordion>

  <Accordion title="Resolution ran but nothing was committed" icon="triangle-alert">
    This can occur if the agent could not produce a clean staged result. Try triggering resolution again. If it happens repeatedly, resolve the conflicts manually.
  </Accordion>
</AccordionGroup>

## What's next

<CardGroup>
  <Card title="Finishing Touches overview" href="/finishing-touches" icon="sparkles">
    See all available finishing touches and how to trigger them from any PR
  </Card>

  <Card title="Autofix" href="/finishing-touches/autofix" icon="wrench">
    Automatically implement fixes for unresolved CodeRabbit review findings
  </Card>

  <Card title="Custom recipes" href="/finishing-touches/custom-finishing-touches" icon="scroll">
    Define reusable, named recipes that encode your team's repeated tasks into one-click agentic actions
  </Card>
</CardGroup>


# Simplify code
Source: https://docs.coderabbit.ai/finishing-touches/simplify

Automatically review changed code for opportunities to simplify, improve reuse, quality, and efficiency, then apply targeted improvements.

<GitHubBadge /> | <OpenBetaBadge /> <ProPlusPlanBadge />

Simplify reviews the files changed in your pull request and applies targeted code improvements: extracting reusable functions, simplifying conditionals, removing redundant code — while preserving existing behavior. Use it when you want a quick code-quality pass after writing a feature or fix.

## Platform support

<CardGroup>
  <Card title="GitHub" icon="github">
    Simplify is currently available on GitHub pull requests through the CodeRabbit Walkthrough checkbox.
  </Card>
</CardGroup>

## Usage

Trigger Simplify using the **✨ Simplify code** checkbox in the CodeRabbit PR Walkthrough on GitHub.

## How it works

<Steps>
  <Step title="Trigger Simplify">
    Check **✨ Simplify code** in the CodeRabbit Walkthrough.
  </Step>

  <Step title="Analyze changed files">
    CodeRabbit clones your repository into a sandbox and diffs the PR branch
    against the base to identify all changed files.
  </Step>

  <Step title="Apply improvements">
    An AI agent reads each changed file, identifies simplification opportunities,
    and applies targeted edits: extracting reusable functions, simplifying
    conditionals, and removing redundant code without changing behavior.
  </Step>

  <Step title="Verify with tests">
    The agent runs your existing test suite to confirm no regressions were
    introduced by the changes.
  </Step>

  <Step title="Deliver the result">
    CodeRabbit either opens a new PR with the simplified code or commits the
    changes directly to your branch, depending on the option you select.
  </Step>
</Steps>

<Info>
  Simplify may take up to 20 minutes depending on the size of the pull request.
</Info>

## Output options

<Card title="Create a PR with simplified code" icon="git-pull-request-create-arrow">
  CodeRabbit opens a new pull request against your branch with the simplified
  changes. Review and merge it like any other PR.
</Card>

<Card title="Commit simplified code to branch" icon="git-commit-vertical">
  CodeRabbit commits the simplified code directly to your existing PR branch.
  Not available for fork PRs.
</Card>

## Scope and limitations

* Simplify is a **Pro+ plan** feature.
* The agent preserves existing behavior — it will not change public APIs, rename exported symbols, or alter test assertions.
* If your test suite fails after simplification, CodeRabbit still delivers the changes so you can review and iterate.

## What's next

<CardGroup>
  <Card title="Autofix" icon="wrench" href="/finishing-touches/autofix">
    Automatically implement fixes for unresolved CodeRabbit review findings
  </Card>

  <Card title="Generate unit tests" icon="test-tube" href="/finishing-touches/unit-test-generation">
    Generate comprehensive unit tests for your changed functions and methods
  </Card>

  <Card title="Generate docstrings" icon="book" href="/finishing-touches/docstrings">
    Add documentation to functions that are missing it
  </Card>
</CardGroup>


# Generate unit tests
Source: https://docs.coderabbit.ai/finishing-touches/unit-test-generation

Generate comprehensive unit tests automatically for your pull requests, including edge cases and error conditions.

<GitHubBadge /> <GitLabBadge /> | <OpenBetaBadge /> <ProPlusPlanBadge />

## Platform support

<CardGroup>
  <Card title="GitHub" icon="github">
    Use a PR comment command or the CodeRabbit Walkthrough checkbox.
  </Card>

  <Card title="GitLab" icon="gitlab">
    Use a merge request comment command.
  </Card>
</CardGroup>

<img alt="Unit Test Generation" />

AI coding tools let you write code 10x faster, but comprehensive testing still happens manually. CodeRabbit bridges this gap by analyzing your code changes and generating sophisticated unit tests that understand your project's patterns, testing frameworks, and edge cases.

<CardGroup>
  <Card title="PR comment command" icon="message-square-code">
    Type `@coderabbitai generate unit tests` in a GitHub pull request or GitLab merge request comment to generate tests automatically
  </Card>

  <Card title="UI checkbox" icon="square-check-big">
    On GitHub, use the **Generate unit tests** checkbox in the CodeRabbit Walkthrough for one-click generation
  </Card>
</CardGroup>

## How it works

<Steps>
  <Step title="Request test generation">
    Comment `@coderabbitai generate unit tests` in your PR or merge request. On GitHub, you can also check the box in the CodeRabbit Walkthrough.
  </Step>

  <Step title="Context-aware analysis">
    CodeRabbit examines your code changes with full context - understanding your
    testing frameworks, existing patterns, and team guidelines from previous
    reviews to identify what needs coverage
  </Step>

  <Step title="Intelligent test generation">
    Tests are generated based on your project's specific context, including
    proper mocking strategies, framework conventions, and edge cases that matter
    for your codebase
  </Step>

  <Step title="Choose delivery method">
    Receive tests in a separate PR or as a new commit on your current PR
    branch
  </Step>

  <Step title="Automatic CI integration">
    For separate PRs, CodeRabbit analyzes available CI workflows and fixes build failures, import errors, and dependency issues automatically
  </Step>
</Steps>

CodeRabbit's test generation goes beyond basic templates. It understands your project's testing patterns and generates tests that actually integrate with your existing test suite.

## Output delivery options

<Tabs>
  <Tab title="Separate PR">
    **Recommended for most teams** CodeRabbit creates a new pull request
    containing all generated tests. This approach keeps your feature PR focused
    while allowing independent review of test code. **Key advantage**:
    CodeRabbit automatically fixes CI/CD integration issues. If tests fail due
    to missing dependencies, import errors, or configuration problems,
    CodeRabbit analyzes your GitHub Actions logs and pushes fixes. This means
    you get working tests, not just test code that looks right.
  </Tab>

  <Tab title="Same PR commit">
    Tests are added as a new commit to your existing pull request. This keeps
    feature code and tests together but expands your PR scope. Good for smaller
    changes where you want everything reviewed together.
  </Tab>
</Tabs>

## Path-specific customization

Configure test generation for different parts of your codebase using `.coderabbit.yaml`:

```yaml theme={null}
code_generation:
  unit_tests:
    path_instructions:
      - path: "**/*.ts"
        instructions: |
          Use vitest for testing framework.
          Generate comprehensive test cases including edge cases and error conditions.
          Include proper TypeScript types in test expectations.
      - path: "**/api/**"
        instructions: |
          Focus on request/response validation and error handling.
          Mock external API calls using MSW.
          Test authentication middleware and rate limiting.
      - path: "**/components/**"
        instructions: |
          Use React Testing Library for component tests.
          Test user interactions, accessibility, and error boundaries.
          Mock complex props and verify state changes.
```

These instructions become part of CodeRabbit's context for future test generation, continuously improving test quality and consistency across your codebase.

## What's next

<CardGroup>
  <Card title="Finishing Touches overview" href="/finishing-touches" icon="sparkles">
    See all available finishing touches and how to trigger them from any PR
  </Card>

  <Card title="Autofix" href="/finishing-touches/autofix" icon="wrench">
    Automatically implement fixes for unresolved CodeRabbit review findings
  </Card>

  <Card title="Resolve merge conflicts" href="/finishing-touches/resolve-merge-conflict" icon="git-merge">
    Let CodeRabbit analyze the intent behind conflicting changes and commit a clean resolution to your branch
  </Card>
</CardGroup>


# Quickstart
Source: https://docs.coderabbit.ai/getting-started/quickstart

Get CodeRabbit up and running in 2 minutes. Connect your repositories and start receiving AI-powered code reviews and Coding Plans.

<Info>
  **Want a guided tour?** Explore key features with our [hands-on guide](/guide)
  using a provided demo project.
</Info>

## Initial Setup

<Steps>
  <Step title="Sign up with your Git platform">
    Use your existing GitHub, GitLab, Azure DevOps, Bitbucket Cloud, or Bitbucket Data Center account to [create your CodeRabbit account](https://app.coderabbit.ai/login?free-trial=). No credit card required!
  </Step>

  <Step title="Add your repositories">
    [Add repositories](https://app.coderabbit.ai/settings/repositories) that CodeRabbit should review. You control exactly which repos have access. For detailed instructions, choose your Git platform below.

    <CardGroup>
      <Card title="GitHub.com" icon="github" href="/platforms/github-com">
        Public or private GitHub repositories
      </Card>

      <Card title="GitHub Enterprise Server" icon="github" href="/platforms/github-enterprise-server">
        GitHub integration for enterprise teams
      </Card>

      <Card title="GitLab.com" icon="gitlab" href="/platforms/gitlab-com">
        Integrate with cloud GitLab.com
      </Card>

      <Card title="Self-managed GitLab" icon="gitlab" href="/platforms/self-hosted-gitlab">
        Connect your self-hosted GitLab instance
      </Card>

      <Card title="Azure DevOps" icon="microsoft" href="/platforms/azure-devops">
        Seamless integration with Microsoft Azure DevOps
      </Card>

      <Card title="Bitbucket Cloud" icon="bitbucket" href="/platforms/bitbucket-cloud">
        AI code reviews for your Bitbucket Cloud repositories
      </Card>

      <Card title="Bitbucket Data Center" icon="bitbucket" href="/platforms/bitbucket-data-center">
        Connect your self-hosted Bitbucket Data Center instance
      </Card>
    </CardGroup>
  </Step>
</Steps>

## What's Next

You're all set! Here's what you can do now:

<CardGroup>
  <Card title="Pull Request Reviews" icon="git-pull-request" href="/overview/pull-request-review">
    Open a pull request and get actionable AI feedback within minutes.
  </Card>

  <Card title="IDE & CLI Reviews" icon="laptop" href="/overview/ide-cli-review">
    Review uncommitted changes in VS Code, Cursor, Windsurf, or from the command
    line.
  </Card>
</CardGroup>

<Card title="CodeRabbit Plan" icon="list-check" href="/overview/coderabbit-plan">
  Create precise Coding Plans from issues, PRDs, designs, or free-form text —
  grounded in your codebase.
</Card>

<Info>
  CodeRabbit provides highly valuable feedback right from the start, but you can get even more by explaining your team standards, code style agreements and project specifics.

  Explore [language-specific examples](/configuration/example) and [hands-on guide](/guide) to make yourself familiar with most important features and settings.
</Info>

## Want a guided walkthrough?

New to CodeRabbit? Follow our [Hands-on Guide](/guide) to explore key features step-by-step using a test repository. You'll learn how to:

* See CodeRabbit perform an automated code review
* Chat with CodeRabbit about its feedback
* Generate code improvements automatically

<Card title="Start the Hands-on Guide" icon="map" href="/guide">
  A step-by-step walkthrough of CodeRabbit's core features
</Card>


# Configuration via YAML file
Source: https://docs.coderabbit.ai/getting-started/yaml-configuration

Learn how to configure CodeRabbit using a YAML file for advanced customization.

In this guide, we will cover the configuration using a YAML file. For the complete list of available options, see the [Configuration Reference](/reference/configuration). For ready-to-use examples tailored to specific frameworks and languages, see [Configuration Examples](/configuration/example).

<Info>
  Move existing UI configuration to a YAML file?

  Use the `@coderabbitai configuration` command on any PR to get the resolved configuration in YAML format. The response includes source comments that show where settings came from, such as repository YAML, central configuration, UI settings, defaults, global overrides, etc. You can then copy the configuration to a `.coderabbit.yaml` file in the root of your repository.
</Info>

## Configure CodeRabbit using a YAML File

`.coderabbit.yaml` configuration file must be located in the root of the repository. The configuration present in the feature branch under review will be automatically detected and used by CodeRabbit for that review.

### Example Configuration

```yaml .coderabbit.yaml theme={null}
language: "en-US"
reviews:
  profile: "chill"
  request_changes_workflow: false
  high_level_summary: true
  poem: true
  review_status: true
  review_details: false
  auto_review:
    enabled: true
    drafts: false
chat:
  auto_reply: true
```

## Configuration Options

The configuration file supports numerous options for customizing CodeRabbit's behavior. For the complete list of available configuration options and their descriptions, see the [configuration reference](/reference/configuration#reference).

<CardGroup>
  <Card title="Configuration Reference" icon="book" href="/reference/configuration">
    Complete documentation of all options
  </Card>

  <Card title="Configuration Examples" icon="file-code" href="/configuration/example">
    Ready-to-use examples for popular frameworks and languages
  </Card>
</CardGroup>

## Shared configuration

If you are self-hosting CodeRabbit in an air-gapped environment, you can use the shared configuration feature to share the configuration across multiple repositories.

You can either reference a publicly accessible configuration file via URL or reference a configuration file that CodeRabbit can read through the same platform connection it uses for reviews.

To use shared configuration, you need to:

1. Create a `.coderabbit.yaml` file and host it in a location that is either publicly accessible (e.g., a web server or public GitHub Gist) or in a repository that the CodeRabbit bot can read on the same platform as the repository under review.
2. Create a `.coderabbit.yaml` file in the root of your repository with the following content:

<Tabs>
  <Tab title="GitHub">
    GitHub repositories use the repository format.

    ```yaml theme={null}
    remote_config:
      repository: "shared-configs"
      ref: "main"
      path: ".shared-coderabbit.yaml"
    ```
  </Tab>

  <Tab title="GitLab">
    GitLab repositories use the full namespace path.

    ```yaml theme={null}
    remote_config:
      repository: "your_org_name/shared_configs"
      ref: "main"
      path: ".shared-coderabbit.yaml"
    ```
  </Tab>

  <Tab title="External URL (not recommended)">
    <Warning>
      Shared configuration via URL is not recommended, as it may expose sensitive configuration details. Use the repository file configuration, [Central Configuration](/configuration/central-configuration) for managing configurations across multiple repositories, and [Configuration Inheritance](/configuration/configuration-inheritance) for reusing configurations across different layers.
    </Warning>

    ```yaml theme={null}
    remote_config:
      url: "https://your-config-location/.coderabbit.yaml"
    ```
  </Tab>
</Tabs>


# Interactive code review chat
Source: https://docs.coderabbit.ai/guide/chat

Learn how to interact with CodeRabbit through conversations and get clarifications on its feedback

<Steps>
  <Step icon="circle-check-big" title="Integrate CodeRabbit into a GitHub repository that you own" />

  <Step icon="circle-check-big" title="Observe CodeRabbit perform a code review of a pull request that you initiate" />

  <Step title=">>> Converse with CodeRabbit about the code review" />

  <Step title="Prompt CodeRabbit to generate its own improvements to the pull request" />
</Steps>

## Engage in interactive dialogue

One of CodeRabbit's most powerful features is its ability to engage in natural, context-aware conversations about your code. Rather than just receiving static feedback, you can ask follow-up questions, request clarifications, challenge recommendations, or explore alternative approaches.

This interactivity transforms code review into a collaborative dialogue, helping you understand not just *what* to change, but *why* changes are recommended.

## Ask CodeRabbit for clarification

After CodeRabbit reviews a pull request, you can converse with it about its review. You can question its recommendations, ask for explanations, or request it to adjust its review approach for your project's specific needs.

1. Post the following as a new GitHub comment attached to the pull request:

   ```text Chat in PR wrap theme={null}
   @coderabbitai Why do all of these functions need docstrings? Isn't it obvious enough what they do?
   ```

   After a few moments, CodeRabbit posts its reply, explaining its motivations for its recommendation. The reply might resemble the following:

   > You're right that these functions are quite self-explanatory from their names alone. Docstrings aren't strictly necessary for every function, especially in smaller projects with clear function names.
   >
   > While docstrings do provide benefits (IDE tooltips, documentation generation, help for future developers), they can sometimes feel redundant for very straightforward functions. It's ultimately a matter of coding style and project requirements.
   >
   > If you prefer to skip docstrings for obvious utility functions in this project, that's perfectly reasonable. Would you like me to adjust my review approach regarding documentation for this repository?

   In this case, CodeRabbit is offering to adjust its future behavior when reviewing changes to this repository. Instead, follow the next step to ask CodeRabbit to implement part of its suggestions.

## What you can discuss with CodeRabbit

CodeRabbit can engage in various types of conversations about your code:

* **Question recommendations** - Ask why certain changes were suggested
* **Explore alternatives** - Discuss different approaches to solving the same problem
* **Request context** - Get explanations about best practices or design patterns
* **Clarify implementation details** - Understand how to apply suggestions in your specific context
* **Discuss trade-offs** - Explore the pros and cons of different solutions

<Tip>
  You can mention CodeRabbit using `@coderabbitai` in any pull request comment
  to start a conversation. It understands the context of your entire pull
  request and can reference specific files, functions, or previous comments in
  its responses.
</Tip>


# Code Review
Source: https://docs.coderabbit.ai/guide/code-review

Experience CodeRabbit's automated code review by creating your first pull request

<Steps>
  <Step icon="circle-check-big" title="Integrate CodeRabbit into a GitHub repository that you own" />

  <Step title=">>> Observe CodeRabbit perform a code review of a pull request that you initiate" />

  <Step title="Converse with CodeRabbit about the code review" />

  <Step title="Prompt CodeRabbit to generate its own improvements to the pull request" />
</Steps>

## Create a pull request

Now that CodeRabbit is integrated with your repository, it's time to see it in action. You'll create a pull request with intentionally imperfect code to demonstrate how CodeRabbit identifies issues and provides actionable feedback.

The following steps guide you through creating a pull request that adds a small Python library with a few common code quality issues.

Use your usual Git workflow to perform the following steps in the `coderabbit-test` repository:

<Steps>
  <Step title="Create a branch">
    Create a branch named `add-utils`.
  </Step>

  <Step title="Create a new file">
    In that new `add-utils` branch, create a new file called `simple_utils.py`, with the following content:

    ```python theme={null}
    # simple_utils.py - A tiny utility library

    def reverse_string(text):
        """Reverses the characters in a string."""
        return text[::-1]

    def count_words(sentence):
        return len(sentence.split())

    def celsius_to_fahrenheit(celsius):
        return (celsius * 9/5) + 32
    ```
  </Step>

  <Step title="Commit the file">
    Commit the added file to the `add-utils` branch. Use any text you want for the commit message.
  </Step>

  <Step title="Create a pull request">
    Create a pull request that proposes to merge the `add-utils` branch into the `main` branch. Use any text you want for the pull request message.
  </Step>
</Steps>

After a few moments, CodeRabbit responds to the pull request using the `@coderabbitai` GitHub account. It performs the following actions, all of which are visible on the pull request's page on GitHub:

* If you didn't write a pull request summary, then CodeRabbit adds a new summary to the pull request.
* CodeRabbit posts a comment titled <Hint type="walkthrough" /> containing analysis and commentary about the content of the pull request.
* CodeRabbit attaches a detailed code review to the pull request as another comment.

Part of the review resembles the following screenshot:

<img alt="An example code review comment" />

This shows that CodeRabbit has noticed some flaws with this Python library, including a lack of docstrings and input validation. The review comment identifies these flaws, and suggests how you might improve them.


# You're Ready to Ship Better Code!
Source: https://docs.coderabbit.ai/guide/complete

Congratulations! You've completed the CodeRabbit hands-on guide and experienced AI-powered code reviews firsthand

<Steps>
  <Step icon="circle-check-big" title="Integrate CodeRabbit into a GitHub repository that you own" />

  <Step icon="circle-check-big" title="Observe CodeRabbit perform a code review of a pull request that you initiate" />

  <Step icon="circle-check-big" title="Converse with CodeRabbit about the code review" />

  <Step icon="circle-check-big" title="Prompt CodeRabbit to generate its own improvements to the pull request" />
</Steps>

## What you've accomplished

In just a few minutes, you've experienced the core capabilities that make CodeRabbit a powerful addition to your development workflow:

* **Automated code review** - Saw how CodeRabbit analyzes your code changes and identifies potential improvements
* **Interactive conversations** - Engaged in meaningful dialogue with an AI reviewer that understands your code
* **Code generation** - Witnessed CodeRabbit automatically create improvements, from documentation to code changes
* **Hands-on experience** - Completed a full cycle from integration to automated code improvements

These are the same features that development teams use every day to maintain code quality, reduce review time, and ship with confidence.

## Take it further

Continue experimenting with CodeRabbit in your `coderabbit-test` repository for as long as you like. Try creating more pull requests, asking different questions, or exploring other commands.

When you're ready, you can delete the test repository and start integrating CodeRabbit into your real projects.

<Tip>
  The skills you've learned in this guide apply directly to your production
  repositories. CodeRabbit adapts to each project's unique context, coding
  standards, and best practices.
</Tip>

## Your next steps

Now that you've seen CodeRabbit in action, here's how to maximize its value in your workflow:

### Essential integrations

* **[Add CodeRabbit to your repositories](/platforms/)** - Integrate with GitHub, GitLab, Azure DevOps, or Bitbucket
* **[Install the IDE extension](/ide)** - Get CodeRabbit directly in VS Code, Cursor, or Windsurf
* **[Try the CLI tool](/cli/)** - Review code changes before committing them. Works with Claude Code!

### Customize your experience

* **[Configure CodeRabbit behavior](/getting-started/yaml-configuration)** - Tailor reviews to your project's needs
* **[Set up path-based instructions](/configuration/path-instructions)** - Apply different rules to different parts of your codebase

### Get help when you need it

* **[Explore all commands](/guides/commands)** - Discover the full range of CodeRabbit capabilities
* **[Review best practices](/guides/code-review-overview)** - Learn how to get the most from automated code reviews
* **[Contact support](/support)** - Get help from the CodeRabbit team

## Welcome to better code reviews

You're now part of a community of developers who are shipping higher-quality code faster. Ready to experience AI-powered code reviews on your real projects? Start by adding CodeRabbit to your next repository!


# Improvements
Source: https://docs.coderabbit.ai/guide/improvements

Learn how to use CodeRabbit commands to automatically generate code improvements

<Steps>
  <Step icon="circle-check-big" title="Integrate CodeRabbit into a GitHub repository that you own" />

  <Step icon="circle-check-big" title="Observe CodeRabbit perform a code review of a pull request that you initiate" />

  <Step icon="circle-check-big" title="Converse with CodeRabbit about the code review" />

  <Step title=">>> Prompt CodeRabbit to generate its own improvements to the pull request" />
</Steps>

## Request code improvements

One of CodeRabbit's powerful features is its ability to not just identify issues, but also generate the code changes needed to fix them. Instead of manually implementing the suggestions from the review, you can ask CodeRabbit to do it for you.

In this step, you'll use a CodeRabbit command to automatically generate documentation improvements for your Python code.

### Generate docstrings

Post the following as a new comment on your pull request:

```text theme={null}
@coderabbitai generate docstrings
```

This command instructs CodeRabbit to analyze your code and create documentation strings for all functions.

### What CodeRabbit does next

After a few moments, CodeRabbit automatically performs the following actions:

1. **Creates a new branch** - CodeRabbit generates a new branch based on your `add-utils` branch
2. **Commits the changes** - CodeRabbit adds properly formatted docstrings to your `simple_utils.py` file
3. **Opens a pull request** - CodeRabbit creates a new pull request from the new branch back into `add-utils`

You can review the generated docstrings in the new pull request, and if you're satisfied with them, merge them into your original branch.

## Review the generated changes

Once CodeRabbit creates the new pull request with the docstrings:

1. Navigate to the new pull request
2. Review the generated documentation
3. Check that the docstrings accurately describe each function
4. Merge the changes if they meet your standards

This demonstrates how CodeRabbit can handle not just code review, but also automated code generation based on best practices.

### Other available commands

CodeRabbit supports many other commands to help you improve your code. For example:

* `@coderabbitai generate tests` - Create unit tests for your code
* `@coderabbitai fix` - Apply suggested fixes from the review
* `@coderabbitai help` - See all available commands

<Tip>
  You can use CodeRabbit commands on any pull request comment to request
  specific actions. This makes it easy to iterate on code improvements without
  leaving GitHub.
</Tip>


# Hands-on guide
Source: https://docs.coderabbit.ai/guide/index

A step-by-step walkthrough of CodeRabbit's core features using a test repository

This hands-on guide walks you through CodeRabbit's core features using a test GitHub repository. You'll experience firsthand how CodeRabbit analyzes code, provides actionable feedback, and writes fixes and improvements for you.

<Info>
  **Just want to get started quickly?** Skip to the
  [Quickstart](/getting-started/quickstart) to set up your own project.
</Info>

## What you'll learn

By the end of this guide, you'll have hands-on experience with:

* Automated code review on pull requests
* Interactive conversations with CodeRabbit
* Automatic code generation and improvements

## Overview

<Steps>
  <Step title="Integrate CodeRabbit into a GitHub repository that you own" />

  <Step title="Observe CodeRabbit perform a code review of a pull request that you initiate" />

  <Step title="Converse with CodeRabbit about the code review" />

  <Step title="Prompt CodeRabbit to generate its own improvements to the pull request" />
</Steps>

## What you'll need

* A GitHub account
* 5-10 minutes

<Note>
  While this tutorial focuses on GitHub, CodeRabbit also works with GitLab,
  Azure DevOps, and Bitbucket. For more information, see [Integrate with Git
  platforms](/platforms).
</Note>

## What happens next

After completing this guide, you'll have:

* Seen CodeRabbit automatically review code changes in real-time
* Experienced interactive conversation with an AI code reviewer
* Watched CodeRabbit generate code improvements on your behalf
* A test repository you can continue experimenting with


# Repository setup
Source: https://docs.coderabbit.ai/guide/repository

Set up a GitHub test repository and integrate CodeRabbit for automated code reviews

<Steps>
  <Step title=">>> Integrate CodeRabbit into a GitHub repository that you own" />

  <Step title="Observe CodeRabbit perform a code review of a pull request that you initiate" />

  <Step title="Converse with CodeRabbit about the code review" />

  <Step title="Prompt CodeRabbit to generate its own improvements to the pull request" />
</Steps>

## Before you begin

Create a new repository on GitHub. Name the new repository `coderabbit-test`, and let it have otherwise default GitHub settings.

## Integrate CodeRabbit with your GitHub account

To integrate CodeRabbit with your GitHub account, follow these steps:

<Steps>
  <Step title="Create an account">
    Visit [the CodeRabbit login page](https://app.coderabbit.ai/login?free-trial=). No credit card required!
  </Step>
</Steps>

CodeRabbit takes a moment to set up the integration. After it finishes, the CodeRabbit dashboard appears.

## Add CodeRabbit to your repository

To add CodeRabbit to your test repository, follow these steps:

<Steps>
  <Step title="Access repository settings">
    On the CodeRabbit dashboard, click **Add Repositories**. A GitHub repository-access dialog appears.
  </Step>

  <Step title="Grant repository access">
    Select the **Only select repositories** radio button.
  </Step>

  <Step title="Select your test repository">
    From the **Select repositories** menu, select the `coderabbit-test` repository that you created earlier in this guide.
  </Step>

  <Step title="Install and authorize CodeRabbit">
    Click **Install & Authorize**.

    <Info>
      CodeRabbit requests read and write access to your repository in order for its code review, issue management, and pull request generation features to work. CodeRabbit does not retain your source code after review, except when [review caching](/reference/caching) is enabled to speed up future reviews. For more information, see [the CodeRabbit Trust Center](https://trust.coderabbit.ai).
    </Info>
  </Step>

  <Step title="Complete signup if prompted">
    If a CodeRabbit **Complete your signup** dialog appears, then fill it out with the requested information before continuing.
  </Step>
</Steps>

CodeRabbit is now ready to use with your test repository. The next steps demonstrate its core code-review features.


# Overview
Source: https://docs.coderabbit.ai/guides/code-review-overview

Discover how CodeRabbit transforms your development workflow with AI-powered code reviews that provide instant, comprehensive feedback on every pull request.

Transform your code review process with CodeRabbit's AI-powered analysis that delivers comprehensive feedback within minutes of creating a pull request. Get detailed summaries, security insights, and improvement suggestions that help your team ship better code faster.

<Info>
  Ready to see CodeRabbit in action? Try our [hands-on guide](/guide) for a demonstration using a real repository.
</Info>

## What CodeRabbit does for your pull requests

CodeRabbit automatically analyzes every pull request with a multi-layered approach that combines the best of AI and industry-standard tools:

<CardGroup>
  <Card title="Bug detection" icon="bug">
    Spot potential runtime errors, null pointer exceptions, race conditions, and logic flaws before deployment
  </Card>

  <Card title="One-click fixes" icon="mouse-pointer-click">
    Apply suggested changes directly to your PR with a single click—no copy-paste, no switching contexts
  </Card>

  <Card title="AI-generated summaries" icon="file-text">
    Comprehensive summaries and <Hint type="walkthrough">walkthroughs</Hint> of code changes with contextual insights
  </Card>

  <Card title="Security & quality analysis" icon="shield-check">
    Integration with 50+ open-source linters and security scanners for comprehensive coverage
  </Card>

  <Card title="Intelligent suggestions" icon="lightbulb">
    Context-aware improvement recommendations based on your entire repository
  </Card>

  <Card title="Code graph analysis" icon="git-branch">
    Deep understanding of code relationships and dependencies across your project
  </Card>
</CardGroup>

## How automatic reviews work

<Steps>
  <Step title="Integration setup">
    After you [connect CodeRabbit to your
    repository](/getting-started/quickstart), it monitors for new pull requests
    and commits
  </Step>

  <Step title="Instant analysis">
    When a pull request is created, CodeRabbit immediately begins analyzing the
    code changes using multiple AI models and static analysis tools
  </Step>

  <Step title="Comprehensive review">
    Within minutes, CodeRabbit publishes detailed review comments with
    summaries, security findings, improvement suggestions and one-click fixes
  </Step>

  <Step title="Continuous updates">
    For subsequent commits, CodeRabbit performs incremental reviews focusing on
    the new changes
  </Step>
</Steps>

## Review types and severity levels

CodeRabbit categorizes its feedback into different types and severity levels to help you prioritize and address issues effectively.

### Review types

Each review comment leads with a **content category** badge that identifies the area of your codebase the feedback relates to:

* 🔒 **Security & Privacy** - Vulnerabilities, authentication and authorization flaws, secret handling, and data exposure
* 🩺 **Stability & Availability** - Crashes, unhandled errors, resource leaks, and reliability risks
* 🗄️ **Data Integrity & Integration** - Data correctness, persistence, schema, and integration-boundary issues
* 🎯 **Functional Correctness** - Logic errors, incorrect behavior, and unhandled edge cases
* 🚀 **Performance & Scalability** - Inefficiencies, bottlenecks, and scalability concerns
* 📐 **Maintainability & Code Quality** - Readability, structure, naming, and adherence to best practices

### Severity levels

Each review comment is assigned a severity level to indicate its importance:

* 🔴 **Critical** - Severe issues that could cause system failures, security breaches, or data loss
* 🟠 **Major** - Significant problems that impact functionality or performance
* 🟡 **Minor** - Issues that should be addressed but don't critically impact the system
* 🔵 **Trivial** - Low-impact suggestions for code quality improvements
* ⚪ **Info** - Informational comments or context without requiring action

### Review triggers and events

CodeRabbit automatically initiates reviews based on these repository activities:

<Tabs>
  <Tab title="New pull requests" icon="git-pull-request">
    **Full comprehensive review** when a new pull request is created - Complete analysis of all proposed changes - Security and quality assessment - Code style and best practices review
  </Tab>

  <Tab title="New commits" icon="git-commit">
    **Incremental review** when existing pull requests receive new commits - Focus on newly added changes - Updates to previous recommendations - Maintains conversation context
  </Tab>
</Tabs>

## Interactive code reviews with CodeRabbit

Once CodeRabbit reviews your pull request, you can engage in dynamic conversations and request specific actions by mentioning `@coderabbitai` in your comments.

<CardGroup>
  <Card title="Control reviews" icon="settings" href="/guides/commands">
    Pause, resume, or customize review behavior with simple commands
  </Card>
</CardGroup>

### Smart conversation capabilities

<Tabs>
  <Tab title="Contextual chat" icon="message-circle">
    Ask CodeRabbit questions about your code changes, architecture decisions, or implementation approaches. It has access to your entire repository for informed responses.

    ```md theme={null}
    @coderabbitai Why did you suggest using a factory pattern here?
    ```
  </Tab>

  <Tab title="Review control" icon="pause-circle">
    Manage CodeRabbit's review behavior for specific pull requests:

    ```md theme={null}
    @coderabbitai pause
    @coderabbitai resume
    @coderabbitai resolve
    ```
  </Tab>

  <Tab title="Code generation" icon="sparkles">
    Request CodeRabbit to generate documentation:

    ```md theme={null}
    @coderabbitai generate docstrings
    ```
  </Tab>
</Tabs>

<Tip>
  CodeRabbit [learns from your feedback](/knowledge-base/learnings) and coding patterns
  to provide increasingly relevant suggestions over time.
</Tip>

## Next steps

Ready to dive deeper into CodeRabbit's capabilities? Explore these essential features to maximize your code review experience:

<CardGroup>
  <Card title="Review commands" icon="terminal" href="/guides/commands">
    Learn all the commands to control CodeRabbit's behavior during reviews
  </Card>
</CardGroup>


# Manage code reviews
Source: https://docs.coderabbit.ai/guides/commands

Learn how to control and manage CodeRabbit's automatic code reviews with commands. Pause, resume, ignore reviews, request manual reviews, resolve comments, request approval, and update pull request summaries using @coderabbitai commands.

You can control CodeRabbit's behavior with a specific pull request by mentioning the username of its bot alongside keywords in comments or the pull request description, as specified by the next sections of this page. Examples on this page use `@coderabbitai`. If your installation uses a different CodeRabbit service-account handle, use that handle instead.

For a complete CodeRabbit command reference, see [Code review command reference](/reference/review-commands).

## Control automatic code reviews

By default, CodeRabbit automatically reviews every new pull request created in your repository. It updates its review with comments whenever the pull request has new commits pushed to it.

The following sections show you how to tell CodeRabbit to modify this behavior with a specific pull request, such as pausing reviews, or resolving open comments.

For more information about permanently configuring the behavior of CodeRabbit on your repository, see [Add a configuration file](/getting-started/yaml-configuration).

### Pause and resume automatic code reviews

You can tell CodeRabbit to pause its automatic reviews of a pull request. If you do, then you can still manually request CodeRabbit to review changes using the commands listed on [Code review command reference](/reference/review-commands).

To pause automated reviews of a pull request, post the following comment to the pull request:

```md theme={null}
@coderabbitai pause
```

To resume automated reviews after pausing them, post the following comment to the pull request:

```md theme={null}
@coderabbitai resume
```

### Disable automatic code reviews

To disable automatic code reviews for a pull request, add the following line anywhere in the pull request description:

```md theme={null}
@coderabbitai ignore
```

As long as that text remains in the description, CodeRabbit will not automatically review any commits associated with that pull request. You can still chat with CodeRabbit and issue other commands in the pull request comments.

To enable automatic reviews on that pull request, delete "`@coderabbitai ignore`" from the pull request description. CodeRabbit commences automatic reviews starting with the next commit made to the branch under review.

<Info>
  Use `auto-review` [configuration setting](/reference/configuration#param-auto-review) to control which requests should not be reviewed automatically (choose base branches, ignore drafts, skip bot users, etc.)
</Info>

## Manually request code reviews

You can ask CodeRabbit to perform a code review at any time. This can be useful when you have paused automated code reviews. Manually requested reviews have two types:

<Info>
  `@coderabbitai review` does only incremental review (what changed since last review). When you want CodeRabbit to review all changes from scratch, use `@coderabbitai full review`.
</Info>

* A *full review* disregards any comments that CodeRabbit has already made on this pull request, and generates a complete review of the entire pull request.

* An *incremental review* takes all comments that CodeRabbit has made since its most recent full review into consideration, and generates a review of only the new changes.

To manually request a full review, post the following comment to the pull request:

```md theme={null}
@coderabbitai full review
```

To manually request an incremental review, post the following comment to the pull request:

```md theme={null}
@coderabbitai review
```

## Resolve comments and request approval

To have CodeRabbit mark all of its previous comments as resolved, post the following as a new top-level PR comment:

```md theme={null}
@coderabbitai resolve
```

`@coderabbitai resolve` is not supported in inline or review-thread replies.

To have CodeRabbit resolve its unresolved review threads and attempt to approve the pull request, post the following as a new top-level PR comment:

```md theme={null}
@coderabbitai approve
```

`@coderabbitai approve` only submits an approval when `reviews.request_changes_workflow` is enabled. Without that setting, CodeRabbit resolves its review threads but reports that approval is disabled. It is not supported in review-thread replies.

## Update information about the pull request

The commands in this section request CodeRabbit to generate and post updated information about the pull request itself.

### Update the summary text

To have CodeRabbit update the generated summary of the branch’s proposed changes to the pull request’s description, post the following comment:

```md theme={null}
@coderabbitai summary
```

CodeRabbit updates the summary text to the description under the heading "Summary by CodeRabbit".

### Diagram the pull request history

To have CodeRabbit post a comment that contains a sequence diagram which visualizes the history of the pull request under review, post the following comment:

```md theme={null}
@coderabbitai generate sequence diagram
```

## Get information about CodeRabbit

The commands in this section request CodeRabbit to display its own configuration or documentation.

### Display current configuration

To have CodeRabbit post a comment listing out its current configuration with your repository, post the following comment to the pull request:

```md theme={null}
@coderabbitai configuration
```

### Display a quick-reference guide

To have CodeRabbit post a comment to the pull request with a quick-reference guide to its own commands and other features, post the following comment to the pull request:

```md theme={null}
@coderabbitai help
```


# Configuration overview
Source: https://docs.coderabbit.ai/guides/configuration-overview

Configure CodeRabbit to fit your organization and repositories using multiple approaches with clear priority rules.

CodeRabbit works out of the box with sensible defaults, but configuration lets you customize reviews for your team's specific needs. Choose from multiple configuration approaches based on your workflow preferences.

## Configuration approaches

### File-based

<CardGroup>
  <Card title="YAML file (recommended)" icon="file-code" href="/getting-started/yaml-configuration">
    Version-controlled configuration committed to your repository
  </Card>

  <Card title="Central configuration" icon="layers" href="/configuration/central-configuration">
    Organization-wide configuration from a dedicated repository
  </Card>
</CardGroup>

### Web Interface-based

<CardGroup>
  <Card title="Repository settings" icon="git-branch" href="/guides/repository-settings">
    Configure individual repositories with specific needs
  </Card>

  <Card title="Organization settings" icon="building-2" href="/guides/organization-settings">
    Apply the same configuration to all repositories in your organization
  </Card>
</CardGroup>

### YAML file (recommended)

Create a `.coderabbit.yaml` file in your repository root for version-controlled configuration. This approach gives you the benefits of infrastructure-as-code: configuration changes go through code review, maintain history, and deploy with your application.

Best for: Teams that prefer GitOps workflows and want configuration changes tracked in version control.

See the [sample configurations](/configuration/example) for language-specific recommendations and [configuration reference](/reference/configuration#reference) for all available options.

### Central configuration

Create a dedicated `coderabbit` repository in your organization with a `.coderabbit.yaml` file. This configuration automatically applies to any repository that doesn't have its own settings, giving you organization-wide defaults with the flexibility of repository-specific overrides.

Best for: Organizations wanting centralized configuration management without requiring individual repository setup.

See [Central configuration](/configuration/central-configuration) for setup instructions and platform support.

### Repository settings

Use repository settings when different projects need different CodeRabbit configurations. Configure each repository individually through the web UI or with a local `.coderabbit.yaml` file.

Best for: Organizations with diverse projects requiring specific review approaches.

See [Repository settings](/guides/repository-settings).

### Organization settings

Use organization settings when you want consistent CodeRabbit behavior across all your repositories. Configure once in the web UI and all repositories inherit the same settings. The web interface offers three view modes: **Concise** for the most common settings, **All Settings** for full control, and **YAML Editor** for direct YAML editing. Concise and All Settings modes include a live Preview panel.

Best for: Teams with standardized coding practices across projects.

See [Organization settings](/guides/organization-settings).

Workspace settings are available for Enterprise workspace customers. In CodeRabbit Cloud, this includes SSO workspaces and self-hosted Git provider organizations linked to a workspace. SSO workspace admins can manage these settings. For linked self-hosted organizations, viewing requires permission to view Organization Settings, and saving requires permission to update Organization Settings.

## Understanding configuration priority

Configuration sources don't merge by default. When you use multiple configuration methods, CodeRabbit follows a strict priority hierarchy:

<table>
  <thead>
    <tr>
      <th>Priority</th>
      <th>Source</th>
      <th>Location</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>0 (Highest)</td>
      <td><a href="/guides/configuration-overview#global-overrides">Workspace global overrides</a></td>
      <td>CodeRabbit UI - Workspace Settings - Global Overrides (Enterprise workspace customers)</td>
    </tr>

    <tr>
      <td>1</td>
      <td><a href="/guides/configuration-overview#global-overrides">Organization global overrides</a></td>
      <td>CodeRabbit UI - Organization Settings - Global Overrides</td>
    </tr>

    <tr>
      <td>2</td>
      <td><a href="/getting-started/yaml-configuration">Repository file</a></td>
      <td><code>.coderabbit.yaml</code> in the repository</td>
    </tr>

    <tr>
      <td>3</td>
      <td><a href="/configuration/central-configuration">Central repository</a></td>
      <td><code>.coderabbit.yaml</code> in <code>coderabbit</code> repository</td>
    </tr>

    <tr>
      <td>4</td>
      <td><a href="/guides/repository-settings">Repository settings</a></td>
      <td>CodeRabbit UI - Repository Settings</td>
    </tr>

    <tr>
      <td>5</td>
      <td><a href="/guides/organization-settings">Organization settings</a></td>
      <td>CodeRabbit UI - Organization Settings</td>
    </tr>

    <tr>
      <td>6</td>
      <td>Workspace settings</td>
      <td>CodeRabbit UI - Workspace Settings (Enterprise workspace customers)</td>
    </tr>

    <tr>
      <td>7 (Lowest)</td>
      <td><a href="/reference/configuration">Default settings</a></td>
      <td>CodeRabbit schema defaults</td>
    </tr>
  </tbody>
</table>

<Warning>
  You can enable `configuration inheritance` to [let CodeRabbit merge configuration](/configuration/configuration-inheritance) from parent levels instead of using only the highest-priority source.
</Warning>

**Example:** If you set a custom timeout in organization settings and central configuration but have a local `.coderabbit.yaml` that doesn't mention timeouts and <Hint type="configuration-inheritance" /> is disabled, CodeRabbit uses the default timeout value, not your organization or central configuration settings.

<Info>
  To see exactly which layer each setting came from, run `@coderabbitai configuration` on any pull request. The resolved YAML is annotated with sources (repository YAML, central configuration, UI settings, defaults, etc.) so you can diagnose priority conflicts without guessing.
</Info>

## Global overrides

Global overrides let administrators enforce settings across every repository and PR review, regardless of what individual repositories configure in their `.coderabbit.yaml` files or repository-level UI settings.

Best for: Enforcing compliance policies, mandatory review profiles, or required path instructions that no repository can opt out of.

<Warning>
  Global overrides take precedence over **all** other configuration sources, including repository `.coderabbit.yaml` files. Use them for policies that must be enforced across a workspace or organization (for example, compliance-driven review profiles or required path instructions) rather than for general defaults.
</Warning>

Enterprise workspace customers can also configure workspace-level global overrides. In SSO workspaces, this requires workspace-admin access. For linked self-hosted Git provider organizations, saving overrides requires permission to update Organization Settings. Workspace global overrides are applied after organization global overrides and take precedence when both levels set the same key.

<Info>
  If a setting is not behaving as expected, run `@coderabbitai configuration` on any pull request. The resolved YAML is annotated with the source that supplied each value, making it easy to identify when a global override is silently winning above your repository or organization configuration. Possible sources are:

  * **Repository YAML** — `.coderabbit.yaml` in the repository
  * **Central YAML** — `.coderabbit.yaml` in the `coderabbit` repository
  * **Environment YAML** — `YAML_CONFIG` environment variable (self-hosted only)
  * **Repository UI** — CodeRabbit UI repository settings
  * **Organization UI** — CodeRabbit UI organization settings
  * **Workspace UI** — CodeRabbit UI workspace settings (enterprise only)
  * **Defaults** — CodeRabbit schema defaults
  * **Global overrides** — organization or workspace overrides (enterprise only)
</Info>

### Who can configure global overrides

SSO workspace admins can view and edit workspace global overrides. For linked self-hosted Git provider organizations, viewing requires permission to view Organization Settings, and editing requires permission to update Organization Settings. Organization admins can view and edit organization global overrides.

### How to set global overrides

1. In the CodeRabbit UI, open **CodeRabbit configuration** for an SSO workspace, **Workspace Settings** for a linked self-hosted organization, or your [**Organization Settings**](https://app.coderabbit.ai/settings/organizations) page.
2. In the settings mode switcher, select **Global Overrides**.
3. Edit the YAML using the same schema as `.coderabbit.yaml` ([schema.v2.json](https://coderabbit.ai/integrations/schema.v2.json)). Only include the keys you want to enforce - leave everything else out.
4. Save. The overrides take effect on subsequent PR reviews across the workspace or organization.

Example - enforce an assertive review profile and a required path instruction on every repository:

```yaml .coderabbit.yaml theme={null}
reviews:
  profile: assertive
  path_instructions:
    - path: "**/*.sql"
      instructions: "Flag any statements that drop or truncate tables."
```

### Override behavior

Global overrides are applied on top of the fully-resolved configuration using these rules:

| Type        | Behavior                                                                                                                                                    |
| ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Objects** | Merged recursively - override properties replace matching properties at each nesting level                                                                  |
| **Arrays**  | Combined by key - override entries take priority when keys match (e.g., matching `path` in `path_instructions`); unique entries from other sources are kept |
| **Scalars** | Simple override - the override value wins                                                                                                                   |

<Note>
  Arrays in global overrides follow the same merge logic as [configuration inheritance](/configuration/configuration-inheritance) - entries are merged by a stable key (for example, `path` for `path_instructions`). Override entries take priority when keys match, while unique entries from other sources are kept.
</Note>

### Enforcing inheritance

Setting `inheritance: true` in a global override **enforces [configuration inheritance](/configuration/configuration-inheritance) across the entire organization or workspace**. Every repository and PR review merges the full inheritance chain - including repositories that set `inheritance: false` (or omit it) in their own `.coderabbit.yaml` or UI settings. The override's `inheritance` flag is evaluated before the inheritance walk and takes precedence over each level's own flag, so no repository can opt out. This lets administrators turn on inheritance everywhere from a single place, instead of adding `inheritance: true` to every configuration source.

## Adaptive configuration

Besides manual configuration, CodeRabbit automatically builds learnings about your team's review preferences based on your interactions with review comments over time. This creates a dynamic, self-improving layer.

Learnings capture patterns like:

* Which types of suggestions your team typically accepts or rejects
* Coding standards specific to your repositories
* Review focus areas that matter most to your workflow

<CardGroup>
  <Card title="Learnings" icon="brain" href="/knowledge-base/learnings">
    How learnings work and how to manage them
  </Card>
</CardGroup>


# Customize CodeRabbit pull request reports with prompts
Source: https://docs.coderabbit.ai/guides/custom-reports

Build tailored CodeRabbit pull request reports using natural language prompts, custom formatting, scheduling, and flexible data filtering for your team.

<ProPlanBadge />

CodeRabbit's custom reports use natural language prompts to generate exactly the insights your team needs. Instead of fixed templates, you describe what you want and CodeRabbit creates tailored reports with your preferred format, data, and structure.

<Tip>
  New to CodeRabbit reports? Start with the [reports
  overview](/management/reports) to understand the basics before diving
  into customization.
</Tip>

## What you can customize

<CardGroup>
  <Card title="Content & data" icon="database">
    Choose specific pull request information, comments, CI/CD status, and linked
    issues to include in your reports.
  </Card>

  <Card title="Format & structure" icon="layout-template">
    Define report layout using markdown formatting, tables, bullet points, and
    custom grouping patterns.
  </Card>

  <Card title="Filtering & sorting" icon="funnel">
    Include or exclude PRs based on labels, status, team members, or custom
    criteria you define.
  </Card>

  <Card title="Language support" icon="globe">
    Generate reports in multiple languages by specifying your preferred language
    in the prompt.
  </Card>
</CardGroup>

## Creating Custom Report Templates

### Basic Structure

A custom report template consists of instructions that tell CodeRabbit what information to include and how to present it. Here's a basic example:

```text lines icon="text" theme={null}
Please provide a summary of:
- All merged pull requests
- Critical bug fixes
- Code review discussions

Group by:
- Repository
- Team

Format using:
- Bullet points for changes
- Tables for statistics
```

### Example for different languages

Japanese:

```text theme={null}
レポートを英語ではなく日本語で送信してください。

以下の要約を提供してください：
- すべてのプルリクエスト活動
- コードレビューの議論
```

French:

```text theme={null}
Veuillez envoyer le rapport en français et non en anglais.

Veuillez fournir un résumé de :
- Toutes les activités de demandes de fusion
- Discussions sur la révision de code
```

### Available Data Points

Your custom reports can access the following PR information that you can reference in your prompts:

#### Pull Request Status

Contained within the `<pr_details>` tag.

* `Merged`: boolean (true/false) - Whether the PR has been merged

* `Draft`: boolean (true/false) - Whether the PR is in draft state

* `State`: string ("open"/"closed") - Current state of the PR

* `Mergeable`: boolean (true/false) - Whether the PR can be merged

* `Is stale`: boolean - Whether PR has been inactive for over 168 hours

* `PR Stage`: string - The current stage of open PRs in Open or Draft state, can be one of:
  * "Needs Author Action" - PR requires author attention due to merge conflicts, draft status, or requested changes
  * "Waiting for Author to Merge" - PR has approvals and is ready for author to merge
  * "Waiting for Code Reviews" - PR is waiting for reviewers to approve
  * undefined - PR is not in an open state (is merged or closed)

#### Basic Information

Contained within the `<pr_details>` tag.

* `Pull request number`: number - The PR's identifier
* `Title`: string - PR title
* `URL`: string - Link to the PR
* `Author name`: string - PR creator's username
* `Created at`: datetime - When the PR was created
* `Last activity`: datetime - Most recent activity timestamp
* `Closed at`: datetime (if applicable) - When the PR was closed
* `Source branch`: string - Source branch name
* `Target branch`: string - Target branch name
* `Labels`: array of strings - All labels applied to the PR
* `Reviewers`: array of strings - Assigned reviewers' usernames

#### Summarized PR Details

* `<pr_description>`: string - Contains the body of your pull request (aka the PR description at the top of the PR page).

* `<file_changes_summary>`: string - Contains a file by file summary of the changes made in the PR in markdown format. This summary is generated by CodeRabbit AI during the PR review process. This includes several sections for each file that was changed:
  * `filename`: string - The name of the file that was changed.
  * `AI-generated summary of changes`: markdown - An overall summary of the changes made in the file.
  * `Alterations to the declarations of exported or public entities`: markdown - A more specific breakdown of the changes made to the file such as exactly what was added, removed, or modified.

#### Comments

* `<pr_comments>`: array of comment objects - Contains all the comments made on the PR.

* `<comment>`: object - Each individual comment is wrapped in this tag and is an object with the following properties:
  * `<comment_author_username>`: string - The username of the comment author.
  * `<comment_created_at>`: datetime - The date and time the comment was created.
  * `<comment_updated_at>`: datetime - The date and time the comment was last updated.
  * `<comment_body>`: markdown - The content of the comment.

#### CI/CD Check Status

* `<pr_checks>`: array of check objects - Contains all CI/CD checks for the PR. *GitHub Only*.

* `<pr_check>`: object - Each individual check is wrapped in this tag and is an object with the following properties:
  * `<pr_check_name>`: string - The name of the CI/CD check.
  * `<pr_check_status>`: string - The status of the check (e.g., "success", "failure", "in\_progress", "canceled").
  * `<pr_check_url>`: string - The URL to view the detailed results of the check.

Here's an example prompt that uses these data points:

```xml Example prompt icon="code" theme={null}
Use the <overall_instructions> to guide the content of the summary. Use the format shown in <example> but do not include or refer to the example's content in the final summary/report.

<overall_instructions>
Generate a summary of each pull request in the following bullet point format:

- PR Link: Provide a hyperlink to the pull request from the 'URL:' value
- Title: Provide the value of the 'Title:' field
- PR State: Provide the state of the PR based on the following conditions:
  - If 'Merged: true' set 'PR State: 🔀 Merged'
  - Else If 'Draft: true' set 'PR State: 📝 Draft'
  - Else If 'State: open' or 'State: active' set 'PR State: 💬 Open'
  - Else If 'State: closed' or 'State: DECLINED' and 'Merged: false' set 'PR State: 🔒 Closed'
  - Else set 'PR State: ❓ Unknown'
  - If the PR is stale, add '⚠️ Stale' at the end of the PR State.
- Mergeable (if PR State is not 'Merged'): Provide the mergeable status of the PR as 'Mergeable' or 'Not Mergeable' based on the "Mergeable: " value.
- PR Stage (if PR State is not 'Merged'): Provide the stage of the PR based on the "PR Stage: " value.
- Summary: In under 50 words provide a short summary of the PR.
- Comments: In under 50 words provide a short summary of all comments found within <pr_comments>, including each comments author username from <comment_author_username>. If there are no comments available, output 'No comments'.
</overall_instructions>

<example>
- **PR Link:** [#3001](https://github.com/mygithuborg/myrepo/pull/3001)
- **Title:** PR Title
- **PR State:** 💬 Open
- **Mergeable:** Mergeable
- **PR Stage:** Waiting for Code Reviews
- **Summary:** Summary of the PR.
- **Comments:** Summary of the PR comments or No comments.

- **PR Link:** [#302](https://github.com/mygithuborg/thatrepo/pull/302)
- **Title:** PR Title
- **PR State:** 💬 Open
- **Mergeable:** Mergeable
- **PR Stage:** Waiting for Author to Merge
- **Summary:** Summary of the PR.
- **Comments:** Summary of the PR comments or No comments.

- **PR Link:** [#3](https://github.com/mygithuborg/myotherrepo/pull/3)
- **Title:** PR Title
- **PR State:** 🔀 Merged
- **Summary:** Summary of the PR.
- **Comments:** Summary of the PR comments or No comments.

- **PR Link:** [#14](https://github.com/mygithuborg/frontend/pull/14)
- **Title:** PR Title
- **PR State:** 💬 Open
- **Mergeable:** Mergeable
- **PR Stage:** Needs Author Action
- **Summary:** Summary of the PR.
- **Comments:** Summary of the PR comments or No comments.

- **PR Link:** [#13005](https://github.com/mygithuborg/backend/pull/13005)
- **Title:** PR Title
- **PR State:** 🔀 Merged
- **Summary:** Summary of the PR.
- **Comments:** Summary of the PR comments or No comments.

- **PR Link:** [#3006](https://github.com/mygithuborg/myrepo/pull/3006)
- **Title:** PR Title
- **PR State:** 🔀 Merged
- **Summary:** Summary of the PR.
- **Comments:** Summary of the PR comments or No comments.

- **PR Link:** [#3007](https://github.com/mygithuborg/myrepo/pull/3007)
- **Title:** PR Title
- **PR State:** 📝 Draft
- **Mergeable:** Not Mergeable
- **PR Stage:** Needs Author Action
- **Summary:** Summary of the PR.
- **Comments:** Summary of the PR comments or No comments.
</example>
```

### Formatting options

CodeRabbit supports full markdown formatting in your custom reports:

<CardGroup>
  <Card title="Text formatting" icon="bold">
    **Bold**, *italic*, `code`, and regular text with headers using `#`, `##`,
    `###`.
  </Card>

  <Card title="Lists & tables" icon="list">
    Bullet points, numbered lists, and structured tables for organized data
    presentation.
  </Card>

  <Card title="Links & blocks" icon="link">
    Hyperlinks to PRs, code blocks for examples, and any other standard markdown
    elements.
  </Card>
</CardGroup>

### Headers and Titles

The name you give to each report in the CodeRabbit menu will be used for the first line of any report or the subject for emails. For example, if your report is named `Executive Summary Template`, then this string will appear on the subject of your emails and start of all message chains.

When using the `Preview Report` button in the CodeRabbit menu, the subject will begin with `Preview: <report name>`.

The reports will also have an overall title describing the report content such as `Pull Request Summary Report (January 2025)`.

To change these details of this overall title you should include specific instructions in your custom prompt with examples such as:

```text lines wrap icon="text" theme={null}
- Do not add a date to the titles like "Pull Request Summary Report (January 2025)" it should just be "Pull Request Summary Report"
```

### Language Support

You can generate reports in multiple languages by specifying the ISO language code in your template. For example:

```text lines wrap icon="text" theme={null}
Language: fr
Please provide a summary of:
- All pull request activities
- Code review discussions
```

## Advanced Features

### Filtering

Include specific filtering instructions in your template:

```text lines wrap icon="text" theme={null}
Include only:
- PRs with "critical" or "bug" labels
- Changes to production code
- Reviews from senior developers

Exclude:
- Automated commits
- Documentation changes
- Dependency updates
```

### Custom Grouping

Organize information using custom grouping rules:

```text lines wrap icon="text" theme={null}
Group by:
1. Priority (High/Medium/Low)
2. Component (Frontend/Backend/Infrastructure)
3. Team (Team A/Team B)

Within each group, sort by:
- Activity date (newest first)
- Impact level
```

### Optional Data Sources

You can also include optional data sources in your custom reports. By default, CodeRabbit will not include the following data sources. In a custom report you will see the option to include these data sources by clicking the `Select Optional Data Sources` button. This adds special XML tags to your prompt that allow you to include this data in your report.

#### Bot Comments

Bot comments are comments made by bots and CodeRabbit AI on a PR. To enable bot comments you must include the tag `<include_bot_comments>` in your prompt.

These are very similar in structure to regular user comments but with a few key differences:

* `<bot_comments>`: array of comment objects - Contains all the comments made on the PR.

* `<bot_comment>`: object - Each individual comment is wrapped in this tag and is an object with the following properties:
  * `<bot_name>`: string - The username of the comment author.
  * `<bot_comment_created_at>`: datetime - The date and time the comment was created.
  * `<bot_comment_updated_at>`: datetime - The date and time the comment was last updated.
  * `<bot_comment_body>`: markdown - The content of the comment.

#### Issues and Tickets

Issues and tickets bring in conversations, descriptions, and comments from Jira and Linear as part of your report if the ticket is linked in your PR description. To enable issues and tickets you must include the tag `<include_issues_and_tickets>` in your prompt.

* `<issues_and_tickets>`: array of issue objects - Contains all the linked issues and tickets.

* `<issue>`: object - Each individual issue is wrapped in this tag and is an object with the following properties:
  * `<issue_title>`: string - The title or thread ID of the issue.

  * `<issue_url>`: string - The URL to the issue.

  * `<issue_id>`: string - The unique identifier of the issue.

  * `<issue_author>`: string - The username of who created the issue.

  * `<issue_created_at>`: datetime - The date and time the issue was created.

  * `<issue_updated_at>`: datetime - The date and time the issue was last updated.

  * `<issue_body>`: markdown - The content/description of the issue. This contains the following sections:
    * `<issue_description>`: markdown - The description of the issue.
    * `<issue_comments>`: array of comment objects - Contains all the comments made on the issue.

#### Remove PRs without a "Score Card/Chart" bot comment

This option gives you the ability to create a report limited only to pull requests containing a "Score Card" or "Score Chart" bot comment from CodeRabbit or other bots. To enable this option you must include the tag `<pr_score_card>` in your prompt.

> **IMPORTANT:** This will automatically remove any pull requests from your reports if they do not contain a "Score Card" or "Score Chart" bot comment. Using this option without setting up a flow to create these comments will result in `No new pull request activity in the last XYZ hours` errors. Do not enable this option unless you have asked CodeRabbit to create a "Score Card" through a comment or implemented the "Score Chart" bot comment flow below.

For example, you can ask CodeRabbit to check several conditions on a pull request and produce a "Score Chart":

<Accordion title="Click to view example User Score Card/Chart Comment:">
  <img alt="Score Card/Chart Trigger Comment Example" />

  ```markdown theme={null}
  @coderabbitai
  Use the <overall_instructions> to guide the content of the summary. Use the format shown in <\_example> but do not include or refer to the example's content in the final summary/report.

  <overall_instructions>

  **Instructions:**
  Generate a weekly code review report for the author of this pull request only following scoring parameters. Calculate the scores and compile the results into a table so that the team-wise average score can be easily determined.
  **Scoring Parameters:**

  1. **Basic Code Standards (Score out of 2)**
     - Avoidance of hard-coded values
     - No repetition of code (DRY principle)

  2. **Code Readability (Score out of 2)**
     - Presence of meaningful comments
     - Proper variable declaration using `const` and `let`

  3. **Error Handling (Score out of 4)**
     - Handling failure scenarios (e.g., try-catch, fallbacks)
     - Proper loading state implementation (e.g., button click loading states)
     - Handling edge cases (e.g., checking for undefined or missing values)
     - Input validation (ensuring correct user inputs)

  4. **Circle CI Check Validation (Score: 0 or 1)**
     - `0` → Not Passed
     - `1` → Passed

  **Final Score Calculation:**
  Combine the scores from the parameters above to derive the final code quality score (out of 9).
  **Output Format:**
  Provide the final report in a table format with the following columns (use shorthand notations), be sure to include this list at the top above the chart in the "Column Notation" section so users understand what the columns mean:

  - **User Name (User)**
  - **Basic Code Standards (BCS) (out of 2)**
  - **Code Readability (CR) (out of 2)**
  - **Error Handling (EH) (out of 4)**
  - **Shopify Theme Check (CI) (out of 1)**
  - **Final Code Quality Score (FCQS) (out of 9)**

  </overall_instructions>

  <\_example>

  ## Column Notation

  - **User Name (User)**
  - **Basic Code Standards (BCS) (out of 2)**
  - **Code Readability (CR) (out of 2)**
  - **Error Handling (EH) (out of 4)**
  - **Shopify Theme Check (CI) (out of 1)**
  - **Final Code Quality Score (FCQS) (out of 9)**

  ## Score Chart

  | User | BCS (2) | CR (3) | EH (2) | CI (1) | FCQS (9) |
  | --- | --- | --- | --- | --- | --- |
  | John Doe | 2       | 3      | 2      | 1      | 9        |

  </\_example>
  ```
</Accordion>

Then CodeRabbit will reply with a score for your pull request:

<Accordion title="Click to view resulting Score Card/Chart bot comment:">
  <img
    alt="CodeRabbit Score Card/Chart Result Comment
Example"
  />
</Accordion>

You can then utilize this in a report. We recommend your report looks specifically for these score cards and puts together a unified report:

<Accordion title="Click to view example Report Prompt when using Score Card/Chart:">
  <img alt="Report Example" />

  <img alt="Where to put this prompt" />

  Prompt Example:

  ```markdown theme={null}
  Use the <overall_instructions> to guide the content of the summary. Use the format shown in <example> but do not include or refer to the example's content in the final summary/report.

  <overall_instructions>
  **Instructions:**

  Locate the score chart comment in the <bot_comments>. There will be a single comment with data on these fields:

  - **User Name (User)**
  - **Basic Code Standards (BCS) (out of 2)**
  - **Code Readability (CR) (out of 2)**
  - **Error Handling (EH) (out of 4)**
  - **Shopify Theme Check (CI) (out of 1)**
  - **Final Code Quality Score (FCQS) (out of 9)**

  These details may also be in the form of a chart such as:

  ## Score Chart

  | User | BCS (2) | CR (3) | EH (2) | CI (1) | FCQS (9) |
  | --- | --- | --- | --- | --- | --- |
  | John Doe | 2       | 3      | 2      | 1      | 9        |

  You will create a new chart averaging all the values from various pull requests for each author. Only include pull requests with a `Score Chart`. Do not invent or create score charts if none exist.

  </overall_instructions>

  <example>

  ## Column Notation

  - **User Name (User)**
  - **Basic Code Standards (BCS) (out of 2)**
  - **Code Readability (CR) (out of 2)**
  - **Error Handling (EH) (out of 4)**
  - **Shopify Theme Check (CI) (out of 1)**
  - **Final Code Quality Score (FCQS) (out of 9)**

  ## Score Chart

  | User | BCS (2) | CR (3) | EH (2) | CI (1) | FCQS (9) | PR URL |
  | --- | --- | --- | --- | --- | --- | --- |
  | John Doe | 2       | 3      | 2      | 1      | 9        | URL    |
  | Alex Foo | 2       | 3      | 2      | 1      | 9        | URL    |

  </example>
  <include_bot_comments>
  <pr_score_card>
  ```
</Accordion>

**Best Practices for Score Cards/Charts:**

* The reporting bot only has access to your comments and summary (like a project manager) if you want to make a report looking for these score card/chart comments make sure the reviewer does this ahead of time.
* Only include checks for very specific scenarios, such as a specific check failing or using tabs vs spaces.
* Do not use general rules without explaining specifically what they mean. If you add "Ensure the pull request follows development best practices" you must define what "development best practices" actually mean or the AI will guess.
* Make one point for each specific check and make sure it's a True/False condition.
* Instead of manually commenting on pull requests, you can use the [GitHub Actions Bot](https://github.com/marketplace/actions/create-or-update-comment) to automatically comment on pull requests and trigger CodeRabbit score card/chart comments by including `@coderabbitai` in the comment.

#### Organization Statistics

Organization statistics provide comprehensive organization-level metrics that can be included in custom reports. This data is very similar to what you'll find in your CodeRabbit dashboards - if you want dashboard data in your reports, use this option! To enable organization statistics, you must include the tag `<include_org_stats>` in your prompt.

The `<organization_stats>` block contains comprehensive organization-level metrics including individual PR details and high-level organization metrics, providing a complete picture of development activity and CodeRabbit's impact across your organization.

**Example Prompt:**

```xml theme={null}
Use the <overall_instructions> to guide the content of the summary.

<overall_instructions>
Share all Organization Statistics details you find inside the <organization_stats> block.

Make the formatting of this report cool and draw some conclusions from this.

Show the top 10 tool findings and top 10 contributor info.

Use bullet points not numbers for the tool findings.

For contributors format information in a table like:

## Column Notation

- User Name: User
- PRs Created: PRC
- Reviews Approved: RA
- Reviews Requested Changes On: RRC
- Reviews Commented On: RC
- Total Comments Posted: TCP
- CodeRabbit Reviews Triggered: CRT
- Total PRs Reviewed: TPRR

## 👥 All Contributors

| User | PRC | RA | RRC | RC | TCP | CRT | TPRR |
| --- | --- | --- | --- | --- | --- | --- | --- |
| John Doe |     2 |    1 |     9 |    0 |     3 |     2 |      3 |
| Alex Foo |     2 |    1 |     9 |    1 |     3 |     2 |      1 |
</overall_instructions>

<include_org_stats>
```

**Available Organization Statistics Data:**

### 📊 Basic Organization Information

* Organization Name: The organization's display name
* Members: Total member count
* Active Repositories: Number of repositories with activity in the time period
* Total Reviews: Total number of reviews performed in the time period
* Total PRs: Total number of pull requests in the time period
* Report Period: Start and end dates for the reporting period
* Last Activity: Most recent activity date (if available)

**🤖 CodeRabbit Suggestions** (when > 0)

* Total Suggestions: All CodeRabbit suggestions made
* Potential Issues: Issues identified by CodeRabbit
* Issues Found: Confirmed issues found
* Refactor Suggestions: Code refactoring recommendations
* Nitpick Suggestions: Minor improvement suggestions (will be 0 unless assertive/nitpick mode is enabled)

**🔧 Tool Findings** (when > 0)

* Total Findings: All tool findings across all tools
* Actionable Errors: Errors that require action
* All Tools: Breakdown by tool and category showing:
  * Tool name and category
  * Count of findings
  * Percentage of total findings

**🚨 Pipeline Failures** (when > 0)

* Total Failures: All pipeline failures detected
* Errors: Critical pipeline errors

**👥 Developer Performance** (when available)

All Contributors: A list of developers showing:

* PRs Created: The number of pull requests that this developer authored during the time period
* Comments: The total number of review comments (issue, refactor, and nitpick) generated by CodeRabbit for this developer's reviews
* CodeRabbit Reviews Triggered: The number of times this developer triggered CodeRabbit reviews on pull requests
* Reviews Approved: The number of unique pull requests where this developer approved the changes
* Reviews Requested Changes On: The number of unique pull requests where this developer requested changes
* Reviews Commented On: The number of unique pull requests where this developer left comments (without approving or requesting changes)
* Total PRs Reviewed: The total number of unique pull requests where this developer performed any review action (approved, requested changes, or commented)

### 📈 Additional Metrics

* Active Users: Number of users who were active
* PRs Reviewed: Total PRs that were reviewed
* PRs Merged: Total PRs that were merged
* Total Suggestions Accepted: CodeRabbit suggestions that were accepted
* Issue Comments: Comments on potential issues
* Refactor Comments: Comments on refactoring suggestions
* Learnings Created: Number of learnings created
* Learnings Used: Number of learnings applied
* Docstrings Generated: Number of docstrings generated
* Chat Sessions: Number of chat sessions

Accepted suggestions use the same criteria as dashboard acceptance-rate metrics. See [How acceptance rate is calculated](/guides/dashboard-metrics#how-acceptance-rate-is-calculated).

## Best practices

<CardGroup>
  <Card title="Be specific" icon="target">
    Clearly define what should be included/excluded, use precise language to avoid ambiguity, and specify exact metrics you want to track.
  </Card>

  <Card title="Structure matters" icon="layout-grid">
    Start with high-level summaries, use consistent grouping patterns, and include clear section breaks for better readability.
  </Card>

  <Card title="Keep it relevant" icon="focus">
    Focus on actionable information, avoid redundant data points, and consider your audience's specific needs and workflows.
  </Card>

  <Card title="Optimize readability" icon="eye">
    Use appropriate formatting, include visual breaks, and maintain consistent styling throughout your reports.
  </Card>

  <Card title="Use examples" icon="clipboard-list">
    Include "do this" and "don't do this" examples, demonstrate proper formatting patterns, and show concrete use cases.
  </Card>

  <Card title="Maintain consistency" icon="refresh-cw">
    Use `<overall_instructions>` and `<example>` tag blocks to ensure consistent formatting across teams and report types.
  </Card>
</CardGroup>

### Add Examples for Consistent Formatting

Try to use `<overall_summary>` and `<example>` tag blocks to keep consistency across reports:

```text lines wrap icon="text" theme={null}
Use the <overall_instructions> to guide the content of the summary. Use the format shown in <example> but do not include or refer to the example's content in the final summary/report.

<overall_instructions>
Generate release notes with the following sections:

- Summary: A high-level summary of the overall change instead of specific files within 100 words.
- Changes: A bullet point list of all the significant changes made in this release.

Significant changes include new features, bug fixes, and other notable changes.
Use a single sentence for each change without headings or categorization.
Do not include changes from PRs that have not been merged.
Don't show changes that are too insignificant and don't affect the end-user.
Use a single level of bullet points for each change.
Don't add links to the PRs.
Do not add a list of pull requests.
Do not show a random release date, version, etc. if they are not known.
</overall_instructions>

<example>
## Summary
[Summary of the release]

## Changes
- [Summary of the change 1]
- [Summary of the change 2]
- [Summary of the change 3]
- ...
- [Summary of the change N]
</example>
```

## Example Templates

### Executive Summary Template

```text theme={null}
Provide a high-level overview:
1. Key metrics:
   - Total PRs merged
   - Average review time
   - Code quality scores
2. Notable achievements
3. Blocking issues
4. Resource allocation

Format:
- Use tables for metrics
- Bullet points for achievements
- Clear headers for sections
```

### Technical Deep Dive Template

```text theme={null}
Generate a detailed technical report:
1. Code changes:
   - Architecture updates
   - API modifications
   - Database changes
2. Testing coverage
3. Performance impacts
4. Security considerations

Include:
- Links to significant PRs
- Code snippets for major changes
- Technical debt analysis
```

## Advanced Example Templates

Here's a more advanced example of a custom report template:

### **Good Day Release Report**

```text theme={null}
**GPT Specialization:**
This GPT specializes in summarizing software release notes and optional summary paragraphs into a consistent, clear, and concise format. The goal is to streamline the presentation of release notes, making them easy to understand for a general audience. It prioritizes clarity, brevity, and coherence while highlighting important updates without unnecessary jargon.

**Release Note Structure:**

1. **Release Notes Organization**
   The items in the release notes may not be in the desired order. It is crucial to group similar items together meaningfully. Review the list after the release notes are created and reorder items within each heading based on relevance. Use **PRODUCT FEATURE GROUPS** to understand which items are related.

2. **General Release Note Guidelines**
   - The title should be: `GoodDay Release v${versionNumber}`

3. **Release Note Line Items**
   - Reword individual release lines to maintain a consistent tone (happy and fun)
   - Use past tense for descriptions
   - Items in the 🧼 Fixes group should begin with "Fixed"
   - Consolidate duplicate or closely related items, and list the associated GitHub pull requests as a comma-delimited list at the end (e.g., GH-123, GH-456)
   - Add links to Github App for each PR

4. **GitHub App Links**
   - each pr mentioned should include hyperlinking to the pull request such as [your-org/your-repo/pull/123](https://github.com/your-org/your-repo/pull/123)

5. **Grouping Release Note Line Items**
   - Replace any emoji in the provided content with the appropriate **RELEASE NOTE GROUP**
   - Order the **RELEASE NOTE GROUP** according to the structure below

6. **Release Note Groups**
   - 🚀 **Features**: New capabilities or enhancements
   - 🧼 **Fixes**: Bug fixes or problem resolutions
   - 🧰 **Maintenance**: Documentation, cleanup, or technical changes
   - 📚 **Other**: Anything else

7. **PR Label Uses**
   - Omit any PRs with the label `skip-changelog`
   - Use the labels from related pull requests to group items together
   - Map PR labels to release note groups using the table below:

     | RELEASE NOTE GROUP | LABELS |
     | --- | --- |
     | 🚀 Features | feature, enhancement |
     | 🧼 Fixes | bug, fix |
     | 🧰 Maintenance | design, docs |
     | 📚 Other | other, tech |

8. **Final Checks**
   - Verify that the number of items matches the number of PRs included
   - Ensure the PR links match the PR number and reflect the content of the changes
```

### **Nato's Special Report**

```text theme={null}
Generate a report of all pull requests in the following format:

- As the first paragraph, start with "🟣" if merged, "⚫" if draft, "🟢" if open, "🔴" if closed
  - On the same line, add the PR title in bold (and only the title; don't put anything else in bold after that)
  - On the same line, add the PR browser link (do not use an api link)
  - On the same line, add the last activity date in the format "Day Month Year, Hour:Minute AM/PM (Timezone)" in italic (don't put anything else in italic after that and make sure it's not bold)
- Make a new bullet-point list of high-level changes in the PR
  - Start each change with a gitmoji followed by a very terse one-liner to mention at a high level what the change does and to what part of the application it applies to
  - Do not start with verbose non-speak such as "The pull request enhances" or "This PR introduces". Keep it terse and straight to the point. Start change descriptions with a verb
  - Do not end with justifications or reasons for the changes such as "... enhancing type safety". Stick to the facts, do not make up the outcome of a change
  - Limit to the 4 most relevant changes
  - Examples: "✨ Add a rotating tagline on the home page", "🔧 Add func-style to ESLint", "📝 Add download badge to `README.md`", "✅ Add unit tests for comment trees", "👷 Create a pipeline to publish to npmjs.org", "🐛 Fix comment submission in posts", "📄 License under AGPL-3.0-or-later", "📱 Change post view for mobile", "💄 Make sidebar links blue", "🩹 Fix unfollow button", "🔒️ Limit login cookies to a specific subdomain", "🥅 Handle errors when commenting in a post", "🙈 Stop ignoring `.env` and start ignoring `.env.local` and `.env.*.local`", "⬆️ Update lemmy-js-client to v0.19.4", "🏷️ Define interfaces for pull request events", "🔐 Add environment variables for Bitbucket Server", "🚚 Rename exported client instances in test files", "🏷️ Add type alias `EventKey` and its type guard `isEventKey`", "🏗️ Aggregate exports for pull request events in an index file"
- Start the next paragraph with "Blockers:" in bold
  - Summarize any issues preventing the PR from progressing
    - Some examples: "Waiting for merge", "Waiting for review", "Failing CI/CD", "Needs more tests", "Needs rebase", "@username is waiting for a response", etc.
  - If the PR is stale, note it here
- Do not add a "Report" heading
- Make sure there is one empty line between each paragraph

These are the available emojis and the type of change they represent. Do not use any other emoji. Make sure the change corresponds to the gitmoji.

<gitmojis>
🎨: Improve structure / format of the code.
⚡️: Improve performance.
🔥: Remove code or files.
🐛: Fix a bug.
🚑️: Critical hotfix.
✨: Introduce new features.
📝: Add or update documentation.
🚀: Deploy stuff.
💄: Add or update the UI and style files.
🎉: Begin a project.
✅: Add, update, or pass tests.
🔒️: Fix security or privacy issues.
🔐: Add or update secrets.
🔖: Release / Version tags.
🚨: Fix compiler / linter warnings.
🚧: Work in progress.
💚: Fix CI Build.
⬇️: Downgrade dependencies.
⬆️: Upgrade dependencies.
📌: Pin dependencies to specific versions.
👷: Add or update CI build system.
📈: Add or update analytics or track code.
♻️: Refactor code.
➕: Add a dependency.
➖: Remove a dependency.
🔧: Add or update configuration files.
🔨: Add or update development scripts.
🌐: Internationalization and localization.
✏️: Fix typos.
💩: Write bad code that needs to be improved.
⏪️: Revert changes.
🔀: Merge branches.
📦️: Add or update compiled files or packages.
👽️: Update code due to external API changes.
🚚: Move or rename resources (e.g.: files, paths, routes).
📄: Add or update license.
💥: Introduce breaking changes.
🍱: Add or update assets.
♿️: Improve accessibility.
💡: Add or update comments in source code.
🍻: Write code drunkenly.
💬: Add or update text and literals.
🗃️: Perform database related changes.
🔊: Add or update logs.
🔇: Remove logs.
👥: Add or update contributor(s).
🚸: Improve user experience / usability.
🏗️: Make architectural changes.
📱: Work on responsive design.
🤡: Mock things.
🥚: Add or update an easter egg.
🙈: Add or update a .gitignore file.
📸: Add or update snapshots.
⚗️: Perform experiments.
🔍️: Improve SEO.
🏷️: Add or update types.
🌱: Add or update seed files.
🚩: Add, update, or remove feature flags.
🥅: Catch errors.
💫: Add or update animations and transitions.
🗑️: Deprecate code that needs to be cleaned up.
🛂: Work on code related to authorization, roles and permissions.
🩹: Simple fix for a non-critical issue.
🧐: Data exploration/inspection.
⚰️: Remove dead code.
🧪: Add a failing test.
👔: Add or update business logic.
🩺: Add or update healthcheck.
🧱: Infrastructure related changes.
🧑‍💻: Improve developer experience.
💸: Add sponsorships or money related infrastructure.
🧵: Add or update code related to multithreading or concurrency.
🦺: Add or update code related to validation.
</gitmojis>
```

<Warning>
  For large reporting windows, custom reports may omit some high-cost data or fail if the prompt becomes too large. When a report includes more than 200 pull requests, CodeRabbit skips linked issues/tickets and GitHub CI/CD checks for that run. If your report still exceeds the model context limit, narrow the date range, reduce the repository or team scope, use the `GROUP_BY` option to split the report into smaller sections, or remove optional data sources.
</Warning>

## Related Resources

* [Schedule reports](/guides/scheduled-reports)
* [API Documentation](/api-reference/report-generate)


# Overview
Source: https://docs.coderabbit.ai/guides/dashboard



The CodeRabbit Dashboard provides visibility into your team's review speed, code quality, collaboration patterns, and the impact of AI-assisted reviews. Use the dashboard to track performance, identify bottlenecks, and measure the ROI of CodeRabbit across your organization.

The dashboard is organized into two sections, accessible from the sidebar.

## Filters

All dashboard metrics can be filtered by:

* **Timeframe**: Select a date range for analysis
* **Org Name**: Filter by a specific organization (self-hosted only, see [Aggregate dashboard](#aggregate-dashboard-for-self-hosted))
* **Repository**: Focus on one or more repositories at the same time
* **Username**: View individual contributor metrics
* **Team**: Filter by a specific team

## Aggregate dashboard for self-hosted

If you are using a self-hosted CodeRabbit instance, the dashboard displays aggregate metrics across all organizations within your instance. Use the **Org Name** filter to drill down into a specific organization's data, or select **All** to view combined metrics across every organization.

This gives instance administrators a single view of review activity, code quality trends, and team performance across the entire deployment.

## Git platform reviews

Metrics for pull request reviews on GitHub, GitLab, Azure DevOps, and Bitbucket. All metrics are calculated only for pull requests that were reviewed by CodeRabbit and merged within the selected timeframe.

For detailed metric definitions, see [Git platform review metrics](/guides/dashboard-metrics).

### Summary

Measure the ROI of AI-assisted reviews. The Summary page displays repository activity, pull request throughput, chat usage, time saved through AI-assisted reviews, comment volume and acceptance rates, and issues surfaced by automated tools.

**Key questions this page answers:**

* How much productivity is the team gaining from AI-assisted reviews?
* Is AI-generated feedback trustworthy and relevant?
* What types of review comments appear most frequently?

### Quality Metrics

Understand what kinds of issues CodeRabbit catches and how often developers act on the feedback. The Quality Metrics page shows comment acceptance rates by severity and category, with drill-down into individual review comments to assess whether feedback is relevant and actionable. For acceptance criteria, see [How acceptance rate is calculated](/guides/dashboard-metrics#how-acceptance-rate-is-calculated).

**Key questions this page answers:**

* Are we improving code quality across critical domains?
* Is CodeRabbit catching meaningful issues?
* Do developers trust and act on AI suggestions?
* Are certain teams or repositories seeing more severe problems?

### Time Metrics

Identify bottlenecks in your review cycle. The Time Metrics page shows how long PRs wait before, during, and after reviews — from first human review through merge — so you can pinpoint where work stalls.

**Key questions this page answers:**

* Is our review process fast enough to support development velocity?
* Where do PRs wait the longest—before, during, or after reviews?
* Are certain repositories or teams experiencing delays unrelated to reviews?

### Knowledge Base

See how your team's accumulated knowledge and integrated tools improve reviews. The Knowledge Base page tracks how often [Learnings](/knowledge-base/learnings) from chat conversations, [path-based instructions](/configuration/path-instructions), and [MCP server](/integrations/mcp-servers) integrations are applied to pull requests, which context sources provide the most coverage, and what automated tool findings are being surfaced.

**Key questions this page answers:**

* How many <Hint type="learnings" /> have been created and how often are they applied?
* How often are path-based instructions being applied to pull requests?
* Which MCP servers are providing coverage across pull requests?
* Is the team building up institutional knowledge over time?
* Which tools are surfacing the most findings, and at what severity?

### Organization Trends

Spot changes in team health over time. The Organization Trends page visualizes weekly PR throughput, reviewer participation, chat adoption, and CI/CD failures to help you catch emerging patterns early.

**Key questions this page answers:**

* Are we merging work consistently, or is a backlog forming?
* Is review participation evenly distributed across the team?
* Are weekly activity levels trending in a healthy direction?

### Pre-merge Checks and Finishing Touches

Monitor how your quality gates and <Hint type="finishing-touches">Finishing Touches</Hint> are performing. The Pre-merge Checks page shows which built-in and [custom checks](/pr-reviews/custom-checks) are configured, how often they run, their pass/fail outcomes, and Finishing Touch recipe usage so you can tune checks or catch gaps.

**Key questions this page answers:**

* How many Pre-merge Checks are configured and how often do they run?
* What is the pass/fail distribution across checks?
* Are custom checks catching issues before code is merged?
* How often are Finishing Touch recipes being triggered and what types are most used?

### Reporting

Track report delivery across your organization. The Reporting page shows how many [scheduled](/guides/scheduled-reports) and on-demand reports are configured, how consistently they're delivered, and which channels your team uses.

**Key questions this page answers:**

* How many reports have been delivered and through which channels?
* How many reports are configured across the organization?

### Data Metrics

Drill down to individual contributors and pull requests. The Data Metrics page is designed for auditability, coaching insights, and debugging review process issues.

**Key questions this page answers:**

* Which developers need more support?
* Which PRs took unusually long to finalize, and why?
* Are certain contributors struggling with specific issue types?
* Which tools surface the most issues?

### Data Export

Download per-PR review metrics as CSV for offline analysis, custom reporting, or integration with other tools.

For export instructions and field definitions, see [Data Export](/guides/data-export).

<Info>
  For programmatic access, use the [Metrics Data API](/api-reference/metrics-data-api) (Enterprise plan feature).
</Info>

## IDE/CLI reviews

Metrics for code reviews performed through CodeRabbit IDE extensions (such as Cursor, VS Code) and the CLI.

For detailed metric definitions, see [IDE/CLI review metrics](/guides/ide-cli-dashboard-metrics).

### IDE/CLI Summary

Understand how your team is adopting CodeRabbit reviews outside of pull requests. The Summary page shows which [IDE extensions](/ide/index) and [CLI tools](/cli/index) are being used, how many reviews are performed, and whether [Learnings](/knowledge-base/learnings) and [path-based instructions](/configuration/path-instructions) carry over to local reviews.

**Key questions this page answers:**

* How actively are developers using IDE/CLI reviews?
* Which IDE extensions or CLI tools are most popular?
* Are Learnings being applied to IDE/CLI reviews?
* Are path-based instructions being applied to IDE/CLI reviews?

### IDE/CLI Organization Trends

Track week-over-week adoption of IDE and CLI reviews across your team. The Organization Trends page shows weekly usage trends, compares activity across extensions, and surfaces automated tool findings by name and severity.

**Key questions this page answers:**

* Is IDE/CLI review adoption growing week over week?
* Are reviews distributed across team members?
* Which tools are surfacing the most findings?

### IDE/CLI Data Metrics

Drill down into individual user activity for IDE and CLI reviews to identify who's actively using local reviews and where to focus adoption efforts.

**Key questions this page answers:**

* Which team members are actively using IDE/CLI reviews?
* How does usage compare across different IDE extensions and the CLI?


# Git platform review metrics
Source: https://docs.coderabbit.ai/guides/dashboard-metrics

Detailed definitions and calculations for all CodeRabbit Git platform review dashboard metrics.

<Info>
  All metrics on this page that are derived from pull requests are calculated only for pull requests that were **reviewed by CodeRabbit and merged** within the selected timeframe. Metrics can be filtered by repository, username, team, or organization (self-hosted only).
</Info>

## Summary

The Summary page provides a high-level overview of team performance in terms of delivery speed and review quality.

**Active Repositories**: Total repositories with CodeRabbit installed that had review activity.

**Merged Pull Requests**: Total pull requests reviewed by CodeRabbit and successfully merged, with the average number of PRs merged per active user.

**Active Users**: Total users whose pull requests were reviewed by CodeRabbit, split by assigned and unassigned seats.

**Chat Usage**: Number of chat sessions started and total messages exchanged with CodeRabbit.

**Median Time**: Median time from review readiness to merge and to last commit.

<Expandable title="Calculation details">
  Medians of:

  * `(pr_merge - ready_for_review)`
  * `(last_commit - ready_for_review)`

  where:

  * `ready_for_review`: Timestamp when PR was marked ready for review (or creation date if never in draft)
  * `pr_merge`: Timestamp when the PR was merged
  * `last_commit`: Timestamp of the last non-merge, non-rebased commit (or merge date if no later commit)
</Expandable>

**Reviewer Time Saved**: AI-estimated human reviewer time saved during pull request reviews.

<Expandable title="Calculation details">
  Sum of estimated review effort displayed in the Walkthrough section of each
  merged PR, representing the human review time saved since CodeRabbit's
  automated analysis handles the initial code review.
</Expandable>

**CodeRabbit Review Comments**: Review comments posted by CodeRabbit on merged PRs.

**Acceptance Rate**: Percentage of CodeRabbit comments accepted by developers. See [How acceptance rate is calculated](#how-acceptance-rate-is-calculated) for the accepted-comment criteria.

**Avg Review Comments Posted per PR**: Average review comments per pull request from CodeRabbit and human reviewers. Human reviewers follow the [human reviewer exclusion](#human-reviewer-exclusion) definition.

**Review Comments by Severity**: Distribution of CodeRabbit review comments grouped by severity.

**Severity Distribution**: Radar view of CodeRabbit comments by severity, showing posted vs accepted.

**Review Comments by Category**: Distribution of CodeRabbit review comments grouped by category.

<Expandable title="Additional details">
  Categories describe the type of issue identified:

  * **Security & Privacy**: Vulnerabilities that enable exploitation or expose sensitive data (e.g., auth bypass, injection attacks, exposed secrets)
  * **Data Integrity & Integration**: Problems that corrupt data or break API/schema contracts (e.g., transaction issues, schema mismatches, broken migrations)
  * **Performance & Scalability**: Inefficiencies impacting speed or resource usage (e.g., N+1 queries, missing caching, unoptimized loops)
  * **Stability & Availability**: Issues causing crashes, hangs, or resource leaks at runtime (e.g., null pointer errors, memory leaks, deadlocks)
  * **Functional Correctness**: Logic errors producing wrong results (e.g., off-by-one errors, incorrect conditions, algorithm mistakes)
  * **Maintainability & Code Quality**: Code hygiene affecting readability and future changes (e.g., unclear naming, duplication, poor structure)

  Data captured from Nov 10, 2025 onwards.
</Expandable>

**Category Distribution**: Radar view of CodeRabbit comments by category, showing posted vs accepted.

<Expandable title="Additional details">
  Categories describe the type of issue identified:

  * **Security & Privacy**: Vulnerabilities that enable exploitation or expose sensitive data (e.g., auth bypass, injection attacks, exposed secrets)
  * **Data Integrity & Integration**: Problems that corrupt data or break API/schema contracts (e.g., transaction issues, schema mismatches, broken migrations)
  * **Performance & Scalability**: Inefficiencies impacting speed or resource usage (e.g., N+1 queries, missing caching, unoptimized loops)
  * **Stability & Availability**: Issues causing crashes, hangs, or resource leaks at runtime (e.g., null pointer errors, memory leaks, deadlocks)
  * **Functional Correctness**: Logic errors producing wrong results (e.g., off-by-one errors, incorrect conditions, algorithm mistakes)
  * **Maintainability & Code Quality**: Code hygiene affecting readability and future changes (e.g., unclear naming, duplication, poor structure)

  Data captured from Nov 10, 2025 onwards.
</Expandable>

**Avg Review Iterations per PR**: Average number of review iterations per pull request.

<Expandable title="Calculation details">
  Count of review events per PR.
</Expandable>

**Tool Findings**: Automated tool findings surfaced during reviews.

<Expandable title="Tool categories">
  * **SAST**: Security scanners like Semgrep, Betterleaks, Checkov
  * **Linter**: Code quality tools like ESLint, RuboCop, Flake8
  * **Other**: Unrecognized tools
</Expandable>

**Pipeline Failures**: CI/CD pipeline failures detected during reviews (counted once per PR).

<Tip>
  If either **Median Time (Merge)** or **Median Time (Last Commit)** spikes, it
  may signal bottlenecks or overloaded reviewers.
</Tip>

***

## Quality Metrics

All charts on this page support drill-down into individual comments. Click any acceptance rate stat to view comments for that severity or category. On the bar charts, click a bar to reveal a tooltip, then click the **Posted** or **Accepted** count to list those comments and navigate to each one on the pull request.

**Acceptance Rate by Severity**: Percentage of CodeRabbit comments accepted, grouped by severity. Click any severity value to view all comments for that severity.

<Expandable title="Calculation details">
  `(Accepted comments ÷ Posted comments) × 100` calculated per severity level.
</Expandable>

**Review Comment Count by Severity**: Number of CodeRabbit comments posted and accepted, grouped by severity. Click a bar to open a tooltip, then click the Posted or Accepted count to drill down into individual comments.

**Acceptance Rate by Category**: Percentage of CodeRabbit comments accepted, grouped by category. Click any category value to view all comments for that category.

<Expandable title="Calculation details">
  `(Accepted comments ÷ Posted comments) × 100` calculated per category.

  Data captured from Nov 10, 2025 onwards.
</Expandable>

**Review Comment Count by Category**: Number of CodeRabbit comments posted and accepted, grouped by category. Click a bar to open a tooltip, then click the Posted or Accepted count to drill down into individual comments.

<Expandable title="Additional details">
  Data captured from Nov 10, 2025 onwards.
</Expandable>

**Comment Details**: Paginated table of individual comments shown when drilling down from an acceptance rate stat or a bar chart count. Click the pull request number or comment link to navigate to the comment on the pull request.

<Expandable title="Fields included">
  * **Pull Request**: PR number
  * **Comment**: Direct link to the comment on the pull request
  * **Repository**: Repository name
  * **Author**: PR author
  * **Severity**: Severity of the comment
  * **Category**: Category of the issue identified
  * **Accepted**: Whether the comment was accepted (Yes/No)
  * **Created At**: Timestamp of when the comment was posted
</Expandable>

### How acceptance rate is calculated

Acceptance rate measures the share of CodeRabbit review comments that developers fully act on:

```text theme={null}
Acceptance Rate = (Accepted Comments / Posted Comments) x 100
```

CodeRabbit calculates acceptance rate separately for each severity level, such as Critical, Major, and Minor, and for each comment category, such as Security & Privacy, Functional Correctness, and Maintainability & Code Quality.

A comment counts as accepted when CodeRabbit can verify that the feedback was fully addressed. This can happen in four ways:

* The developer applies a one-click commit suggestion, and CodeRabbit confirms the change during the next incremental review.
* The developer uses **Fix with AI**, commits the generated fix, and CodeRabbit verifies that the issue was addressed.
* The developer fixes the issue in their IDE, pushes a new commit, and CodeRabbit marks the comment as addressed on the next incremental review.
* The developer replies in the review thread to confirm the fix, and the review comment shows the confirmation.

The acceptance flag is set by CodeRabbit's verification logic, not by the Git provider's thread state. These actions do not count as accepted comments:

* Manually resolving the conversation in GitHub or GitLab.
* Using `@coderabbitai resolve`. This removes the review blocker so the PR can be merged, but it does not mark the comment as accepted for dashboard metrics.
* Partially addressing the suggestion. The comment must be fully addressed to count as accepted.
* Ignoring the comment. The metric does not distinguish between actively rejected comments and comments that were not acted on.
* Addressing only part of a multi-comment thread. The thread remains not accepted until the feedback is fully resolved.
* Creating a Learning to dismiss future comments. A Learning does not flip the acceptance flag unless the code changes or the developer confirms the fix.

This makes acceptance rate a quality signal for CodeRabbit feedback: it reflects AI-verified or developer-confirmed action, rather than manual thread cleanup.

### Comment categories

Categories describe the type of issue identified:

* **Security & Privacy**: Vulnerabilities that enable exploitation or expose sensitive data (e.g., auth bypass, injection attacks, exposed secrets)
* **Data Integrity & Integration**: Problems that corrupt data or break API/schema contracts (e.g., transaction issues, schema mismatches, broken migrations)
* **Performance & Scalability**: Inefficiencies impacting speed or resource usage (e.g., N+1 queries, missing caching, unoptimized loops)
* **Stability & Availability**: Issues causing crashes, hangs, or resource leaks at runtime (e.g., null pointer errors, memory leaks, deadlocks)
* **Functional Correctness**: Logic errors producing wrong results (e.g., off-by-one errors, incorrect conditions, algorithm mistakes)
* **Maintainability & Code Quality**: Code hygiene affecting readability and future changes (e.g., unclear naming, duplication, poor structure)

<Tip>
  High acceptance for critical issues suggests CodeRabbit is catching
  **meaningful defects** early.
</Tip>

***

## Time Metrics

**Time to Merge**: Duration from PR review-ready to merge. Shown as average, median, P75, and P90.

<Expandable title="Calculation details">
  `(pr_merge - ready_for_review)` where:

  * `ready_for_review`: Timestamp when PR was marked ready for review (or creation date if never in draft)
  * `pr_merge`: Timestamp when the PR was merged
</Expandable>

**Weekly Review-Ready → Merge Time**: Weekly trend of time from review-ready to merge.

**Time to Last Commit**: Duration from PR review-ready to final commit (or merge if no later commit). Shown as average, median, P75, and P90.

<Expandable title="Calculation details">
  `(last_commit - ready_for_review)` where:

  * `ready_for_review`: Timestamp when PR was marked ready for review (or creation date if never in draft)
  * `last_commit`: Timestamp of the last non-merge, non-rebased commit (or merge date if no new commits)
</Expandable>

**Weekly Review-Ready → Last Commit Time**: Weekly trend of time from review-ready to final commit.

### Human reviewer exclusion

Human reviewers exclude the pull request author; usernames that are blank or contain only whitespace; recognized service or automation accounts, including usernames that match patterns such as `svc-*`, `bot-*`, and `*-bot`, CI systems, dependency bots, and security-analysis bots; and accounts marked as bots within the matching workspace and source-control provider. Username-pattern matching is conservative: a real person whose username follows a service-account pattern is excluded until per-customer exceptions are available.

Existing values can shift without new pull request activity when an account is newly recognized as automated. Human review comment totals can decrease, and time to first human review can increase when an automated account was previously counted as the first reviewer.

**Time to First Human Review**: Duration from PR review-ready to the first human review activity. Shown as average, median, P75, and P90. Human reviewers follow the [human reviewer exclusion](#human-reviewer-exclusion) definition.

<Expandable title="Calculation details">
  `(first_human_review - ready_for_review)` where:

  * `ready_for_review`: Timestamp when PR was marked ready for review (or creation date if never in draft)
  * `first_human_review`: Timestamp of the first review activity by a human reviewer
</Expandable>

**Weekly Review-Ready → First Human Review Time**: Weekly trend of time from review-ready to the first human review activity.

**Time to Last Human Review**: Duration from PR review-ready to the last human review activity. Shown as average, median, P75, and P90. Human reviewers follow the [human reviewer exclusion](#human-reviewer-exclusion) definition.

<Expandable title="Calculation details">
  `(last_human_review - ready_for_review)` where:

  * `ready_for_review`: Timestamp when PR was marked ready for review (or creation date if never in draft)
  * `last_human_review`: Timestamp of the last review activity by a human reviewer
</Expandable>

**Weekly Review-Ready → Last Human Review Time**: Weekly trend of time from review-ready to the last human review activity.

### Understanding time metrics

* **Average**: Overall average duration across all PRs
* **Median**: Typical duration (less affected by outliers)
* **P75**: 75th percentile, helps identify PRs taking longer than usual
* **P90**: 90th percentile, highlights potential bottlenecks

<Info>
  If **Time to Last Commit** is short but **Time to Merge** is much longer, PRs may be sitting idle—stalled by approvals, release gates, or unclear ownership.
</Info>

## Knowledge Base

Track how your team's accumulated knowledge contributes to pull request reviews.

**Learnings Created**: Total <Hint type="learnings" /> created from chat interactions, showing both all-time and within the selected time period.

**Learnings Usage**: Percentage of PRs that benefited from Learnings and total times applied.

**Path-based Instructions Usage**: Percentage of PRs that benefited from <Hint type="path-instructions">path-based instructions</Hint> and total times applied.

**Weekly Learnings Created**: Weekly count of Learnings created.

**Weekly Learnings Applied**: Weekly count of the number of times Learnings were applied.

**PR Coverage by MCP Server**: Percentage of PRs that used each of the MCP servers.

**MCP Tool Usage**: Total tool calls and insights generated per MCP server.

**Tool Findings by Tool Name**: Automated tool findings grouped by individual tool.

**Tool Findings by Severity**: Automated tool findings grouped by severity.

## Organization Trends

**Weekly Pull Requests: Created & Merged**: Weekly counts of pull requests created and merged.

**Weekly Avg Comments per PR: CodeRabbit & Human**: Weekly average review comments posted by CodeRabbit and human reviewers.

**Weekly Active Users**: Weekly count of distinct users whose PRs were reviewed by CodeRabbit.

**Weekly Avg Pull Requests per User**: Weekly average number of pull requests merged per user.

**Weekly Chat Sessions**: Weekly trend of chat interactions with CodeRabbit on pull requests.

**Weekly Pipeline Failures**: Weekly trend of CI/CD pipeline failures detected during reviews.

**Most Active Pull Request Authors**: Top 10 contributors ranked by number of merged PRs.

**Most Active Pull Request Reviewers**: Top 10 contributors ranked by number of PRs reviewed.

<Info>
  Slow **Time to First Human Review** combined with concentrated reviewer activity may indicate review responsibilities are falling on too few people.
</Info>

## Pre-merge Checks

Monitor how your built-in and [custom](/pr-reviews/custom-checks) quality gates are performing across repositories.

**Custom Pre-merge Checks Configured**: Number of unique custom Pre-merge Checks configured.

**Weekly Pre-Merge Check Runs**: Weekly trend of Pre-merge Check runs, broken down by result status.

**Pre-Merge Check Runs**: Number of Pre-merge Checks executed, split by built-in and custom checks.

**Pre-Merge Check Results**: Count of pass, fail, and inconclusive outcomes for each Pre-merge Check.

## Finishing Touches

**Finishing Touch Runs**: Number of [Finishing Touch](/finishing-touches/index) recipes executed, split by recipe type.

**Weekly Finishing Touch Runs**: Weekly trend of Finishing Touch runs, broken down by recipe type.

**Finishing Touch Runs by Output Type**: Number of Finishing Touch recipes executed, split by output delivery type.

## Reporting

Track [scheduled](/guides/scheduled-reports) and on-demand report delivery across your organization.

**Scheduled Reports Delivered**: Total scheduled reports successfully delivered.

**Reports Delivered by Channel**: Distribution of reports delivered across delivery channels.

**Reports Configured**: Number of active reports configured, split by scheduled and on-demand.

**Weekly Reports Delivered**: Weekly count of scheduled reports successfully delivered.

## Data Metrics

**Active User Details**: Per-user summary of pull request activity and reviews.

<Expandable title="Fields included">
  * **PRs Created**: Number of PRs created by the user
  * **PRs Merged**: Number of PRs merged by the user
  * **Median Time to Last Commit**: Median time for PRs authored by the user
  * **Total Review Comments**: CodeRabbit comments posted on their PRs
  * **Overall Acceptance Rate**: Percentage of comments accepted
  * **Critical Comments**: Posted vs accepted
  * **Major Comments**: Posted vs accepted
  * **Other Comments**: Posted vs accepted
</Expandable>

**Pull Request Details**: Detailed review metrics for each merged pull request.

<Expandable title="Fields included">
  * **Repository**: Repository name
  * **Author**: PR author
  * **Created At**: PR creation timestamp
  * **First Human Review**: Timestamp of first human review
  * **Merged At**: PR merge timestamp
  * **Estimated Complexity**: AI-estimated PR complexity
  * **Estimated Review Time**: AI-estimated review effort
  * **Number of Human Reviewers**: Count of human reviewers. Human reviewers follow the [human reviewer exclusion](#human-reviewer-exclusion) definition.
  * **Human Review Comment Count**: Comments from human reviewers. Human reviewers follow the [human reviewer exclusion](#human-reviewer-exclusion) definition.
  * **Total CodeRabbit Comments**: Posted vs accepted
  * **Critical Comments**: Posted vs accepted
  * **Major Comments**: Posted vs accepted
  * **Other Comments**: Posted vs accepted
  * **Tool Findings**: Automated tool issues found
  * **Pipeline Failures**: CI/CD failures detected
</Expandable>

**Tool Finding Details**: Automated tool findings surfaced during review for merged pull requests.

<Expandable title="Fields included">
  * **Tool Name**: Name of the tool (e.g., ESLint, Semgrep)
  * **Category**: Rule type or issue category
  * **Severity**: Warning, error, grammar, style, or unknown
  * **Count**: Number of occurrences
</Expandable>

***

## Data Export

The Data Export page provides CSV downloads of per-PR review metrics for offline analysis, reporting, or integration with other tools.

For export instructions and field definitions, see [Data Export](/guides/data-export).

<Tip>
  For programmatic access, use the [Metrics Data API](/api-reference/metrics-data-api) (Enterprise plan feature).
</Tip>


# Data Export
Source: https://docs.coderabbit.ai/guides/data-export

Export data from your CodeRabbit Dashboard for offline analysis and reporting.

<ProPlanBadge />

This page covers the **Dashboard CSV export**. For programmatic access, use the
[Metrics Data API](/api-reference/metrics-data-api) (Enterprise plan required).

## How to export

1. Navigate to **Dashboard > Data Export**
2. Select the required date range:
   * Last 7 days
   * Last 30 days
   * Last 90 days
   * Custom range (within the last 1 year)
3. Click the **Export** button
4. The CSV file downloads automatically

## Exported fields

The CSV includes the following fields for each PR:

| Field                                                | Type     | Description                                                                                                                                                                                    |
| ---------------------------------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `pr_url`                                             | String   | Full URL to the pull request                                                                                                                                                                   |
| `author_id`                                          | String   | Unique numeric identifier assigned by your Git provider (GitHub, GitLab, etc.). Unlike usernames, this ID remains constant even if the user changes their username.                            |
| `author_username`                                    | String   | Username of the PR author                                                                                                                                                                      |
| `organization_id`                                    | String   | Unique identifier for the organization assigned by your Git provider. Unlike organization names, this ID remains constant even if the organization is renamed.                                 |
| `organization_name`                                  | String   | Organization name                                                                                                                                                                              |
| `repository_id`                                      | String   | Unique numeric identifier assigned by your Git provider. Unlike repository names, this ID remains constant even if the repository is renamed or transferred to a different owner.              |
| `repository_name`                                    | String   | Repository name                                                                                                                                                                                |
| `created_at`                                         | ISO 8601 | When the PR was created                                                                                                                                                                        |
| `ready_for_review_at`                                | ISO 8601 | When the PR became ready for review (matches `created_at` if the PR was never a draft; empty for older records where this timestamp was not collected)                                         |
| `first_human_review_at`                              | ISO 8601 | When the first human review was submitted (empty if no human reviewers). Human reviewers follow the [human reviewer exclusion](/guides/dashboard-metrics#human-reviewer-exclusion) definition. |
| `last_commit_at`                                     | ISO 8601 | When the last non-merge, non-rebased commit was pushed (empty if no new commits)                                                                                                               |
| `merged_at`                                          | ISO 8601 | When the PR was merged                                                                                                                                                                         |
| `estimated_complexity`                               | Integer  | Complexity score (1-5)                                                                                                                                                                         |
| `estimated_review_minutes`                           | Integer  | Estimated time to review in minutes                                                                                                                                                            |
| `total_coderabbit_comments_posted`                   | Integer  | Total review comments posted by CodeRabbit                                                                                                                                                     |
| `total_coderabbit_comments_accepted`                 | Integer  | Total CodeRabbit review comments accepted                                                                                                                                                      |
| `critical_comments_posted`                           | Integer  | Critical severity comments posted                                                                                                                                                              |
| `critical_comments_accepted`                         | Integer  | Critical severity comments accepted                                                                                                                                                            |
| `major_comments_posted`                              | Integer  | Major severity comments posted                                                                                                                                                                 |
| `major_comments_accepted`                            | Integer  | Major severity comments accepted                                                                                                                                                               |
| `minor_comments_posted`                              | Integer  | Minor severity comments posted                                                                                                                                                                 |
| `minor_comments_accepted`                            | Integer  | Minor severity comments accepted                                                                                                                                                               |
| `trivial_comments_posted`                            | Integer  | Trivial severity comments posted                                                                                                                                                               |
| `trivial_comments_accepted`                          | Integer  | Trivial severity comments accepted                                                                                                                                                             |
| `info_comments_posted`                               | Integer  | Info severity comments posted                                                                                                                                                                  |
| `info_comments_accepted`                             | Integer  | Info severity comments accepted                                                                                                                                                                |
| `security_and_privacy_comments_posted`               | Integer  | Security & Privacy category comments posted                                                                                                                                                    |
| `security_and_privacy_comments_accepted`             | Integer  | Security & Privacy category comments accepted                                                                                                                                                  |
| `performance_and_scalability_comments_posted`        | Integer  | Performance & Scalability category comments posted                                                                                                                                             |
| `performance_and_scalability_comments_accepted`      | Integer  | Performance & Scalability category comments accepted                                                                                                                                           |
| `functional_correctness_comments_posted`             | Integer  | Functional Correctness category comments posted                                                                                                                                                |
| `functional_correctness_comments_accepted`           | Integer  | Functional Correctness category comments accepted                                                                                                                                              |
| `maintainability_and_code_quality_comments_posted`   | Integer  | Maintainability & Code Quality category comments posted                                                                                                                                        |
| `maintainability_and_code_quality_comments_accepted` | Integer  | Maintainability & Code Quality category comments accepted                                                                                                                                      |
| `data_integrity_and_integration_comments_posted`     | Integer  | Data Integrity & Integration category comments posted                                                                                                                                          |
| `data_integrity_and_integration_comments_accepted`   | Integer  | Data Integrity & Integration category comments accepted                                                                                                                                        |
| `stability_and_availability_comments_posted`         | Integer  | Stability & Availability category comments posted                                                                                                                                              |
| `stability_and_availability_comments_accepted`       | Integer  | Stability & Availability category comments accepted                                                                                                                                            |

<Info>
  Severity and category data is only available for pull requests reviewed on or
  after October 10, 2025. Earlier pull requests will have empty values for these
  fields.
</Info>

For more details on how these metrics are calculated, see [Dashboard Metrics](/guides/dashboard-metrics).

## CSV format

The exported file uses standard CSV formatting:

* UTF-8 encoding
* Comma-separated values
* ISO 8601 timestamps (UTC)
* Empty values for null fields

## Limits

| Limit        | Value  |
| ------------ | ------ |
| Maximum rows | 10,000 |

If your export exceeds 10,000 rows, you'll see a warning that data has been truncated. To get complete data:

* Reduce the date range
* Use the [Metrics Data API](/api-reference/metrics-data-api) for larger exports (Enterprise plan required)


# IDE/CLI review metrics
Source: https://docs.coderabbit.ai/guides/ide-cli-dashboard-metrics

Detailed definitions for all CodeRabbit IDE and CLI review dashboard metrics.

## Summary

The Summary page provides a high-level overview of review activity across [IDE extensions](/ide/index) and the [CLI](/cli/index). Use it to understand adoption, see whether <Hint type="learnings" /> carry over to local reviews, and track tool findings.

**Active Repositories**: Total number of repositories where reviews were performed through IDE extensions or CLI.

**Active Users**: Number of active users who have used CodeRabbit IDE extensions or CLI for reviews.

**Reviews**: Total number of code reviews performed through IDE extensions or CLI.

**Review Comments**: Total review comments posted for reviews done through IDE extensions or CLI.

**Learnings Usage**: Percentage of IDE/CLI reviews that benefited from Learnings and total times applied.

**Path-based Instructions Usage**: Percentage of IDE/CLI reviews that benefited from <Hint type="path-instructions">path-based instructions</Hint> and total times applied.

**Tool Findings**: Automated tool findings from SAST and linter tools surfaced during reviews.

**Active Users by Extension Type**: Active users broken down by IDE extension or CLI.

**Reviews by Extension Type**: Distribution of code reviews across IDE extensions and CLI.

***

## Organization Trends

Track week-over-week adoption of IDE and CLI reviews across your team.

**Weekly Active Users**: Weekly trend of unique users performing reviews using each IDE extension or CLI.

**Weekly Reviews**: Weekly trend of reviews performed using each IDE extension or CLI.

**Weekly Avg Reviews per User**: Weekly trend of average number of reviews per active user.

**Weekly Review Comments**: Weekly trend of review comments posted through IDE extensions and CLI.

**Tool Findings by Tool Name**: Number of automated tool findings surfaced during reviews, grouped by individual tool.

**Tool Findings by Severity**: Number of automated tool findings surfaced during reviews, grouped by severity.

***

## Data Metrics

Drill down into individual user activity to identify who's actively using local reviews and where to focus adoption efforts.

**Active User Details**: Per-user summary of IDE extension and CLI review activity.

<Expandable title="Fields included">
  * **Full Name**: Full name of the user
  * **Username**: Username of the user
  * **Extension Type**: IDE extension or CLI used
  * **Installed**: When the extension or CLI was installed
  * **Last Used**: Timestamp of the user's most recent review
  * **Total Reviews**: Number of code reviews performed via CodeRabbit
  * **Total Review Comments**: Number of review comments posted by CodeRabbit
</Expandable>

## What's next

<CardGroup>
  <Card title="IDE extension overview" href="/ide/index" icon="code">
    Set up and use CodeRabbit's AI-powered code reviews directly in your IDE.
  </Card>

  <Card title="Command-line review tool" href="/cli/index" icon="square-terminal">
    Run CodeRabbit reviews from the CLI to catch issues before you commit.
  </Card>

  <Card title="Dashboard overview" href="/guides/dashboard" icon="layout-dashboard">
    Explore all dashboard sections and learn what each page helps you answer.
  </Card>
</CardGroup>


# Legacy Report Testing
Source: https://docs.coderabbit.ai/guides/ondemand-reports

Generate single-use test reports using the legacy CodeRabbit API. Learn how to create API keys and make test sample report requests programmatically.

<ProPlanBadge />

<DeprecatedBadge href="/guides/scheduled-reports" />

<Accordion title="All instructions for generating test sample reports">
  ## Overview

  Generate single-use reports instantly using the CodeRabbit API. API generated reports are ideal for testing report formats or getting quick insights without setting up recurring schedules.

  <Tip>
    For a conceptual overview of reports in CodeRabbit, see [Generate
    reports](/management/reports).
  </Tip>

  ## API access

  CodeRabbit offers a way to generate api reports using the [CodeRabbit API](/api-reference/report-generate). You will need an API Key to access the CodeRabbit API and generate an api report.

  ## Create an API key

  <Steps>
    <Step title="Navigate to API Keys">
      Sign in to your CodeRabbit account and navigate to the [**API
      Keys**](https://app.coderabbit.ai/settings/api-keys) page under
      'Organization Settings' in the left sidebar
    </Step>

    <Step title="Create new key">
      Click on the **Create API Key** button and enter a name for the API Key
    </Step>

    <Step title="Save your key">
      Copy the API key, and keep it safe as it won't be visible again
    </Step>
  </Steps>

  <img alt="API Keys" />

  ## Generate an api report

  Once you have the API key, pass it in the `x-coderabbitai-api-key` header when calling the API:

  ```bash theme={null}
  curl -X 'POST' \
    'https://api.coderabbit.ai/api/v1/report.generate' \
    -H 'accept: application/json' \
    -H 'x-coderabbitai-api-key: cr-xxxxxxxxxxxxx' \
    -H 'Content-Type: application/json' \
    -d '{
      "from": "2024-05-01",
      "to": "2024-05-15"
    }'
  ```

  ### Sample response

  ```json JSON wrap icon="code" theme={null}
  [
  	{
  		"group": "Developer Activity",
  		"report": "*Developer Activity*:\n\n 🟢 **Update README.md** [#10](https://gitlab.com/master-group123/sub-group/project1/-/merge_requests/10)\n• Summary: The change updates the project description and modifies a section header for clearer instructions.\n• Last activity: 1 day ago, mergeable\n• Insights:\n - :magnifying_glass: @user2 Suggested updating the wording to make it clearer"
  	}
  ]
  ```

  <Info>
    If you get a 401 UNAUTHORIZED error, check if you're passing the right API key
    in the `x-coderabbitai-api-key` header
  </Info>

  ### API schema

  The on-demand report generation endpoints take in inputs as per the schema shown below:

  <Card title="API Reference" icon="code" href="/api-reference/report-generate">
    View complete API documentation and request/response schemas
  </Card>
</Accordion>

## What's next

<CardGroup>
  <Card title="Customize reports" icon="paintbrush" href="/guides/custom-reports">
    Learn how to create custom report formats and prompts
  </Card>

  <Card title="Scheduled reports" icon="calendar" href="/guides/scheduled-reports">
    Set up automated recurring reports for regular monitoring
  </Card>
</CardGroup>


# Organization settings
Source: https://docs.coderabbit.ai/guides/organization-settings

Manage default CodeRabbit settings across your entire Git platform organization and configure repository-level overrides.

Configure CodeRabbit settings for your entire organization to establish consistent code review standards across all repositories. For a general overview of configuring CodeRabbit, see [Configure CodeRabbit](/guides/configuration-overview).

## About organization settings

You can use the CodeRabbit web interface to set the CodeRabbit configuration for all Git repositories associated with your organization. By default, all repositories apply your organization's CodeRabbit configuration.

<Info>
  You can override organization settings for individual repositories if needed.
  For more information, see [Repository
  settings](/guides/repository-settings).
</Info>

## Browse and modify your organization settings

<Steps>
  <Step title="Access the CodeRabbit web interface">
    Visit [the CodeRabbit web
    interface](https://app.coderabbit.ai).
  </Step>

  <Step title="Navigate to organization settings">
    In the sidebar, click **Organization Settings**.
  </Step>

  <Step title="Modify settings">
    Browse and modify your settings. The settings page opens in **Concise** mode
    by default, which shows the most commonly used settings. When you're finished
    making changes, click **Apply Changes** to save your configuration.

    <Info>
      If the [configuration inheritance](/configuration/configuration-inheritance) is disabled and a repository has individual settings enabled via configuration file or via repository settings, Organization Settings **will be ignored**. Unset values will fall back to schema defaults.
    </Info>
  </Step>
</Steps>

## Workspace Settings

<EnterprisePlanBadge />

Enterprise customers can enable **Use Workspace Settings** from **Organization Settings**. When **Use Workspace Settings** is on, affected organization settings sections become read-only, and CodeRabbit settings resolve from workspace settings or schema defaults if no workspace settings exist instead of organization-specific settings. See [Configuration inheritance](/configuration/configuration-inheritance) for the full hierarchy.

### Settings view modes

The web interface provides three ways to view and edit your organization settings. All three modes read from the same underlying configuration, so changes persist when you switch between them.

* **Concise (default)**: A curated subset of the most commonly changed settings, organized into categories like General, Reviews, Pre-merge checks, and Finishing touches.
* **All Settings**: The complete list of every available setting. Switch to this mode if you need to access less common settings such as individual tool configurations, chat settings, knowledge base, code generation, and issue enrichment.
* **YAML Editor**: Direct YAML editing with syntax highlighting, real-time schema validation, and clipboard support. Only non-default values are shown. The YAML format matches `.coderabbit.yaml` for easy transfer between the web interface and repository files.

To switch modes, use the **Change mode** dropdown at the bottom of the sidebar.

<Tip>
  Use **Cmd+K** (Mac) or **Ctrl+K** (Windows/Linux) to open the command
  palette and search for any setting across all modes.
</Tip>

<Note>
  In YAML Editor mode, validation errors must be resolved before saving
  changes.
</Note>

### Preview

In Concise and All Settings modes, a live Preview panel appears on the right side of the settings page. This panel shows a mock PR review comment that visualizes how your settings affect the information CodeRabbit displays in pull request reviews.

<Frame>
  <img alt="Concise mode with the Preview panel showing a live mock of how walkthrough settings affect the PR review comment" />
</Frame>

* Toggle the preview using the **Preview** button in the top-right corner. Preview is enabled by default.
* Settings that affect the PR review output are tagged with **Preview**, so you can identify which settings have a visible impact.
* When you change a setting with preview support, the preview panel automatically scrolls to the affected section and highlights the change.

The preview includes sections such as the PR summary, CodeRabbit-generated summary, walkthrough with changes table, sequence diagrams, pre-merge check results, and finishing touches.


# Repository settings
Source: https://docs.coderabbit.ai/guides/repository-settings

Configure CodeRabbit's behavior for individual repositories using the web interface. Learn about configuration precedence and best practices.

## Browse and modify your settings using the web interface

To view or modify your repository settings using the CodeRabbit web interface:

<Steps>
  <Step title="Open repository settings">
    Visit [the CodeRabbit web interface](https://app.coderabbit.ai/settings/repositories) and click **Repositories** in the sidebar
  </Step>

  <Step title="Select repository">
    Click the gear-shaped **Settings** icon of the repository whose settings you want to view or modify
  </Step>

  <Step title="Disable Organization Settings">
    If the **Use Organization Settings** toggle is on, click it to turn it off to customize this repository's settings

    <Info>
      If you leave the toggle on, CodeRabbit applies settings from [the organization-configuration page](/guides/organization-settings) to this repository
    </Info>
  </Step>

  <Step title="Modify settings">
    Browse and modify your settings. Click **Apply Changes** when you are finished.

    <Info>
      The settings page opens in **Concise** mode by default, which shows the most commonly used settings, switch to **All** to access all possible options.
    </Info>
  </Step>
</Steps>

### Settings view modes

The web interface provides three ways to view and edit your repository settings. To switch modes, use the **Change mode** dropdown at the top. All three modes read from the same underlying configuration, so changes persist when you switch between them.

#### Visual Modes

* **Concise (default)**: A curated subset of the most commonly changed settings, organized into categories like General, Reviews, Pre-merge checks, and Finishing touches.
* **All Settings**: The complete list of every available setting. Switch to this mode if you need to access less common settings such as individual tool configurations, chat settings, knowledge base, code generation, and issue enrichment.

<Info>
  Use **Cmd+K** (Mac) or **Ctrl+K** (Windows/Linux) to open the command palette and search for any setting across all modes.
</Info>

#### Text Mode

* **YAML Editor**: Direct YAML editing with syntax highlighting, real-time schema validation, and clipboard support. Only non-default values are shown. The YAML format matches `.coderabbit.yaml` for easy transfer between the web interface and repository files.

<Info>
  In YAML Editor mode, validation errors must be resolved before saving changes.
</Info>

### Preview

In Concise and All Settings modes, a live Preview panel appears on the right side of the settings page. This panel shows a mock PR review comment that visualizes how your settings affect the information CodeRabbit displays in pull request reviews.

<Frame>
  <img alt="Concise mode with the Preview panel showing a live mock of how walkthrough settings affect the PR review comment" />
</Frame>

* Toggle the preview using the **Preview** button in the top-right corner. Preview is enabled by default.
* Settings that affect the PR review output are tagged with **Preview**, so you can identify which settings have a visible impact.
* When you change a setting with preview support, the preview panel automatically scrolls to the affected section and highlights the change.

The preview includes sections such as the PR summary, CodeRabbit-generated summary, walkthrough with changes table, sequence diagrams, pre-merge check results, and finishing touches.


# Schedule reports
Source: https://docs.coderabbit.ai/guides/scheduled-reports

Set up automated recurring reports for GitHub, GitLab, Bitbucket, and Azure DevOps with customizable schedules, filters, and delivery channels including email, Slack, Discord, and Teams.

<ProPlanBadge />

CodeRabbit Pro offers automated recurring reports that provide insights into your organization's activities. These reports can be customized and delivered through various channels to help teams stay informed about development progress.

<Tip>
  For a conceptual overview of reports in CodeRabbit, see [Generate
  reports](/management/reports).
</Tip>

## Setting up a recurring report

<Steps>
  <Step title="Navigate to Recurring Reports">
    Go to **Recurring Reports** in the [CodeRabbit
    dashboard](https://app.coderabbit.ai/reports/recurring)
  </Step>

  <Step title="Create new report">Click **Create Report**</Step>

  <Step title="Configure settings">
    Configure the following settings based on your team's needs
  </Step>
</Steps>

### Schedule configuration

<img alt="Schedule Configuration" />

The schedule configuration allows you to set precise timing for your reports:

#### Frequency options

<Tabs>
  <Tab title="Days of Week">
    * Select any combination of days (Sun-Sat)
    * Set frequency (every 1-3 weeks)
    * Ideal for weekly team syncs or sprint reviews
  </Tab>

  <Tab title="Days of Month">
    * Select specific dates (1-31)
    * Special date handling:
      * **31st**: Runs on the last day of every month
      * **30th**: Skips February
      * **29th**: Only runs in February during leap years
  </Tab>
</Tabs>

#### Time settings

* Set specific time for report generation
* Choose from comprehensive timezone list (e.g., America/New\_York)
* Reports run at the specified time in the selected timezone

<Check>
  Choose a time that works for all team members, especially for distributed
  teams across different time zones.
</Check>

### Report parameters

Reports can be filtered using multiple parameters, match pull requests using the **IN** option and exclude pull requests using the **NOT\_IN** option:

<CardGroup>
  <Card title="Repositories" icon="folder">
    Select specific repositories to monitor
  </Card>

  <Card title="Labels" icon="tag">
    Filter by labels with operators:

    * **IN**: Match any selected label
    * **NOT\_IN**: Exclude any PR with a selected label
    * **ALL**: Match all selected labels
  </Card>

  <Card title="Users" icon="user">
    Filter by specific users
  </Card>

  <Card title="Teams" icon="users">
    Filter by organization teams

    <Info>Team filtering is not available for GitLab repositories</Info>
  </Card>
</CardGroup>

<Info>
  Each parameter can be:

  * Added or removed as needed
  * Combined with other parameters for precise filtering
  * Modified using different operators
</Info>

### Report content

Reports include comprehensive PR information:

<AccordionGroup>
  <Accordion title="PR metadata">
    * Title and description
    * Creation and last activity dates
    * Status (merged, mergeable, draft)
    * State (open, closed, merged)
  </Accordion>

  <Accordion title="Collaboration details">
    * Labels and reviewers
    * Comments and discussions
    * Team associations
  </Accordion>

  <Accordion title="Additional context">
    * Repository context
    * Author information
  </Accordion>
</AccordionGroup>

<Info>
  PRs are marked as stale after 168 hours (7 days) of inactivity. This helps
  identify potential workflow bottlenecks.
</Info>

### Report templates

CodeRabbit offers several built-in templates:

<CardGroup>
  <Card title="Daily Standup Report" icon="calendar">
    A concise summary of pull requests and activities
  </Card>

  <Card title="Sprint Report" icon="list-check">
    A structured overview of sprint goals, completed tasks, in-progress work,
    and blockers
  </Card>

  <Card title="Release Notes" icon="rocket">
    A high-level changelog with summary and significant changes
  </Card>

  <Card title="Custom Templates" icon="paintbrush">
    Create your own format using prompts. Allows for endless customization such
    as native language reporting (Japanese, Spanish, French, etc.), custom
    formatting, custom titles, and more. [Learn more about custom reports
    →](/guides/custom-reports)
  </Card>
</CardGroup>

Example custom prompt:

```text lines Custom Prompt wrap icon="text" theme={null}
Please provide a summary of:
- All pull request activities
- Related issues and comments
- Code review discussions
- Quality gate status

Do not include:
- Bot conversations
- Sequence diagrams
```

### Communication channels

Configure where your reports will be delivered:

<img alt="Report Delivery Platforms" />

<Tabs>
  <Tab title="Email">
    * Enter individual email addresses
    * Use distribution lists for team-wide delivery
  </Tab>

  <Tab title="Slack/Discord">
    <Steps>
      <Step title="Connect workspace">
        Connect your workspace through OAuth
      </Step>

      <Step title="Select channels">
        Select target channels
      </Step>

      <Step title="Bot installation">
        CodeRabbit bot will be installed automatically
      </Step>
    </Steps>

    <Info>
      If installation fails, check the [Slack service](https://slack-status.com/) or [Discord status](https://discordstatus.com/) page for any outages.
    </Info>
  </Tab>

  <Tab title="Microsoft Teams">
    <Steps>
      <Step title="Create webhook">
        Create a webhook in your Teams channel
      </Step>

      <Step title="Add URL">
        Add the webhook URL to CodeRabbit
      </Step>

      <Step title="Select channels">
        Select target channels
      </Step>
    </Steps>
  </Tab>
</Tabs>

<Check>
  Create separate reports if you need to send to multiple channels with
  different formats. Learn more about [custom report
  formats](/guides/custom-reports).
</Check>

## Managing reports

### Preview reports

<Tip>
  Test your configuration using the **Preview Report** button to generate a
  sample report instantly.
</Tip>

### Grouping options

Reports can be organized hierarchically using groups and subgroups:

<Tabs>
  <Tab title="Primary Grouping">
    Select from these options to organize your main report structure:

    * **None**: No grouping, flat list of items
    * **Repository**: Group by source repository
    * **Label**: Group by PR labels
    * **Team**: Group by team ownership
    * **User**: Group by PR author
  </Tab>

  <Tab title="Subgrouping">
    After selecting a primary group, you can add a secondary level of organization:

    * Choose any remaining grouping option for further categorization
    * Subgroups create a nested hierarchy within primary groups
    * Select "None" to use only primary grouping
  </Tab>
</Tabs>

<Check>
  Choose grouping options that match your team's workflow. For example:

  * Use Repository → Team for large multi-team organizations
  * Use User → Label to track individual contributions by type
  * Use Team → Repository to monitor team activity across repos
</Check>

### Report lifecycle management

Control your reports through their entire lifecycle:

#### Editing reports

<Steps>
  <Step title="Make changes">
    Make your desired changes to any configuration settings
  </Step>

  <Step title="Save changes">
    Click the **Save** button to apply your changes
  </Step>

  <Step title="Changes take effect">
    Changes take effect from the next scheduled run
  </Step>
</Steps>

<Check>
  Remember to click **Save** when you're done making changes. Your modifications
  will be discarded if you navigate away without saving.
</Check>

#### Disabling reports

Toggle the **Active** switch to temporarily pause a report.

Disabled reports:

* Maintain their configuration
* Skip scheduled runs
* Can be re-enabled at any time
* Show "Disabled" status in the dashboard

#### Deleting reports

<Steps>
  <Step title="Click delete">
    Click the **Delete** button (trash icon) next to the report
  </Step>

  <Step title="Confirm deletion">Confirm deletion in the modal</Step>
</Steps>

<Info>
  This action is permanent and cannot be undone. All report history and
  configuration will be removed.
</Info>

<Warning>
  Deleting a report will immediately stop all scheduled runs and remove access
  to historical reports. Consider disabling instead of deleting if you might
  need the report again.
</Warning>

## Best practices

<CardGroup>
  <Card title="Scheduling" icon="clock">
    * Align report timing with your team's workflow
    * Consider timezone differences for distributed teams
  </Card>

  <Card title="Content" icon="file-text">
    * Keep prompts focused on actionable information
    * Use grouping to improve readability
    * Exclude unnecessary details that may create noise
  </Card>

  <Card title="Distribution" icon="share">
    * Use channels your team actively monitors
    * Consider creating separate reports for different audiences (e.g., management vs. development team)
  </Card>
</CardGroup>

## Related resources

<CardGroup>
  <Card title="Custom Reports" icon="paintbrush" href="/guides/custom-reports">
    Create personalized report formats
  </Card>
</CardGroup>

## What's next

<CardGroup>
  <Card title="Customize reports" icon="paintbrush" href="/guides/custom-reports">
    Learn how to create custom report formats and prompts
  </Card>
</CardGroup>


# CodeRabbit IDE Extension
Source: https://docs.coderabbit.ai/ide/index

Review code changes before you commit and create agent-ready Coding Plans, directly in your IDE with the CodeRabbit extension.

## Supported IDEs

The extension works with VS Code and <u>any editor that supports VS Code extensions</u>:

<CardGroup>
  <Card title="Visual Studio Code">
    Full native support for the official VS Code editor
  </Card>

  <Card title="Cursor">
    Compatible with Cursor's AI-powered development environment
  </Card>

  <Card title="Windsurf">
    Works seamlessly with Windsurf and other VS Code-compatible editors
  </Card>
</CardGroup>

Use the extension standalone for local development, or combine it with CodeRabbit's pull request reviews for comprehensive code quality coverage.

## Features

<CardGroup>
  <Card title="Review uncommitted changes" icon="git-commit-vertical">
    Get instant reviews on uncommitted code as you develop. Catch issues before
    you even commit, reducing PR comment noise by 80%.
  </Card>

  <Card title="One-click fixes" icon="wrench">
    Apply simple suggested fixes instantly. Complex fixes get handed off to your
    AI agent with one click.
  </Card>

  <Card title="Fix all" icon="sparkles">
    New feature: Send all review comments and context to your coding agent at once
    for comprehensive fixes.
  </Card>

  <Card title="AI agent integration" icon="bot">
    Native integration with Copilot, Claude Code CLI and extension, Codex CLI,
    OpenCode, Cline, Roo, Kilo Code, Augment Code, plus clipboard fallback for
    any AI agent.
  </Card>

  <Card title="Context-aware reviews" icon="database">
    Paid users reviewing repositories connected to their CodeRabbit organization
    get full context: learnings, tools, and 50+ contextual sources for
    comprehensive analysis.
  </Card>

  <Card title="Coding Plans" icon="list-check">
    Create, browse, and implement Coding Plans from the **Plans** tab, then hand selected phases to your AI coding agent.
  </Card>
</CardGroup>

## Pricing and capabilities

For IDE review limits per plan, see [Rate limits](/management/plans#rate-limits).

Paid users get nearly all PR review features in the IDE, including learnings and contextual analysis. Only chat, docstrings, and unit test generation remain exclusive to PR reviews. Note that PR reviews and IDE reviews may differ, even if run on the same PR.

For custom rate limits or Enterprise needs, contact [sales@coderabbit.ai](mailto:sales@coderabbit.ai).

## Get started

<CardGroup>
  <Card title="Install the VS Code extension" href="/ide/vscode-install" icon="download">
    Download and install the CodeRabbit extension for VS Code or compatible
    editors.
  </Card>

  <Card title="Plan implementation" href="/ide/vscode-plan" icon="list-check">
    Create Coding Plans from your workspace and hand selected phases to your AI coding agent.
  </Card>

  <Card title="Review code changes" href="/ide/vscode-use" icon="play">
    Learn how to trigger reviews, apply fixes, and integrate with your development workflow.
  </Card>
</CardGroup>


# Configure the VS Code extension
Source: https://docs.coderabbit.ai/ide/vscode-config

Customize the CodeRabbit VS Code extension settings, including AI agent integration, automatic review behavior, regional infrastructure, task startup, and self-hosted configurations.

Configure the CodeRabbit VS Code extension to match your workflow preferences. For more information about using the extension, see [Review local changes](/ide).

<Note>
  These instructions are specific to VS Code. If you're using a VS Code-compatible
  editor like Cursor or Windsurf, the steps are similar but may require some
  adaptation.
</Note>

## Find the settings screen

<Steps>
  <Step title="Open CodeRabbit sidebar">
    Open the CodeRabbit activity bar/sidebar.
  </Step>

  <Step title="Click the settings icon">
    In the sidebar, click the gear-shaped icon on the top right (beside the
    logout icon).
  </Step>
</Steps>

<Tip>
  You can also search for **CodeRabbit: Settings** in the command palette to
  open the settings directly.
</Tip>

The settings screen contains the following configuration controls.

| Setting              | Values                                                                                                                                       | Default  | Use when                                                                                                                    |
| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------- |
| **Agent Type**       | `Native`, `Claude Code`, `Claude Code Extension`, `Codex CLI`, `Clipboard`, `Cline`, `Devin`, `Roo`, `Kilo Code`, `Augment Code`, `OpenCode` | `Native` | You want to choose how **Fix with AI** sends review comments to an AI coding agent.                                         |
| **Auto Review Mode** | `Disabled`, `Prompt`, `Auto`                                                                                                                 | `Prompt` | You want to control whether local commits trigger CodeRabbit reviews.                                                       |
| **Region**           | `us`, `eu`                                                                                                                                   | `us`     | You use CodeRabbit Cloud and need the extension to connect to US or EU infrastructure.                                      |
| **Auto Start Task**  | `true`, `false`                                                                                                                              | `true`   | You want supported AI agents to start tasks automatically instead of opening with the prompt ready for manual confirmation. |
| **Self Hosted URL**  | URL                                                                                                                                          | unset    | You use a self-hosted CodeRabbit instance instead of CodeRabbit Cloud.                                                      |

## Configure AI agent integration

The **Agent Type** setting lets you choose how the extension responds when using the **Fix with AI** feature during code reviews.

<Tabs>
  <Tab title="Native integrations">
    <CardGroup>
      <Card title="Native">
        Prompts the AI agent associated with your IDE to apply the suggested
        fix.

        <Note>
          Works with VS Code (using Copilot), Cursor, Devin, and Windsurf. For other
          IDEs, copies to clipboard.
        </Note>
      </Card>

      <Card title="Clipboard">
        Copies prompt text describing the suggested fix to your clipboard for
        manual use with your preferred AI agent.
      </Card>
    </CardGroup>
  </Tab>

  <Tab title="Command-line tools">
    <CardGroup>
      <Card title="Claude Code">
        Opens Terminal and uses the `claude` command-line program to apply
        fixes.
      </Card>

      <Card title="Codex CLI">
        Opens Terminal and uses the `codex` command-line program to apply fixes.
      </Card>

      <Card title="OpenCode">
        Opens Terminal and uses the `opencode` command-line program to apply
        fixes.
      </Card>
    </CardGroup>
  </Tab>

  <Tab title="VS Code extensions">
    <CardGroup>
      <Card title="Claude Code Extension">
        Opens the Claude Code VS Code extension with the suggested fix prompt.
      </Card>

      <Card title="Cline">
        Opens the Cline sidebar and runs a task to apply the suggested fix.
      </Card>

      <Card title="Roo">
        Opens the Roo sidebar and runs a task to apply the suggested fix.
      </Card>

      <Card title="Kilo Code">
        Opens the Kilo Code sidebar and runs a task to apply the suggested fix.
      </Card>

      <Card title="Augment Code">
        Opens the Augment Code sidebar with the prompt, allowing you to start
        the task manually.
      </Card>
    </CardGroup>
  </Tab>
</Tabs>

For more information about the **Fix with AI** feature, see [Request help from your AI coding agent](/ide/vscode-use#use-ai-coding-agents).

## Configure automatic review behavior

The **Auto Review Mode** setting controls how the extension handles automatic code reviews after you make commits to your local Git repository.

<CardGroup>
  <Card title="Disabled">
    The extension doesn't perform automatic code reviews.
  </Card>

  <Card title="Prompt">
    After every commit, displays a dialog asking if you'd like to perform a code
    review.
  </Card>

  <Card title="Auto">
    Always performs a review after every commit automatically.
  </Card>
</CardGroup>

For more information about this feature, see [Automatically review local commits](/ide/vscode-use#automatic-reviews).

## Choose the CodeRabbit region

The **Region** setting controls which CodeRabbit Cloud infrastructure the extension connects to.

| Value | Behavior                                        |
| ----- | ----------------------------------------------- |
| `us`  | Connects to the US region. This is the default. |
| `eu`  | Connects to the EU region.                      |

If you configure **Self Hosted URL**, the extension connects to that URL instead of the selected CodeRabbit Cloud region.

## Configure task startup

The **Auto Start Task** setting controls whether supported AI agents start working on the suggested fix automatically.

| Value   | Behavior                                                                             |
| ------- | ------------------------------------------------------------------------------------ |
| `true`  | Starts tasks automatically for supported agents. This is the default.                |
| `false` | Opens the selected agent with the prompt ready so you can review and start manually. |

This setting applies to supported agents such as **Native** in VS Code, **Cline**, **Roo**, and **Kilo Code**.

## Use with self-hosted CodeRabbit

The **Self Hosted URL** setting is only used when you're using a self-hosted instance of CodeRabbit. If you're using the CodeRabbit Cloud service, you don't need to configure this setting.

Set this to the base URL of your CodeRabbit instance, such as `https://coderabbit.yourcompany.com`. When this value is configured, the extension connects directly to your server instead of the selected CodeRabbit Cloud region.

<Warning>
  You will need to log in and log out of the extension after adding this value
  for the changes to take effect.
</Warning>

## What's next

<CardGroup>
  <Card title="Use the VS Code extension" href="/ide/vscode-use">
    Learn how to review code changes and use AI features
  </Card>

  <Card title="Uninstall the VS Code extension" href="/ide/vscode-uninstall">
    Remove the CodeRabbit extension from your editor
  </Card>
</CardGroup>


# Install the VS Code extension
Source: https://docs.coderabbit.ai/ide/vscode-install

Install the CodeRabbit VS Code extension to review code changes locally in your editor.

Install the CodeRabbit VS Code extension to review code changes directly in your editor. For more information about using the extension, see [Review local changes](/ide).

<Note>
  These instructions are specific to VS Code. If you're using a VS Code-compatible
  editor like Cursor or Windsurf, the steps are similar but may require some
  adaptation.
</Note>

## Before you begin

Before you can use the CodeRabbit VS Code extension, you need a CodeRabbit account.

<Info>
  Don't have an account yet? Create one by visiting [the CodeRabbit login page](https://app.coderabbit.ai/login?free-trial=).
</Info>

## Install the extension

<Steps>
  <Step title="Open Extensions">
    In the editor activity bar, click **Extensions**.
  </Step>

  <Step title="Search for CodeRabbit">
    In the sidebar, type `coderabbit` into the **Search Extensions in
    Marketplace** search bar. **CodeRabbit** will appear as a search result.
  </Step>

  <Step title="Select the extension">
    Select **CodeRabbit**. A summary of the CodeRabbit VS Code extension appears in
    the main pane with installation controls.
  </Step>

  <Step title="Configure auto-update (optional)">
    If you want your editor to automatically check for and apply future updates to
    the extension, keep the **Auto Update** checkbox selected. Otherwise, clear
    the checkbox.
  </Step>

  <Step title="Install the extension">Click **Install**.</Step>

  <Step title="Log in to CodeRabbit">
    A **Log in to CodeRabbit to get started** dialog appears. Click **Login**.

    <Accordion title="If the login dialog is dismissed or times out">
      1. Click the CodeRabbit icon in the VS Code activity bar
      2. Click the **Use CodeRabbit for Free** button
    </Accordion>
  </Step>

  <Step title="Grant browser permission">
    Grant VS Code permission to open your browser, if asked.
  </Step>

  <Step title="Complete authentication">
    In your web browser, log into your CodeRabbit account.
  </Step>

  <Step title="Handle redirect (if needed)">
    After signing in, the browser will redirect you back to VS Code. Enterprise SSO users in workspaces with multiple CodeRabbit organizations, multiple Git providers such as GitHub, GitLab, or Bitbucket, or self-hosted provider instances may first be prompted to choose a Git provider and CodeRabbit organization; single-organization, single-provider sign-ins continue to redirect directly. If the redirect doesn't occur:

    1. Copy the code displayed in the success window
    2. Click **Paste code from browser** in VS Code
    3. Paste the code into the input field that appears
  </Step>
</Steps>

This connects your CodeRabbit account with the CodeRabbit VS Code extension.

## Install using the marketplace website

If you're using the VS Code IDE (not a derived IDE like Cursor or Windsurf), you can alternatively install the CodeRabbit extension by visiting [the extension's page on the Visual Studio Marketplace](https://coderabbit.link/vscode-docs).

<Warning>
  If you install the extension this way, you still need to connect your
  CodeRabbit account to the extension after installing it, as described in the
  previous section.
</Warning>

## Install in a cloud or remote IDE

Cloud and remote development environments such as [Brev](https://brev.dev), [GitHub Codespaces](https://github.com/features/codespaces), and [Gitpod](https://www.gitpod.io) run VS Code in an ephemeral container. VS Code extensions are not persisted across instance restarts by default, so you need to reinstall the CodeRabbit extension each time you start a new instance unless you configure your environment to preserve it.

### Install per session

Follow the same steps as the [standard installation above](#install-the-extension). The extension is available for the lifetime of that instance.

### Persist the extension across sessions

To avoid reinstalling on every new instance, add the CodeRabbit extension to your environment's configuration so it installs automatically when a new instance starts.

**Using `devcontainer.json` (GitHub Codespaces and compatible environments):**

Add the CodeRabbit extension ID to the `extensions` array:

**Using Brev:**

```json .devcontainer/devcontainer.json theme={null}
  {
    "customizations": {
      "vscode": {
        "extensions": ["CodeRabbit.coderabbit-vscode"]
      }
    }
  }
```

In your Brev workspace definition, add `coderabbitai.coderabbit-vscode` to the list of VS Code extensions to pre-install. Refer to the [Brev documentation](https://brev.dev/docs) for the specific configuration field.

<Warning>
  Some cloud development environments route traffic through a proxy that strips
  WebSocket control frames. If the CodeRabbit extension gets stuck at **Setting
  up** for more than a few minutes in a cloud IDE, ensure you are running
  extension version **0.7.1 or later**, which includes a fix for this
  connectivity pattern. If the issue persists, check your environment's
  WebSocket proxy configuration.
</Warning>

## What's next

<CardGroup>
  <Card title="Use the VS Code extension" href="/ide/vscode-use">
    Learn how to review code changes with the extension
  </Card>

  <Card title="Configure the VS Code extension" href="/ide/vscode-config">
    Customize the extension settings for your workflow
  </Card>

  <Card title="Use with Self-hosted CodeRabbit" href="/ide/vscode-selfhosted">
    Set up the extension with your self-hosted instance
  </Card>
</CardGroup>


# Plan implementation in VS Code
Source: https://docs.coderabbit.ai/ide/vscode-plan

Create, browse, and implement CodeRabbit Coding Plans directly from the VS Code extension, then hand off selected phases to your AI coding agent.

<GitHubBadge /> <GitLabBadge /> | <ProPlusPlanBadge /> <EnterprisePlanBadge />

CodeRabbit Plan is available directly in your IDE. The **Plans** tab in the CodeRabbit sidebar lets you create agent-ready Coding Plans from a description and your workspace files, browse existing plans, and hand off selected phases to your AI coding agent, all without leaving VS Code.

<Info>
  These instructions are for VS Code. If you're using a VS Code-compatible editor like Cursor or Windsurf, the steps are similar but may require adaptation.
</Info>

## Requirements

* The [CodeRabbit VS Code extension](/ide/vscode-install) installed, and you are signed in to CodeRabbit.
* A Pro+ or Enterprise plan. Other plans see an upgrade prompt in the Plans tab.
* The repository open in your workspace must be installed in your CodeRabbit organization. If it isn't, the Plans tab links you to the repository settings so you can install it first.

## Create a plan

<Steps>
  <Step title="Open the Plans tab">
    Click the CodeRabbit icon in the VS Code activity bar, then select the
    **Plans** tab in the sidebar.
  </Step>

  <Step title="Describe what you want to build">
    Type a description of the feature, bug fix, or change in the composer at the
    bottom of the tab. Include goals, scope, and constraints. The more context
    you provide, the better the plan.
  </Step>

  <Step title="Reference workspace files (optional)">
    Type `@` or click the mention button to reference files and folders from
    your workspace. Referenced files are included as context, and folder
    references include the files inside them.
  </Step>

  <Step title="Attach supporting documents (optional)">
    Click the paperclip icon to attach PRDs, design specs, or screenshots.
    Supported formats include text, Markdown, CSV, JSON, PDF, and common image
    types, with up to 10 attachments of 5 MB each.
  </Step>

  <Step title="Create the plan">
    Click the send button or press <kbd>Cmd/Ctrl</kbd> + <kbd>Enter</kbd>.
    CodeRabbit analyzes your repository and generates the plan, showing each
    generation step in a progress timeline. The finished plan appears in the
    Plans list.
  </Step>
</Steps>

## Browse plans

The Plans tab lists the plans for the connected repository, newest first. Each entry shows the plan title, its status, the number of phases, and when it was created. Use the **Search plans** box to filter by title, and click any plan to open its details.

## Review plan details

The plan view shows everything CodeRabbit generated, in the same structure as the web app:

* **Summary**: An overview of the planned change.
* **Research**: Key findings from CodeRabbit's codebase analysis.
* **Assumptions**: The assumptions CodeRabbit made, with the chosen options and rationale.
* **Coding Plan**: The implementation phases. Expand a phase to see its description, task list, and the **AI prompt**, which you can copy for use with any agent.

See [Plan refinement](/plan/plan-refinement) for what each section contains.

## Implement a plan

<Steps>
  <Step title="Select phases">
    Check the phases you want to implement, or use **Select all**. Handing off
    one phase at a time often works better for complex plans.
  </Step>

  <Step title="Click Implement">
    Click the **Implement** button to send the selected phases' prompts to your
    configured AI coding agent: Copilot, Claude Code, Codex CLI, Devin,
    OpenCode, Cline, Roo, Kilo Code, Augment Code, or the clipboard as a
    fallback.
    Configure your preferred agent in [extension
    settings](/ide/vscode-config#configure-ai-agent-integration).
  </Step>
</Steps>

## Refine a plan on the web

Click **Iterate on Web** in the plan view to open the plan in the [CodeRabbit web app](https://app.coderabbit.ai/plan), where you can refine it through chat and collaborate with your team. When you return to the editor, the Plans tab picks up the updated plan.

This works in the other direction too: the **Send to IDE** option in the web app's [Agent Handoff](/plan/agent-handoff) opens the plan directly in your editor.

## What's next

<CardGroup>
  <Card title="CodeRabbit Plan overview" href="/plan" icon="map">
    Learn how Coding Plans work and the other ways to create them
  </Card>

  <Card title="Configure the extension" href="/ide/vscode-config" icon="settings">
    Customize automatic review behavior and AI agent integration
  </Card>
</CardGroup>


# Use with self-hosted CodeRabbit
Source: https://docs.coderabbit.ai/ide/vscode-selfhosted

Connect the VS Code extension to your self-hosted CodeRabbit instance for on-premises code reviews with full data control.

Configure the CodeRabbit VS Code extension to work with your organization's self-hosted CodeRabbit instance. This setup gives you all the benefits of AI-powered code reviews while maintaining full control over your code and data.

<Tip>
  Using CodeRabbit's managed service instead? See [Install the VS Code
  extension](/ide/vscode-install) for the standard setup process.
</Tip>

## Prerequisites

Before connecting to your self-hosted instance, ensure:

<CardGroup>
  <Card title="Extension version" icon="download">
    CodeRabbit extension version `0.12.1` or higher installed in your editor
  </Card>

  <Card title="Clean setup" icon="log-out">
    Log out of the extension if you were previously connected to the managed
    service
  </Card>
</CardGroup>

## Connect your self-hosted instance

<Steps>
  <Step title="Access self-hosted option">
    Click on the "Self hosting CodeRabbit?" button, located below the "Use
    CodeRabbit for free" button.
  </Step>

  <Step title="Configure instance URL">
    Enter your self-hosted instance URL when prompted.

    <Note>
      Make sure the instance URL is reachable within your network and websocket
      connections are allowed.
    </Note>
  </Step>

  <Step title="Select git provider and authenticate">
    Select your git provider: GitLab, Self-Hosted GitLab, GitHub, or GitHub
    Enterprise. If using GitHub or GitHub Enterprise, enter your [GitHub
    Personal Access
    Token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens)
    when prompted.
  </Step>
</Steps>

You should now be connected to your self-hosted instance and ready to use the VS Code extension.

## Next steps

<CardGroup>
  <Card title="Use the VS Code extension" href="/ide/vscode-use" icon="play">
    Learn how to trigger reviews, apply fixes, and integrate with your
    development workflow.
  </Card>

  <Card title="Configure the VS Code extension" href="/ide/vscode-config" icon="settings">
    Customize extension settings, review preferences, and integration options.
  </Card>

  <Card title="Uninstall the VS Code extension" href="/ide/vscode-uninstall" icon="trash">
    Remove the extension if you no longer need it or want to switch setups.
  </Card>
</CardGroup>


# Uninstall the VS Code extension
Source: https://docs.coderabbit.ai/ide/vscode-uninstall

Step-by-step guide to properly uninstall the CodeRabbit VS Code extension, including logout and removal from your editor.

This page covers uninstalling the CodeRabbit VS Code extension. For more information about the extension, see [Review local changes](/ide).

<Tip>
  Before uninstalling, make sure to log out of your CodeRabbit account to
  properly disconnect the extension.
</Tip>

<Note>
  The instructions on this page are specific to using the extension with VS Code.
  If you are instead using a VS Code-compatible editor such as Cursor or
  Windsurf, then the steps that you need to follow are similar, but might
  require some adaptation.
</Note>

## Uninstall the extension

To properly uninstall the VS Code extension:

<Steps>
  <Step title="Open CodeRabbit sidebar">
    In the VS Code activity bar, click the CodeRabbit icon
  </Step>

  <Step title="Log out of your account">
    In the CodeRabbit sidebar, click the door-shaped **Logout** icon
  </Step>

  <Step title="Open Extensions panel">
    In the VS Code activity bar, click the **Extensions** icon
  </Step>

  <Step title="Manage CodeRabbit extension">
    In the Extensions sidebar, click the gear-shaped **Manage** icon next to
    CodeRabbit in the list of installed extensions
  </Step>

  <Step title="Remove extension">
    Select **Uninstall** from the dropdown menu
  </Step>
</Steps>

<Note>
  After uninstalling, you may need to restart VS Code to completely remove all
  extension components.
</Note>


# Review code changes in VS Code
Source: https://docs.coderabbit.ai/ide/vscode-use

Review code changes in your local Git repository using the CodeRabbit VS Code extension with automatic or manual review options.

Review code changes directly in VS Code using the CodeRabbit extension. Choose between automatic reviews after every commit or manual reviews for specific changes.

<Note>
  These instructions are for VS Code. If you're using a VS Code-compatible editor
  like Cursor or Windsurf, the steps are similar but may require adaptation.
</Note>

## Choose your workflow

<CardGroup>
  <Card title="Automatic reviews" icon="zap">
    Let CodeRabbit review every commit automatically
  </Card>

  <Card title="Manual reviews" icon="sliders-vertical">
    Control exactly what gets reviewed and when
  </Card>
</CardGroup>

## Automatic reviews

The simplest way to get code reviews. CodeRabbit automatically reviews all changes when you commit to your local Git repository.

<Steps>
  <Step title="Make a Git commit">
    Commit your changes using VS Code or terminal. A dialog appears asking
    **Would you like to start a review?**
  </Step>

  <Step title="Start the review">
    Click **Yes**. The CodeRabbit sidebar opens with the review in progress.
  </Step>

  <Step title="Wait for completion">
    The review typically completes within a few minutes. Click **Stop the
    review** to cancel if needed.
  </Step>
</Steps>

<Tip>
  You can configure the extension to always review automatically or never
  prompt. See [Configure automatic review
  behavior](/ide/vscode-config#configure-automatic-review-behavior).
</Tip>

## Manual reviews

Get precise control over what CodeRabbit reviews. Compare any branch against any other branch, review only committed changes, or focus on specific files.

<Steps>
  <Step title="Open CodeRabbit sidebar">
    Click the CodeRabbit icon in the VS Code activity bar.
  </Step>

  <Step title="Select base branch (optional)">
    Under **Branch** in the sidebar, click the base branch name to compare against
    a different branch.
  </Step>

  <Step title="Choose review scope">
    Select your review type:

    <Tabs>
      <Tab title="All changes">
        **Review all changes** - Includes both committed and uncommitted changes
      </Tab>

      <Tab title="Committed only">
        **Review committed changes** - Only changes you've committed locally
      </Tab>

      <Tab title="Uncommitted only">
        **Review uncommitted changes** - Only staged and unstaged changes
      </Tab>
    </Tabs>
  </Step>

  <Step title="Verify files to review">
    Check the **Files to review** list in the sidebar. Use `git stash` or change
    your review scope to modify which files are included.
  </Step>

  <Step title="Start the review">
    Click the review button. The sidebar shows progress as the review runs.
  </Step>
</Steps>

## Working with review results

After any review completes, CodeRabbit adds actionable comments to your code. Each comment includes specific suggestions you can apply directly or use as guidance.

### Browse and apply suggestions

Review comments appear in the **Files** section of the CodeRabbit sidebar. Click any comment to see the detailed suggestion inline in your editor.

When CodeRabbit provides a specific code fix, click the **Apply suggested change** checkmark icon to apply it immediately.

### Use AI coding agents

For complex issues, click the **Fix with AI** star icon to send the problem to your preferred AI coding agent:

* **VS Code + Copilot**: Sends directly to Copilot
* **Command-line tools**: Claude Code, Codex CLI, OpenCode - opens terminal with the selected command
* **VS Code extensions**: Claude Code Extension, Cline, Roo, Kilo Code, Augment Code - hands off the prompt to the selected extension
* **Clipboard fallback**: Copies prompt for use with any AI agent

Configure your preferred AI agent in [extension settings](/ide/vscode-config#configure-ai-agent-integration).

### Give feedback

Signed-in users can select **Give feedback** from the sidebar footer or title bar, or from the command palette, to open a short in-extension survey for general feedback about the extension experience. This is separate from feedback on individual review suggestions.

The action is available to signed-in CodeRabbit Cloud users and does not appear for self-hosted installations.

### Managing comments

* **Ignore**: Remove comment from editor view
* **Collapse**: Hide comment but keep indicator icon
* **Restore**: Click collapsed/ignored comments in sidebar to show again

## What's next

<CardGroup>
  <Card title="Plan implementation" href="/ide/vscode-plan">
    Design implementation and hand off the plan to your coding agent
  </Card>

  <Card title="Configure the extension" href="/ide/vscode-config">
    Customize automatic review behavior and AI agent integration
  </Card>
</CardGroup>


# AI Code Review
Source: https://docs.coderabbit.ai/index

CodeRabbit is an AI-powered platform for code review, planning, and development workflows. Review pull requests on GitHub, plan implementations from Jira issues, open PRs using Slack, and get real-time feedback in your IDE or CLI. Ship better software faster with confidence!

<CardGroup>
  <Card title="CodeRabbit Agent" icon="slack" href="/slack-agent">
    AI-powered investigation, planning, and code changes right from Slack.

    Shared workspace knowledge, external tools, governed access, and scheduled or message-triggered automations.
  </Card>

  <Card title="Code Review" icon="git-pull-request" href="/guides/code-review-overview">
    Automated, context-aware code reviews. Catches bugs, enforces standards, and
    learns from your team's feedback. One-click fixes and continuous
    improvement: for Pull Requests, in your IDE and in the CLI.
  </Card>

  <Card title="CodeRabbit Plan" icon="list-check" href="/plan">
    Turn ideas, issues, PRDs, and designs into precise Coding Plans. Get
    research, tasks, and AI-ready prompts grounded in your actual codebase, then
    hand off directly to your coding agent.
  </Card>
</CardGroup>

Use CodeRabbit wherever you work. Integrate with your Git platform and issue tracker for automated PR reviews and planning, get real-time feedback in your IDE, run reviews from the command line, or bring AI-powered coding assistance into Slack.

<CardGroup>
  <Card title="Web App" icon="globe" href="/platforms/overview">
    Use CodeRabbit on GitHub, GitLab, Azure DevOps, and Bitbucket. Connect Jira
    and Linear for issue tracking and planning.
  </Card>

  <Card title="Agent for Slack" icon="slack" href="/slack-agent">
    Ask questions, generate plans, create issues, and open PRs from any Slack
    channel, thread, or DM.
  </Card>

  <Card title="CLI Tool" icon="square-terminal" href="/overview/ide-cli-review">
    Pre-commit reviews from the command line. Works with Claude Code, Cursor,
    Codex, Gemini, and more.
  </Card>

  <Card title="IDE Extension" icon="laptop" href="/overview/ide-cli-review">
    Review code as you write with VS Code, Cursor, and Windsurf extensions. Get
    instant feedback without leaving your editor.
  </Card>
</CardGroup>

<Info>
  **Need quick answers?** Try **Ask AI** in the search bar (press <kbd>⌘K</kbd>
  on Mac or <kbd>Ctrl+K</kbd> on Windows/Linux). It's trained on our
  documentation and gives great answers!
</Info>

## How to use this documentation

Our docs are organized into four tabs to help you find what you need:

* [**CodeRabbit Platform**](/) — Everything about pull request reviews, planning, commands, and code quality tools
* [**IDE Review Extension**](/ide) — Use CodeRabbit in VS Code, Cursor, and Windsurf
* [**Command-Line Review Tool**](/cli/) — Integrate the CLI with Claude Code, Cursor, Codex, Gemini, and more
* [**CodeRabbit Agent for Slack**](/slack-agent/) — Bring AI investigation, planning, and modification into your Slack workspace
* [**Management**](/management/) — Subscription plans, user roles, reports, and integrations with tools like Jira

The Platform Overview section walks you through CodeRabbit's architecture and the tools that power it. If you're new to CodeRabbit, check out the [Quickstart](/getting-started/quickstart) to get your first project reviewed in under 5 minutes, or follow the [Hands-on Guide](/guide/) for a step-by-step walkthrough of setup and key features.


# CircleCI integration
Source: https://docs.coderabbit.ai/integrations/circleci

Connect CodeRabbit to CircleCI to surface pipeline failure context directly in pull request reviews.

When you connect CircleCI to CodeRabbit, pipeline failure details are pulled into the review automatically. CodeRabbit reads the build output and posts inline comments with suggested fixes on the lines of code that caused the failure — no manual copy-pasting of logs required.

## Prerequisites

Before setting up the CircleCI integration, ensure you have:

* A CircleCI account with access to the projects you want to connect
* Permission to generate Personal API Tokens in CircleCI

## Connect CircleCI

The integration uses a CircleCI Personal API Token to authenticate.

<Steps>
  <Step title="Open the CodeRabbit Integrations page">
    Navigate to [Integrations](https://app.coderabbit.ai/integrations?tab=ci-cd) in the CodeRabbit app and select the **CI/CD** tab.
  </Step>

  <Step title="Enable CircleCI">
    Locate the CircleCI card and toggle it on. A **Connect CircleCI** dialog appears.
  </Step>

  <Step title="Create a Personal API Token in CircleCI">
    In a new browser tab:

    1. Go to your [CircleCI User Settings](https://app.circleci.com/settings/user/tokens).
    2. Click **Create New Token**.
    3. Give it a descriptive name, for example `CodeRabbit Integration`.
    4. Copy the generated token.
  </Step>

  <Step title="Paste the token into CodeRabbit">
    Back in the CodeRabbit dialog, paste the token into the **API Token** field and click **Save**.
  </Step>
</Steps>

<Info>
  Keep your Personal API Token secure. It grants CodeRabbit read access to your CircleCI pipeline logs. If the token is revoked or rotated, repeat the steps above to reconnect.
</Info>

## How it works

After connecting:

1. A pull request is opened or updated and your CircleCI pipelines run.
2. CodeRabbit waits for the pipelines to finish.
3. CodeRabbit reads the failure output via the CircleCI pipeline API.
4. Inline comments with suggested fixes are posted on the relevant lines of code.

No additional repository-level configuration is required. CodeRabbit picks up pipeline results automatically for every pull request where CircleCI reports a failure.

## What's next

<CardGroup>
  <Card title="CI/CD pipeline analysis" href="/pr-reviews/cicd-pipeline-analysis" icon="workflow">
    Learn how CodeRabbit analyzes pipeline failures across all supported CI/CD platforms and posts fix suggestions inline.
  </Card>

  <Card title="GitHub Checks configuration" href="/tools/github-checks" icon="github">
    Configure the timeout and enable/disable behavior for GitHub Actions pipeline analysis.
  </Card>
</CardGroup>


# Issue trackers
Source: https://docs.coderabbit.ai/integrations/issue-trackers

CodeRabbit integrates with popular issue tracking systems to enrich reviews with issue context, validate requirements, create issues from review comments, and design Coding Plans.

<ProPlanBadge />

## Supported integrations

<CardGroup>
  <Card title="GitHub Issues" icon="github">
    Works automatically without setup
  </Card>

  <Card title="GitLab Issues" icon="gitlab">
    Works automatically without setup
  </Card>

  <Card title="Azure DevOps Boards" icon="microsoft" href="/platforms/azure-devops">
    Works through your Azure DevOps platform setup
  </Card>

  <Card title="Jira" icon="jira" href="/integrations/jira">
    Connect via the CodeRabbit Forge app from Atlassian Marketplace
  </Card>

  <Card title="Linear" icon="linear" href="/integrations/linear">
    OAuth-based integration for Linear workspaces
  </Card>
</CardGroup>

## Features

CodeRabbit connects with your issue tracking systems to bring issue context into every stage of development, from planning through code review. Here's what the integration enables:

<CardGroup>
  <Card title="Context enrichment" icon="book-open" href="/issues/pr-validation">
    Pulls in issue details: descriptions, acceptance criteria, and discussions,
    so CodeRabbit understands *why* a change is being made.
  </Card>

  <Card title="Requirement validation" icon="clipboard-check" href="/issues/pr-validation">
    Assesses whether your code changes properly address the linked issue's
    acceptance criteria and flags any gaps.
  </Card>

  <Card title="Issue planning" icon="layout-list" href="/issues/planner">
    Analyzes your issues and codebase to generate step-by-step Coding Plans for
    a handoff to any coding agent or IDE copilot.
  </Card>

  <Card title="Issue creation" icon="square-plus" href="/issues/creation">
    Creates new issues directly from PR review comments, ensuring nothing
    discussed during review gets lost.
  </Card>
</CardGroup>

## Integration Guides

<CardGroup>
  <Card title="Jira" icon="jira" href="/integrations/jira">
    Install and configure the Jira Cloud integration via the Atlassian
    Marketplace
  </Card>

  <Card title="Linear" icon="linear" href="/integrations/linear">
    Install and configure the Linear integration via OAuth
  </Card>
</CardGroup>


# Jira Integration
Source: https://docs.coderabbit.ai/integrations/jira

Connect CodeRabbit to Jira to enrich pull request reviews with issue context, validate changes against acceptance criteria, create issues from review comments, and design Coding Plans.

<AllPlatformsBadge /> | <ProPlanBadge />

## Overview

The Jira integration connects CodeRabbit to your Jira workspace, bringing issue context into every stage of development. Here's what the integration enables:

<CardGroup>
  <Card title="Context enrichment" icon="book-open" href="/issues/pr-validation">
    Pulls in Jira issue details so CodeRabbit understands *why* a change is
    being made
  </Card>

  <Card title="Requirement validation" icon="clipboard-check" href="/issues/pr-validation">
    Assesses whether code changes address the linked issue's acceptance criteria
  </Card>

  <Card title="Issue planning" icon="layout-list" href="/issues/planner">
    Generates step-by-step <Hint type="coding-plan">Coding Plans</Hint> from Jira issues for coding agents and
    IDE copilots
  </Card>

  <Card title="Issue creation" icon="square-plus" href="/issues/creation">
    Creates new Jira issues directly from PR review comments
  </Card>
</CardGroup>

## Prerequisites

Before setting up the Jira integration, ensure you have:

* A **Jira Cloud** account (for Jira Data Center or self-hosted, see [Jira Data Center](#jira-data-center-self-hosted) below)
* Admin access to install apps on your Jira site
* A CodeRabbit Pro plan

## Install the Jira Cloud integration

The Jira Cloud integration uses a Forge app from the Atlassian Marketplace. Follow these steps to connect your Jira site to CodeRabbit:

<Steps>
  <Step title="Enable Jira integration in CodeRabbit">
    Navigate to
    [Integrations](https://app.coderabbit.ai/integrations?tab=integrations) in
    the CodeRabbit app and toggle **Jira** to enable the integration.
  </Step>

  <Step title="Copy the installation secret">
    A modal appears with setup instructions and an **Installation Secret**
    (valid for 15 minutes). Copy the secret, then click **Open Atlassian
    Installation**.
  </Step>

  <Step title="Install from Atlassian Marketplace">
    On the Atlassian Marketplace page for the CodeRabbit app, click **Get app**.
  </Step>

  <Step title="Select your Jira site">
    Choose which Jira site to install the CodeRabbit app on and click
    **Install**.
  </Step>

  <Step title="Open Jira app settings">
    In your Jira site, click the **Settings** gear icon and select **Marketplace
    apps**.
  </Step>

  <Step title="Complete the setup">
    Under **Apps**, select **CodeRabbit**. On the CodeRabbit Setup page, paste
    the Installation Secret you copied earlier and click **Complete Setup**.
  </Step>

  <Step title="Verify the integration">
    Return to CodeRabbit and click **Refresh Status** to confirm the integration
    is connected.
  </Step>
</Steps>

<Info>
  The Installation Secret expires after 15 minutes. If it expires before you
  complete the setup, start the process again from step 1.
</Info>

## Jira Data Center (Self-Hosted)

### Authentication and permissions

Jira Data Center uses a personal access token (PAT) with its REST API v2 client. The PAT does not use OAuth-style selectable scopes; it inherits the permissions of the Jira user who issues it. Use a dedicated CodeRabbit service account so you can scope and audit its access independently.

Grant the integration user these permissions:

* **Access tickets and manage webhooks (required)**: Grant read and search access to every project and issue CodeRabbit should use, including issue details, comments, and attachments. The user must also be able to manage webhooks. During setup, CodeRabbit checks the Jira server and registers its webhook; the connection cannot be saved if Jira rejects the webhook registration.
* **Create issues (recommended)**: Grant issue-creation permission only if you want users to create Jira issues through CodeRabbit.
* **Add comments (recommended)**: Grant comment-creation permission for Jira-triggered Issue Planner acknowledgments, errors, and plan-ready replies.
* **Update comments (recommended)**: Grant permission to update comments created by the integration user so CodeRabbit can update its Jira response comment.

The webhook subscribes to `issue-created`, `issue-updated`, `comment-created`, `comment-updated`, and `comment-deleted` events. Jira 9 uses the older webhook API and subscribes only to `issue-created` and `issue-updated` events.

### Network access

Your Jira Data Center instance must allow inbound HTTPS connections from CodeRabbit's outbound IP addresses. If your Jira Data Center instance requires IP allowlisting, add these CodeRabbit IP addresses:

```text IPs to allow list wrap theme={null}
35.222.179.152/32, 34.170.211.100/32, 136.113.208.247/32, 136.64.151.96/28, 34.122.160.224/29, 18.232.215.9/32, 98.89.212.255/32, 52.1.193.145/32, 44.199.13.86/32
```

### Integration behavior

| Capability             | Behavior                                                                                                                                   |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| **Enrichment**         | Searches Jira and reads issue details, comments, and attachments to add context to code reviews.                                           |
| **Validation**         | Reads the linked issue's title and description to validate code changes against its requirements.                                          |
| **Planning**           | Posts acknowledgments, errors, and plan-ready replies for Jira-triggered Issue Planner workflows, and can update its own response comment. |
| **Creation**           | Creates a Jira issue only when a user explicitly requests issue creation from a review.                                                    |
| **Webhook management** | Registers and manages the CodeRabbit webhook during self-hosted integration setup.                                                         |
| **Status transitions** | Does not transition Jira issues or update their statuses. **Transition Issues** permission is not required.                                |

## Configure CodeRabbit for Jira

After connecting Jira, use `project_keys` to allow specific Jira projects and `excluded_project_keys` as the deny override. The project key is the prefix that appears before issue numbers—for example, if your issue URL is `https://company.atlassian.net/browse/PROJ-123`, the project key is `PROJ`.

Excluded project keys are never used as CodeRabbit context, regardless of repository allowlists. Exclusions are managed as a workspace-level security policy and always take precedence over `project_keys`.

<Tabs>
  <Tab title="YAML Configuration">
    Add the `project_keys` setting under `knowledge_base.jira` in your `.coderabbit.yaml` file:

    ```yaml .coderabbit.yaml theme={null}
    # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
    knowledge_base:
      jira:
        usage: "enabled"
        project_keys:
          - "PROJ"
          - "DEV"
          - "BACKEND"
        excluded_project_keys:
          - "SECURITY"
          - "HR"

    chat:
      integrations:
        jira:
          usage: "enabled"
    ```

    The `usage` setting controls when the integration is active:

    * `auto` (default): Disabled for public repositories, enabled for private repositories
    * `enabled`: Always enabled
    * `disabled`: Always disabled
  </Tab>

  <Tab title="Web Interface">
    1. Navigate to your repository or organization settings in the [CodeRabbit app](https://app.coderabbit.ai)
    2. Go to **Configuration** → **Knowledge Base**
    3. Under **Jira**, add the project keys CodeRabbit may use and the project keys to exclude
    4. Save the configuration

    <Frame>
      <img alt="Jira integration setup showing project key configuration" />
    </Frame>
  </Tab>
</Tabs>

<Info>
  By default, Jira integration is enabled for private repositories and disabled
  for public repositories. You can override this behavior by setting
  `knowledge_base.jira.usage: enabled` and `chat.integrations.jira.usage:
    	enabled` in your `.coderabbit.yaml` file or using the web interface. See the
  [Configuration reference](/reference/configuration) for details.
</Info>

## Example usage

### Linking Jira issues to pull requests

To have CodeRabbit validate requirements from a Jira issue, include the issue URL in your pull request description:

```md theme={null}
This PR implements the user authentication flow.

Closes https://company.atlassian.net/browse/PROJ-123
```

CodeRabbit will fetch the issue details and assess whether your code changes address the requirements specified in the issue. See the [Linked issues guide](/issues/pr-validation) for best practices on linking issues.

### Creating Jira issues from reviews

During a code review, you can ask CodeRabbit to create a Jira issue by mentioning `@coderabbitai` in a comment:

```md theme={null}
@coderabbitai create a Jira issue for this technical debt in the PROJ project
```

CodeRabbit will create a well-structured issue with relevant context from the code review discussion. See the [Issue creation guide](/issues/creation) for more details.

## Related resources

<Card title="Requirement validation" icon="link" href="/issues/pr-validation">
  Best practices for linking issues to pull requests
</Card>

<Card title="Issue Planning" icon="layout-list" href="/issues/planner">
  Generate Coding Plans from issues for coding agents
</Card>

<Card title="Issue creation" icon="square-plus" href="/issues/creation">
  Create issues directly from CodeRabbit reviews
</Card>


# Linear Integration
Source: https://docs.coderabbit.ai/integrations/linear

Connect CodeRabbit to Linear to enrich pull request reviews with issue context, validate changes against acceptance criteria, create issues from review comments, and design Coding Plans.

<AllPlatformsBadge /> | <ProPlanBadge />

## Overview

The Linear integration connects CodeRabbit to your Linear workspace, bringing issue context into every stage of development. Here's what the integration enables:

<CardGroup>
  <Card title="Context enrichment" icon="book-open" href="/issues/pr-validation">
    Pulls in Linear issue details so CodeRabbit understands *why* a change is
    being made
  </Card>

  <Card title="Requirement validation" icon="clipboard-check" href="/issues/pr-validation">
    Assesses whether code changes address the linked issue's acceptance criteria
  </Card>

  <Card title="Issue planning" icon="layout-list" href="/issues/planner">
    Generates step-by-step Coding Plans from Linear issues for coding agents and
    IDE copilots
  </Card>

  <Card title="Issue creation" icon="square-plus" href="/issues/creation">
    Creates new Linear issues directly from PR review comments
  </Card>
</CardGroup>

## Prerequisites

Before setting up the Linear integration, ensure you have:

* A Linear account with access to the workspace you want to connect
* A CodeRabbit Pro plan

## Install the Linear integration

The Linear integration uses OAuth authentication to securely connect your Linear workspace to CodeRabbit.

<Steps>
  <Step title="Enable Linear integration">
    Navigate to
    [Integrations](https://app.coderabbit.ai/integrations?tab=integrations) in
    the CodeRabbit app and toggle **Linear** to enable the integration.
  </Step>

  <Step title="Authenticate with Linear">
    You will be redirected to Linear's login page. Enter your credentials to
    authorize CodeRabbit to access your Linear workspace.
  </Step>
</Steps>

## Configure CodeRabbit for Linear

After connecting Linear, configure which Linear teams CodeRabbit should access by adding your team keys. The team key is a short team identifier—for example, if your issue URL is `https://linear.app/company/issue/DEV-123`, the team key is `DEV`.

<Tabs>
  <Tab title="YAML Configuration">
    Add the `team_keys` setting under `knowledge_base.linear` in your `.coderabbit.yaml` file:

    ```yaml .coderabbit.yaml theme={null}
    # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
    knowledge_base:
      linear:
        usage: "enabled"
        team_keys:
          - "DEV"
          - "ENG"

    chat:
      integrations:
        linear:
          usage: "enabled"
    ```

    The `usage` setting controls when the integration is active:

    * `auto` (default): Disabled for public repositories, enabled for private repositories
    * `enabled`: Always enabled
    * `disabled`: Always disabled
  </Tab>

  <Tab title="Web Interface">
    1. Navigate to your repository or organization settings in the [CodeRabbit app](https://app.coderabbit.ai)
    2. Go to **Configuration** → **Knowledge Base**
    3. Under **Linear**, add your team keys
    4. Save the configuration

    <Frame>
      <img alt="Linear integration setup showing team key configuration" />
    </Frame>
  </Tab>
</Tabs>

<Info>
  By default, Linear integration is enabled for private repositories and
  disabled for public repositories. You can override this behavior by setting
  `knowledge_base.linear.usage: enabled` and `chat.integrations.linear.usage:
    	enabled` in your `.coderabbit.yaml` file or using the web interface. See the
  [Configuration reference](/reference/configuration) for details.
</Info>

## Example usage

### Linking Linear issues to pull requests

To have CodeRabbit validate requirements from a Linear issue, include the issue URL in your pull request description:

```md theme={null}
This PR implements the user authentication flow.

Closes https://linear.app/company/issue/DEV-123
```

CodeRabbit will fetch the issue details and assess whether your code changes address the requirements specified in the issue. See the [Linked issues guide](/issues/pr-validation) for best practices on linking issues.

### Creating Linear issues from reviews

During a code review, you can ask CodeRabbit to create a Linear issue by mentioning `@coderabbitai` in a comment:

```md theme={null}
@coderabbitai create a Linear issue for this bug in the DEV team
```

CodeRabbit will create a well-structured issue with relevant context from the code review discussion. See the [Issue creation guide](/issues/creation) for more details.

## Related resources

<Card title="Requirement validation" icon="link" href="/issues/pr-validation">
  Best practices for linking issues to pull requests
</Card>

<Card title="Issue planning" icon="layout-list" href="/issues/planner">
  Generate Coding Plans from issues for coding agents
</Card>

<Card title="Issue creation" icon="square-plus" href="/issues/creation">
  Create issues directly from CodeRabbit reviews
</Card>


# Integrate MCP servers
Source: https://docs.coderabbit.ai/integrations/mcp-servers

Connect CodeRabbit to external tools and data sources through the Model Context Protocol (MCP) for enhanced code reviews with richer contextual understanding.

<AllPlatformsBadge /> | <ProPlanBadge /> <ProPlusPlanBadge />

Connect CodeRabbit to external tools and data sources through the Model Context Protocol (MCP) integration. This allows CodeRabbit to serve as the MCP client and provides richer contextual understanding for enhanced code reviews.

<Info>
  The number of MCP server connections you can configure depends on your plan. See [Plans and pricing — MCP servers](/management/plans#mcp-servers) for current limits.
</Info>

## What MCP integration enables

<CardGroup>
  <Card title="Code reviews">
    Enhanced analysis with external context and documentation
  </Card>

  <Card title="Code suggestions">
    Improved validation using your organization's knowledge
  </Card>

  <Card title="PR chat">
    Access to relevant documentation and project information
  </Card>
</CardGroup>

## Supported integrations

Access your documentation, project management tools, knowledge bases, Figma designs, and more through MCP servers.

### Suggested MCP servers

The **Integrations** page includes nine suggested MCP servers: Notion, Context7, Linear, GitHub Copilot, Sentry, Asana, Monday.com, ClickUp and DeepWiki. An MCP integration supplies the server name, hosted endpoint, and authentication method. To connect another MCP server, choose **New MCP Server** and enter its connection details manually.

## Considerations

<CardGroup>
  <Card>
    <Info>
      **CodeRabbit as MCP client**: CodeRabbit acts as the MCP client, not the
      server. It ingests data from your connected MCP servers.
    </Info>

    <Warning>
      **Data relevance**: Consider what MCP data will be helpful for code
      reviews. CodeRabbit uses this data for analysis, validation, and chat
      interactions.
    </Warning>

    <Tip>
      **Faster integrations**: This approach unlocks integrations without
      waiting for formal CodeRabbit support. If a tool has an MCP server,
      CodeRabbit can connect to it.
    </Tip>
  </Card>
</CardGroup>

## Setup

<Steps>
  <Step title="Open integrations">
    Open [Integrations](https://app.coderabbit.ai/integrations).
  </Step>

  <Step title="Choose an MCP server">
    Select a suggested server and click **Add**, or choose **New MCP Server** for a custom setup.

    Add **Usage guidance** when CodeRabbit needs help finding the right information on the server. See [User guidance](#user-guidance) for details.
  </Step>

  <Step title="Complete authentication">
    Enter the required API token, complete OAuth, or continue without authentication according to the server's configuration.
  </Step>

  <Step title="Configure tools">
    Discover the tools exposed by the server and choose which tools CodeRabbit may use, then save the connection.
  </Step>
</Steps>

## How it works

<Tabs>
  <Tab title="During code reviews">
    CodeRabbit automatically calls relevant MCP tools during analysis to:

    <CardGroup>
      <Card title="Gather context">
        Collects additional review context from your connected data sources
      </Card>

      <Card title="Enhance comments">
        Validates and enriches suggested review comments with relevant information
      </Card>
    </CardGroup>

    <Info>
      Enhanced review comments will include enriched insights while maintaining your existing workflow. Tools used during analysis are listed under **"Additional context used."**
    </Info>
  </Tab>

  <Tab title="In chat interactions">
    MCP integration enhances chat by providing access to:

    <CardGroup>
      <Card title="Contextual information">
        Retrieves relevant information based on discussion topics
      </Card>

      <Card title="External documentation">
        Accesses your organization's knowledge bases and documentation
      </Card>
    </CardGroup>
  </Tab>
</Tabs>

## User guidance

The **Usage guidance** field contains instructions that CodeRabbit reads before using your MCP server. Use it to describe what information is available, what to look for, and why it matters for code reviews.

Some MCP servers need no additional guidance—the agent can figure out how to use their tools on its own. But many servers benefit from explicit context, especially when:

* The server stores a wide variety of content (for example, a Notion workspace covering engineering specs, meeting notes, HR policies, and runbooks)
* The server uses internal naming conventions or project keys that the agent can't guess
* The server is a custom in-house tool whose purpose isn't obvious from its tool names alone
* Resources are organized in non-standard hierarchies that the agent can't automatically navigate

### What to include in user guidance

Good user guidance answers three questions for the agent:

1. **What is stored here?** Describe the kind of information available on this MCP server.
2. **What should CodeRabbit look for?** Narrow the scope to what's relevant for code reviews.
3. **How is it organized?** Provide naming conventions, key formats, or URL patterns the agent needs to find the right resources.

### Example configurations

<Tabs>
  <Tab title="Notion">
    Notion workspaces can contain many different types of content. Tell the agent which pages or databases are relevant to code reviews:

    ```text wrap theme={null}
    This Notion workspace contains our engineering documentation.
    For code reviews, look in the "Engineering" space—specifically:
    - "Architecture Decisions" for design rationale
    - "API Contracts" for interface specifications
    - "Service Runbooks" for operational context

    Do not pull content from HR, Finance, or Company-wide spaces.
    ```
  </Tab>

  <Tab title="Custom in-house MCP server">
    For internal tools, explain what the server exposes and why it's useful for reviews:

    ```text wrap theme={null}
    This is our internal quality gate service. It provides:
    - Static analysis results for each pull request
    - Security scan findings from our custom ruleset
    - Architecture compliance checks against our approved patterns

    Always fetch the quality gate report for the current PR before commenting
    on code quality or security issues. Results are indexed by repository name
    and PR number.
    ```
  </Tab>

  <Tab title="Jenkins">
    If your Jenkins jobs are organized in folders that CodeRabbit can't automatically discover:

    ```text wrap theme={null}
    Jenkins builds are located at:
    https://jenkins.company.com/job/{workspace}/job/{repo}/job/PR-{pr}/

    Use getBuild or getBuildLog to fetch build results directly from this path.
    ```

    <Tip>
      This is particularly useful for Jenkins Organization Folders, where jobs are nested under workspace/repo/PR structures that aren't searchable via the standard Jenkins API.
    </Tip>
  </Tab>

  <Tab title="SonarQube">
    If your SonarQube project keys follow a naming convention:

    ```text wrap theme={null}
    SonarQube project key format: {org}_{repo}
    Dashboard: https://sonar.company.com/dashboard?id={org}_{repo}
    ```
  </Tab>

  <Tab title="Azure DevOps">
    For Azure DevOps pipelines using project-specific paths:

    ```text wrap theme={null}
    Pipeline runs: https://dev.azure.com/{org}/{project}/_build?definitionId=1&branchName=refs/pull/{pr}/merge
    ```
  </Tab>
</Tabs>

### URL template placeholders

When guidance includes URLs that change per pull request, use **placeholders** that CodeRabbit automatically expands with values from the current PR:

```text theme={null}
https://jenkins.company.com/job/{workspace}/job/{repo}/job/PR-{pr}/
```

#### Available placeholders

| Placeholder                             | Description                   | Example value |
| --------------------------------------- | ----------------------------- | ------------- |
| `{repo}`, `{repo name}`, `{repository}` | Repository name               | `my-backend`  |
| `{pr}`, `{pr number}`                   | Pull request number           | `42`          |
| `{mr}`, `{mr number}`                   | Merge request number (GitLab) | `42`          |
| `{workspace}`, `{owner}`, `{org}`       | Organization or workspace     | `acme-corp`   |
| `{project}`                             | Project name (Azure DevOps)   | `MyProject`   |

<Info>
  Placeholders are case-insensitive. `{repo}`, `{REPO}`, and `{Repo}` all work the same way.
</Info>


# Create issues
Source: https://docs.coderabbit.ai/issues/creation

Turn code discussions into tracked issues across GitHub, GitLab, Jira, and Linear directly from CodeRabbit's chat interface.

<AllPlatformsBadge /> | <ProPlanBadge />

When reviewing code, important issues often surface in discussions but get lost without proper tracking. CodeRabbit bridges this gap by creating issues directly from pull request conversations or chat interactions, ensuring nothing falls through the cracks.

CodeRabbit supports issue creation across GitHub, GitLab, Jira, and Linear. You can create issues naturally through conversations—just mention `@coderabbitai` and describe what needs to be tracked.

## Creating issues through agentic chat

The most straightforward way to create issues is through CodeRabbit's chat interface. During pull request reviews or in comment threads, mention `@coderabbitai` and ask to create an issue. CodeRabbit analyzes the context and creates a well-structured issue with relevant details (code context, discussion history, etc.) for your chosen platform.

<Frame>
  <img alt="Creating an issue through CodeRabbit's agentic chat interface" />
</Frame>

## Supported platforms

<CardGroup>
  <Card title="GitHub and GitLab" icon="git-alt">
    Git-based platform issues work automatically without additional setup.
    CodeRabbit creates issues directly in your repository.
  </Card>
</CardGroup>

<CardGroup>
  <Card title="Jira" icon="jira" href="/integrations/jira">
    Create Jira tickets after configuring the **Jira integration**.
  </Card>

  <Card title="Linear" icon="linear" href="/integrations/linear">
    Generate Linear issues once you've set up the **Linear integration**.
  </Card>
</CardGroup>

## Best practices

<CardGroup>
  <Card title="Provide context" icon="code">
    Include relevant code snippets, error messages, or discussion context when
    requesting issue creation. This helps CodeRabbit generate more detailed and
    actionable issues.
  </Card>

  <Card title="Specify the platform" icon="arrow-pointer">
    If you have multiple issue platforms configured, explicitly mention which one
    to use: "Create a Jira ticket for this" or "Add this to Linear."
  </Card>

  <Card title="Include assignee information" icon="user">
    Mention specific team members who should handle the issue: "Create an issue
    for @username to investigate this performance problem."
  </Card>

  <Card title="Set priority and timing" icon="clock">
    Indicate urgency or deadlines: "Create a high-priority issue for the memory
    leak in checkout flow" or "Add this to the next sprint."
  </Card>
</CardGroup>

For detailed information about configuring issue tracking integrations, see our [Issue Integrations](/integrations/issue-trackers) guide.


# Issue Enrichment
Source: https://docs.coderabbit.ai/issues/enrichment

CodeRabbit automatically analyzes your issues to detect duplicates, find related issues and PRs, suggest assignees, and apply smart labels.

<GitHubBadge /> | <OpenBetaBadge />

## Overview

CodeRabbit Issue Enrichment automatically analyzes your issues and provides contextual
insights to help you work more efficiently. When you create or edit an issue, CodeRabbit
posts a comment with:

* 🔍 **Duplicate Detection** - Identifies if your issue already exists
* 🔗 **Similar Issues** - Shows related issues that might have solutions or context
* 🔗 **Related Pull Requests** - Finds PRs that addressed similar problems
* 👤 **Suggested Assignees** - Recommends team members based on expertise
* 🏷️ **Smart Labeling** - Automatically categorizes issues with appropriate labels

<Tip>
  Looking to generate implementation plans? Check out [CodeRabbit Plan](/plan) to create Coding Plans from issues, PRDs, designs, or free-form descriptions.
</Tip>

## Getting Started

Issue enrichment is enabled by default on GitHub issues. CodeRabbit will automatically enrich new issues with contextual information.

### Disable Issue Enrichment

To turn off automatic enrichment, add this to your `.coderabbit.yaml` configuration file:

```yaml theme={null}
issue_enrichment:
  auto_enrich:
    enabled: false
```

## Features

### Duplicate Detection

CodeRabbit analyzes your issue against existing issues in your repository and knowledge
base to detect potential duplicates.

**What you'll see:**

```markdown theme={null}
## 🔗 Similar Issues

**Possible Duplicates**

- https://github.com/owner/repo/issues/42
```

### Similar Issues

Discover related issues that might provide context, workarounds, or solutions.

**What you'll see:**

```markdown theme={null}
## 🔗 Similar Issues

**Related Issues**

- https://github.com/owner/repo/issues/15
- https://github.com/owner/repo/issues/28
- https://github.com/owner/repo/issues/31
```

### Related Pull Requests

See PRs that addressed similar problems or touched related code.

**What you'll see:**

```markdown theme={null}
## 🔗 Related PRs

#123 - Fix authentication bug [merged]
#145 - Update auth flow [open]
#98 - Improve login error handling [closed]
```

### Suggested Assignees

Get smart recommendations for who should work on the issue based on past contributions
to related issues and PRs.

**What you'll see:**

```markdown theme={null}
## 👤 Suggested Assignees

- [@guritfaq](https://github.com/guritfaq)
- [@harjotgill](https://github.com/harjotgill)
- [@aravindputrevu](https://github.com/aravindputrevu)
```

### Smart Auto-Labeling

Automatically apply appropriate labels to issues based on their content.

#### Configuration

```yaml theme={null}
issue_enrichment:
  labeling:
    auto_apply_labels: true
    labeling_instructions:
      - label: bug
        instructions: Issues reporting bugs, errors, crashes, incorrect behavior, or unexpected results. This includes runtime errors, logic errors, broken functionality, regressions, and any deviation from expected or documented behavior.
      - label: enhancement
        instructions: Feature requests, improvements to existing functionality, performance optimizations, refactoring suggestions, UI/UX enhancements, and any suggestions to make the project better or add new capabilities.
      - label: documentation
        instructions: Documentation updates, additions, corrections, or clarifications needed. This includes missing docs, outdated information, unclear instructions, API documentation, code examples, README improvements, and any requests for better explanations or guides.
```

## Frequently Asked Questions

### Can I customize what information is shown?

Currently, the enrichment format is standardized, but you can customize label categories with auto-labeling and configure auto-planning to choose which issues get plans.

### Does enrichment work for private repositories?

Yes! Issue enrichment works for both public and private repositories. Knowledge base and
enrichment respect your repository access controls.

### How does CodeRabbit find related issues and PRs?

CodeRabbit uses semantic similarity search on your knowledge base by indexing issues and PRs based upon vectorized representations (which cannot be reversed into the original issues and PR's).

### Will enrichment update when I edit the issue?

Yes! When you edit an issue that already has enrichment, CodeRabbit will re-analyze the updated content, search for new related issues and PRs, update the enrichment comment, and trigger auto-planning if labels changed.


# Planning on Azure DevOps
Source: https://docs.coderabbit.ai/issues/planner/azure-devops

Generate comprehensive Coding Plans from Azure DevOps Boards work items.

<AzureBadge /> | <ProPlusPlanBadge />

<Info>
  This guide covers work-item-based planning with Azure DevOps Boards. For the full CodeRabbit Plan documentation, see [CodeRabbit Plan](/plan).
</Info>

## Prerequisites

Complete the [Azure DevOps platform setup](/platforms/azure-devops) for the repositories you want CodeRabbit to plan against. The Azure DevOps user or service account configured for CodeRabbit must have read and write access to work items, as well as access to the related repository.

## Initiating Planning

### Manual Planning

<CardGroup>
  <Card title="CodeRabbit Command" icon="terminal">
    Comment `@coderabbitai plan` or `@coderabbit plan` on an Azure DevOps Boards work item to generate a plan.
  </Card>
</CardGroup>

<Info>
  You can also select the CodeRabbit user from the comment editor's @-mention
  picker and type `plan` after the mention.
</Info>

### Auto-Planning

Auto-planning is not yet available for Azure DevOps Boards. Use the plan command to generate plans on demand. Auto-planning rulesets are available for [Jira](/issues/planner/jira) and [Linear](/issues/planner/linear), and label-based auto-planning is available for [GitHub](/issues/planner/github) and [GitLab](/issues/planner/gitlab).

## Repository Resolution

Since Azure DevOps Boards work items aren't always tied to a specific repository, CodeRabbit needs to determine which repository to analyze when generating a plan.

CodeRabbit attempts to resolve the repository in this order:

<Steps>
  <Step title="Check Work Item Description">
    If the work item description contains `repository: <repo-name>` or a link to a repository, CodeRabbit uses that repository.

    ```markdown theme={null}
    repository: my-repo
    OR
    repository: https://dev.azure.com/my-org/my-project/_git/my-repo
    ```
  </Step>

  <Step title="Automatic Detection">
    CodeRabbit leverages its deep understanding of your project to intelligently
    predict which repository is most relevant.
  </Step>

  <Step title="Ask the User">
    If CodeRabbit can't confidently determine the repository, it replies to the work item asking you to specify which repository to use. Reply with the repository name in a follow-up work item comment to continue planning.
  </Step>
</Steps>

## Viewing and Refining Plans

Once a Coding Plan is generated, CodeRabbit replies on the work item with a link to the plan in the CodeRabbit web app. Anyone in your organization can view and work with the plans.

<Info>
  Plans in the web app are organization-specific. If a plan shows a 404 error,
  verify you're viewing the correct organization in the CodeRabbit web app.
</Info>

<Frame>
  <img alt="View Coding Plans in the CodeRabbit web app" />
</Frame>

### Chatting about Your Plan

Use the chat panel on the right side of the plan viewer in the CodeRabbit web app to:

* Ask questions about the plan or the codebase
* Request changes to specific tasks or phases
* Challenge design choices and provide additional context
* Get clarification on implementation details

### Re-planning

After providing feedback through chat:

1. Review your feedback in the chat history
2. Click the **Redo** button
3. CodeRabbit generates a new plan version incorporating your feedback

### Version History

Each re-plan creates a new version. Use the version selector at the top of the plan viewer to:

* View previous versions
* Compare what changed between versions
* Revert to an earlier version by marking it as active

<Info>You can only chat about the currently active version.</Info>

### Handing Off to a Coding Agent

Click the **Handoff** button at the bottom of the plan viewer to see your options:

#### Copy to Clipboard

Copy the agentic prompts to your clipboard, then paste them into your preferred coding agent (Claude Code, Cursor, GitHub Copilot, etc.).

#### IDE Extension

If you have the CodeRabbit IDE extension installed, the Coding Plan can be sent directly to your coding agent through the extension. The agentic prompts appear in your coding agent's input field, ready to execute.

If you don't have the extension installed, you'll be prompted to install it.


# Planning on GitHub
Source: https://docs.coderabbit.ai/issues/planner/github

Generate comprehensive Coding Plans from your issues on the GitHub issue tracker.

<GitHubBadge title="GitHub Cloud" /> <GitHubBadge title="GitHub Enterprise Cloud" /> <GitHubBadge title="GitHub Enterprise Server" href="/plan" /> | <ProPlusPlanBadge />

## Initiating Planning

### Manual Planning

There are two ways to trigger Planning manually:

<CardGroup>
  <Card title="CodeRabbit Command" icon="terminal">
    Comment `@coderabbitai plan` on any GitHub Issue to generate a plan.
  </Card>

  <Card title="Checkbox" icon="square-check-big">
    When Issue Enrichment is enabled, CodeRabbit posts a comment on new issues
    with a **Create Plan** checkbox. Check the box to generate a plan.
  </Card>
</CardGroup>

### Auto-Planning (Recommended)

Automatically generate plans when specific labels are added to issues.

<Tabs>
  <Tab title="Using configuration file">
    ```yaml theme={null}
    issue_enrichment:
      planning:
        enabled: true
        auto_planning:
          enabled: true
          labels:
            - "plan-me" # Auto-plan issues with this label
            - "feature" # Also auto-plan these
            - "!no-plan" # Never auto-plan issues with this label
    ```
  </Tab>

  <Tab title="Using the Web Interface">
    To configure auto-planning labels in the CodeRabbit web app:

    1. Navigate to **Configuration → Issue Enrichment → Auto-Planning**
    2. Enable **Automatic Planning**
    3. Add your desired labels in the labels field:
       * Enter labels that should trigger auto-planning (e.g., `plan-me`, `feature`)
       * Use the `!` prefix for exclusion labels (e.g., `!no-plan`)
    4. Save your configuration

    The web interface provides the same functionality as the YAML configuration, allowing you to manage auto-planning labels without committing configuration files to your repository.
  </Tab>
</Tabs>

#### Label Matching Rules

| Configuration                    | Behavior                                                                      |
| -------------------------------- | ----------------------------------------------------------------------------- |
| Inclusion only (e.g., `feature`) | Plans only issues with at least one matching label                            |
| Exclusion only (e.g., `!wip`)    | Plans all issues except those with excluded labels                            |
| Mixed (e.g., `feature`, `!wip`)  | Plans issues that have an inclusion label AND don't have any exclusion labels |

<Info>
  Exclusion labels (starting with `!`) always take priority over inclusion
  labels.
</Info>

## Viewing and Refining Plans

Once a Coding Plan is generated, CodeRabbit posts the full plan as a comment on the issue.

<Frame>
  <img alt="Coding Plan posted as a comment on a GitHub issue" />
</Frame>

### Chatting about Your Plan

Reply to the Coding Plan comment on the issue to:

* Ask questions about the plan or the codebase
* Request changes to specific tasks or phases
* Challenge design choices and provide additional context
* Get clarification on implementation details

<Frame>
  <img alt="Discuss the Coding Plan with CodeRabbit" />
</Frame>

### Re-planning

Once asked to make changes, CodeRabbit will respond to your comment and update the plan accordingly. You can also comment `@coderabbitai plan` again on the issue to regenerate the plan from scratch.

### Handing Off to a Coding Agent

Copy the agentic prompts from the Coding Plan comment on the issue, and paste them into your preferred coding agent (Claude Code, Cursor, GitHub Copilot, etc.).

Alternatively, if your coding agent can access GitHub directly (for example, through the GitHub MCP), you can simply ask it to `fetch the issue by its number and execute CodeRabbit's plan`.


# Planning on GitLab
Source: https://docs.coderabbit.ai/issues/planner/gitlab

Generate comprehensive Coding Plans from your issues on the GitLab issue tracker.

<GitLabBadge title="GitLab Cloud" /> <GitLabBadge title="GitLab Self-Hosted" href="/plan" /> | <ProPlusPlanBadge />

## Prerequisites

### Webhook Configuration

For Issue Planner to work, your GitLab webhook must include the **Issues events** trigger. If you recently installed CodeRabbit, this trigger is **automatically configured** for you. No additional setup is required.

If you installed CodeRabbit before Issue Planner was available, you need to manually add the "Issues events" trigger to your webhook:

Go to **Settings → Webhooks** in your GitLab project or group, edit the webhook pointing to `https://coderabbit.ai/gitlabHandler`, enable **Issues events** under Trigger, and save.

## Initiating Planning

### Manual Planning

<CardGroup>
  <Card title="CodeRabbit Command" icon="terminal">
    Comment `@coderabbitai plan` on any GitLab Issue to generate a plan.
  </Card>
</CardGroup>

### Auto-Planning (Recommended)

Automatically generate plans when specific labels are added to issues.

<Tabs>
  <Tab title="Using configuration file">
    ```yaml theme={null}
    issue_enrichment:
      planning:
        enabled: true
        auto_planning:
          enabled: true
          labels:
            - "plan-me" # Auto-plan issues with this label
            - "feature" # Also auto-plan these
            - "!no-plan" # Never auto-plan issues with this label
    ```
  </Tab>

  <Tab title="Using the Web Interface">
    To configure auto-planning labels in the CodeRabbit web app:

    1. Navigate to **Configuration → Issue Enrichment → Auto-Planning**
    2. Enable **Automatic Planning**
    3. Add your desired labels in the labels field:
       * Enter labels that should trigger auto-planning (e.g., `plan-me`, `feature`)
       * Use the `!` prefix for exclusion labels (e.g., `!no-plan`)
    4. Save your configuration

    The web interface provides the same functionality as the YAML configuration, allowing you to manage auto-planning labels without committing configuration files to your repository.
  </Tab>
</Tabs>

### Label Matching Rules

| Configuration                    | Behavior                                                                      |
| -------------------------------- | ----------------------------------------------------------------------------- |
| Inclusion only (e.g., `feature`) | Only plans issues with at least one matching label                            |
| Exclusion only (e.g., `!wip`)    | Plans all issues except those with excluded labels                            |
| Mixed (e.g., `feature`, `!wip`)  | Plans issues that have an inclusion label AND don't have any exclusion labels |

<Info>
  Exclusion labels (starting with `!`) always take priority over inclusion
  labels.
</Info>

## Viewing and Refining Plans

Once a Coding Plan is generated, CodeRabbit posts the full plan as a comment on the issue.

### Chatting about Your Plan

Reply to the Coding Plan comment on the issue to:

* Ask questions about the plan or the codebase
* Request changes to specific tasks or phases
* Challenge design choices and provide additional context
* Get clarification on implementation details

For example:

```markdown theme={null}
Can you add more detail to Phase 2 about error handling?
```

### Re-planning

Once asked to make changes, CodeRabbit will respond to your comment and update the plan accordingly. You can also comment `@coderabbitai plan` again on the issue to regenerate the plan from scratch.

### Handing Off to a Coding Agent

Copy the agentic prompts from the Coding Plan comment on the issue, and paste them into your preferred coding agent (Claude Code, Cursor, GitHub Copilot, etc.).

Alternatively, if your coding agent can access GitLab directly (for example, through the GitLab MCP), you can simply ask it to `fetch the issue by its number and execute CodeRabbit's plan`.


# Issue Planner
Source: https://docs.coderabbit.ai/issues/planner/index

Turn issues into comprehensive Coding Plans ready for your favorite coding agent or IDE copilot. Works with GitHub, GitLab, Azure DevOps, Jira, and Linear!

<ProPlusPlanBadge />

<Info>
  Issue Planner is one way to use **CodeRabbit Plan**. You can also create plans directly using free-form descriptions, PRDs, or design specs. See the full [CodeRabbit Plan documentation](/plan) for an overview of all options.
</Info>

CodeRabbit analyzes your issues, specifications, and project codebase to generate Coding Plans you can hand off to any coding agent or IDE copilot. Because CodeRabbit [deeply understands](/overview/architecture) your codebase through continuous analysis, each plan is tailored to your architecture and conventions, covering codebase research, step-by-step tasks, and agent-ready prompts.

## Supported Issue Trackers

CodeRabbit supports five issue trackers for plan generation. See the platform-specific guides for setup and configuration details.

<CardGroup>
  <Card title="GitHub" icon="github" href="/issues/planner/github">
    Guide
  </Card>

  <Card title="GitLab" icon="gitlab" href="/issues/planner/gitlab">
    Guide
  </Card>

  <Card title="Azure DevOps" icon="microsoft" href="/issues/planner/azure-devops">
    Guide
  </Card>

  <Card title="Jira" icon="jira" href="/issues/planner/jira">
    Guide
  </Card>

  <Card title="Linear" icon="linear" href="/issues/planner/linear">
    Guide
  </Card>
</CardGroup>

## Planning

The recommended way to use issue planning is to **enable auto-planning** on your platform so that Coding Plans are generated automatically whenever issues match the conditions you configure. Refer to the platform-specific guides above to set up auto-planning.

To generate a plan on demand, comment `@coderabbitai plan` on any issue.

## Viewing and Refining Plans

How you view and refine Coding Plans depends on your platform:

<CardGroup>
  <Card title="GitHub & GitLab">
    The full Coding Plan is posted as a comment directly on the issue. Reply to
    the plan comment to refine details, challenge design choices, or request
    changes.

    <Frame>
      <img alt="Coding Plan as GitHub issue comment" />
    </Frame>
  </Card>

  <Card title="Azure DevOps, Jira & Linear">
    The Coding Plan is available in the CodeRabbit web app. Use the chat
    panel on the right to iterate on the plan before handing off the finalized prompts to
    your coding agent.

    <Frame>
      <img alt="Plan Editor user interface" />
    </Frame>
  </Card>
</CardGroup>

<Info>
  For platform-specific details on triggering and configuring plans, see the
  [GitHub](/issues/planner/github), [GitLab](/issues/planner/gitlab),
  [Azure DevOps](/issues/planner/azure-devops), [Jira](/issues/planner/jira),
  and [Linear](/issues/planner/linear) guides.
</Info>

### Plan Structure

Each Coding Plan contains the following sections:

| Section            | Description                                                                                                                                                               |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Summary**        | 2-3 sentence overview of the implementation approach                                                                                                                      |
| **Research**       | Deep codebase analysis leveraging CodeRabbit's project knowledge, identifying relevant files, patterns, dependencies, and architectural decisions specific to the project |
| **Design Choices** | Decisions made during planning with rationale for each                                                                                                                    |
| **Phases**         | Logical chunks of work that should be done together                                                                                                                       |
| **Tasks**          | Individual tasks within each phase                                                                                                                                        |
| **Agent Prompt**   | Machine-readable instructions for coding agents (per phase and combined)                                                                                                  |

### Chatting about Your Plan

Chat with CodeRabbit to ask questions, request changes to specific tasks or phases, challenge design choices, or get clarification on implementation details. CodeRabbit responds and updates the plan accordingly. See the platform-specific guides for details on how chatting works on your platform.

### Re-planning

Provide feedback and regenerate your plan to incorporate changes. See the platform-specific guides for details on the re-planning workflow.

### Handing Off to a Coding Agent

Once you're satisfied with a Coding Plan, copy the agentic prompts and paste them into your preferred coding agent (Claude Code, Cursor, GitHub Copilot, etc.). Depending on the platform, you can also hand off directly through the CodeRabbit IDE extension or ask an agent with direct platform access (for example, GitHub or GitLab MCP) to fetch the issue and execute CodeRabbit's plan. See the platform-specific guides for handoff options.

## Frequently Asked Questions

### How long does plan generation take?

Plan generation typically takes [between 5 and 10 minutes](#how-is-coderabbit-different-from-using-chatgpt-or-coding-agents-for-planning) depending on the complexity of the issue and codebase.

### Can I regenerate a plan?

Yes. You can regenerate a plan on all supported platforms. See your platform's guide for specific instructions.

### Can multiple people work on the same plan?

Yes. Anyone in your organization can view plans, discuss them with CodeRabbit, and trigger re-plans.

### How is CodeRabbit different from using ChatGPT or coding agents for planning?

Any AI agent or LLM can write an implementation plan. The difference is in the quality and context behind that plan:

1. **Deeper codebase understanding** - When an AI agent generates a plan, it typically reviews only a handful of files. CodeRabbit's Coding Plans are grounded in [deep codebase understanding](/overview/architecture) through continuous code analysis and an extensive knowledge base. This means plans reference the right files, follow your established patterns, and integrate seamlessly with your existing code.

2. **Access to issues and better context** - CodeRabbit works with issue trackers, surfacing relevant related issues, even when the assigned engineer isn't aware of them. This broader context ensures plans account for ongoing work, previous decisions, and the full scope of your project's direction.

3. **Collaborative review** - CodeRabbit plans are available for review by other engineers and product owners. Team members can discuss, challenge design choices, and refine plans together before implementation begins.

4. **Accountability and history** - Every plan version is preserved. You can track what was planned, when it was planned, and why decisions were made. This audit trail provides accountability and helps teams understand the evolution of features over time.


# Planning on Jira
Source: https://docs.coderabbit.ai/issues/planner/jira

Generate comprehensive Coding Plans from your issues using Jira issue tracker.

<ProPlusPlanBadge />

<Info>
  This guide covers issue-based planning with Jira. For the full CodeRabbit Plan documentation, see [CodeRabbit Plan](/plan).
</Info>

## Prerequisites

Enable the Jira integration as explained in the [integrations documentation](/integrations/issue-trackers)

<Warning>
  **Existing Jira users:** If you enabled Jira before this feature was released,
  you'll need to re-authenticate to grant the additional permissions required
  for planning.
</Warning>

## Initiating Planning

### Manual Planning

<CardGroup>
  <Card title="CodeRabbit Command" icon="terminal">
    Comment `@coderabbitai plan` on any issue to generate a plan.
  </Card>
</CardGroup>

### Auto-Planning (Recommended)

Navigate to the **Planning** tab in the CodeRabbit web app to configure automatic planning rulesets.

<Info>
  **Configuration via Web UI Only:** Auto-planning rulesets must be configured
  through the CodeRabbit web interface. Configuration via `.coderabbit.yaml` is
  not supported for this feature.
</Info>

A ruleset consists of conditions that, when met, automatically trigger plan generation. All conditions are optional—you can use any combination that fits your workflow:

| Condition      | Description                                                  |
| -------------- | ------------------------------------------------------------ |
| **Issue Type** | Match specific issue types (e.g., Bug, Feature, Task)        |
| **Labels**     | Match issues with specific labels                            |
| **Assignee**   | Match issues assigned to specific users                      |
| **Status**     | Match issues in specific statuses (e.g., Ready, In Progress) |

You can create multiple rulesets with different combinations of conditions. A plan is triggered when any ruleset matches.

Auto-planning rulesets are configured at the workspace level. When your workspace has multiple CodeRabbit organizations or Jira connections, select the organization and issue tracker **Connection** before choosing repositories or conditions. Each ruleset is saved against the selected Jira connection.

<Info>
  Specifying a repository using the Repository selector ensures plans are
  always generated against the correct codebase in the selected organization,
  skipping the repository resolution step.
</Info>

## Repository Resolution

Since Jira issues aren't tied to a specific repository, CodeRabbit needs to determine which repository to analyze when generating a plan.

CodeRabbit attempts to resolve the repository in this order:

<Steps>
  <Step title="Check Issue Description">
    If the issue description contains `repository: <repo-name>` or a link to a repository, CodeRabbit uses that repository.

    ```markdown theme={null}
    repository: my-org/my-repo
    OR
    repository: https://github.com/my-org/my-repo
    ```
  </Step>

  <Step title="Check Planning Rulesets">
    If a planning ruleset specifies a repository, CodeRabbit uses that repository.
  </Step>

  <Step title="Automatic Detection">
    CodeRabbit leverages its deep understanding of your project to intelligently
    predict which repository is most relevant.
  </Step>

  <Step title="Ask the User">
    If CodeRabbit can't confidently determine the repository, it replies to the issue asking you to specify which repository to use. Reply with the repository name to continue planning.
  </Step>
</Steps>

## Viewing and Refining Plans

Once a Coding Plan is generated, view it in the CodeRabbit web app. Anyone in your organization can view and work with the plans.

<Info>
  Plans in the web app are organization-specific. If a plan shows a 404 error,
  verify you're viewing the correct organization in the CodeRabbit web app.
</Info>

<Frame>
  <img alt="View Coding Plans in the CodeRabbit web app" />
</Frame>

### Chatting about Your Plan

Use the chat panel on the right side of the plan viewer in the CodeRabbit web app to:

* Ask questions about the plan or the codebase
* Request changes to specific tasks or phases
* Challenge design choices and provide additional context
* Get clarification on implementation details

### Re-planning

After providing feedback through chat:

1. Review your feedback in the chat history
2. Click the **Redo** button
3. CodeRabbit generates a new plan version incorporating your feedback

### Version History

Each re-plan creates a new version. Use the version selector at the top of the plan viewer to:

* View previous versions
* Compare what changed between versions
* Revert to an earlier version by marking it as active

<Info>You can only chat about the currently active version.</Info>

### Handing Off to a Coding Agent

Click the **Handoff** button at the bottom of the plan viewer to see your options:

#### Copy to Clipboard

Copy the agentic prompts to your clipboard, then paste them into your preferred coding agent (Claude Code, Cursor, GitHub Copilot, etc.).

#### IDE Extension

If you have the CodeRabbit IDE extension installed, the Coding Plan can be sent directly to your coding agent through the extension. The agentic prompts appear in your coding agent's input field, ready to execute.

If you don't have the extension installed, you'll be prompted to install it.


# Planning on Linear
Source: https://docs.coderabbit.ai/issues/planner/linear

Generate comprehensive Coding Plans from your issues using Linear issue tracker.

<ProPlusPlanBadge />

<Info>
  This guide covers issue-based planning with Linear. For the full CodeRabbit Plan documentation, see [CodeRabbit Plan](/plan).
</Info>

## Prerequisites

Enable the Linear integration as explained in [integrations documentation](/integrations/issue-trackers)

## Initiating Planning

### Manual Planning

<CardGroup>
  <Card title="CodeRabbit Command" icon="terminal">
    Comment `@coderabbitai plan` on any issue to generate a plan.
  </Card>
</CardGroup>

### Auto-Planning (Recommended)

Navigate to the **Planning** tab in the CodeRabbit web app to configure automatic planning rulesets.

<Info>
  **Configuration via Web UI Only:** Auto-planning rulesets must be configured
  through the CodeRabbit web interface. Configuration via `.coderabbit.yaml` is
  not supported for this feature.
</Info>

A ruleset consists of conditions that, when met, automatically trigger plan generation. All conditions are optional—you can use any combination that fits your workflow:

| Condition      | Description                                                  |
| -------------- | ------------------------------------------------------------ |
| **Issue Type** | Match specific issue types (e.g., Bug, Feature, Task)        |
| **Labels**     | Match issues with specific labels                            |
| **Assignee**   | Match issues assigned to specific users                      |
| **Status**     | Match issues in specific statuses (e.g., Ready, In Progress) |

You can create multiple rulesets with different combinations of conditions. A plan is triggered when any ruleset matches.

Auto-planning rulesets are configured at the workspace level. When your workspace has multiple CodeRabbit organizations or Linear connections, select the organization and issue tracker **Connection** before choosing repositories or conditions. Each ruleset is saved against the selected Linear connection.

<Info>
  Specifying a repository using the Repository selector ensures plans are
  always generated against the correct codebase in the selected organization,
  skipping the repository resolution step.
</Info>

## Repository Resolution

Since Linear issues aren't tied to a specific repository, CodeRabbit needs to determine which repository to analyze when generating a plan.

CodeRabbit attempts to resolve the repository in this order:

<Steps>
  <Step title="Check Issue Description">
    If the issue description contains `repository: <repo-name>` or a link to a repository, CodeRabbit uses that repository.

    ```markdown theme={null}
    repository: my-org/my-repo
    OR
    repository: https://github.com/my-org/my-repo
    ```
  </Step>

  <Step title="Check Planning Rulesets">
    If a planning ruleset specifies a repository, CodeRabbit uses that repository.
  </Step>

  <Step title="Automatic Detection">
    CodeRabbit leverages its deep understanding of your project to intelligently
    predict which repository is most relevant.
  </Step>

  <Step title="Ask the User">
    If CodeRabbit can't confidently determine the repository, it replies to the issue asking you to specify which repository to use. Reply with the repository name to continue planning.
  </Step>
</Steps>

## Viewing and Refining Plans

Once a Coding Plan is generated, view it in the CodeRabbit web app. Anyone in your organization can view and work with the plans.

<Info>
  Plans in the web app are organization-specific. If a plan shows a 404 error,
  verify you're viewing the correct organization in the CodeRabbit web app.
</Info>

<Frame>
  <img alt="View Coding Plans in the CodeRabbit web app" />
</Frame>

### Chatting about Your Plan

Use the chat panel on the right side of the plan viewer in the CodeRabbit web app to:

* Ask questions about the plan or the codebase
* Request changes to specific tasks or phases
* Challenge design choices and provide additional context
* Get clarification on implementation details

### Re-planning

After providing feedback through chat:

1. Review your feedback in the chat history
2. Click the **Redo** button
3. CodeRabbit generates a new plan version incorporating your feedback

### Version History

Each re-plan creates a new version. Use the version selector at the top of the plan viewer to:

* View previous versions
* Compare what changed between versions
* Revert to an earlier version by marking it as active

<Info>You can only chat about the currently active version.</Info>

### Handing Off to a Coding Agent

Click the **Handoff** button at the bottom of the plan viewer to see your options:

#### Copy to Clipboard

Copy the agentic prompts to your clipboard, then paste them into your preferred coding agent (Claude Code, Cursor, GitHub Copilot, etc.).

#### IDE Extension

If you have the CodeRabbit IDE extension installed, the Coding Plan can be sent directly to your coding agent through the extension. The agentic prompts appear in your coding agent's input field, ready to execute.

If you don't have the extension installed, you'll be prompted to install it.


# PR validation using linked issues
Source: https://docs.coderabbit.ai/issues/pr-validation

CodeRabbit provides intelligent assessment of linked issues to validate whether pull requests properly address their requirements. This guide explains how to effectively use linked issues and write clear issue descriptions for optimal results.

<Info>
  To use linked issues with Jira or Linear, you must first enable the
  corresponding integration. Note that these integrations are enabled for
  private repositories by default, but disabled for public repositories. See
  [Issue trackers](/integrations/issue-trackers) for setup instructions.
</Info>

## Understanding linked issues

A linked issue is one that is explicitly referenced in your pull request description using platform-specific syntax:

<CodeGroup>
  ```bash GitHub theme={null}
  fixes #123
  closes #123
  resolves #123
  ```

  ```bash GitLab theme={null}
  closes #123
  fixes #123
  https://gitlab.com/org/repo/-/issues/123
  ```

  ```bash Jira/Linear theme={null}
  https://company.atlassian.net/browse/PROJ-123
  https://linear.app/company/issue/DEV-123
  ```
</CodeGroup>

When CodeRabbit detects linked issues, it analyzes them against your pull request changes to determine if the requirements are met:

<Frame>
  <img alt="Example of a linked Linear issue with summary, technical notes, and acceptance criteria" />
</Frame>

If a requirement from the linked issue isn't addressed, CodeRabbit flags it during review:

<Frame>
  <img alt="CodeRabbit review comment showing a potential issue where a linked issue requirement was not addressed" />
</Frame>

## Best practices for issue writing

### Issue titles

Create descriptive, technical titles that clearly state the goal:

<Tabs>
  <Tab title="Good examples">
    * "Add PrismaLint integration to configuration flow"
    * "Fix race condition in user authentication"
    * "Implement caching for GraphQL queries"
  </Tab>

  <Tab title="Poor examples">
    * "Fix bug"
    * "Update code"
    * "Improve performance"
  </Tab>
</Tabs>

### Issue descriptions

Write comprehensive descriptions that provide clear technical context:

<Steps>
  <Step title="Problem statement">
    * Clearly describe what needs to be changed
    * Include technical details about affected components
    * Reference specific files or functions if known
  </Step>

  <Step title="Expected solution">
    * Outline the desired implementation approach
    * Include code examples or pseudo-code when relevant
    * List specific acceptance criteria
  </Step>
</Steps>

**Example description:**

```markdown theme={null}
Problem:
The configuration system doesn't validate Prisma schema files before deployment,
leading to potential runtime errors.

Solution:
Integrate PrismaLint into the configuration flow to:

- Validate schema files during PR checks
- Enforce consistent naming conventions
- Prevent common Prisma anti-patterns

Affected Components:

- Configuration validation pipeline
- CI/CD workflow
- Schema validation logic

Acceptance Criteria:

- [ ] PrismaLint runs on all PR checks
- [ ] Failed validations block merging
- [ ] Clear error messages for schema issues
```

### Consistent terminology

Use consistent terminology between issues and pull requests:

<Tabs>
  <Tab title="Good practices">
    * Use the same technical terms consistently
    * Reference components with their exact names
    * Maintain consistent naming patterns
  </Tab>

  <Tab title="Poor practices">
    * Mixing different terms for the same component
    * Using vague or non-technical language
    * Inconsistent capitalization or formatting
  </Tab>
</Tabs>

## Linking issues effectively

### In pull requests

<Tabs>
  <Tab title="Direct references">
    ```md theme={null}
    Fixes #123
    Resolves organization/repo#456
    Closes https://github.com/org/repo/issues/789
    ```
  </Tab>

  <Tab title="Multiple issues">
    ```md theme={null}
    This PR addresses:
    - Fixes #123
    - Closes #456
    - Resolves https://jira.company.com/browse/PROJ-789
    ```
  </Tab>
</Tabs>

### Cross-references

For better traceability:

<Steps>
  <Step title="Add PR references in issue comments">
    Link back to the pull request from the issue discussion
  </Step>

  <Step title="Use complete URLs for external systems">
    Include full URLs when referencing Jira, Linear, or other platforms
  </Step>

  <Step title="Maintain bidirectional links">
    Ensure related issues reference each other for complete context
  </Step>
</Steps>

## How CodeRabbit assesses linked issues

CodeRabbit evaluates linked issues through this process:

<Steps>
  <Step title="Analyze issue content">
    Reviews issue titles and descriptions for requirements and context
  </Step>

  <Step title="Compare PR changes">
    Examines the code changes in the pull request
  </Step>

  <Step title="Validate requirements">
    Determines if the changes meet the stated objectives
  </Step>

  <Step title="Provide assessment">
    Returns one of three possible outcomes:

    * ✅ **Addressed**: Objective completed (no explanation needed)
    * ❌ **Not addressed**: Objective not met (explanation provided)
    * ❓ **Unclear**: Uncertain if objective is met (explanation provided)
  </Step>
</Steps>

<Note>
  Only the issue title and description are considered in the assessment.
  Comments and discussion threads are not currently analyzed.
</Note>

## Tips for better assessments

<CardGroup>
  <Card title="Be specific">
    * Include clear, measurable objectives
    * List specific technical requirements
    * Reference affected code components
  </Card>

  <Card title="Provide context">
    * Explain why changes are needed
    * Document current behavior
    * Describe expected outcomes
  </Card>

  <Card title="Use technical details">
    * Include file paths when known
    * Reference specific functions or classes
    * Mention relevant technologies
  </Card>

  <Card title="Keep it focused">
    * One main objective per issue
    * Clear scope boundaries
    * Specific acceptance criteria
  </Card>
</CardGroup>

## Related resources

<CardGroup>
  <Card title="Review instructions" href="/configuration/path-instructions">
    Learn how to add custom instructions to your reviews
  </Card>

  <Card title="Issue creation" href="/issues/creation">
    Automatically create issues from PR reviews
  </Card>

  <Card title="Issue trackers" href="/integrations/issue-trackers">
    Set up Jira or Linear integrations for linked issues
  </Card>
</CardGroup>


# Code Guidelines
Source: https://docs.coderabbit.ai/knowledge-base/code-guidelines

CodeRabbit automatically detects coding guideline files such as .cursorrules, CLAUDE.md, and AGENTS.md in your repository and applies them as review criteria—no extra configuration required.

CodeRabbit scans your repository for well-known AI coding assistant configuration files and uses their content as review criteria. If your team already writes instructions for tools like Cursor, Claude, or Windsurf, CodeRabbit picks those up automatically and enforces the same standards during code review.

## Supported files

The following file patterns are detected by default:

| File pattern                             | Associated tool                      |
| ---------------------------------------- | ------------------------------------ |
| `**/AGENTS.md`                           | AI agent instructions                |
| `**/.cursorrules`                        | Cursor                               |
| `.github/copilot-instructions.md`        | GitHub Copilot                       |
| `.github/instructions/*.instructions.md` | GitHub Copilot (scoped instructions) |
| `**/CLAUDE.md`                           | Claude Code                          |
| `**/GEMINI.md`                           | Gemini CLI                           |
| `**/.cursor/rules/*`                     | Cursor (rules directory)             |
| `**/.windsurfrules`                      | Windsurf                             |
| `**/.clinerules/*`                       | Cline                                |
| `**/.rules/*`                            | Generic team rules                   |
| `**/AGENT.md`                            | AI agent instructions                |

<Info>
  File names are case-sensitive. A file named `claude.md` is not matched by the `**/CLAUDE.md` pattern.
</Info>

## How scoping works

By default, a guideline file applies to the directory it lives in and all of its subdirectories. CodeRabbit does not apply guidelines from one part of your repository tree to unrelated paths unless you explicitly map the guideline to source-file patterns with `applyTo` in a `filePatterns` object entry.

**Examples:**

* `CLAUDE.md` at the repository root → applies to all files
* `src/frontend/CLAUDE.md` → applies only to files under `src/frontend/`
* `src/backend/.cursorrules` → applies only to files under `src/backend/`

This directory-scoped behaviour means you can maintain separate, purpose-fit guidelines for different areas of a monorepo without them interfering with each other. When directory placement does not match the files a guideline should govern, use the object form of `filePatterns` to define the mapping explicitly.

<Info>
  Without an explicit `applyTo` mapping, guidelines in a documentation or tooling
  directory will not affect code review unless the reviewed files live inside
  that same directory tree.
</Info>

<Warning>
  A common mistake is adding guideline file names (for example `CLAUDE.md`) to
  `path_instructions`. This tells CodeRabbit to **review** those files as
  changed code, not to **use** them as guidelines. Use `filePatterns` instead
  (see below), or rely on auto-detection.
</Warning>

## Managing applied guidelines

The CodeRabbit UI shows the coding guidelines that were applied during the latest reviews for a repository. Repository admins with write access can edit or trash applied guideline rows for future reviews of that repository.

* Click the pencil icon on a guideline row to edit its path pattern or instruction text. The edit changes what CodeRabbit applies in future reviews for that repository, but it leaves the original guideline document unchanged.
* Use **Reset to original** on an edited guideline to discard the repository-level edit and apply the original rendered guideline text again.
* Select one or more applied guideline rows and click **Trash selected** to stop those rendered guidelines from being applied in future reviews.

Trashing a guideline does not delete the source guideline file from your repository. It suppresses the rendered path pattern and instruction text that CodeRabbit applied for that repository. If the source guideline changes enough to render as a different instruction, it can appear again as a new applied guideline.

To turn off code guidelines entirely for a repository, set `knowledge_base.code_guidelines.enabled` to `false`.

## Adding custom file patterns

If your team stores coding standards in files that are not in the default list, you can extend the detected patterns by setting `knowledge_base.code_guidelines.filePatterns` in your `.coderabbit.yaml`. Each entry can be either a glob string or an object with `files` and `applyTo` fields.

A string entry locates guideline files and scopes each matched file to its containing directory and subdirectories. An object entry uses `files` to locate the guideline document or documents and `applyTo` to define the source-file glob or globs they govern. This explicit mapping lets you store guidelines outside a source tree and apply them to any matching files.

Custom patterns are **added on top of** the defaults—they do not replace them.

```yaml .coderabbit.yaml theme={null}
# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
knowledge_base:
  code_guidelines:
    filePatterns:
      - "**/CODING_STANDARDS.md"
      - files: "docs/guidelines/frontend.md"
        applyTo: "src/frontend/**/*.{js,jsx,ts,tsx}"
```

Glob patterns follow the same syntax used elsewhere in CodeRabbit configuration. The `**` wildcard matches any number of path segments.

In the configuration editor, the **Files** and **Apply To** fields correspond to the `files` and `applyTo` properties in an object entry.

## Configuration reference

```yaml .coderabbit.yaml theme={null}
# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
knowledge_base:
  code_guidelines:
    enabled: true
    filePatterns:
      - "**/CODING_STANDARDS.md"
```

| Field          | Type                                             | Default | Description                                                                                                                                                                                                                              |
| -------------- | ------------------------------------------------ | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `enabled`      | boolean                                          | `true`  | Apply coding guideline files as review criteria. Set to `false` to disable auto-detection entirely.                                                                                                                                      |
| `filePatterns` | array of strings or `{ files, applyTo }` objects | `[]`    | Additional guideline mappings. String entries use directory-based scoping; object entries map guideline files to explicit source-file patterns. Supplements the built-in defaults; does not replace them. File names are case-sensitive. |

<Note>
  Setting `filePatterns` to an empty list (`[]`) keeps the default patterns
  active. To disable code guidelines entirely, set `enabled: false`.
</Note>

## What's next

<CardGroup>
  <Card title="Knowledge base overview" href="/knowledge-base">
    Learn about all knowledge base capabilities: learnings, code guidelines, and linked repositories.
  </Card>

  <Card title="Learnings" href="/knowledge-base/learnings">
    Teach CodeRabbit your team's review preferences through natural conversation.
  </Card>

  <Card title="Configuration reference" href="/reference/configuration#knowledge-base">
    Full reference for all `knowledge_base` configuration options.
  </Card>
</CardGroup>


# Knowledge Base overview
Source: https://docs.coderabbit.ai/knowledge-base/index

How CodeRabbit enriches code reviews with context beyond the diff — learnings, code guidelines, multi-repo analysis, MCP servers, web search, and linked issues.

CodeRabbit's knowledge base is the collection of context sources it draws on to make reviews smarter than a plain diff analysis. When CodeRabbit reviews a pull request, it combines several signals: what your team has taught it, the coding rules already in your repo, related code in linked repositories, external documentation fetched from the web, connected MCP servers, and issues or past PRs that provide business context.

This section documents each context source, how to configure it, and when you need to take action to enable it.

## Context sources

<CardGroup>
  <Card title="Learnings" icon="brain" href="/knowledge-base/learnings">
    Adaptive AI memory. CodeRabbit learns your team's review preferences from
    natural-language chat and applies them automatically to future reviews.
  </Card>

  <Card title="Code Guidelines" icon="file-text" href="/knowledge-base/code-guidelines">
    Auto-detected team rules. CodeRabbit reads coding standards from
    `.cursorrules`, `CLAUDE.md`, `.github/copilot-instructions.md`, and other
    AI agent configuration files — no manual import required.
  </Card>

  <Card title="Multi-repo Analysis" icon="git-branch" href="/knowledge-base/multi-repo-analysis">
    Cross-repository context. Link related repositories so CodeRabbit can detect
    breaking changes, API mismatches, and dependency issues that cross repo
    boundaries.
  </Card>

  <Card title="MCP Servers" icon="server" href="/knowledge-base/mcp-context">
    External tool context via the Model Context Protocol. Connect MCP servers to
    give CodeRabbit access to internal APIs, databases, or documentation systems
    during reviews.
  </Card>

  <Card title="Web Search" icon="globe" href="/knowledge-base/web-search">
    Up-to-date external documentation. CodeRabbit searches the web to gather
    context about libraries, APIs, and standards referenced in a pull request.
  </Card>

  <Card title="Linked Issues" icon="bug" href="/issues/pr-validation">
    Issue tracker context. CodeRabbit reads linked GitHub, GitLab, Jira, and
    Linear issues to understand the intent behind a pull request and validate
    that the changes address them.
  </Card>
</CardGroup>

## What's on by default vs. what needs setup

| Context source         | Status                            | Notes                                                            |
| ---------------------- | --------------------------------- | ---------------------------------------------------------------- |
| Learnings              | **On by default**                 | Starts learning from your first `@coderabbitai` chat interaction |
| Code guidelines        | **On by default**                 | Reads supported config files automatically; no setup required    |
| Web search             | **On by default**                 | Enabled unless explicitly disabled                               |
| Pull request context   | **On by default**                 | Uses past PRs for context; scope configurable                    |
| GitHub / GitLab issues | **On by default (private repos)** | `auto` scope; enabled for private repos, isolated for public     |
| Multi-repo analysis    | **Needs setup**                   | Requires linking repositories in `.coderabbit.yaml` or the UI    |
| MCP servers            | **Needs setup**                   | Requires an MCP integration to be configured                     |
| Jira                   | **Needs setup**                   | Requires Jira integration and an active connection               |
| Linear                 | **Needs setup**                   | Requires Linear integration and an active connection             |

## Issue trackers and past pull requests

CodeRabbit can pull context from issue trackers and your PR history using four `knowledge_base` configuration fields:

* **`knowledge_base.issues`** — scope for GitHub and GitLab issues (`local`, `global`, or `auto`; default: `auto`)
* **`knowledge_base.jira`** — use Jira as a knowledge source (`auto`, `enabled`, or `disabled`; default: `auto`); supports `project_keys` to restrict to specific projects
* **`knowledge_base.linear`** — use Linear as a knowledge source (`auto`, `enabled`, or `disabled`; default: `auto`); supports `team_keys` to restrict to specific teams
* **`knowledge_base.pull_requests`** — scope for past PR context (`local`, `global`, or `auto`; default: `auto`)

For Jira and Linear, `auto` means the integration is active for private repositories and disabled for public ones. See [PR validation and linked issues](/issues/pr-validation) for how CodeRabbit uses this context during reviews. See the [configuration reference](/reference/configuration#knowledge-base) for all available options.

## Global configuration

### Opt out of data retention

All context sources that learn from your repository — including learnings, issues, and PR context — require CodeRabbit to retain data about your organization's usage. To disable these features and remove any stored data, set `knowledge_base.opt_out` to `true`:

<Info>
  CodeRabbit never uses customer code for model training, whether data retention is enabled or disabled. Data retention only controls whether CodeRabbit stores knowledge base data on our side, such as learnings, issue context, and pull request context.
</Info>

```yaml .coderabbit.yaml theme={null}
knowledge_base:
  opt_out: true
```

<Warning>
  Setting `opt_out: true` immediately and irrevocably removes all stored knowledge base data, including learnings. Stateless sources like code guidelines and web search continue to work.
</Warning>

### Full configuration reference

For a complete list of `knowledge_base` options including scope values, file patterns, and integration keys, see the [Knowledge base section of the configuration reference](/reference/configuration#knowledge-base).


# Learnings
Source: https://docs.coderabbit.ai/knowledge-base/learnings

Teach CodeRabbit your review preferences using natural-language chat.

## About CodeRabbit learnings

As your team works with CodeRabbit, it learns your team's code-review preferences based on chat interactions, and adds these preferences to an internal database that it associates with your Git platform organization. We call these internal records *learnings*.

<img alt="CodeRabbit learnings interface" />

CodeRabbit learnings are flexible, natural-language statements about code-review preferences whose purpose can include the following:

* Special instructions about reviewing particular files.
* Guidance for reviewing all of the files of one repository.
* Code-review preferences that CodeRabbit must apply across all of your organization's repositories.

<iframe title="YouTube video player" />

Every time CodeRabbit prepares to add a comment to a pull request or issue, it loads the learnings that apply based on your [configured scope](#specify-the-scope-of-learnings). Depending on your settings, CodeRabbit applies either the repository's learnings only, or all of your organization's learnings. CodeRabbit uses these learnings as additional context or instructions for its comment.

Use learnings for incremental preferences that emerge during code reviews—preferences that don't require a formal configuration change but should be applied to future reviews. Use [review instructions](/configuration/path-instructions) or coding guidelines for formal, documented standards.

You can review and edit your organization's CodeRabbit learnings at any time, as detailed later in this page.

## Add learnings

### Adding a learning via comment

To add learnings to the database CodeRabbit keeps about your organization's preferences, communicate your preferences using natural language, in a comment attached to any pull request or issue.

If CodeRabbit decides to create one or more learnings based on a comment, then it makes this explicit in its response to that comment by adding a collapsible section titled **Learnings Added** to its own response comment.

Imagine a scenario where CodeRabbit has reviewed a GitHub-based pull request from your team that adds a feature to an authentication middleware library. CodeRabbit has flagged a certain file as needing improvement, attaching this comment to the relevant lines in its review:

> Consider using nested try-catch blocks here to handle different error scenarios more comprehensively.

If this critique disagrees with your team's coding practices specific to try-catch blocks, then you can reply to this CodeRabbit using a comment of your own, addressed to the `@coderabbitai` service account on GitHub:

> @coderabbitai Actually, we've found that nested try-catch blocks make our auth middleware harder to debug in production. We prefer early returns with specific error codes - it's cleaner and our monitoring tools can track them better.

CodeRabbit considers your reply, and decides to make a learning out of it. It acknowledges this in another reply:

> You're absolutely right about the debugging benefits. Early returns with specific error codes do provide better clarity and monitoring capabilities. I'll remember this preference for your authentication middleware. Thank you for the guidance!

CodeRabbit also adds a **Learnings added** section to this comment, making explicit the fact that this chat has modified its future behavior with your team.

CodeRabbit then creates a new learnings record for itself. Along with metadata such as the pull request number, filename, and GitHub user associated with the learning, CodeRabbit adds this self-instructive text to the new record:

> In authentication middleware, prefer returning early with specific error codes rather than nested try-catch blocks. This improves readability and makes error tracking easier in production environments.

If your organization requires approval before newly created chat-sourced learnings are applied, CodeRabbit creates a pending request instead of immediately adding the learning to the active learning set. Admins can approve or disapprove the request from the Learnings dashboard, and pending requests auto-approve after the configured delay unless an admin rejects them first. Existing learnings are not affected, and CodeRabbit-inferred learnings created automatically by the review pipeline continue to apply immediately.

### Add learnings from files

You can import content from any file in your repository as learnings. This is useful for converting existing team documentation into learnings that CodeRabbit will apply during reviews.

To import a file as learnings, mention the file in a pull request comment:

```md theme={null}
@coderabbitai add a learning using docs/coding-standards.md
```

CodeRabbit reads the file contents and creates corresponding learnings. This is useful when:

* Converting existing team documentation into CodeRabbit learnings
* Bulk-adding multiple preferences at once
* Importing learnings from an exported CSV file

<Note>
  If you have AI agent configuration files like `.cursorrules`, `CLAUDE.md`, or `.github/copilot-instructions.md`, use [code guidelines](/knowledge-base/code-guidelines) instead. CodeRabbit automatically detects and applies these files without manual import.
</Note>

### Credential redaction

When a learning is newly created during PR Review, imported, approved, or edited by an administrator, CodeRabbit replaces recognizable credentials with credential-type markers before storing the text and creating its vector embedding. Markers identify the credential type, for example, `***REDACTED_GITHUB_TOKEN***`, `***REDACTED_STRIPE_KEY***`, or `***REDACTED_URI_PASSWORD***`. For each connection URI, CodeRabbit removes only the password; the scheme, username, host, port, and path remain.

CodeRabbit later reuses the same redacted text in PR Review context and CSV exports. Ordinary guidance and code examples that discuss authentication without containing a high-confidence secret remain unchanged. Redaction occurs only at write time and does not backfill or clean previously stored learnings.

### Best practices for new learnings

When communicating with CodeRabbit during an active code review, follow these practices to create effective learnings:

#### Consider if it's a pattern or a one-off

Determine whether a correction represents a team-wide preference that should apply to all future reviews, or a situation specific to this pull request.

Not every correction should become a learning. For one-time exceptions, such as unusual temporary code patterns during a migration, resolve the comment without creating a learning. For systemic preferences that should persist across reviews, provide feedback that CodeRabbit can store as a learning.

#### Explain the why, not just the what

Don't just tell CodeRabbit what to do, explain the reasoning. The "why" helps CodeRabbit apply the learning correctly in similar-but-not-identical situations:

<CodeGroup>
  ```md Less effective theme={null}
  @coderabbitai Don't suggest adding user IDs to error messages.
  ```

  ```md More effective theme={null}
  @coderabbitai We intentionally keep user IDs out of error messages
  because they end up in logs that get shipped to third-party monitoring.
  We track user context separately via our tracing system instead.
  ```
</CodeGroup>

#### Reply to specific comments for maximum context

Prefer to reply directly to the comment on the specific line of code rather than leaving general comments on the PR. This gives CodeRabbit more context when considering feedback, allowing it to create more specific learnings.

A generic comment on the PR might produce a vague learning. Replying to a specific line produces a learning tied to that file pattern and context.

## View learnings

To view the learnings that CodeRabbit has associated with your organization, go to [app.coderabbit.ai/learnings](https://app.coderabbit.ai/learnings).

This opens the Learnings dashboard, which gives you an at-a-glance overview of your organization's learnings along with a sortable, filterable table. By default, the table is sorted by **Last used** descending.

<Frame>
  <img alt="CodeRabbit learnings dashboard" />
</Frame>

### KPI cards

At the top of the dashboard, four KPI (Key Performance Indicator) cards summarize the state of your learnings. Clicking a card filters and sorts the table to the relevant subset.

| Card                  | What it shows                                                          | Click behavior                                                              |
| --------------------- | ---------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| **Total Learnings**   | The total number of learnings stored for your organization.            | Shows all learnings, sorted by **Last Used** descending.                    |
| **Active**            | Learnings that have been used in a review within the last 30 days.     | Filters to active learnings only, sorted by **Last Used** descending.       |
| **Never Used**        | Learnings that have never been applied to a review (usage count of 0). | Filters to never-used learnings, sorted by **Created At** descending.       |
| **Created This Week** | Learnings created within the last 7 days.                              | Filters to recently created learnings, sorted by **Created At** descending. |

Use these cards to quickly identify which learnings are actively influencing reviews, which ones might be stale, and what your team has added recently.

### Table columns

The learnings table contains the following columns:

| Column         | Description                                                                                |
| -------------- | ------------------------------------------------------------------------------------------ |
| **Learning**   | The natural-language text of the learning (the description).                               |
| **Usage**      | The number of times CodeRabbit has applied this learning during reviews and chat sessions. |
| **Last Used**  | The date this learning was most recently applied to a review or chat session.              |
| **Created At** | The date this learning was created.                                                        |
| **Updated At** | The date this learning was last modified.                                                  |

### View learning details

Click any row in the table, or click the **Action** button on the row, to open a detailed view of that learning. The detail view displays the following fields:

| Field           | Description                                                                                                 |
| --------------- | ----------------------------------------------------------------------------------------------------------- |
| **Description** | The full text of the learning. Recognized credentials appear as [redaction markers](#credential-redaction). |
| **Usage**       | The number of times CodeRabbit has applied this learning during reviews and chat sessions.                  |
| **Created by**  | The username of the person whose comment created the learning.                                              |
| **Repository**  | The repository the learning is associated with.                                                             |
| **Created at**  | The date this learning was created.                                                                         |
| **Updated at**  | The date this learning was last modified.                                                                   |
| **Last used**   | The date this learning was most recently applied.                                                           |

From this view you can also edit the description or delete the learning.

### Review pending learnings

Organizations that require approval for newly created chat-sourced learnings have a **Pending approvals** tab on the Learnings dashboard. This tab lists new learnings waiting for review, including the requested learning text, source repository, source pull request when available, requester, request date, and auto-approval deadline. CodeRabbit applies [credential redaction](#credential-redaction) again before storing approved text.

Administrators can approve or disapprove pending learnings. You can act on a single pending learning or select multiple rows for bulk approval or disapproval.

### Sort learnings

You can sort the table by any column. Click a column header to sort by that column in ascending order, and click it again to switch to descending order. Sorting lets you quickly find your most-used learnings, your oldest learnings, or the ones most recently updated.

### Filter displayed learnings

Over time, the learnings that CodeRabbit gathers for your organization can become quite numerous. This can make manually browsing the full list difficult. The CodeRabbit web interface has search and filtering tools to help you find specific learnings, based on the topic of the learning text, or on other metadata.

To filter the displayed learnings by topic or concept, enter that topic or concept into the **Search learnings** field. Because this is a vector-based similarity search, the returned learnings don't necessarily contain the exact text of your search terms.

For example, to see the top learnings that have to do with error reporting, enter `error reporting` into **Search learnings**. This will find learnings about exceptions, try-catch, error codes, and other semantically related topics.

To filter the displayed learnings by repository, file path, or user, click the **Filters** button at the top right of the table and select additional criteria. Your repositories, file paths, and users will automatically populate as tags when you search the values.

### Edit or delete learnings

You can edit and delete learnings in two ways:

**Via the web interface**: If your account has the **Admin** [CodeRabbit role](/management/roles) with your organization, then you can edit the text of any stored learning or delete it through the CodeRabbit dashboard. When you save an edit, CodeRabbit applies [credential redaction](#credential-redaction) again before storing the updated text.

To edit or delete a learning via the web interface:

1. Click the **Action** button on the learning's row in the table, which resembles a right arrow.

2. Edit the **Description** to edit the learning, or press **Delete** to delete it.

**Via CodeRabbit comments**: Any user can request learning modifications through natural language comments in pull requests or issues. Ask CodeRabbit to remove or modify specific learnings by mentioning `@coderabbitai` and describing the change you want.

## Export and transfer learnings

You can export your organization's learnings and import them into another CodeRabbit account. This is useful when migrating accounts or consolidating organizations.

### Export learnings

To export your learnings:

1. Visit [the CodeRabbit web interface](https://app.coderabbit.ai).
2. Navigate to **Learnings** in the sidebar.
3. Click the export option to download your learnings as a CSV file.

The CSV file contains all your learnings with their associated metadata, including the repository, file path, usage count, last date edited, last date used, date created, and learning text. Exported learning text reflects any applied [redaction markers](#credential-redaction) rather than the original secrets.

### Import learnings to a new account

To import learnings into a new CodeRabbit account:

1. Ensure the new account is connected to your repository and has an active CodeRabbit subscription.

2. Add the exported learnings CSV file to a branch in your repository.

3. Create a pull request from that branch.

4. Use CodeRabbit chat to request the import:

```md theme={null}
@coderabbitai import file my_learnings.csv as Learnings data for future use
```

CodeRabbit will process the CSV file and import your previous learnings into the new environment.

## Configure learnings storage and application

CodeRabbit has several configuration options that modify the storage and application of learnings.

### Opt out of learnings storage

CodeRabbit enables learnings by default. To disable learnings, enable [the *Opt out* setting](/reference/configuration#knowledge-base), which disables all CodeRabbit [knowledge base](/knowledge-base) features for your organization or repository, including learnings.

<Info>
  On self-hosted CodeRabbit, you can also disable all features that require long-term data retention by setting `knowledge_base.opt_out` to `true`. See [Opt out of data retention](/knowledge-base#opt-out-of-data-retention).
</Info>

### Specify the scope of learnings

[The Learnings configuration setting](/reference/configuration#knowledge-base) lets you specify the *scope* that CodeRabbit applies to all of the learnings it has collected about your organization. You can set this option to one of the following values:

* **`auto`** *(default)*: When reviewing a public repository, CodeRabbit applies only the learnings specific to that repository. When reviewing a private repository, CodeRabbit applies all of your organization's learnings. This is the default setting.
* **`global`**: CodeRabbit applies all of your organization's learnings to all code reviews.
* **`local`**: CodeRabbit applies only learnings associated with code reviews' respective repositories.

### Require approval before applying learnings

Use `knowledge_base.learnings.approval_delay` to control whether newly created chat-sourced learnings apply immediately or wait for admin review. This setting is available on all pricing plans and can be configured at the organization or repository level. The value is an integer from `0` to `30`, measured in days.

<Tabs>
  <Tab title="Using configuration file">
    ```yaml .coderabbit.yaml theme={null}
    knowledge_base:
      learnings:
        approval_delay: 7
    ```
  </Tab>

  <Tab title="Using Web Interface">
    Navigate to your repository or organization **Settings**, then **Knowledge Base** → **Learnings** and configure the **Approval delay** field.
  </Tab>
</Tabs>

* `0` applies newly created chat-sourced learnings immediately. **This is the default**.
* `1` through `30` creates pending requests for newly created chat-sourced learnings and auto-approves each request after that many days unless an admin disapproves it first. Existing learnings are not affected, and CodeRabbit-inferred learnings still apply immediately.

Use a delay when your organization wants admins to review learned preferences before they affect future reviews. Keep the value at `0` when you want CodeRabbit to learn from chat feedback without an approval step.

### When to use each scope

The default `auto` scope can be suboptimal for organizations with diverse repositories. Consider these scenarios:

<AccordionGroup>
  <Accordion title="Use 'local' for diverse tech stacks">
    If your organization has repositories with different conventions—such as a
    Python backend and a React frontend—use `local` scope to prevent
    cross-contamination of learnings. Without `local` scope, learnings about
    Python exception handling might incorrectly influence React component
    reviews, or vice versa.

    ```yaml .coderabbit.yaml theme={null}
    knowledge_base:
      learnings:
        scope: "local"
    ```
  </Accordion>

  <Accordion title="Use 'global' for consistent org-wide standards">
    If your organization maintains consistent coding standards across all
    repositories—such as security practices, documentation requirements, or naming
    conventions—use `global` scope to apply learnings universally.

    ```yaml .coderabbit.yaml theme={null}
    knowledge_base:
      learnings:
        scope: "global"
    ```
  </Accordion>

  <Accordion title="Use 'auto' for mixed visibility">
    The `auto` setting works well when you have both public and private
    repositories, and you want to:

    * Keep public repository learnings isolated
    * Share learnings across private repositories

    This is the default behavior and requires no configuration.
  </Accordion>
</AccordionGroup>

## Troubleshooting

### Learnings appear to not be working

If CodeRabbit seems to ignore your learnings—for example, continuing to make suggestions that contradict existing learnings—try this workaround:

1. **Review existing learnings.** Go to your project's Learnings page and verify that all relevant learnings are active and clearly phrased.

2. Consider possible conflicts with path instructions or coding guidelines. Path instructions precede learnings.

3. **Add a reinforcement rule.** Introduce a new rule that explicitly tells the model to stop and reconsider the Learnings before continuing the review. For example:

   ```
   “Before responding, review all Learnings to ensure none are ignored.”
   ```

4. **Save and re-test.** Commit this change and observe the next few automated reviews. CodeRabbit should now respect the learnings more consistently.

This situation can occur when the model deprioritizes certain learnings due to contextual overlap or conflicting instructions. The reinforcement rule prompts the model to stop and reassess learnings before proceeding.

### Maintaining learnings over time

Team conventions evolve, and learnings can become stale. To maintain learnings effectively:

* **Quarterly review.** Set a reminder to review your learnings every quarter. Look for learnings that reference deprecated patterns, old file structures, or outdated team decisions.
* **Delete contradictory learnings.** If you find learnings that conflict with current practices, delete them to avoid confusing CodeRabbit.
* **Update rather than accumulate.** When team standards change, update or delete old learnings rather than adding new ones that contradict them. Multiple conflicting learnings on the same topic can produce inconsistent behavior.

To identify outdated learnings:

1. Use the similarity search to find learnings about areas where your practices have changed.
2. Filter by creation date to find the oldest learnings.
3. Review learnings from team members who are no longer active.

## What's next

<CardGroup>
  <Card title="Review instructions" href="/configuration/path-instructions" icon="file-text">
    Add path-based rules to tell CodeRabbit exactly how to review specific files and directories
  </Card>

  <Card title="Code guidelines" href="/knowledge-base/code-guidelines" icon="book">
    Let CodeRabbit automatically detect and apply your existing coding standards from files like CLAUDE.md and .cursorrules
  </Card>

  <Card title="Multi-repo analysis" href="/knowledge-base/multi-repo-analysis" icon="git-branch">
    Link related repositories so CodeRabbit can spot breaking changes and API mismatches across repo boundaries
  </Card>
</CardGroup>


# MCP Servers
Source: https://docs.coderabbit.ai/knowledge-base/mcp-context

Use MCP servers as a knowledge source to give CodeRabbit additional context from your documentation systems, design tools, and project management platforms during reviews and chat.

<AllPlatformsBadge /> | <ProPlanBadge /> <ProPlusPlanBadge />

MCP (Model Context Protocol) servers are a knowledge source that CodeRabbit can query during reviews and chat. By connecting MCP servers to CodeRabbit, you give it access to context from your external tools — such as documentation systems, design files, and project management platforms — so that review comments and chat responses reflect your organization's full context.

<Info>
  The number of MCP server connections depends on your plan: **Pro** supports up to 5 MCP servers, **Pro+** supports up to 15, and **Enterprise** supports up to 20.
</Info>

## What MCP servers add to reviews

When MCP servers are connected, CodeRabbit can draw on external context beyond the code itself. Supported integrations include:

* **Documentation and knowledge bases** — Internal docs, wikis, and reference material
* **Project management tools** — Issues, tickets, and project specs
* **Design tools** — Figma designs and related design assets
* **Any tool with an MCP server** — If a tool publishes an MCP server, CodeRabbit can connect to it without waiting for a formal integration

This makes review comments more relevant to your team's standards and project context.

## How CodeRabbit uses MCP during analysis

CodeRabbit acts as the MCP **client** — it ingests data from your connected MCP servers, not the other way around. During a code review or chat interaction, CodeRabbit:

<CardGroup>
  <Card title="Gathers context">
    Automatically calls relevant MCP tools to collect additional review context from your connected data sources
  </Card>

  <Card title="Enhances comments">
    Validates and enriches suggested review comments with the information retrieved
  </Card>

  <Card title="Supports chat">
    Accesses your organization's knowledge bases and documentation when responding to PR chat questions
  </Card>

  <Card title="Stays transparent">
    Lists the tools it used under **"Additional context used"** in the review walkthrough
  </Card>
</CardGroup>

CodeRabbit searches your connected MCP tools automatically, but some tools organize their resources in ways that are hard to discover without a hint—for example, Jenkins Organization Folders or SonarQube projects with custom key formats. In those cases, add **Usage guidance** with URL patterns such as `{repo}` or `{pr}` to tell CodeRabbit where to look for each pull request. See [User guidance](/integrations/mcp-servers#user-guidance) for the full reference and examples.

## Examples of MCP server types

Based on the integrations described in the CodeRabbit documentation, common categories of MCP servers you can connect include:

| Category              | Examples                                         |
| --------------------- | ------------------------------------------------ |
| Documentation systems | Internal wikis, Confluence spaces, Context7      |
| Design tools          | Figma files and design assets                    |
| Project management    | Issue trackers, project boards                   |
| Knowledge bases       | Team knowledge bases and reference documentation |

<Info>
  This approach unlocks integrations without waiting for formal CodeRabbit support. If a tool has an MCP server, CodeRabbit can connect to it.
</Info>

## Configuration

<Info>
  MCP servers must be added through the CodeRabbit web interface before they can be used. Open [Integrations](https://app.coderabbit.ai/integrations) and click **Add** (for preconfigured) or **new MCP server** (for a custom server). For the suggested servers, preset behavior, and full setup instructions, see [Integrate MCP servers](/integrations/mcp-servers).
</Info>

Once an MCP server is connected, control its usage with the `knowledge_base.mcp` section of your [`.coderabbit.yaml`](/getting-started/yaml-configuration) file:

```yaml .coderabbit.yaml theme={null}
knowledge_base:
  mcp:
    usage: auto
    disabled_servers:
      - my-disabled-server
```

* The `usage` field (`auto` | `enabled` | `disabled`) controls whether MCP servers are used as a knowledge source. `auto` disables MCP for public repositories. Use `enabled` to activate for all repositories, or `disabled` to turn off entirely.
* The `disabled_servers` field allows you to selectively disable specific servers by name.

For instructions on connecting and configuring MCP servers in the CodeRabbit app, see [Integrate MCP servers](/integrations/mcp-servers).

## What's next

<CardGroup>
  <Card title="Set up MCP servers" icon="plug" href="/integrations/mcp-servers">
    Connect and configure MCP servers in the CodeRabbit app
  </Card>

  <Card title="Knowledge base overview" icon="brain" href="/knowledge-base">
    Learn about all knowledge sources available to CodeRabbit
  </Card>

  <Card title="Web search" icon="globe" href="/knowledge-base/web-search">
    Use web search as an additional knowledge source
  </Card>
</CardGroup>


# Multi-Repo Analysis
Source: https://docs.coderabbit.ai/knowledge-base/multi-repo-analysis

Link related repositories so CodeRabbit can detect breaking changes, API mismatches, and dependency issues that cross repository boundaries during code review.

<AllPlatformsBadge /> | <ProPlanBadge /> <ProPlusPlanBadge /> <EnterprisePlanBadge />

Many projects are built from multiple interdependent subprojects, for example: a backend service, a frontend app, a mobile client — that share APIs, type definitions, or database schemas. When they're in separate repositories, a change in one can silently break another. To enable CodeRabbit to detect these cross-repository impacts during code review, configure linked repositories for the repositories that depend on each other or enable automatic repository linking when it is available for your organization.

<Info>
  The number of linked repositories you can configure depends on your plan. Automatic repository linking is available only on paid Pro+ plans and Enterprise plans. See [Plans and pricing](/management/plans#linked-repositories) for details.
</Info>

## Use cases

Multi-repo analysis is most valuable when your codebase is split across several repositories that share contracts or dependencies:

* **API contracts** — When a backend API changes, frontend or mobile repositories may need coordinated updates.
* **Microservices architectures** — A change to a service's REST API may break consumers in other repositories.
* **Shared libraries** — Modifications to a shared utility or type definition can have ripple effects across multiple repositories.
* **Database schemas** — Schema changes can affect all services that query the same data model.

## How it works during reviews

When you submit a pull request, CodeRabbit inspects the changes and determines whether they may affect the linked repositories. If the research agent finds relevant cross-repository impact, it includes those findings in the review. If the changes are self-contained and have no cross-repo effect, the agent does not produce findings (this is expected behavior and does not indicate a misconfiguration).

By default, CodeRabbit compares your changes against each linked repository's default branch. When the change you depend on hasn't merged yet, you can [point CodeRabbit at a specific branch or pull request](#specifying-a-branch-or-pull-request-to-review-against) of a linked repository instead.

## Where findings appear

Cross-repository findings appear in the PR <Hint type="walkthrough" /> under **Review details** > **Additional context used**, grouped by linked repository name. When automatic repository linking contributes repositories, the **Review info** section also lists the repositories CodeRabbit considered and labels each one as `manual` or `auto-detected`. Findings also surface in inline review comments and comment replies when relevant.

When CodeRabbit reviews a linked repository against a specific branch or pull request rather than its default branch, the **Review info** section notes which ref was used — for example, *reviewed against open PR #123 `feat/orders-v2` instead of the default branch* (references on GitLab are labeled as merge requests). Repositories reviewed against their default branch are listed without an annotation. See [Specifying a branch or pull request to review against](#specifying-a-branch-or-pull-request-to-review-against).

To see the **Review details** section, enable [`review_details`](/reference/configuration) in your configuration:

```yaml .coderabbit.yaml theme={null}
reviews:
  review_details: true
```

## Setting it up

Linked repositories are configured through the CodeRabbit web interface or via your `.coderabbit.yaml` file. In most cases, you want to configure links at the **repository level**, configuring linked repositories at the organization level applies the same linked repository to *every* repository in your organization, which is rarely what you want. If you need to share a default linked repository across repos while still allowing per-repo overrides, see [configuration inheritance](/configuration/configuration-inheritance).

For larger or fast-changing dependencies, [Automatic repository linking](#automatic-repository-linking) lets CodeRabbit discover and maintain the list for you.

<Tabs>
  <Tab title="YAML Configuration">
    Add a `linked_repositories` section under `knowledge_base` in your `.coderabbit.yaml` file inside the repository you want to configure (for example, your frontend repo):

    ```yaml .coderabbit.yaml theme={null}
    knowledge_base:
      linked_repositories:
        - repository: "myorg/backend-api"
          instructions: "Contains REST API endpoints and database models"
    ```
  </Tab>

  <Tab title="Web Interface">
    <Steps>
      <Step title="Open the repository's Knowledge Base settings">
        In the [CodeRabbit app](https://app.coderabbit.ai), navigate to the specific repository you want to configure (for example, your frontend repo), then go to **Knowledge Base** > **Linked Repositories**.
      </Step>

      <Step title="Add a linked repository">
        Click **Add** and enter the repository path in the format used by your platform:
        `org/repo` for GitHub and Bitbucket, `project/repo` for Azure DevOps, or
        `group/subgroup/repo` for GitLab.
      </Step>

      <Step title="Add a description (optional)">
        Optionally provide a description and guidance on what this repository contains so CodeRabbit knows where to focus its search. For example: *"Contains REST API endpoints and database models."*
      </Step>
    </Steps>
  </Tab>
</Tabs>

### Configuration fields

| Field                          | Required | Description                                                                                                                                                                                                                                                               |
| ------------------------------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `automatic_repository_linking` | No       | Enables CodeRabbit to [automatically detect](#automatic-repository-linking) related repositories for review context. Requires a paid Pro+ plan or an Enterprise plan. On other plans, setting this field to `true` in `.coderabbit.yaml` is ignored. Defaults to `false`. |
| `repository`                   | Yes      | Repository in `org/repo` format (GitHub and Bitbucket), `project/repo` format (Azure DevOps), or `group/subgroup/repo` format (GitLab)                                                                                                                                    |
| `instructions`                 | No       | Description and guidance on what the repository contains (max 2,000 characters)                                                                                                                                                                                           |

## Automatic repository linking

<ProPlusPlanBadge />

<EnterprisePlanBadge />

Instead of maintaining a list of related repositories by hand, you can let CodeRabbit discover and link them automatically. When enabled, CodeRabbit scans your organization's repositories and infers relationships by examining import statements, dependency manifests, API consumption, and broader architectural patterns, then describes each relationship so the review agent can reason about cross-repository impact.

Detection runs progressively after you enable the feature. CodeRabbit discovers relationships over time as it reviews more pull requests, so the set of automatically linked repositories grows gradually rather than appearing all at once. Reviews opened immediately after enabling may not yet include automatically discovered repositories.

Automatically linked repositories supplement your manually configured ones. Manually linked repositories are always preserved; auto-detected links fill any remaining slots.

<Info>
  Automatic repository linking is available only on paid Pro+ plans and Enterprise plans. It counts toward your plan's [linked-repository limit](#plan-limits). CodeRabbit will not link more repositories than your plan allows.
</Info>

<Tabs>
  <Tab title="YAML Configuration">
    Set `automatic_repository_linking` under `knowledge_base` in the repository's `.coderabbit.yaml`:

    ```yaml .coderabbit.yaml theme={null}
    knowledge_base:
      automatic_repository_linking: true
    ```
  </Tab>

  <Tab title="Web Interface">
    <Steps>
      <Step title="Open the repository's Knowledge Base settings">
        In the [CodeRabbit app](https://app.coderabbit.ai), navigate to the repository, then open **Knowledge Base** settings.
      </Step>

      <Step title="Enable automatic repository linking">
        Turn on **Automatic repository linking**. CodeRabbit discovers and links related repositories for you, in addition to any you have configured manually.
      </Step>
    </Steps>
  </Tab>
</Tabs>

### Viewing automatically linked repositories

After you enable automatic repository linking, CodeRabbit surfaces what it has detected in the **Auto-linked repositories** tab, under a repository's **Knowledge Base** settings. The tab is read-only and scoped to a single repository: it lists the repositories CodeRabbit links during reviews of the repository you are viewing, so open a specific repository's settings to see its list.

<Info>
  You can only view this list after automatic repository linking is enabled. The editable **Automatic repository linking** toggle lives in the **Knowledge Base** settings tab; while it is off, the **Auto-linked repositories** tab points you back there to turn it on instead of showing a list. Because detection runs progressively, the tab is also empty right after you enable the feature and fills in as CodeRabbit reviews more pull requests.
</Info>

From the tab you can:

* **Search and sort by repository name** to locate a repository in a long list.
* **Filter by status** — Enabled or Disabled. The tab shows only enabled repositories by default; add **Disabled** to the status filter (or clear the filter) to see repositories you have turned off.
* **Open a repository's details** by selecting its row. A read-only drawer shows the repository's status and the instructions CodeRabbit detected for it.

Automatically linked repositories also appear in the pull request review comment under **Review info**, where each repository is labeled `auto-detected`.

### Disabling an automatically linked repository

Automatic linking is best-effort discovery, so CodeRabbit may link a repository you would rather keep out of reviews. You can turn off an individual repository without disabling automatic linking for the whole repository:

<Steps>
  <Step title="Open the Auto-linked repositories tab">
    In the repository's settings, go to **Knowledge Base** > **Auto-linked repositories**.
  </Step>

  <Step title="Select the repository">
    Click the repository's row to open its detail drawer.
  </Step>

  <Step title="Disable or re-enable it">
    Choose **Disable** to exclude the repository from reviews, or **Enable** to include it again.
  </Step>
</Steps>

When you disable an automatically linked repository:

* **It is excluded from reviews entirely.** CodeRabbit no longer researches or references it, and it no longer appears in the **Review info** list.
* **It is marked Disabled and greyed out** in the tab, and hidden by the default status filter.
* **It frees a slot against your [plan limit](#plan-limits).** A disabled repository no longer counts toward your linked-repository limit, so CodeRabbit can link another repository it discovers in its place.
* **Your choice persists.** CodeRabbit keeps the repository disabled even if it rediscovers it during a later review. Re-enable it from the same drawer whenever you want it back.

## Specifying a branch or pull request to review against

<GitHubBadge />

<GitLabBadge />

By default, CodeRabbit reviews your pull request against the **default branch** of each linked repository. When the change you depend on lives on a feature branch or in an open pull request that hasn't merged yet, you can tell CodeRabbit which ref of a linked repository to review against by referencing it in the pull request description.

This is useful for coordinated changes across repositories — for example, a frontend pull request that depends on a backend API change that hasn't merged yet. Pointing CodeRabbit at the companion branch or pull request lets it review against the code that will ship together, instead of a default branch that doesn't contain those changes yet.

<Info>
  A reference only takes effect when the repository is **already linked**, either [manually](#setting-it-up) or through [automatic repository linking](#automatic-repository-linking). Referencing a repository that is not linked has no effect and does not add it to the linked set.
</Info>

### Supported reference formats

Add any of the following to the pull request description. CodeRabbit resolves the reference directly against the platform, independent of the referenced pull request's age or author.

| What you reference                     | GitHub                                           | GitLab                                                        |
| -------------------------------------- | ------------------------------------------------ | ------------------------------------------------------------- |
| Pull request / merge request by number | `owner/repo#123`                                 | `group/subgroup/repo#123`                                     |
| Pull request / merge request by URL    | `https://github.com/owner/repo/pull/123`         | `https://gitlab.com/group/subgroup/repo/-/merge_requests/123` |
| Branch by URL                          | `https://github.com/owner/repo/tree/branch-name` | `https://gitlab.com/group/subgroup/repo/-/tree/branch-name`   |
| Branch by name                         | `owner/repo@branch-name`                         | `group/subgroup/repo@branch-name`                             |

### How references are resolved

* **The repository must already be linked.** References to repositories that are not linked are ignored and do not expand the linked set.
* **GitHub and GitLab only.** Manual reference selection is not available on Bitbucket, Azure DevOps, or other platforms.
* **Read access is required.** The CodeRabbit bot must be able to read the referenced repository, which is the same access required to link it.
* **Referenced pull requests must be open.** A closed, merged, or nonexistent pull request reference is ignored, and CodeRabbit falls back to the default branch.

### Automatic same-branch matching

If you don't reference anything explicitly, CodeRabbit still checks whether a linked repository has a branch whose name matches your pull request's head (source) branch. When it finds one, CodeRabbit reviews against that branch — preferring an open pull request on the branch, otherwise the branch itself — so identically named branches across repositories are picked up automatically with no description needed.

An explicit reference always takes precedence over automatic same-branch matching.

<Info>
  The branch or pull request CodeRabbit selects for each linked repository appears in the **Review info** section of the review summary. See [Where findings appear](#where-findings-appear).
</Info>

## Platform requirements

The CodeRabbit bot must have read access to all linked repositories.

**Same platform only**: All linked repositories must be on the same platform as the pull request under review. You cannot link a GitHub repository to a GitLab repository, because access tokens are platform-specific.

| Platform                  | Requirement                                                                                                                                                 |
| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **GitHub**                | The CodeRabbit GitHub App must be installed on all linked repositories. Inaccessible repositories are skipped, and a warning appears in the review summary. |
| **GitLab**                | The bot token must have read access. Tokens are typically scoped to the group or instance.                                                                  |
| **Bitbucket Cloud**       | The bot token must have read access. Tokens are scoped to the workspace.                                                                                    |
| **Bitbucket Data Center** | The HTTP access token must have read access. Tokens are scoped to the project or repository.                                                                |
| **Azure DevOps**          | The PAT must have read access. Tokens are scoped to the organization.                                                                                       |

<Info>
  On GitHub, linked repositories can span multiple organizations as long as the CodeRabbit GitHub App is installed in each organization. Other platforms scope access tokens to the group, workspace, or organization.
</Info>

## Configuration inheritance

When [configuration inheritance](/configuration/configuration-inheritance) is enabled, organization-level and repository-level `linked_repositories` settings are merged. Repository-level entries take priority: if both levels define the same repository, the repository-level instructions are used.

After merging, the list is truncated to your plan's limit, with repository-level entries preserved. If automatic repository linking is enabled, auto-detected links fill only the remaining slots after manual organization-level and repository-level entries are merged and deduplicated. If any repositories are dropped during this process, a warning appears in the review summary showing which repositories were kept and which were skipped.

## Plan limits

The number of linked repositories you can activate depends on your plan. See [Plans and pricing](/management/plans#linked-repositories) for current limits.

Both manually configured and auto-detected repositories count toward the limit. Manual entries are always filled first; auto-detected repositories use whatever slots remain. [Disabled](#disabling-an-automatically-linked-repository) automatically linked repositories are the exception: they no longer count toward the limit, so disabling one frees a slot for another repository CodeRabbit discovers.

If your `.coderabbit.yaml` defines more linked repositories than your plan allows:

* **Your configuration is preserved.** CodeRabbit does not delete or reject entries that exceed your plan's limit.
* **Only the first N items are active.** CodeRabbit evaluates entries in the order they appear in your configuration, up to your plan's limit. Entries beyond the limit are ignored during reviews.
* **Upgrade to restore full access.** Moving to a higher plan immediately activates all configured entries up to the new limit.

## Troubleshooting

If cross-repository context is not appearing in reviews, work through these checks in order:

<AccordionGroup>
  <Accordion title="Linked repositories not configured?">
    Check your `.coderabbit.yaml` or the **Settings** UI for a `linked_repositories` section, or enable `knowledge_base.automatic_repository_linking` if automatic linking is available for your organization. Multi-repo analysis is not enabled by default.
  </Accordion>

  <Accordion title="Auto-detected repository missing?">
    Manual linked repositories consume plan slots first. If you expected an auto-detected repository to appear, confirm that `automatic_repository_linking` is enabled, the repository is not disabled in the **Auto-linked repositories** tab, the bot can read the related repository, and your plan has an available linked-repository slot after manual links are applied.
  </Accordion>

  <Accordion title="Automatic repository linking setting ignored?">
    Automatic repository linking requires a paid Pro+ plan or an Enterprise plan. If your organization is on any other plan, CodeRabbit does not enable automatic repository linking from the app and ignores `knowledge_base.automatic_repository_linking: true` in `.coderabbit.yaml`.
  </Accordion>

  <Accordion title="Linked repository is the same as the current repo?">
    Multi-repo analysis filters out the repository currently being reviewed. Make sure you have linked a *different* repository.
  </Accordion>

  <Accordion title="Bot does not have access?">
    On GitHub, the CodeRabbit App must be installed on the linked repository. On other platforms, the bot token must have read access. If a linked repository is inaccessible, a warning appears in the review summary identifying the repository and the specific error.
  </Accordion>

  <Accordion title="Pull request has no cross-repo impact?">
    If the changes in the pull request are self-contained, the research agent will not produce cross-repository findings. This is expected — the absence of findings does not mean the feature is broken.
  </Accordion>
</AccordionGroup>

## What's next

<CardGroup>
  <Card title="Knowledge Base overview" href="/knowledge-base" icon="book">
    Return to the Knowledge Base overview for all adaptive review features
  </Card>

  <Card title="CodeRabbit Learnings" href="/knowledge-base/learnings" icon="brain">
    Use learnings to train CodeRabbit on your team's specific preferences
  </Card>

  <Card title="Model Context Protocol" href="/knowledge-base/mcp-context" icon="plug">
    Extend CodeRabbit's understanding with external tools via the MCP
  </Card>
</CardGroup>


# Web Search
Source: https://docs.coderabbit.ai/knowledge-base/web-search

How CodeRabbit uses web search to gather additional context during code reviews and chat responses.

CodeRabbit can perform web queries during reviews and chat to fetch the latest
documentation and external content, improving the accuracy and relevance of its
output. Web search is enabled by default for all users.

## How it works

When reviewing a pull request or responding in chat, CodeRabbit may perform web
queries to include publicly available information — such as current
documentation — that may not have been included in the underlying AI model's
training data.

You can see when web search was used by checking the **Review details** section
in the walkthrough summary comment (requires
[`review_details: true`](/reference/configuration#reviews) in your
configuration).

## Configuration

Control web search with the `knowledge_base.web_search` setting in your
`.coderabbit.yaml` file.

```yaml theme={null}
knowledge_base:
  web_search:
    enabled: true  # default
```

| Field                               | Type    | Default | Description                                  |
| ----------------------------------- | ------- | ------- | -------------------------------------------- |
| `knowledge_base.web_search.enabled` | boolean | `true`  | Use web search to gather additional context. |

## Disabling web search

You may want to disable web search in situations such as:

* **Air-gapped or restricted environments** — where outbound network access
  from the review process is not permitted.
* **Policy requirements** — where your organization restricts use of external
  data sources during code review.

To disable, set `enabled` to `false`:

```yaml theme={null}
knowledge_base:
  web_search:
    enabled: false
```

<Info>
  If you want CodeRabbit to have access to the latest documentation or other up-to-date information, but don't want to grant full web search access, consider connecting [MCP Servers](/knowledge-base/mcp-context) instead.
</Info>

## What's next

<CardGroup>
  <Card title="Knowledge Base" icon="brain" href="/knowledge-base">
    Overview of all knowledge base features
  </Card>

  <Card title="MCP Context" icon="plug" href="/knowledge-base/mcp-context">
    Add external tool integrations as context sources
  </Card>

  <Card title="Configuration Reference" icon="book" href="/reference/configuration#knowledge-base">
    Full reference for knowledge base settings
  </Card>
</CardGroup>


# Add organizations
Source: https://docs.coderabbit.ai/management/adding-organizations

Learn how to add new organizations to CodeRabbit and grant the necessary permissions to enable code review across your organization's repositories.

Adding organizations to CodeRabbit allows you to extend code review capabilities across repositories within your organization. You can start this flow from the organization switcher when you add an organization, or when you select an organization that does not have repositories connected yet.

## How to add organizations

Follow these steps to add a new organization to your CodeRabbit account:

<Steps>
  <Step title="Navigate to change organization">
    Go to [app.coderabbit.ai](https://app.coderabbit.ai) and ensure you're
    logged in to your account.
  </Step>

  <Step title="Refresh organization list">
    Click the **Refresh** button next to your organizations list to check for
    new organizations that you have access to. <img alt="Checking for new
    organizations" />

    If a newly added organization or its repositories do not appear immediately after you return from GitHub, use **Refresh organization list** again or retry the add flow. CodeRabbit preserves your place while setup is active. If setup is not completed promptly (about 30 minutes), restart **Add organization**.
  </Step>

  <Step title="Select organization">
    Find the organization you want to add in the list of available
    organizations.
  </Step>

  <Step title="Grant permissions">
    Click the **Grant** button next to the organization name to authorize
    CodeRabbit access. <img alt="Granting permission to
    organization" />
  </Step>

  <Step title="Complete GitHub setup">
    After granting CodeRabbit organization access, continue through the GitHub setup steps that CodeRabbit opens for the organization:

    1. **Grant GitHub bot access** - Authorize CodeRabbit bot access on GitHub. This permission enables CodeRabbit write actions, such as opening pull requests or posting commit statuses, when a workflow requires them.
    2. **Select repositories** - Choose which repositories CodeRabbit can access from the GitHub App repository-selection page.
  </Step>
</Steps>

## What permissions does CodeRabbit need?

When you grant CodeRabbit access to an organization, it receives the following permissions:

* **Read organization and team membership** - To understand your team structure
* **Read organization projects** - To access repositories for code review
* **Access user email addresses (read-only)** - For notifications and user identification

<Info>
  Organizations control which applications are allowed to access their private data. You may need organization admin approval to complete this process.

  If you don't see the **Grant** button, contact your organization administrator to approve CodeRabbit's application request. An organization's IP allow list can also block access; see [GitHub troubleshooting](/platforms/github-com#troubleshooting).
</Info>

After the organization is added, manage which repositories CodeRabbit can access from [Repository settings](/guides/repository-settings).

## What's next

Once you've successfully added your organization, you can:

* [Configure CodeRabbit](/getting-started/yaml-configuration) for your organization's specific needs
* [Manage your subscription](/management/subscription-management) to ensure adequate seats for your team
* [Set up repository-specific settings](/guides/repository-settings) for fine-tuned control


# Audit Logs
Source: https://docs.coderabbit.ai/management/audit-logs

Track and review administrative actions across your organization with a tamper-resistant audit log.

<EnterprisePlanBadge />

<AdminRoleBadge />

The Audit Logs give Enterprise organizations a searchable record of administrative actions taken across workspace settings, billing controls, seat management, and more. Use them to answer "who changed what, and when?" whether you're investigating an incident, satisfying a compliance review, or just keeping an eye on operational changes.

## Accessing Audit Logs

### Settings UI

Open the [CodeRabbit dashboard](https://app.coderabbit.ai) and navigate to **Settings → Audit Logs**. The page is visible to users with an admin role on the Enterprise plan.

The log table shows four columns:

| Column               | Description                                                                                        |
| -------------------- | -------------------------------------------------------------------------------------------------- |
| **User**             | The actor who performed the action, with their role (Admin, Member, Billing Admin, Bot, or System) |
| **Action**           | What happened, e.g. "Added repository" or "Created API key"                                        |
| **Resource Summary** | A short description of the specific resource affected                                              |
| **Recency / Time**   | Relative and absolute timestamp of when the action occurred                                        |

#### Searching and filtering

Use the search bar to find entries by actor name. Narrow results further using the filter controls:

* **Action** — select one or more event types
* **Resource type** — select one or more resource categories
* **Date range** — set an inclusive start and end date/time

All filters can be combined. Filter counts refresh automatically so repeat investigations stay fast.

### REST API

The same data is available programmatically. This is useful for exporting entries to a SIEM, building custom compliance reports, or integrating audit data into internal tooling.

See the [Audit Logs API reference](/api-reference/audit-logs) for the complete parameter list, response schema, and code samples.

## What is logged

The Audit Logs capture high-signal administrative changes across your workspace:

| Resource        | Events tracked                                                                                                     |
| --------------- | ------------------------------------------------------------------------------------------------------------------ |
| Organization    | Creation and deletion, including organization creation during Enterprise SSO workspace onboarding and attach flows |
| Repositories    | Adding and removing repositories, including provider sync and Slack install paths                                  |
| Subscription    | Subscription creation, updates, and cancellation                                                                   |
| Seat management | Organization and workspace seat assignments and removals                                                           |
| Configuration   | Organization-wide, repository-level, and workspace-level config changes                                            |
| User roles      | Workspace role changes and organization-scoped role changes                                                        |
| API keys        | API key creation and deletion                                                                                      |

<Info>
  Coverage expands as more admin flows are instrumented. Events are logged when the action is instrumented, so historical coverage before a given release date may be incomplete.
</Info>

## Common use cases

**Security review** — Search for a specific user to see all actions they have taken. Filter by `api_key_create` or `api_key_delete` to audit API key lifecycle. Use the date range filter to focus on a specific incident window.

**Access management audit** — Filter on seat assignment and role change events to review who was granted or removed access, and by which admin.

**Configuration change investigation** — Filter on configuration events to identify when a setting was changed and who changed it.

**Compliance reporting** — Export entries for a date range via the API to demonstrate administrative controls and a clear chain of custody.

## What's next

<CardGroup>
  <Card title="Audit Logs API reference" href="/api-reference/audit-logs" icon="book">
    Full parameter reference, response schema, and interactive playground for the `audit-logs` endpoint
  </Card>

  <Card title="Role-based access" href="/management/roles" icon="shield">
    Learn about Admin, Member, and Billing Admin roles and what each can access in your organization
  </Card>
</CardGroup>


# Billing and changing plans
Source: https://docs.coderabbit.ai/management/billing

View invoices, change your subscription plan, update payment methods, and adjust seat counts from CodeRabbit's Subscription and Billing page.

<AdminRoleBadge />

Manage your billing history, subscription plan, payment methods, billing information, and team seat count from [Subscription and Billing](https://app.coderabbit.ai/settings/subscription) in your organization settings.

## Billing and invoices

Use the **Invoices** tab to view and download billing history for accounting and expense reporting. Use the **Billing Overview** tab to resolve unpaid invoices when CodeRabbit shows a **Pay pending invoices** action.

### View billing history

<Steps>
  <Step title="Open invoices">
    Go to [**Account - Subscription and Billing - Invoices**](https://app.coderabbit.ai/settings/subscription?tab=invoices) in your organization settings.
  </Step>

  <Step title="View or download invoices">
    Use the invoice actions to view an invoice in your browser or download it for your records.
  </Step>
</Steps>

<Info>
  Invoices are generated automatically for each billing cycle. Payment history shows all charges, including prorated amounts for plan or seat changes.
</Info>

### Pay pending invoices

<Steps>
  <Step title="Open Billing Overview">
    Go to [**Subscription and Billing**](https://app.coderabbit.ai/settings/subscription) to access **Billing Overview**.
  </Step>

  <Step title="Check payment methods">
    Add or select a valid payment method before paying pending invoices. CodeRabbit blocks the invoice payment flow until a valid payment method is available.
  </Step>

  <Step title="Start payment">
    Click **Pay pending invoices** in **Plan details**. CodeRabbit redirects you to the invoice payment flow.
  </Step>
</Steps>

## Plans and seats

Modify your subscription plan, billing cycle, or number of seats as your team's needs change.

### Change your plan or seat count

<Steps>
  <Step title="Open subscription settings">
    Go to [**Subscription and Billing**](https://app.coderabbit.ai/settings/subscription) in your organization settings and select **Billing Overview**.
  </Step>

  <Step title="Open plan details">
    In **Plan details**, click the edit button. Self-serve plans can also expand **View all plans** from the current plan card and choose **Upgrade** or **Downgrade** on a plan card.
  </Step>

  <Step title="Choose organization details">
    In the subscription drawer, review **Organization**, **Payment Currency**, **Plan Selected**, and **Seats selected**. Choose Pro or Pro+, monthly or annual billing, and the seat count you need.
  </Step>

  <Step title="Update billing information">
    Confirm the account contact and invoice details when prompted. Account contact details include first name, last name, company name, primary email, and phone number. Invoice details include billing email, billing address, optional Tax ID, and any additional invoice recipients.
  </Step>

  <Step title="Confirm payment method">
    Add a payment method or choose an existing valid payment method when the change has a paid billing impact.
  </Step>

  <Step title="Review the summary">
    Review the order summary, seat change, billing cycle, coupon, amount due, and next charge. Click **Update Subscription** to save the change.
  </Step>
</Steps>

### Scheduled changes

CodeRabbit applies new subscriptions, upgrades, and added seats immediately when possible. Downgrades, cancellations, seat reductions, and some billing-cycle changes are scheduled for the end of the billing cycle so access is not removed mid-cycle. When a scheduled change exists, **Billing Overview** shows a **Manage changes** banner where admins can edit the scheduled plan or remove the scheduled change.

Some mixed changes split into immediate and scheduled parts. For example, upgrading while reducing seats upgrades the plan immediately and schedules the seat reduction. Downgrading while adding seats adds seats immediately under the current plan and schedules the plan downgrade for the end of the billing cycle.

During a trial, admins can schedule the selected paid subscription to start when the trial ends. The trial banner shows the scheduled start date and lets admins switch trial plans, edit the scheduled subscription, or start the subscription immediately.

### Plan and seat considerations

* **Immediate changes**: New subscriptions, plan upgrades, and additional seats take effect immediately when CodeRabbit can collect payment.
* **Scheduled changes**: Plan downgrades, cancellations, seat reductions, and cancellation removals can be scheduled for the end of the billing cycle.
* **Billing adjustments**: Immediate changes are prorated based on your billing cycle.
* **Seat planning**: Consider team growth when adding seats; removing seats later affects team member access when the scheduled reduction takes effect.
* **Coupon support**: Apply one coupon code from the order summary before saving an immediate plan or seat change. Coupons are not available for subscription changes scheduled for trial end or the next billing cycle.

<Info>
  For monthly subscribers, seat unassignment is processed at the end of the billing cycle to prevent immediate disruption. See [Pending unassignment](/management/seat-assignment#pending-unassignment) for details on how seat unassignment timing works.
</Info>

<Info>
  If your subscription already has a coupon, CodeRabbit shows the current coupon in the order summary and does not let you stack a second one. Coupons are also unavailable while a subscription downgrade is already scheduled for your next billing cycle.
</Info>

#### How mid-month changes affect billing

When you add seats or upgrade your plan mid-month, billing is handled automatically based on your payment method:

* **Organizations paying via credit card**: Billed for new users as soon as the change is made
* **Organizations paying via invoice**: Billed at the end of the month

New seats are always billed at the prorated price for the remainder of the billing cycle.

## FAQ

### What billing details are required?

CodeRabbit separates billing details into account contact and invoice details.

* **Account contact**: First name, last name, company name, primary email, and phone number. The company name is the legal entity shown on invoices. The primary email receives subscription updates, payment notifications, and account communications. For subscriptions with more than 10 seats, use a corporate email address.
* **Invoice details**: Billing email, billing address, and optional Tax ID. The billing email receives invoices and payment receipts and appears on invoices. The billing address appears on invoices and is used to determine applicable taxes.
* **Additional invoice recipients**: Add up to 10 additional recipients, such as accounting or finance teammates, to receive invoice copies.

### How do upgrades and downgrades work?

| Plan change                       | Seat change | Behavior                                                                                                   |
| --------------------------------- | ----------- | ---------------------------------------------------------------------------------------------------------- |
| First subscription or Pro to Pro+ | No change   | Immediate                                                                                                  |
| No plan change                    | Increase    | Immediate                                                                                                  |
| First subscription or Pro to Pro+ | Increase    | Immediate                                                                                                  |
| Cancellation or Pro+ to Pro       | No change   | End of billing cycle                                                                                       |
| No plan change                    | Decrease    | End of billing cycle                                                                                       |
| Cancellation or Pro+ to Pro       | Decrease    | End of billing cycle                                                                                       |
| First subscription or Pro to Pro+ | Decrease    | Plan upgrade is immediate. Seat reduction happens at the end of the billing cycle.                         |
| Cancellation or Pro+ to Pro       | Increase    | Seat increase is immediate under the current plan. Plan downgrade happens at the end of the billing cycle. |

<Accordion title="Common subscription scenarios">
  <ul>
    <li>
      <strong>Growing team</strong>
      : Add seats before onboarding new team members to ensure immediate access
    </li>

    <li>
      <strong>Plan evaluation</strong>
      : Upgrade temporarily to evaluate Pro or Pro+ features, then schedule a downgrade before the next billing cycle if not needed
    </li>

    <li>
      <strong>Seasonal scaling</strong>
      : Adjust seats for contractors or seasonal team members, remove when projects complete
    </li>

    <li>
      <strong>Budget planning</strong>
      : Check the order summary before confirming changes
    </li>

    <li>
      <strong>Scheduling activation for after trial ends</strong>
      : Use the "Continue Trial" option during activation to complete your subscription setup now while delaying billing until your trial expires. This gives you the full trial period to evaluate CodeRabbit while locking in your plan.
    </li>

    <li>
      <strong>Reactivating with different seat count</strong>
      : When returning after cancellation, select the seat count that matches your current team size during reactivation. You're not required to use your previous seat count; adjust to your current needs without contacting support.
    </li>
  </ul>
</Accordion>

## What's next

<CardGroup>
  <Card title="Seat assignment" href="/management/seat-assignment" icon="users">
    Understand how CodeRabbit assigns seats during trials, with auto-approval, and manual approval
  </Card>

  <Card title="Usage-based Add-on" href="/management/usage-based-addon" icon="gauge">
    Buy credits to continue PR reviews and CLI usage beyond your plan limit
  </Card>

  <Card title="Plans and pricing" href="/management/plans" icon="credit-card">
    Compare CodeRabbit plans and understand per-developer rate limits
  </Card>
</CardGroup>


# Custom roles and permissions
Source: https://docs.coderabbit.ai/management/custom-roles

Create and manage custom roles with granular permissions for your Enterprise organization in CodeRabbit.

<EnterprisePlanBadge />

<AdminRoleBadge />

## Overview

CodeRabbit includes three built-in system roles — **Admin**, **Member**, and **Billing Admin** — that cover common access patterns. With Custom RBAC (Role-Based Access Control), Enterprise customers can go further by defining additional roles with specific permissions tailored to their organization's structure and workflows. Each custom role controls access to individual resources at one of three levels: no access, read only, or read and write. Once created, custom roles are available across your organization, including in Team Management for per-user assignment.

<CardGroup>
  <Card title="Custom role creation" icon="circle-plus">
    Create roles with a unique name and an optional description to reflect their purpose in your organization.
  </Card>

  <Card title="Granular permissions" icon="user-lock">
    Control access to each resource independently using **No access**, **Read only**, or **Read and Write** — giving you precise control over what each role can do.
  </Card>

  <Card title="Default role assignment" icon="star">
    Designate any custom role as the default so new users joining your organization are automatically assigned the right level of access.
  </Card>

  <Card title="Team Management integration" icon="users">
    Assign custom roles to individual users directly from the Team Management page, alongside the built-in system roles.
  </Card>
</CardGroup>

<Info>
  **Navigation paths for Roles and permissions settings:**

  * **Cloud:** `/settings/roles-permissions`
  * **Self-hosted:** `/settings/account/roles-permissions`
</Info>

***

## View roles and permissions

<Steps>
  <Step title="Navigate to Roles and permissions">
    Go to your organization settings and open the **Roles and permissions** page. You will see a table listing all roles in your organization.
  </Step>

  <Step title="Review the roles table">
    The table displays the following columns for each role:

    * **Role name** — the display name of the role
    * **Role type** — labeled **System** for built-in roles (Admin, Member, Billing Admin) or **Custom** for user-created roles
    * **Description** — optional text describing the role's purpose
    * **Number of assigned users** — how many users currently hold this role
    * **Default role indicator** — a star (★) icon marks the role that is automatically assigned to new users
  </Step>

  <Step title="Search for a role">
    Use the **Search** field at the top of the table to filter roles by name or description. Results update as you type, making it easy to find a specific role in large organizations.
  </Step>

  <Step title="Filter by role type">
    Use the **Filter** dropdown to narrow the list by type:

    * **All** (default) — shows every role
    * **System** — shows only the built-in Admin, Member, and Billing Admin roles
    * **Custom** — shows only user-created custom roles
  </Step>
</Steps>

***

## Create a custom role

<Steps>
  <Step title="Navigate to Roles and permissions">
    Go to your organization settings and open the **Roles and permissions** page.
  </Step>

  <Step title="Open the creation form">
    Click the **Create role** button in the top-right corner of the page. A creation form will appear.
  </Step>

  <Step title="Enter a name">
    Enter a **Name** for the role. This field is required. Role names must be unique within your organization — if the name is already taken, a validation message will appear and the form cannot be submitted until you choose a different name.
  </Step>

  <Step title="Add an optional description">
    Optionally enter a **Description** to explain what the role is for and who should be assigned to it. A good description helps administrators understand the role's purpose at a glance.
  </Step>

  <Step title="Save the role">
    Click **Save**. The new role is created and automatically populated with the default member role permissions as a baseline.
  </Step>

  <Step title="Configure permissions">
    After saving, you are taken to the role detail page where you can adjust the permission matrix to match the access level intended for this role. See [Edit role permissions](#edit-role-permissions) below.
  </Step>
</Steps>

***

## Duplicate an existing role

Duplicating a role copies all of its permission settings into a new role, saving time when you need a role that is similar to an existing one.

<Steps>
  <Step title="Locate the role to duplicate">
    On the **Roles and permissions** page, find the role you want to duplicate in the table.
  </Step>

  <Step title="Open the Actions menu">
    Click the **Actions** menu (the three-dot ⋯ icon) at the far right of the role's row.
  </Step>

  <Step title="Select Duplicate">
    Select **Duplicate** from the dropdown menu. A new role is immediately created with all the same permissions as the original. The new role's name is prefixed with **"Copy of"** followed by the original role name.
  </Step>

  <Step title="Rename and adjust">
    Click the duplicated role's name to open its detail page. Update the name, description, and any permissions as needed.
  </Step>
</Steps>

***

## Edit role permissions

### Role detail page

When you open a custom role by clicking its name on the Roles and permissions page, the detail page displays the following metadata:

* **Assigned users** — the number of users currently assigned to this role
* **Role type** — **System** or **Custom**
* **Created by** — the user who created the role
* **Created on** — the date the role was created

### Permission matrix

Each resource can be configured independently. Select the access level that applies to this role for each resource:

| Resource              | No access | Read only | Read and Write |
| --------------------- | --------- | --------- | -------------- |
| Organization settings | ✓         | ✓         | ✓              |
| Repository settings   | ✓         | ✓         | ✓              |
| Reports               | ✓         | ✓         | ✓              |
| Learnings             | ✓         | ✓         | ✓              |
| Team Management       | ✓         | ✓         | ✓              |
| Billing               | ✓         | ✓         | —              |
| API access            | ✓         | ✓         | —              |

<Warning>
  System roles — **Admin**, **Member**, and **Billing Admin** — are view-only and cannot be edited. Their permission matrices are displayed for reference but all controls are disabled.
</Warning>

### Save or discard changes

<Steps>
  <Step title="Navigate to the role detail page">
    On the **Roles and permissions** page, click the name of the custom role you want to edit. The role detail page opens, showing the permission matrix.
  </Step>

  <Step title="Set access levels">
    For each resource in the permission matrix, select the desired access level using the radio buttons:

    * **No access** — the role cannot see or interact with this resource
    * **Read only** — the role can view this resource but cannot make changes
    * **Read and Write** — the role can view and modify this resource
  </Step>

  <Step title="Apply or cancel">
    Click **Save** to apply your changes. Click **Discard** to cancel all unsaved changes and revert to the previously saved state.
  </Step>
</Steps>

***

## Set a default role

The default role is automatically assigned to new users when they join your organization, ensuring they have the appropriate baseline access without requiring manual role assignment.

<Steps>
  <Step title="Navigate to Roles and permissions">
    Go to your organization settings and open the **Roles and permissions** page.
  </Step>

  <Step title="Open the Actions menu">
    Click the **Actions** menu (the three-dot ⋯ icon) next to the role you want to set as the default.
  </Step>

  <Step title="Set as default">
    Select **Set as default** from the dropdown menu. The role now displays a star (★) icon in the **Default** column of the table, confirming it is the active default role.
  </Step>

  <Step title="Remove default status">
    To remove the default designation without assigning a new default, click the **Actions** menu next to the current default role and select **Remove as default**.
  </Step>
</Steps>

<Info>
  Only one role can be the default at a time. Setting a new role as default automatically removes the default designation from the previously assigned role.
</Info>

***

## Delete a custom role

<Info>
  Deletion is blocked when one or more users are assigned to the role. All users must be reassigned to a different role before deletion is possible. Additionally, if the role being deleted is currently set as the default role, its default status is automatically removed before deletion proceeds.
</Info>

<Tip>
  Reassign all users to another role before attempting to delete a custom role. Check the **Assigned users** count in the table — if it is greater than 0, navigate to **Team Management** to reassign those users first.
</Tip>

<Steps>
  <Step title="Navigate to Roles and permissions">
    Go to your organization settings and open the **Roles and permissions** page.
  </Step>

  <Step title="Verify no users are assigned">
    Check the **Assigned users** count in the row for the role you want to delete. If the count is greater than 0, go to **Team Management** and reassign those users to a different role before continuing.
  </Step>

  <Step title="Open the Actions menu">
    Click the **Actions** menu (the three-dot ⋯ icon) next to the role.
  </Step>

  <Step title="Select Delete">
    Select **Delete** from the dropdown menu.
  </Step>

  <Step title="Confirm deletion">
    A confirmation dialog will appear asking you to confirm the deletion. Confirm to permanently remove the role. This action cannot be undone.
  </Step>
</Steps>

***

## Assign roles in Team Management

The **Team Management** page supports both system and custom roles in the role selector, allowing you to assign any role — built-in or custom — to individual users.

<Info>
  Only organization members can be assigned custom roles. Non-org users may still appear in **Team Management**, but custom roles are not available for them.
</Info>

<Steps>
  <Step title="Navigate to Team Management">
    Go to your organization settings and open the **Team Management** page.
  </Step>

  <Step title="Locate the user">
    Find the user whose role you want to change in the members list. Use the search field or scroll through the list to locate them.
  </Step>

  <Step title="Open the Role dropdown">
    Click the **Role** dropdown next to the user's name. The dropdown displays all available roles — both system roles (Admin, Member, Billing Admin) and any custom roles you have created.
  </Step>

  <Step title="Select the new role">
    Select the desired role from the dropdown. The change is applied immediately using an optimistic update, so the UI reflects the new role right away.
  </Step>

  <Step title="Handle errors">
    If the update fails (for example, due to a permissions issue or network error), the role assignment is automatically rolled back to the previous value and an error message is displayed. Retry the change or contact your administrator if the problem persists.
  </Step>
</Steps>

**Filter members by role:** Use the **Role** filter dropdown in the members list header to display only users assigned to a specific role. This filter includes custom roles, making it easy to audit who has been assigned each custom role in your organization.

## API reference

Custom roles can be managed programmatically using the REST API. The following endpoints are available:

| Endpoint                                                        | Description                                                                |
| --------------------------------------------------------------- | -------------------------------------------------------------------------- |
| [`GET /v1/roles`](/api-reference/roles-list)                    | List all built-in and custom roles for your organization                   |
| [`POST /v1/roles`](/api-reference/roles-create)                 | Create a custom role, optionally copying permissions from an existing role |
| [`GET /v1/roles/permissions`](/api-reference/roles-permissions) | List valid `resource_id` and `access_type` values for building permissions |
| [`GET /v1/roles/{roleId}`](/api-reference/roles-get)            | Retrieve details for a single role                                         |
| [`PATCH /v1/roles/{roleId}`](/api-reference/roles-update)       | Update a custom role's name, description, permissions, or default status   |
| [`DELETE /v1/roles/{roleId}`](/api-reference/roles-delete)      | Delete a custom role that is not assigned to any members                   |

## What's next

<CardGroup>
  <Card title="Roles overview" icon="users" href="/management/roles">
    Learn about the built-in Admin, Member, and Billing Admin roles and how they differ from custom roles.
  </Card>

  <Card title="Seat assignment" icon="user-check" href="/management/seat-assignment">
    Manage user seats and access in your organization.
  </Card>
</CardGroup>


# Management overview
Source: https://docs.coderabbit.ai/management/index

Manage your CodeRabbit platform: repositories, subscriptions, billing, integrations, and analytics

The Management section provides administrative tools to configure, monitor, and optimize your CodeRabbit deployment.

<CardGroup>
  <Card title="Repository configuration" icon="folder-git-2" href="/platforms/overview">
    Connect CodeRabbit with GitHub, GitLab, Azure DevOps, or Bitbucket
  </Card>

  <Card title="Subscription & billing" icon="credit-card" href="/management/plans">
    Manage your plan, billing details, and usage-based add-ons
  </Card>

  <Card title="Dashboard" icon="layout-dashboard" href="/guides/dashboard">
    Track team performance, review velocity, and code quality metrics
  </Card>

  <Card title="Reports" icon="text-search" href="/management/reports/index">
    Generate scheduled and on-demand reports about pull request activity
  </Card>

  <Card title="Integrations" icon="blocks" href="/integrations/mcp-servers">
    Connect issue trackers, MCP servers, and CI/CD integrations
  </Card>

  <Card title="Organization administration" icon="user-cog" href="/management/roles">
    Manage seats, roles, permissions, and audit logs
  </Card>
</CardGroup>

## Repository configuration

Connect repositories from [supported Git platforms](/platforms/overview) including GitHub, GitLab, Azure DevOps, and Bitbucket. Configure CodeRabbit behavior using [organization settings](/guides/organization-settings), [repository settings](/guides/repository-settings), or [YAML configuration](/getting-started/yaml-configuration) files.

## Subscription & billing

Manage your [plan](/management/plans), [billing details](/management/billing), and [usage-based add-ons](/management/usage-based-addon). Adjust your subscription or manage your [seat allocation](/management/subscription-management) as your team grows.

## Dashboard and reports

Monitor team performance with the [CodeRabbit Dashboard](/guides/dashboard), tracking review velocity, code quality, and collaboration patterns. View [dashboard metrics](/guides/dashboard-metrics), export data, and generate custom [reports](/management/reports/index) on-demand or schedule automated delivery via email, Slack, Discord, or Microsoft Teams.

## Integrations

Connect CodeRabbit with [MCP servers](/integrations/mcp-servers), issue trackers such as [Jira](/integrations/jira) and [Linear](/integrations/linear), and [CircleCI](/integrations/circleci) for CI/CD pipeline visibility.

## Organization administration

Manage [seat assignment](/management/seat-assignment) and control access through [role-based permissions](/management/roles) (Admin, Member, Billing Admin). Enterprise customers can create [custom roles](/management/custom-roles) with granular access control, track administrative actions with [audit logs](/management/audit-logs), and [set up Multi-Org](/management/multi-org) for multi-organization rollouts. [Add organizations](/management/adding-organizations) and [upgrade permissions](/management/upgrading-permissions) as needed.

## CodeRabbit API

Use the [CodeRabbit API](/api) to access review data and administrative operations programmatically. Enterprise SSO workspace admins can create [workspace API tokens](/api/workspace-api-tokens) for supported APIs across organizations in a workspace.

## What's next

<CardGroup>
  <Card title="Set up repositories" href="/platforms/overview" icon="folder-git-2">
    Connect your Git platform and start reviewing code with CodeRabbit
  </Card>

  <Card title="Monitor performance" href="/guides/dashboard" icon="layout-dashboard">
    Track team metrics, review velocity, and code quality in the dashboard
  </Card>

  <Card title="Manage your team" href="/management/roles" icon="user-cog">
    Set up roles, manage seat assignment, and configure permissions
  </Card>
</CardGroup>


# Set up Multi-Org
Source: https://docs.coderabbit.ai/management/multi-org

Add and configure multiple organizations in CodeRabbit for Enterprise deployments.

<EnterprisePlanBadge />

Multi-Org lets Enterprise customers manage multiple organizations inside a single CodeRabbit workspace. The current rollout is support-assisted, so use this guide when you are planning a Multi-Org onboarding with the CodeRabbit team.

## Supported platforms

Multi-Org is available on the following git platforms:

<GitHubBadge />

<GitLabBadge />

<BitbucketBadge />

<AzureBadge />

<Info>
  Multi-Org authentication setup is not self-serve. If your rollout requires centralized authentication, your account team will coordinate the supported identity-provider configuration with you.
</Info>

## Before you start

Make sure you have:

* An [Enterprise plan](/management/plans) with Multi-Org support
* An account-team coordinated authentication plan, including any identity-provider metadata requested by CodeRabbit
* A list of the organizations or workspaces that should live in the workspace
* For Azure DevOps rollouts, a dedicated service user and workspace-level [Azure DevOps personal access token](/platforms/azure-devops#azure-devops-for-enterprise-sso-workspaces)

## Current availability

Multi-Org is currently **not self-serve**.

At this stage:

* The rollout is handled with the CodeRabbit team, not self-service
* Multi-Org authentication setup is coordinated by the CodeRabbit team

## Multi-Org setup flow

<Steps>
  <Step title="Share authentication requirements with CodeRabbit">
    Send the authentication requirements and any requested identity-provider metadata to the CodeRabbit team so they can prepare your Multi-Org workspace.
  </Step>

  <Step title="CodeRabbit configures the authentication layer">
    After the required identity-provider details are received, the CodeRabbit team configures the authentication layer and prepares the Multi-Org environment.
  </Step>

  <Step title="Choose the rollout path">
    CodeRabbit then completes one of two onboarding paths depending on your current state:

    <Tabs>
      <Tab title="Existing organizations already onboarded">
        If the customer already has organizations onboarded in CodeRabbit:

        1. CodeRabbit creates a workspace for the customer.
        2. CodeRabbit migrates the existing organizations into that workspace.
        3. CodeRabbit updates or cancels subscriptions if the migration requires billing changes.
        4. Users can then sign in to the workspace through the configured authentication flow.
      </Tab>

      <Tab title="Fresh Multi-Org onboarding">
        If this is a new Enterprise rollout:

        1. CodeRabbit completes the authentication configuration for the new workspace.
        2. Users sign in through the configured authentication flow.
        3. After login, they continue through the standard onboarding flow for the workspace.
      </Tab>
    </Tabs>
  </Step>
</Steps>

<Info>
  Multi-Org access is an Enterprise feature. If you are evaluating Multi-Org for the first time, contact [sales](https://www.coderabbit.ai/contact-us/sales). If you are ready to begin setup, use the [support page](/support) or your existing CodeRabbit contact to start the rollout.
</Info>

## Recommended prep for customers

Before the handoff to CodeRabbit, it helps to prepare:

* Your identity-provider metadata and authentication contact owner
* The list of organizations that should be grouped into the workspace
* For Azure DevOps, the Microsoft tenant to connect and the workspace-level service-user personal access token
* Whether any of those organizations already have active CodeRabbit subscriptions
* The admin owners who should validate first login after authentication is enabled

## What's next

<CardGroup>
  <Card title="Roles and permissions" href="/management/roles" icon="shield-check">
    Review how CodeRabbit roles work before planning the workspace access model
  </Card>

  <Card title="Subscription management" href="/management/billing" icon="user-cog">
    Review billing, plan details, and seat settings for the Enterprise rollout
  </Card>

  <Card title="Support" href="/support" icon="message-circle">
    Contact the CodeRabbit team when you are ready to start Multi-Org onboarding
  </Card>
</CardGroup>


# Plans and pricing
Source: https://docs.coderabbit.ai/management/plans

Compare CodeRabbit plans and understand per-developer review rate limits and feature limits.

CodeRabbit offers five plans with per-developer review rate limits; **Pro**, **Pro+**, and **Enterprise** subscribers can also enable the [usage-based add-on](/management/usage-based-addon) to pay for usage beyond those limits.

This page covers what each plan includes, the review rate limits enforced **per developer**, and feature limits that vary by plan.

## Plans

<CardGroup>
  <Card icon="gift">
    ### Free plan

    Unlimited public and private repositories, no credit card required.

    PR summarization only, code reviews are available via the VS Code extension and CLI. Includes a **14-day Pro+ trial**. When the trial expires, choose Pro or Pro+ to continue, or revert to Free with lower [rate limits](#rate-limits).
  </Card>

  <Card icon="code">
    ### Open source

    Unlimited public repositories, no credit card required.

    Open-source projects receive Pro+ features with no paid subscription required. OSS reviews use a separate rate-limit tier that varies with the project's community and popularity; see [Rate limits](#rate-limits).
  </Card>

  <Card icon="shield-check">
    ### Pro plan

    **\$24 per developer per month** billed annually, or **\$30** month-to-month.

    Includes everything in Free, plus PR reviews, higher rate limits, integration, Knowledge base, linter and SAST tool support, analytics, docstrings, autofix, and [usage-based add-on](/management/usage-based-addon) access.
  </Card>

  <Card icon="shield-plus">
    ### Pro+ plan

    **\$48 per developer per month** billed annually, or **\$60** month-to-month.

    Everything in Pro, plus tasks and actions upstream and downstream of the review process: [CodeRabbit Plan](/plan/index) and issue planning, unit test generation, merge conflict resolution, and other pre/post-merge actions. Pro+ also offers higher [rate limits](#rate-limits).
  </Card>

  <Card icon="building-2">
    ### Enterprise plan

    **Contact sales** — [coderabbit.ai/contact-us/sales](https://www.coderabbit.ai/contact-us/sales)

    Includes everything in Pro+, plus self-hosting options, multi-organization support, SSO, SLA support with a dedicated Customer Success Manager, AWS and GCP Marketplace billing, API access, custom RBAC, and audit logging.
  </Card>
</CardGroup>

## Rate limits

The following review and chat limits are enforced **per developer** over rolling time windows. Each one is a rolling allowance rather than a one-time quota: you can use your full hourly amount in a burst, and additional reviews become available as earlier reviews age out of the window instead of resetting all at once at the top of the hour. For example, Pro includes 5 PR reviews per hour.

The **Files/review** column is the maximum number of files CodeRabbit reviews in a single review, not an hourly limit. The files per review are counted after path filter exclusions.

<table>
  <thead>
    <tr>
      <th>
        Plan
      </th>

      <th>
        Reviews<sup>\*</sup> per developer per hour
      </th>

      <th>
        Files/review
      </th>

      <th>
        Chat
      </th>
    </tr>

    <tr>
      <th>PR</th>
      <th>IDE</th>
      <th>CLI</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Free</td>

      <td>
        <Tooltip>1</Tooltip>
      </td>

      <td>3</td>
      <td>3</td>
      <td>150</td>
      <td>N/A</td>
    </tr>

    <tr>
      <td>OSS</td>

      <td>
        <Tooltip>1-10</Tooltip>
      </td>

      <td>1</td>
      <td>3</td>

      <td>
        <Tooltip>100-300</Tooltip>
      </td>

      <td>25</td>
    </tr>

    <tr>
      <td>Pro</td>
      <td>5</td>
      <td>5</td>
      <td>5</td>
      <td>150</td>
      <td>50</td>
    </tr>

    <tr>
      <td>Pro+</td>
      <td>10</td>
      <td>10</td>
      <td>10</td>
      <td>300</td>
      <td>100</td>
    </tr>

    <tr>
      <td>Enterprise</td>
      <td>12</td>
      <td>12</td>
      <td>12</td>
      <td>300</td>
      <td>100</td>
    </tr>
  </tbody>
</table>

<p><sup>\*</sup> PR, IDE, and CLI review limits are shown per developer, per hour. They work as a rolling allowance: for example, Pro includes 5 PR reviews per hour, which can be used at once; additional reviews become available as earlier reviews age out of the rolling window rather than resetting in one block. For sustained high-volume PR review activity, review availability may adjust under the <a href="#fair-usage-limits-policy">Fair Usage Limits Policy</a>.</p>

Pro, Pro+, and Enterprise organizations can enable the [usage-based add-on](/management/usage-based-addon) (subject to billing-method eligibility) to continue processing eligible over-limit reviews without interruption.

The file limits in the table apply to pull request and merge request reviews after path filters are applied. When an eligible GitHub or GitHub Enterprise review exceeds its included file limit but contains no more than 300 files, CodeRabbit can offer a **Review on demand using usage pricing** action. Reviews with more than 300 files are not supported through usage pricing.

Each PR review run uses one PR review from this allowance, including automatic incremental reviews after new pushes, manual `@coderabbitai review`, and manual `@coderabbitai full review`. To check your own PR review limit without starting a new review, comment `@coderabbitai rate limit` or ask a clear question like `@coderabbitai reviews remaining?`.

<Info>
  When no PR reviews are available, CodeRabbit pauses new reviews until more reviews become available or eligible over-limit reviews continue through the usage-based add-on.
</Info>

### Default Pro+ trial limits

The default 14-day trial starts on **Pro+**. The limits below apply to that default Pro+ trial experience.

| Category                                                                      | Default Pro+ trial |
| ----------------------------------------------------------------------------- | ------------------ |
| PR reviews per developer per hour                                             | 10                 |
| Files per pull request or merge request                                       | 300                |
| [Custom Finishing Touch recipes](/finishing-touches/custom-finishing-touches) | 20                 |
| [Custom Pre-Merge Checks](/pr-reviews/custom-checks)                          | 20                 |
| [Linked repositories](/knowledge-base/multi-repo-analysis)                    | 10                 |

The default Pro+ trial also includes access to <Hint type="finishing-touches" />, [Pre-Merge Checks](/pr-reviews/pre-merge-checks), and [CodeRabbit Plan](/issues/planner).

### Fair Usage Limits Policy

CodeRabbit's PR review limits are designed for modern development workflows where humans, coding agents, and automation may all request reviews. Each PR review uses compute. Fair usage limits keep review capacity reliable and economically sustainable for all customers.

Your plan allowance is not changed. Pro includes 5 PR reviews per hour, Pro+ includes 10 PR reviews per hour, and Enterprise uses the rate shown in the table above. During typical usage, reviews become available at the normal plan rate. When one developer identity reaches the 95th percentile or higher of recent CodeRabbit PR review usage, CodeRabbit gradually spaces out additional reviews for that developer.

Reducing or pausing review activity lets recent usage come down over time, which can restore faster review availability.

The following limits apply per developer identity in an organization:

<Tabs>
  <Tab title="Pro" icon="shield-check">
    | Recent PR review activity        | Review availability                 |
    | -------------------------------- | ----------------------------------- |
    | 0-29 reviews in the last 7 days  | 5 reviews/hour                      |
    | 30-39 reviews in the last 7 days | 4 reviews/hour                      |
    | 40-49 reviews in the last 7 days | 3 reviews/hour                      |
    | 50-59 reviews in the last 7 days | 2 reviews/hour                      |
    | 60+ reviews in the last 7 days   | 1 review/hour, one review at a time |
  </Tab>

  <Tab title="Pro+" icon="shield-plus">
    | Recent PR review activity        | Review availability                 |
    | -------------------------------- | ----------------------------------- |
    | 0-29 reviews in the last 7 days  | 10 reviews/hour                     |
    | 30-39 reviews in the last 7 days | 8 reviews/hour                      |
    | 40-49 reviews in the last 7 days | 6 reviews/hour                      |
    | 50-59 reviews in the last 7 days | 5 reviews/hour                      |
    | 60-69 reviews in the last 7 days | 4 reviews/hour                      |
    | 70-79 reviews in the last 7 days | 3 reviews/hour                      |
    | 80-89 reviews in the last 7 days | 2 reviews/hour                      |
    | 90+ reviews in the last 7 days   | 1 review/hour, one review at a time |
  </Tab>
</Tabs>

### When a review is rate-limited

When a push is rate-limited, CodeRabbit posts a rate-limit comment on the pull request and a passing check titled **"Review rate limited"** — the check passes by design so it never blocks merging on protected branches. The comment is the authoritative signal that no review ran. A previously approved PR keeps its approval.

Comment `@coderabbitai rate limit` to see remaining capacity, then `@coderabbitai review` to trigger a review once capacity is restored.

<Info>
  A blocked push does not consume a review or delay when your next review becomes available. Capacity is limited by earlier reviews in the rolling window, not by the current push.
</Info>

#### How to continue with credits

If your team expects sustained high-volume review activity, buy on-demand credits and enable the [usage-based add-on](/management/usage-based-addon). Eligible over-limit PR reviews can then continue without waiting for the next included review to become available.

#### How to avoid reaching limits

Reduce unnecessary automatic reviews before relying on credits:

* Set [`reviews.auto_review.auto_pause_after_reviewed_commits`](/configuration/auto-review#auto_pause_after_reviewed_commits) to `1` or `2` so CodeRabbit pauses automatic incremental reviews earlier.
* Use [label-based opt-in](/configuration/auto-review#labels) so CodeRabbit reviews only PRs marked ready for review.
* Use [title-based exclusions](/configuration/auto-review#ignore_title_keywords) for WIP, generated, or automation-heavy PRs.
* Turn off automatic reviews for noisy repositories and request reviews manually when the PR is ready.

## Feature limits

Some features have per-plan limits that are separate from the rate limits above.

### Linked repositories

[Multi-Repo Analysis](/knowledge-base/multi-repo-analysis) lets CodeRabbit detect cross-repository breaking changes during reviews. The number of linked repositories you can activate depends on your plan:

| Free | Pro | Pro+ | Enterprise |
| ---- | --- | ---- | ---------- |
| 0    | 1   | 10   | 20         |

For details on how limits are enforced when your configuration exceeds your plan's allowance, see [Multi-Repo Analysis — Plan limits](/knowledge-base/multi-repo-analysis#plan-limits).

### MCP servers

[MCP server](/integrations/mcp-servers) connections let CodeRabbit pull in richer context from your external tools during reviews. The number of MCP server connections you can configure depends on your plan:

| Pro | Pro+ | Enterprise |
| --- | ---- | ---------- |
| 5   | 15   | 20         |

### Custom Finishing Touch recipes

[Custom Finishing Touch recipes](/finishing-touches/custom-finishing-touches) let you define your own post-review automation. The number of custom recipes you can define per repository depends on your plan:

| Pro+ | Enterprise |
| ---- | ---------- |
| 20   | 20         |

### Custom Pre-Merge Checks

[Custom Pre-Merge Checks](/pr-reviews/custom-checks) let you define organization-specific gating checks. The number of custom checks you can define per organization depends on your plan:

| Pro+ | Enterprise |
| ---- | ---------- |
| 20   | 20         |

## What's next

<CardGroup>
  <Card title="Manage your subscription" href="/management/billing" icon="credit-card">
    View invoices, change your subscription plan, and adjust seat counts
  </Card>

  <Card title="Seat assignment" href="/management/seat-assignment" icon="users">
    Control how CodeRabbit assigns seats to team members automatically or manually
  </Card>

  <Card title="Pricing page" href="https://coderabbit.ai/pricing" icon="tag">
    See the full plan comparison and contact sales for Enterprise pricing
  </Card>
</CardGroup>


# Reports Overview
Source: https://docs.coderabbit.ai/management/reports/index

Track and analyze pull request activity across your organization's repositories with CodeRabbit's reporting feature. Set up scheduled reports with customizable prompts.

<ProPlanBadge />

CodeRabbit's reporting feature helps you track pull request activity, review patterns, and team performance across your organization's repositories. Generate insights about code review cycles, contributor activity, and quality metrics to improve your development workflow.

## Report types

<CardGroup>
  <Card title="Scheduled reports" href="/guides/scheduled-reports" icon="calendar">
    Set up automated, recurring reports delivered to your team on a schedule via
    email, Discord, Slack, or Teams. **Recommended for ongoing monitoring**.
  </Card>
</CardGroup>

<Tip>
  **Recommended approach**: Use scheduled reports for regular team updates and
  performance tracking.
</Tip>

## Customize reports using natural language

For scheduled reports, you define the shape and content of your reports by providing a prompt that instructs CodeRabbit about the report you want, using natural language. The scheduled reports interface includes several example prompts that you can choose from, or you can write your own prompt. For more information, see [Customize reports](/guides/custom-reports).

## What's next

* [Schedule reports](/guides/scheduled-reports)


# Role-based access
Source: https://docs.coderabbit.ai/management/roles

Control access to CodeRabbit administrative features by assigning Admin, Member, or Billing Admin roles to organization users.

<AdminRoleBadge />

Control access to CodeRabbit administrative features through role-based permissions. Assign appropriate roles to team members based on their administrative responsibilities.

## Overview of CodeRabbit roles

Every CodeRabbit account has exactly one role per organization. Each role determines access to billing, account management, and administrative functions.

<CardGroup>
  <Card title="Admin">
    Full read/write access to all administrative features, including billing,
    seat management, Audit Logs, and role management.
  </Card>

  <Card title="Member">
    No access to **Subscription and Billing**, **Audit Logs**, or **Roles and
    permissions**. Members can still use developer features and may have
    limited read-only visibility in **Team Management**.
  </Card>

  <Card title="Billing Admin">
    Read/write access to **Subscription and Billing**. Can view **Team
    Management**, **Audit Logs**, and **Roles and permissions**, but cannot
    change user roles or edit permission matrices.
  </Card>
</CardGroup>

<Warning>
  CodeRabbit roles are independent from Git platform roles (GitHub, GitLab,
  etc.). Changing a CodeRabbit role doesn't affect Git platform permissions, and
  vice versa.
</Warning>

<Tip>
  Roles only affect administrative features. All users can access developer
  features like code reviews based on their seat assignments, regardless of
  role.
</Tip>

For complete administrative functions by role, see [Role permissions](#role-permissions).

## Default roles

CodeRabbit automatically assigns default roles based on Git platform permissions:

<CardGroup>
  <Card title="Admin (default)">
    Users with ownership-level Git platform roles (GitHub Admin, Bitbucket
    Owner) receive the Admin role
  </Card>

  <Card title="Member (default)">
    All other users receive the Member role by default
  </Card>
</CardGroup>

<Info>
  Default assignments happen only during initial account setup. Subsequent Git
  platform changes don't affect CodeRabbit roles.
</Info>

You can modify roles after initial assignment if you have Admin privileges.

## Manage user roles

### View current roles

<Steps>
  <Step title="Access CodeRabbit dashboard">
    Go to the [CodeRabbit
    dashboard](https://app.coderabbit.ai/settings/repositories).
  </Step>

  <Step title="Select your organization">
    Choose the organization from the sidebar dropdown.
  </Step>

  <Step title="Navigate to Subscription">
    Click **Subscription** in the sidebar.
  </Step>
</Steps>

The main table shows Admin and Member accounts with their current roles. Click the **Billing Admins** tab to view billing administrators.

### Change user roles

<Info>You must have the Admin role to modify other users' roles.</Info>

<Steps>
  <Step title="Access the user accounts table">
    Follow the steps above to reach your organization's Subscription page.
  </Step>

  <Step title="Update the role">
    Click the dropdown in the user's **Role** column and select the new role.
  </Step>
</Steps>

You can only assign Admin and Member roles through this method. Billing Admin requires a separate invitation process.

### Add billing administrators

<Info>
  Billing Admin users don't consume seat licenses. Add them regardless of
  available seats.
</Info>

<Steps>
  <Step title="Access user management">
    Navigate to your organization's Subscription page as described above.
  </Step>

  <Step title="Send invitation">Click **Invite Billing Admin**.</Step>

  <Step title="Enter details">
    Provide the name and email address of the billing administrator.
  </Step>
</Steps>

The invited user will receive an email to complete setup. Their account appears under the **Billing Admins** tab after activation.

<Info>
  Once a `Billing Administrator` has been successfully invited, they should use the following login process:

  1. Navigate to the [Sign in with email](https://app.coderabbit.ai/sign-in-with-email) page.
  2. Enter tenant name and email address.
  3. A login pass should be received via email.
  4. Use this login pass to access the account.

  Save the sign-in link for future use whenever a new login pass needs to be requested. If the login page does not load properly, clear the browser cache or try using an Incognito window.
</Info>

## Role permissions

Administrative functionality available by role:

| Resource                           | Admin      | Member     | Billing Admin |
| ---------------------------------- | ---------- | ---------- | ------------- |
| Learning Resources (Web Interface) | Read/Write | Read/Write | Read/Write    |
| Metrics/Dashboard                  | Read/Write | Read/Write | Read-only     |
| Reports                            | Read/Write | Read/Write | Read/Write    |
| Integrations                       | Read/Write | Read/Write | Read/Write    |
| Repository Settings                | Read/Write | Read/Write | No access     |
| Organization Settings              | Read/Write | Read-only  | Read-only     |
| Team Management                    | Read/Write | Read-only  | Read-only     |
| Subscription and Billing           | Read/Write | No access  | Read/Write    |
| Roles and permissions              | Read/Write | No access  | Read-only     |
| Audit Logs                         | Read-only  | No access  | Read-only     |

<Info>
  All users can manage learnings through pull request comments regardless of
  role. The Learning Resources permissions apply only to web interface
  management.
</Info>

## API reference <EnterprisePlanBadge />

User roles can be managed programmatically using the REST API:

| Endpoint                                                    | Description                                          |
| ----------------------------------------------------------- | ---------------------------------------------------- |
| [`POST /v1/users/roles`](/api-reference/users-change-roles) | Bulk assign or change roles for organization members |

For managing custom roles via API, see the [Custom roles API reference](/management/custom-roles#api-reference).

## Custom roles <EnterprisePlanBadge />

Enterprise customers can create custom roles with granular permissions beyond the built-in Admin, Member, and Billing Admin roles. Custom roles let you define exactly what each role can access — from organization settings to reports, learnings, and team management features.

For full details on creating and managing custom roles, see [Custom roles and permissions](/management/custom-roles).

## What's next

<CardGroup>
  <Card title="Manage your subscription" href="/management/billing" icon="credit-card">
    Configure seat assignments, billing settings, and subscription details for your organization.
  </Card>

  <Card title="Custom roles and permissions" href="/management/custom-roles" icon="user-lock">
    Create custom roles with granular permissions for Enterprise organizations.
  </Card>
</CardGroup>


# Seat assignment
Source: https://docs.coderabbit.ai/management/seat-assignment

Understand how CodeRabbit assigns seats to users, including trial mode, manual approval, and auto-approval methods.

<AdminRoleBadge />

CodeRabbit ingests users from your git provider (GitHub, GitLab, Bitbucket, and Azure DevOps) and assigns seats based on your organization's active seat assignment mode. Understanding these modes helps you control who gets access to CodeRabbit reviews and how billing is affected.

<Info>
  For managing billing, invoices, and changing your seat count, see [Manage your subscription](/management/billing).
</Info>

## Seat assignment methods

### Trial mode

This mode is only active during the trial. In trial mode, users are automatically provisioned with a seat when they raise a PR in a repository where CodeRabbit is installed.

<Tip>
  To prevent users from getting a seat, you can filter them out using the
  `ignore_usernames` filter.
</Tip>

<Note>
  After the trial ends, organizations automatically transition to manual
  approval mode.
</Note>

### Manual approval

In this mode, admins can update their seat counts manually. When a user without a seat raises a PR in a repository where CodeRabbit is installed, they receive a note on their PR indicating that they do not have a seat and will receive a free tier summary.

<Tip>
  Use the `enable_free_tier` configuration setting to disable free tier reviews
  for users without paid seats.
</Tip>

### Auto-approval

In this mode, users are automatically provisioned seats when they raise a PR in a repository where CodeRabbit is installed.

Automatic assignment is triggered only when a user opens a pull request. Pushing new commits (a synchronize event) to an existing pull request does not assign a seat, so an unseated author remains unseated until they open a new pull request or an administrator assigns one. Newly provisioned users can open a new pull request to trigger automatic assignment. Other users should ask an administrator to assign a seat through [subscription management](/management/subscription-management).

If there is an existing user with a seat who has not raised a CodeRabbit pull request in the last 30 days, that seat is reallocated to the new user. If all seats are taken, CodeRabbit can provision a new license and charge a prorated amount. Enterprise organizations are capped at their purchased seat count, as described in [Enterprise SSO workspaces](#enterprise-sso-workspaces).

<Tip>
  To prevent users from getting a seat, you can filter them out using the
  `ignore_usernames` filter.
</Tip>

## Managing seat assignments

To change your seat assignment mode, navigate to **Team Management** in the CodeRabbit dashboard and click the settings icon next to **Invite Billing Admin**. From this menu, you can switch between auto-approval and manual approval modes. Click **Confirm** to save your changes.

<Frame>
  <img alt="Seat assignment settings showing auto-approval and manual approval options" />
</Frame>

<Info>
  Enterprise customers can assign custom roles in addition to the built-in Admin, Member, and Billing Admin roles. For details on creating and managing custom roles, see [Custom roles and permissions](/management/custom-roles).
</Info>

### Enterprise SSO workspaces

Enterprise SSO workspaces manage seats from **Workspace Team Management**. Open the seat assignment settings to switch between **Automatic** and **Manual** modes.

In **Automatic** mode, a member is assigned a seat when they open a pull request while purchased seat capacity remains. Once all purchased seats are in use, CodeRabbit does not increase the subscription's seat count, and the pull request author is treated as ineligible for the normal review flow. Automatic seat assignment resumes after seat capacity is freed, such as through reallocation, or the purchased seat count is increased.

#### How Enterprise SSO seats are counted

Every pull request author is identified by a **Git identity**, such as a GitHub username, GitLab username, Bitbucket account, or Azure DevOps identity. That Git identity must be covered by a seat to receive paid PR reviews.

In **Workspace Team Management**, CodeRabbit assigns the seat to a member entry. A member entry can be:

* An **IdP member**: A person who signed in through SSO or was provisioned from your identity provider through SCIM.
* A **Git-only member**: An entry created for a Git identity that has pull request activity but is not yet linked to an IdP member.

A seat on either type of member entry covers all Git identities linked to it. The same Git identity can receive reviews across every organization or group for the same Git provider and provider instance in the workspace without another seat.

| Scenario                                                                                                            | Seats consumed |
| ------------------------------------------------------------------------------------------------------------------- | -------------- |
| One GitHub Cloud username in ten GitHub organizations                                                               | One            |
| One GitLab.com username in multiple GitLab groups                                                                   | One            |
| The same person contributing through GitHub and GitLab while the identities are on separate member entries          | Two            |
| The same person using GitHub Cloud and GitHub Enterprise Server while the identities are on separate member entries | Two            |
| The same person using two GitHub Enterprise Server instances while the identities are on separate member entries    | Two            |
| Multiple Git identities linked to one IdP member                                                                    | One            |

<Info>
  When estimating seats, count each separate Git identity unless you know that
  the identities will be linked to the same IdP member.
</Info>

CodeRabbit does not automatically combine Git identities across providers. Git providers do not expose a shared, stable identifier that reliably links a GitHub username, GitLab username, Azure DevOps identity, or self-hosted account to the same person. Email and SAML attributes can differ between providers or may not be available, especially for self-hosted instances.

Enterprise SSO workspaces use one CodeRabbit subscription across the workspace. Adding another organization for an already linked Git identity on the same provider instance does not require another seat.

#### How IdP members, Git identities, and seats relate

The Git identity that opens a pull request determines who needs review access. The member entry that contains that Git identity determines where CodeRabbit assigns the seat.

* If the Git identity is linked to an **IdP member**, the seat is assigned to that IdP member and covers every Git identity linked to the member.
* If the Git identity is not linked to an IdP member, CodeRabbit represents it as a **Git-only member**. That entry can receive a seat so the Git identity can receive paid PR reviews.

In **Manual** mode, admins assign seats to IdP members or Git-only members from **Workspace Team Management**.

In **Automatic** mode, when a Git identity opens a pull request, CodeRabbit finds the member entry that contains it and assigns a seat if needed. If the identity has not been linked to an IdP member, CodeRabbit creates or uses its Git-only member entry.

Admins can link Git identities to an IdP member through **Workspace Team Management** by selecting the member and using **Edit member links**. The same links can be managed with the [User Management API](/api-reference/users-manage-seats). Linking identities that were on separate member entries consolidates them under the IdP member. One seat then covers all of the linked Git identities, and any duplicate seat is freed.

<Info>
  An IdP member provisioned through SCIM initially appears in **Workspace Team
  Management** without a seat. SCIM does not automatically link existing Git
  identities to the new member. An admin must link the appropriate identities
  through the UI or API.
</Info>

When an IdP member is removed through SCIM, CodeRabbit removes the member, their linked Git identities, and their seat from **Workspace Team Management**. If one of those Git identities opens a pull request later, it reappears as a Git-only member and follows the workspace's current seat assignment mode.

#### Choose a seat assignment mode

In **Automatic** mode, CodeRabbit assigns a seat to the member entry containing a Git identity when that identity opens a pull request. If all seats are taken, CodeRabbit can provision a new license according to your subscription.

In **Manual** mode, admins assign seats to IdP members or Git-only members individually from **Workspace Team Management**. Individual seat assignment controls are disabled while Automatic mode is on.

**Workspace Team Management** does not assign consumed seats to billing admins. If a billing admin already has a seat, admins can still unassign it. For role-editing details, see [Workspace roles](/management/sso#workspace-roles).

## Pending unassignment

When you unassign a seat from a user on a monthly paid subscription, the seat is marked as "Pending unassignment" rather than being immediately unassigned. This allows for more flexibility in managing your team while maintaining fair billing practices.

### How "Pending unassignment" works

* **Delayed unassignment**: When you unassign a seat from a monthly subscriber, it remains active until the end of your current billing cycle
* **Continued access**: Users with "Pending unassignment" seats retain full CodeRabbit access until the billing cycle ends
* **Automatic cleanup**: At the end of the billing cycle, all "Pending unassignment" seats are automatically unassigned, and the users will lose the seat

<Note>
  This "Pending unassignment" behavior applies **only to monthly paid
  subscriptions**. Annual subscriptions and other non-monthly subscription types
  are not affected by this behavior.
</Note>

### Billing implications

"Pending unassignment" seats are still counted as active seats for billing purposes during the current cycle. You will continue to be charged for these seats until they are automatically unassigned at the end of your billing period.

This approach ensures you get full value from your subscription while giving you the flexibility to adjust your team composition as needed.

## Troubleshooting

### Existing users having their seats removed

When auto-approval mode is enabled, users have their seats reassigned if they have not raised a PR in the last 30 days and a new user without a seat opens a PR.

### New users in auto-approval mode getting new licenses despite open seats

This is likely due to bot users or external users that have seats. These users are displayed separately from regular git provider organization members.

### Users without seats still receiving CodeRabbit reviews on their PRs

Users without paid seats to CodeRabbit still receive free-tier CodeRabbit reviews unless the `enable_free_tier` setting is disabled.

### Why does a user still have access after I unassigned their seat?

For monthly paid subscriptions, unassigned seats are marked as "Pending unassignment" and remain active until the end of the current billing cycle. This means users retain full CodeRabbit access during this period. See the [Pending unassignment](#pending-unassignment) section for more details on this behavior.

### When will a "Pending unassignment" seat become available for reassignment?

"Pending unassignment" seats are automatically unassigned at the end of your billing cycle. Once the billing cycle ends, the seat becomes fully available for reassignment to a new user. Until then, the seat remains allocated to the original user.

## What's next

<CardGroup>
  <Card title="Manage your subscription" href="/management/subscription-management">
    Access billing history, change plans, and adjust seats
  </Card>

  <Card title="Manage team roles" href="/management/roles">
    Control who can access CodeRabbit and manage administrative settings
  </Card>
</CardGroup>


# Subscription management
Source: https://docs.coderabbit.ai/management/subscription-management

Start a free trial, switch trial plans, convert to a paid subscription, reactivate after cancellation, or cancel a paid subscription.

<AdminRoleBadge />

Start a free trial, switch trial plans, convert to a paid subscription, reactivate your account after cancellation, or cancel a paid subscription from the same **Subscription and Billing** page.

## Starting a free trial

If your organization does not have an active subscription yet, admins and Billing Admins can start a new trial directly from [**Subscription and Billing**](https://app.coderabbit.ai/settings/subscription). No credit card is required.

### Start a new trial from Subscription and Billing

<Steps>
  <Step title="Open subscription settings">
    Go to [**Subscription and Billing**](https://app.coderabbit.ai/settings/subscription) in your organization settings.
  </Step>

  <Step title="Start the trial">
    Click **Start Free Trial** to begin a 14-day Pro+ trial for the organization.
  </Step>

  <Step title="Begin using CodeRabbit">
    Install CodeRabbit on a repository and open a pull request, or continue configuring billing and seat settings from the same page while the trial is active.
  </Step>
</Steps>

## Activating your subscription

Your trial starts on the Pro+ plan. During the trial, you can switch the trial tier between Pro and Pro+ or schedule a paid subscription to begin after the trial ends. See [Plans and pricing](/management/plans) to compare what's included in each plan and to review the plan limits.

### Select your plan, seats, and activation timing

<Steps>
  <Step title="Initiate activation">
    Go to [**Subscription and Billing**](https://app.coderabbit.ai/settings/subscription) in your organization settings and click **Upgrade** from the current plan card.
  </Step>

  <Step title="Choose your plan">
    Select **Pro** or **Pro+** based on your needs. Pro covers all review features; Pro+ adds upstream and downstream workflow actions like issue planning, unit test generation, and higher limits.
  </Step>

  <Step title="Choose your seat count">
    Select the number of seats you need for your paid subscription. This is your initial seat count and can be different from the number of users who had seats during trial.
  </Step>

  <Step title="Select activation timing">
    Choose when billing should start:

    * **Activate Immediately**: Billing starts now and your trial ends immediately
    * **Continue Trial**: Billing starts when your trial expires, giving you the remainder of your trial to continue evaluating
  </Step>

  <Step title="Complete activation">
    Review your selections and billing impact. If you activate immediately and have a coupon code, enter it in the order summary and click **Apply** before you confirm the subscription. Add payment information if needed, then confirm activation.
  </Step>
</Steps>

<Info>
  Coupon codes are not available for subscription changes scheduled for the end of a trial. Start the subscription immediately if you need to enter a coupon code during activation.
</Info>

<Info>
  After activation, your seat assignment mode transitions from trial mode to manual approval. Learn more about [seat assignment modes](/management/seat-assignment).
</Info>

### Manage a scheduled trial subscription

When you schedule a paid subscription for after the trial, **Billing Overview** shows a banner with the subscription start date. Open **Manage trial** to switch the trial tier, edit the scheduled subscription before it starts, or start the subscription immediately.

## Reactivating a canceled subscription

Returning to CodeRabbit after cancellation? Reactivation works similarly to trial activation, but without trial timing options since you're already a returning customer.

### Reactivate with custom seat count

<Steps>
  <Step title="Start reactivation">
    Go to [**Subscription and Billing**](https://app.coderabbit.ai/settings/subscription) and click **Upgrade Plan**, **Reactivate Plan**, or **Remove Cancellation**, depending on your subscription state.
  </Step>

  <Step title="Select your plan">
    Choose Pro or Pro+. Select the plan that matches the CodeRabbit rate limits and agent features your team needs.
  </Step>

  <Step title="Select your seat count">
    Choose the number of seats you need. This can be different from your previous subscription; you're not locked to your old seat count. Adjust based on your current team size without needing to contact support.
  </Step>

  <Step title="Complete reactivation">
    Review the order summary, optionally apply a coupon code, then add or confirm payment information and activate your subscription. Billing starts immediately.
  </Step>
</Steps>

<Info>
  Need to adjust seats after reactivation? You can change your seat count anytime through [billing and plans](/management/billing#plans-and-seats).
</Info>

<Info>
  CodeRabbit supports one coupon at a time for subscription changes. If your subscription already has a coupon, the current coupon appears in the order summary and you cannot apply another one until the existing coupon is removed or expires.
</Info>

## Canceling a paid subscription

Admins and Billing Admins can cancel a paid CodeRabbit subscription directly from [**Subscription and Billing**](https://app.coderabbit.ai/settings/subscription).

<Steps>
  <Step title="Open subscription settings">
    Go to [**Subscription and Billing**](https://app.coderabbit.ai/settings/subscription) in your organization settings.
  </Step>

  <Step title="Open Danger Zone">
    Select the **Danger Zone** tab.
  </Step>

  <Step title="Start cancellation">
    Click **Cancel subscription**.
  </Step>

  <Step title="Confirm the cancellation">
    Select one or more cancellation reasons, add optional feedback, acknowledge the access and Free-tier downgrade notices, then confirm the cancellation.
  </Step>
</Steps>

After cancellation is scheduled, access continues until the end of the current billing cycle. The organization downgrades to the Free plan at renewal, review history and configuration are retained, and you can resubscribe later.

<Info>
  If the page is read-only, your account does not have permission to manage the subscription. Ask an Admin or Billing Admin to complete the cancellation, or see [Roles and permissions](/management/roles).
</Info>

## What's next

<CardGroup>
  <Card title="Billing and plans" href="/management/billing" icon="receipt">
    View invoices, change your subscription plan, and adjust seat counts
  </Card>

  <Card title="Seat assignment" href="/management/seat-assignment" icon="users">
    Understand how CodeRabbit assigns seats during trials, with auto-approval, and manual approval
  </Card>
</CardGroup>


# Set permissions
Source: https://docs.coderabbit.ai/management/upgrading-permissions

Learn how to grant updated permissions to CodeRabbit when new features require additional GitHub access.

When CodeRabbit introduces new features, it may require additional GitHub permissions to function properly. If you see permission warnings or notice that certain features aren't working, follow this guide to update your permissions.

## When you need to update permissions

<Warning>
  If you see a permission warning in CodeRabbit or notice missing functionality,
  you likely need to approve updated permissions for the GitHub App.
</Warning>

<img alt="Permission warning example" />

## Update permissions

<Steps>
  <Step title="Navigate to GitHub settings">
    Go to your GitHub organization or repository settings page.
  </Step>

  <Step title="Access GitHub Apps">
    Navigate to the "GitHub Apps" or "Installed GitHub Apps" section in the
    settings sidebar.
  </Step>

  <Step title="Find CodeRabbit">
    Locate CodeRabbit in the list of installed applications.
  </Step>

  <Step title="Configure the app">
    Click the "Configure" button next to CodeRabbit.
  </Step>

  <Step title="Review and accept permissions">
    Review the new permissions being requested and click "Accept new
    permissions" to approve them. <img alt="Granting updated
    permissions" />
  </Step>
</Steps>

<img alt="Updated permissions" />

## Why permissions are updated

CodeRabbit may request additional permissions for several reasons:

* **New GitHub features**: Access to recently released GitHub APIs and capabilities
* **Enhanced scanning**: Deeper repository analysis and code review features
* **Workflow automation**: Improved CI/CD integration and automated processes
* **Security enhancements**: Advanced security scanning and vulnerability detection

<Note>
  **Not an organization admin?** If you don't have admin privileges, you'll need
  to request approval from your organization administrators to update the
  permissions. Share this guide with them to expedite the process.
</Note>

## Troubleshooting

After updating permissions, CodeRabbit should have all the access it needs. If you continue experiencing issues:

<Steps>
  <Step title="Refresh your browser">
    Clear your browser cache and refresh the CodeRabbit dashboard.
  </Step>

  <Step title="Wait a few minutes">
    Permission changes may take a few minutes to propagate across GitHub's
    systems.
  </Step>

  <Step title="Contact support">
    If problems persist, reach out to our [support
    team](/support) for assistance.
  </Step>
</Steps>

<Check>
  **Need help?** Visit our [support page](/support) or join our
  [Discord community](https://discord.gg/coderabbit) for assistance.
</Check>


# Usage-based Add-on
Source: https://docs.coderabbit.ai/management/usage-based-addon

Buy credits to continue eligible PR reviews and CLI-triggered reviews after the applicable review limit is reached.

<ProPlanBadge />

<AdminRoleBadge />

The **Usage-based add-on** lets Pro, Pro+, and Enterprise organizations continue processing eligible PR reviews and CLI reviews after reaching the applicable review limit. It is the best option for teams that need uninterrupted high-volume review activity beyond their plan allowance and fair usage availability timing. Credits are consumed only when an eligible review continues over that limit. Manage credits and the add-on toggle from the **Usage-based add-on** tab in [Subscription and Billing](https://app.coderabbit.ai/settings/subscription).

<Info>
  The add-on is available on the Pro plan and above and is not visible during a trial. The in-app activation option may not appear for organizations on certain billing arrangements; contact support if the pay-as-you-go toggle is unavailable. Your organization shares one credit balance across all PR and CLI reviews.
</Info>

## Credit pricing

|                           |        |
| ------------------------- | ------ |
| Price per credit          | \$1.00 |
| Cost per reviewed file    | \$0.25 |
| Files reviewed per credit | 4      |

## PR review behavior

When a review is over the applicable limit, the add-on behavior depends on whether it is enabled and whether credits are available:

| Situation                                        | Behavior                                                                                                                      |
| ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- |
| Within the applicable limit                      | Reviews work as normal. No credits are used.                                                                                  |
| Over limit, add-on enabled, credits available    | CodeRabbit continues reviewing and charges pay-as-you-go for each eligible over-limit review. No interruption for developers. |
| Over limit, add-on disabled                      | Developers see a message that the review limit has been reached. An admin can enable the add-on to continue.                  |
| Over limit, add-on enabled, credits insufficient | Developers see a message to contact an admin to purchase more credits.                                                        |

### Large pull requests

File limits per review are separate from the rolling review limits. See [Plans and pricing](/management/plans#rate-limits) for the included file limit for each plan.

When an eligible GitHub pull request exceeds the included file limit but contains no more than 300 files, CodeRabbit skips the automatic review and can display a **Review on demand using usage pricing** action. Selecting the action explicitly authorizes the review to use the usage-based billing path. Generic retry and manual review commands do not authorize usage pricing for a large pull request.

The review proceeds only when usage-based reviews are enabled and sufficient credits or spending capacity are available. Pull requests with more than 300 files cannot be reviewed through this action. Other Git providers show the file-limit message without the interactive usage-priced action.

CLI-triggered reviews follow the same billing path and opt-in logic as reviews from GitHub, GitLab, and Bitbucket PR pages. Authenticated CLI and agentic API-key reviews use the assigned user's plan allowance first. Credits are consumed only after the review reaches the applicable limit and the request is attributed to a user with an assigned seat.

For Pro and Pro+ PR reviews, your plan includes a per-developer hourly allowance. Developers with typical PR review activity continue to see reviews become available normally for their plan. When one developer identity reaches the 95th percentile or higher of recent CodeRabbit PR review usage, CodeRabbit gradually spaces out additional reviews for that developer. Your plan allowance is not changed. To learn more, see our [Fair Usage Limits Policy](/management/plans#fair-usage-limits-policy).

If high volume is not intentional, tune [automatic review controls](/configuration/auto-review) before relying on credits: pause automatic incremental reviews after 1 or 2 reviewed commits, turn off automatic reviews and add a configured ready-for-review label to opt PRs in, use title exclusions for WIP or generated changes, or request reviews manually for noisy repositories. Use credits when the extra throughput is intentional and you want eligible over-limit reviews to continue without waiting for the next included review.

### Enable the add-on

Admins enable and disable the add-on using the pay-as-you-go toggle in **Organization Settings** in the [CodeRabbit dashboard](https://app.coderabbit.ai/settings/subscription?tab=usage). There is one toggle, one credit balance, and one billing path covering all PR and CLI reviews.

### Manage credits

<Steps>
  <Step title="Open the Usage-based add-on tab">
    Go to **[Subscription and Billing](https://app.coderabbit.ai/settings/subscription)** in your organization settings, then open the **Usage-based add-on** tab.
  </Step>

  <Step title="Buy credits">
    Choose one of the available purchase options:

    * **One-time purchase** — buy a fixed credit amount as needed.
    * **Monthly subscription** — set a recurring monthly credit amount billed automatically.
    * **Auto-refill** — automatically top up your balance when it falls below a threshold. You can set a monthly cap for automated refills, with a minimum cap of `$20`.

    Preset amounts of $20, $40, $80, and $100 are available, with a custom entry for larger one-time purchases.
  </Step>

  <Step title="Review usage and transaction history">
    Track total credits purchased, remaining balance, and recent usage events in
    the same tab.
  </Step>
</Steps>

When auto-refill is enabled, CodeRabbit checks the configured monthly cap before each automated refill. The cap applies only to auto-refill charges in the current UTC calendar month. If the next refill would exceed the cap, CodeRabbit skips the automated refill instead of charging a smaller partial refill. Manual credit purchases are not limited by the auto-refill cap.

## What's next

<CardGroup>
  <Card title="Plans and pricing" href="/management/plans" icon="credit-card">
    Compare CodeRabbit plans and understand per-developer rate limits
  </Card>

  <Card title="Billing and plans" href="/management/billing" icon="receipt">
    View invoices, change your subscription plan, and adjust seat counts
  </Card>
</CardGroup>


# The System Behind Every Review Comment
Source: https://docs.coderabbit.ai/overview/architecture

CodeRabbit Architecture | How CodeRabbit works internally

While other tools just scan your changed code, CodeRabbit **orchestrates an entire system** for every single review. This isn't a simple "review this changeset" prompt to an LLM. It's a **production-grade AI infrastructure** designed for one purpose: understanding your code at the deepest level possible.

<Frame>
  <img alt="CodeRabbit Architecture" />
</Frame>

Behind each comment lies:

* **Sandboxed cloud execution** with your full repository cloned for isolated analysis
* **Multi-dimensional code analysis** combining 50+ static analyzers, linters and SAST tools
* **Agentic exploration** that autonomously investigates your codebase for context
* **Specialized AI agents** working in parallel: Review, Verification, Chat, Pre-Merge Checks, and <Hint type="finishing-touches" />
* **Living memory** that learns from your feedback, PRs, issues, and coding guidelines
* **Enterprise integrations** connecting your entire development workflow

**That's why CodeRabbit doesn't just review code, it understands it.**


# CodeRabbit Plan
Source: https://docs.coderabbit.ai/overview/coderabbit-plan

Turn ideas, issues, PRDs, and designs into precise Coding Plans grounded in your codebase, then hand them off to any coding agent.

<Info>
  Platform Tour guides you through all major CodeRabbit features and surfaces. For the detailed documentation on CodeRabbit Plan, follow [this link](/plan).
</Info>

[CodeRabbit Plan](/plan) turns your ideas into detailed, project-aware Coding Plans you can review, refine, and hand off to any coding agent. Because every plan is grounded in [deep codebase understanding](/overview/architecture) and enriched by your project [Knowledge Base](/knowledge-base), it references the right files, follows your established patterns, and produces agent-ready prompts, not generic outlines.

## 1. Create a plan

<Tabs>
  <Tab title="Using web interface">
    The fastest way to get started is the CodeRabbit web app. Go to [app.coderabbit.ai/plan](https://app.coderabbit.ai/plan/new), describe what you want to build in free-form text, select a repository, and click **Create plan**. The form also supports file attachments.

    See the [Create a plan guide](/plan/create-plan) for the full step-by-step walkthrough.
  </Tab>

  <Tab title="Using issue tracker">
    You can generate Coding Plans directly from your issue tracker. Comment `@coderabbitai plan` on any issue, or enable auto-planning to generate plans automatically when issues match your rules.

    <CardGroup>
      <Card title="GitHub" icon="github" href="/issues/planner/github" />

      <Card title="GitLab" icon="gitlab" href="/issues/planner/gitlab" />

      <Card title="Azure DevOps" icon="microsoft" href="/issues/planner/azure-devops" />

      <Card title="Jira" icon="jira" href="/issues/planner/jira" />

      <Card title="Linear" icon="linear" href="/issues/planner/linear" />
    </CardGroup>
  </Tab>
</Tabs>

<br />

<CardGroup>
  <Card title="Codebase understanding" icon="code-xml">
    Analyzes your repository's architecture, patterns, and existing code so
    every plan fits naturally into how your project is built.
  </Card>

  <Card title="Project context" icon="database">
    Draws on related issues, design documents, and accumulated <Hint type="learnings">learnings</Hint> to
    ground every plan in your project's broader context.
  </Card>
</CardGroup>

## 2. Refine

Chat with CodeRabbit to refine details, challenge design choices, or request changes. The conversation is collaborative: product owners and other team members can participate too, ensuring the plan reflects the team's knowledge.

<Tabs>
  <Tab title="Web app">
    Review, tune, and adjust your Coding Plan in the CodeRabbit web app. Use the
    chat panel to iterate on the plan until it's ready.

    <Frame>
      <img alt="Coding Plan in the CodeRabbit web app" />
    </Frame>
  </Tab>

  <Tab title="Issue Trackers (GitHub & GitLab)">
    The full Coding Plan is posted as a comment directly on the issue. Reply to
    the plan comment to refine details, challenge design choices, or request
    changes.

    <Frame>
      <img alt="Coding Plan posted as a comment on a GitHub issue" />
    </Frame>
  </Tab>
</Tabs>

<br />

<Card title="Collaborative Planning" icon="users">
  Plans are available for review by engineers and product owners. Team members discuss, challenge design choices, and refine plans together.
</Card>

<Card title="Accountability and history" icon="clipboard-clock">
  Every plan version is preserved. Track what was planned, when it was planned, and why decisions were made.
</Card>

## 3. Handoff

Once the plan reflects the team's decisions, hand off the finalized prompts to your coding agent of choice. The agent receives precise, codebase-aware instructions it can act on immediately.

<Card title="Agent-ready prompts" icon="zap">
  Finalized plans are exported as structured, codebase-aware prompts that any coding agent can act on immediately — no reinterpretation required.
</Card>

<Card title="Any coding agent" icon="bot">
  Hand off to Claude Code, Codex, Cursor, Gemini, or any other coding agent. The prompt format is agent-agnostic.
</Card>

## What's next

<CardGroup>
  <Card title="CodeRabbit Plan documentation" icon="book" href="/plan">
    Full documentation covering the web interface, plan structure, refinement, and Agent Handoff.
  </Card>

  <Card title="Issue-based planning" icon="ticket" href="/issues/planner">
    Platform-specific guides for generating Coding Plans from GitHub, GitLab, Azure DevOps, Jira, and Linear issues.
  </Card>

  <Card title="CodeRabbit Agent for Slack" icon="slack" href="/overview/slack-agent">
    Bring AI-powered investigation, planning, and code editing into your Slack workspace.
  </Card>
</CardGroup>


# Code reviews in IDE and CLI
Source: https://docs.coderabbit.ai/overview/ide-cli-review

Review your code in IDE or CLI before pushing it to the repo

<Info>
  Platform Tour guides you through all major CodeRabbit features and surfaces. For the detailed documentation on the features, use [CLI documentation](/cli) or [IDE documentation](/ide).
</Info>

CodeRabbit brings AI-powered code reviews directly into your development environment, no pull request required. Review uncommitted changes as you code, apply fixes instantly, integrate seamlessly with your AI coding agents, or run reviews in CI/CD pipelines. Same context-aware analysis as PR reviews, but right where you write code.

## IDE Extension

<Card title="Review code as you write" icon="laptop" href="/ide">
  Get instant feedback in VS Code, Cursor, Windsurf, and any VS Code-based IDE. Review uncommitted changes, apply one-click fixes, or send complex issues to your AI agent.

  **Key features:**

  * Review uncommitted changes in real-time
  * One-click fixes and AI agent integration (Copilot, Claude Code, Cline, Roo Code and more)
  * Automatically detects team coding standards (`CLAUDE.md`, `.cursorrules`, etc.)

  [Learn more about IDE Extension →](/ide)
</Card>

## CLI Tool

<Card title="Pre-commit reviews from the command line" icon="square-terminal" href="/cli">
  Run CodeRabbit review before you open a pull request or as a part of your custom CI/CD pipeline.

  **Key features:**

  * Review committed and uncommitted local changes before pushing
  * Works as Claude Code plugin, Skill or standalone CLI
  * Integrates with Cursor, Codex, Gemini, and other AI agents
  * Output modes: plain text or agent-optimized
  * Perfect for CI/CD pipelines

  [Learn more about CLI Tool →](/cli)
</Card>


# Pull Request Reviews
Source: https://docs.coderabbit.ai/overview/pull-request-review

Within moments of opening a pull request, CodeRabbit analyzes your code with multiple AI models and provides actionable feedback, catching issues that are easy to miss in manual reviews.

<Info>
  Platform Tour guides you through all major CodeRabbit features and surfaces. For the detailed documentation on the Pull Request Reviews, use [this link](/guides/code-review-overview).
</Info>

<CardGroup>
  <Card title="Bug detection" icon="bug">
    Spot potential runtime errors, null pointer exceptions, race conditions, and
    logic flaws before deployment
  </Card>

  <Card title="One-click fixes" icon="mouse-pointer-click">
    Apply suggested changes directly to your PR with a single click—no copy-paste,
    no switching contexts
  </Card>

  <Card title="Smart suggestions" icon="wand-sparkles">
    Get context-aware refactoring recommendations based on your entire codebase,
    not just the changed lines
  </Card>

  <Card title="Continuous improvements" icon="brain">
    CodeRabbit remembers your feedback and applies it to future reviews, getting
    smarter with each PR
  </Card>
</CardGroup>

## Automatic and incremental

CodeRabbit reviews new pull requests automatically and updates its feedback as you push new commits—focusing on what changed.

* **New PRs**: Full analysis of all changes with detailed findings
* **New commits**: Incremental reviews that track what's new since the last review
* **Every update**: Fresh insights without repeating resolved comments

Zero config to start: just open a PR and get the results! This documentation will guide you through review instructions, focus areas, and review style tuning to make the outcome even better.

## Connected to your workflow

CodeRabbit [links relevant issues](/issues/pr-validation) from GitHub, Jira, or Linear to your pull requests, ensuring nothing falls through the cracks. It validates changes against issue requirements and acceptance criteria, catching misalignments before merge.

No more hunting through issue trackers to understand what a PR should accomplish, context is right there when you need it.

## Beyond your CI/CD pipeline

While your linters catch style issues and security scanners flag known vulnerabilities, CodeRabbit understands context:

* Detects bugs that static analyzers miss
* Suggests architecture improvements based on your full repository
* Identifies performance bottlenecks in your logic
* Points out maintainability issues before they compound

Think of it as an experienced teammate who's always available for that first review. The same second!

## Keep the conversation going

Every review comment is the start of a conversation. Reply to ask for clarification, request code examples, or discuss alternatives:

```md theme={null}
@coderabbitai Suggest a better approach for this error handling
```

CodeRabbit has full repository context and can explain its reasoning, generate code, or adjust suggestions based on your feedback.

## What's next

Pull request reviews are just the beginning. CodeRabbit also works in [your IDE](/overview/ide-cli-review) and [from the command line](/overview/ide-cli-review), bringing AI assistance directly into your development workflow.


# CodeRabbit Agent for Slack
Source: https://docs.coderabbit.ai/overview/slack-agent

Bring AI-powered investigation, planning, and code editing into your Slack workspace: with shared context, persistent knowledge, and governed access.

<EarlyAccessBadge />

<Info>
  Platform Tour guides you through all major CodeRabbit features and surfaces. For the detailed documentation on CodeRabbit Agent, follow [this link](/slack-agent).
</Info>

CodeRabbit Agent is an AI agent for **your entire SDLC** right in Slack:

* **Investigate** — Ask questions about your codebase, trace features, and cross-reference Sentry errors with merged PRs and Jira issues, all in natural language.
* **Plan** — Generate structured <Hint type="coding-plan" href="/slack-agent/plans">Coding Plans</Hint> from any Slack thread and hand them off to Claude Code, Codex, Cursor, or any coding agent.
* **Act** — Discuss requirements with your team, reference Linear issues or Figma drafts, then ask CodeRabbit to open a pull request incorporating everything.

<Frame>
  <img alt="Slack conversation where a developer asks CodeRabbit how rate limiting was handled on an existing endpoint, CodeRabbit finds the pattern across merged PRs and ADRs, recommends a lower default for the new endpoint, and opens a pull request after approval" />
</Frame>

CodeRabbit Agent responds to `@coderabbit` mentions in channels and threads, and to direct messages — no special syntax required. Every response runs within the <Hint type="scope" />, so the Agent only sees the repositories and connections your admins have approved for a specific channel. Context carries over between messages, a persistent <Hint type="knowledge-base" /> retains what your team discovers, and every conversation can be reviewed after the fact.

<CardGroup>
  <Card title="Scopes" icon="shield" href="/slack-agent/scopes">
    Control which repositories, connections, and settings are available per
    channel or DM.
  </Card>

  <Card title="Connections" icon="plug" href="/slack-agent/connections">
    Integrate with Jira, Linear, Notion, Sentry, Datadog, PagerDuty, Figma,
    Google Drive, MCP servers, and more.
  </Card>

  <Card title="Automations" icon="clock" href="/slack-agent/automations">
    Save scheduled or message-triggered work — vulnerability checks, weekly
    summaries, alert triage, and periodic audits — that post results into Slack
    threads.
  </Card>

  <Card title="Sandboxes" icon="box" href="/slack-agent/sandboxes">
    Shared environments where CodeRabbit Agent works on code changes and prepares
    pull requests.
  </Card>

  <Card title="Knowledge Base" icon="database" href="/slack-agent/knowledge-base">
    Persistent, team-wide store of facts and decisions that enriches every
    conversation.
  </Card>

  <Card title="Thread reviews" icon="eye" href="/slack-agent/thread-reviews">
    Web-based inspection of any CodeRabbit Agent conversation, with full context and
    citations.
  </Card>
</CardGroup>

## What's next

<CardGroup>
  <Card title="CodeRabbit Agent for Slack documentation" href="/slack-agent" icon="book">
    Full documentation covering capabilities, administration, security, and day-to-day usage.
  </Card>

  <Card title="CodeRabbit architecture" href="/overview/architecture" icon="microchip">
    The system behind every Coding Plan, review comment, and CodeRabbit Agent response.
  </Card>
</CardGroup>


# Agent Handoff
Source: https://docs.coderabbit.ai/plan/agent-handoff

Copy agent-ready prompts from a Coding Plan and hand them off to your preferred coding agent or IDE.

Once you are satisfied with a Coding Plan, Agent Handoff lets you select specific phases and produce precise, context-rich prompts ready for any coding agent. The prompts include all the context an agent needs: file paths, implementation details, and design decisions. This lets you use faster, cheaper models for execution without sacrificing quality.

## How Agent Handoff works

<Steps>
  <Step title="Open the plan detail view">
    In the CodeRabbit web app, navigate to the plan you want to hand off.
  </Step>

  <Step title="Select phases">
    Choose the phases you want to hand off. You can select individual phases for
    focused work, or select all phases for a complete handoff.
  </Step>

  <Step title="Click Agent Handoff">
    Open the Agent Handoff panel to see your output options.
  </Step>

  <Step title="Choose an output method">
    Pick how you want to deliver the prompt to your coding agent:

    * **Copy to clipboard:** Paste the prompt into any agent (Claude Code, GitHub Copilot, Cursor, or any other).
    * **Send to IDE:** Push the prompt directly to Cursor, Devin, VS Code, or Windsurf through the [CodeRabbit IDE extension](/ide).
  </Step>
</Steps>

## Supported agents and IDEs

Agent Handoff produces standard prompts that work with any coding agent. Additionally, the CodeRabbit IDE extension enables direct handoff to supported editors.

| Target                     | Method                                        |
| -------------------------- | --------------------------------------------- |
| **Cursor**                 | Direct via IDE extension or copy to clipboard |
| **Devin**                  | Direct via IDE extension or copy to clipboard |
| **VS Code** and extensions | Direct via IDE extension or copy to clipboard |
| **Windsurf**               | Direct via IDE extension or copy to clipboard |
| **Claude Code**            | Copy to clipboard                             |
| **GitHub Copilot**         | Copy to clipboard                             |
| **Any clipboard agent**    | Copy to clipboard                             |

<Info>
  For direct IDE handoff, install the [CodeRabbit IDE extension](/ide/vscode-install) first.
</Info>

## Tips for effective handoff

* Some coding agents may perform better with focused, sequential instructions rather than everything at once. Consider **Handing off one phase at a time** for complex plans.
* **Review the generated prompt before pasting.** The prompt is editable, so you can add clarifications or remove sections the agent doesn't need.
* **Match the model to the task.** Because the plan already contains precise instructions, you can often use faster or cheaper models for execution without losing quality.

## What's next

<CardGroup>
  <Card title="CodeRabbit IDE extension" href="/ide" icon="laptop">
    Install the extension to enable direct plan handoff to Cursor, Devin, VS Code, and Windsurf.
  </Card>

  <Card title="CodeRabbit Plan for issue trackers" href="/issues/planner" icon="map">
    Turn issues from GitHub, GitLab, Azure DevOps, Jira, or Linear into structured Coding Plans ready for any coding agent.
  </Card>
</CardGroup>


# Create a plan
Source: https://docs.coderabbit.ai/plan/create-plan

Create a Coding Plan from free-form descriptions, PRDs, designs, editor context, or attached files in the CodeRabbit web app, Issue Tracker or VS Code extension.

The [CodeRabbit web app](https://app.coderabbit.ai) and CodeRabbit VS Code extension let you create Coding Plans from free-form descriptions, PRDs, designs, editor context, or attached files, without going through an issue tracker. This is the fastest way to start planning when you already know what you want to build.

<Tabs>
  <Tab title="Web app">
    <Steps>
      <Step title="Open the New Plan page">
        Navigate to **Plan → New Plan** in the CodeRabbit web app, or go directly to [app.coderabbit.ai/plan/new](https://app.coderabbit.ai/plan/new).
      </Step>

      <Step title="Describe what you want to build">
        Enter a description of the feature, bug fix, or change you want to implement. Include goals, scope, and constraints. The more context you provide, the better the plan.
      </Step>

      <Step title="Attach files (optional)">
        Click the paperclip icon to attach supporting documents such as PRDs, design specs, architecture diagrams, or screenshots. Supported formats include text files, PDFs, and images.
      </Step>

      <Step title="Select the target repository">
        Choose the repository CodeRabbit should analyze when generating the plan. This ensures the plan references the correct files, patterns, and conventions.
      </Step>

      <Step title="Click Create plan">
        CodeRabbit analyzes your repository and connected data sources, then generates a full Coding Plan. Plan generation typically takes between 5 and 10 minutes depending on codebase complexity.
      </Step>
    </Steps>
  </Tab>

  <Tab title="VS Code">
    Use the CodeRabbit VS Code extension when the work starts in your editor and you want CodeRabbit to plan against the repository you already have open.

    <Steps>
      <Step title="Open the CodeRabbit sidebar">
        Click the CodeRabbit icon in the VS Code activity bar and open the Plan view.
      </Step>

      <Step title="Describe the work">
        Enter the feature, bug fix, or change you want to implement. Include goals, constraints, and any acceptance criteria you already know.
      </Step>

      <Step title="Select the target repository">
        Choose the repository CodeRabbit should analyze. The extension lists repositories that match the current workspace and your CodeRabbit organization access.
      </Step>

      <Step title="Add context files (optional)">
        Attach relevant files from your workspace when the plan should account for local code, specifications, or examples that are not obvious from the description alone.
      </Step>

      <Step title="Create the plan">
        Start plan generation from the extension. CodeRabbit streams progress in VS Code, then opens the created plan so you can review it, refine it, or open it in the web app.
      </Step>
    </Steps>
  </Tab>
</Tabs>

## Managing plans

Browse all plans for your organization from the [plans list](https://app.coderabbit.ai/plan/plans), where you can:

* **Search** by title or ticket ID to find existing plans.
* **View status** to see whether a plan is in progress, completed, or needs review.
* **Open a plan** to view its full structure, refine it through chat, or hand it off to a coding agent.

Plans created from VS Code appear alongside your other organization plans. The extension also keeps its local plan list refreshed when you return to the plan list.

## Configuration

If you also use issue-tracker-based planning, you can configure auto-planning rules and issue planning toggles from the CodeRabbit web app. These settings control when Coding Plans are generated automatically from issues on GitHub, GitLab, Azure DevOps, Jira, or Linear.

See the [issue-based planning guides](/issues/planner) for platform-specific auto-planning configuration.

## Next Step

<CardGroup>
  <Card title="Plan structure and refinement" href="/plan/plan-refinement" icon="list-tree">
    Learn what each section of a Coding Plan contains and how to iterate on it before handoff.
  </Card>

  <Card title="Use the VS Code extension" href="/ide/vscode-use" icon="square-code">
    Create and review plans from the editor where your code context lives.
  </Card>
</CardGroup>


# CodeRabbit Plan overview
Source: https://docs.coderabbit.ai/plan/index

Create precise, context-aware coding plans from issues, PRDs, designs, or free-form descriptions, powered by CodeRabbit's deep codebase understanding.

<GitHubBadge /> <GitLabBadge /> <AzureBadge /> | <ProPlusPlanBadge />

CodeRabbit Plan generates precise, project-aware Coding Plans you can hand off to any coding agent. Because plans are grounded in continuous codebase analysis, they reference the right files, follow existing conventions, and produce agent-ready prompts rather than generic outlines. CodeRabbit uses connected data sources, including Notion, issue trackers, design docs, and anything linked through your [Knowledge Base](/knowledge-base), to give every plan the full picture.

## Ways to work with CodeRabbit Plan

<Tabs>
  <Tab title="Using web interface">
    The fastest way to get started is the [CodeRabbit web app](https://app.coderabbit.ai/plan). From there, describe what you want to build in free-form text, select a repository, and click **Create plan**.
  </Tab>

  <Tab title="Using issue tracker">
    You can generate Coding Plans [directly from your issue tracker](/issues/planner). Comment `@coderabbitai plan` on any issue, or enable auto-planning to generate plans automatically when issues match your rules. Works with GitHub, GitLab, Azure DevOps, Jira, and Linear.
  </Tab>

  <Tab title="Using the VS Code extension">
    Create and implement plans without leaving your editor with the [CodeRabbit VS Code extension](/ide/vscode-plan). Describe a change in the **Plans** tab, reference workspace files, and hand off the finished plan to your AI coding agent.
  </Tab>
</Tabs>

## How to use CodeRabbit Plan

<Steps>
  <Step title="Create a plan" icon="file-plus-corner">
    Open [app.coderabbit.ai/plan/new](https://app.coderabbit.ai/plan/new) or use the [CodeRabbit VS Code extension](/ide) to describe what you want to build. Paste an issue, a PRD, a design, or plain free-form text, select a repository, and click **Create plan**. See [Create a plan](/plan/create-plan) for more details.
  </Step>

  <Step title="Review and refine the plan" icon="list-tree">
    Learn what each section of a Coding Plan contains and how to refine it. See [Plan refinement](/plan/plan-refinement).
  </Step>

  <Step title="Hand off a plan to a coding agent" icon="arrow-right-to-line">
    Copy agent-ready prompts or send plans directly to your IDE. See [Agent handoff](/plan/agent-handoff).
  </Step>
</Steps>

## Key capabilities

<CardGroup>
  <Card title="Deep codebase understanding" icon="brain">
    CodeRabbit's Coding Plans are grounded in [deep, continuous codebase analysis](/overview/architecture) and an extensive [Knowledge Base](/knowledge-base), so plans reference the right files and follow your established patterns.
  </Card>

  <Card title="Access to issues and broader project context" icon="search">
    CodeRabbit works with issue trackers, surfacing relevant related issues into
    the context, even when the assigned engineer isn't aware of them.
  </Card>

  <Card title="Collaborative review" icon="users">
    Plans are visible to your entire team. Engineers, product owners, and
    stakeholders can discuss, challenge design choices, and refine plans together
    before implementation begins.
  </Card>

  <Card title="Accountability and history" icon="clipboard-clock">
    Every plan version is preserved. You can track what was planned, when it was
    planned, and why decisions were made, providing a full audit trail across the
    lifetime of a feature.
  </Card>

  <Card title="Agent-model efficiency" icon="gauge">
    Precise, context-rich plans let you use faster and cheaper models for the
    execution step, because the hard thinking is already done.
  </Card>
</CardGroup>

## Next Step

<CardGroup>
  <Card title="Create a plan" href="/plan/create-plan" icon="globe">
    Describe what you want to build and generate a Coding Plan in minutes.
  </Card>
</CardGroup>


# Plan structure and refinement
Source: https://docs.coderabbit.ai/plan/plan-refinement

Learn what a Coding Plan contains, how to review and iterate on it, and how version history works.

Every Coding Plan follows a consistent structure designed to give coding agents all the context they need. This page explains each section of a plan and how to refine it before handoff.

## Plan structure

Each Coding Plan contains the following sections:

| Section            | Description                                                                                                                                                                |
| ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Summary**        | A 2–3 sentence overview of the implementation approach.                                                                                                                    |
| **Research**       | Deep codebase analysis leveraging CodeRabbit's project knowledge, identifying relevant files, patterns, dependencies, and architectural decisions specific to the project. |
| **Design Choices** | Key decisions made during planning, with rationale for each.                                                                                                               |
| **Phases**         | Logical chunks of work that should be done together.                                                                                                                       |
| **Tasks**          | Individual tasks within each phase, with file-level specificity.                                                                                                           |
| **Agent Prompt**   | Machine-readable instructions for coding agents, available per phase and as a combined prompt.                                                                             |

## Viewing a plan

Plans are displayed in the CodeRabbit web app with a dedicated plan viewer. Sections are collapsible, and a chat panel appears on the right for refinement.

<Frame>
  <img alt="Coding Plan in the CodeRabbit web app" />
</Frame>

## Refining a plan

After reviewing a Coding Plan, you can refine it through conversation with CodeRabbit:

* **Ask questions** to get clarification on why CodeRabbit chose a particular approach.
* **Challenge design choices** by suggesting an alternative architecture or pattern.
* **Request changes** by asking CodeRabbit to add, remove, or modify specific tasks or phases.
* **Provide additional context** by sharing constraints, requirements, or team preferences that the original plan didn't account for.

CodeRabbit responds and updates the plan accordingly.

## Re-planning and version history

When you need more than a small refinement, you can regenerate the plan entirely:

1. **Provide feedback** through chat explaining what should change.
2. **Trigger a re-plan:** click the **Redo** button.
3. CodeRabbit generates a **new plan version** incorporating your feedback.

Every re-plan creates a new version. Use the version selector at the top of the plan viewer to:

* View previous versions of the plan.
* Compare what changed between versions.
* Switch the active version.

<Info>
  You can only chat about the currently active version of a plan.
</Info>

Version history preserves accountability and a complete decision trail. You can always trace back to understand what was planned, when it changed, and why.

## Next Step

<CardGroup>
  <Card title="Agent Handoff" href="/plan/agent-handoff" icon="arrow-right-to-line">
    Select phases and copy agent-ready prompts, or send plans directly to your IDE.
  </Card>
</CardGroup>


# Azure DevOps
Source: https://docs.coderabbit.ai/platforms/azure-devops

Learn how to integrate CodeRabbit with Azure DevOps repositories using personal access tokens for automated AI-powered code reviews and pull request analysis.

<Warning>
  **Only Azure DevOps administrators can set up this integration.** Before you begin, confirm that you have either `Project Administrator` or `Project Collection Administrator` permissions in Azure DevOps. If you don't, ask an administrator to complete the setup. See [Prerequisites](#prerequisites) for the full list of requirements.
</Warning>

CodeRabbit enhances your Azure DevOps development workflow by providing:

* **Automated code reviews** for newly created pull requests
* **AI-powered suggestions** displayed directly on pull requests
* **Interactive assistance** through the CodeRabbit bot for real-time feedback
* **Seamless integration** with your existing Azure DevOps workflow

<Info>
  To interact with CodeRabbit in pull request comments, use `@coderabbitai` — or the username of the service account you configure below, if it differs.
</Info>

## Prerequisites

* The user installing CodeRabbit must have `Project Collection Administrator` permissions
* Admin approval permissions for Microsoft Apps consent requests
* Entra ID must be enabled for the organization
* An active Azure DevOps account
* Organizational email addresses are required; personal email addresses are not supported for this integration

## Integration Instructions

Complete the setup in the following order. The first three steps happen in Azure DevOps; the last two happen in the CodeRabbit application.

### Azure DevOps configuration

<Steps>
  <Step title="Confirm you are an administrator">
    Before doing anything else, verify that your Azure DevOps account has either
    `Project Administrator` or `Project Collection Administrator` permissions.
    Only administrators can complete this integration. If you don't have these
    permissions, ask an administrator to perform the setup. See
    [Prerequisites](#prerequisites) for the complete list of requirements.
  </Step>

  <Step title="Create a dedicated service account">
    In Azure DevOps, create a new user to act as a dedicated service account for
    CodeRabbit. Using a separate account—rather than a personal one—gives you
    better access control and makes CodeRabbit's activity easy to recognize. See
    [Recommendations](#recommendations) for naming and configuration best
    practices.
  </Step>

  <Step title="Generate a Personal Access Token for the service account">
    Logged in as the service account, generate a Personal Access Token (PAT).
    CodeRabbit uses this token to interact with the Azure DevOps API on behalf of
    the service account. Follow the detailed steps in
    [Generating a Personal Access Token](#generating-a-personal-access-token),
    then save the token securely—it is only displayed once.
  </Step>
</Steps>

### CodeRabbit configuration

<Steps>
  <Step title="Configure the integration">
    Return to the [CodeRabbit application](https://app.coderabbit.ai) and log in
    with your account. You'll be redirected to a page displaying Microsoft Apps
    consent requests.

    <Frame>
      <img alt="CodeRabbit admin consent page for Azure DevOps integration" />
    </Frame>

    Once the applications are approved, click **Continue**. On the "Onboarding"
    page, select the organization you wish to integrate with. Then, on the "Azure
    DevOps User" page, enter the Personal Access Token you generated for the
    service account.

    <Frame>
      <img alt="CodeRabbit Azure DevOps integration settings page" />
    </Frame>
  </Step>

  <Step title="Install CodeRabbit on your repositories">
    To install CodeRabbit and its webhooks on a repository, toggle the switch on
    the "Repositories" page. This registers the webhooks CodeRabbit needs to
    receive pull request events.
  </Step>
</Steps>

## How it works

For the CodeRabbit app to post reviews on pull requests, it needs to interact with the Azure DevOps API, which requires a Personal Access Token.

We recommend creating a dedicated service account in Azure DevOps and generating the Personal Access Token for that account, following [our recommendations](#recommendations). Generating the token from a dedicated account—rather than a personal one—keeps CodeRabbit's access scoped and its activity easy to identify.

## Azure DevOps for Enterprise SSO workspaces

Enterprise SSO workspaces can connect Azure DevOps during workspace onboarding or from workspace provider settings. When prompted, sign in with a work account, or choose **Use a specific tenant** to connect against a tenant GUID or domain such as `contoso.onmicrosoft.com`.

For Multi-Org Azure DevOps rollouts, configure one workspace-level Azure DevOps personal access token for the dedicated CodeRabbit service user. Open the Azure DevOps user settings in CodeRabbit, then save a workspace personal access token scoped to the Azure DevOps organizations attached to the workspace.

The workspace token should have access to every Azure DevOps organization attached to the workspace, with **Code** read and write access and **Pull Request** scopes. CodeRabbit stores the token encrypted. PR Review prefers the workspace token across the linked Azure DevOps organizations and uses an organization-level token only as a fallback when the workspace token is missing or unusable.

<Warning>
  Pull requests opened by the dedicated service user are not reviewed by CodeRabbit, because the reviewer cannot review its own pull requests.
</Warning>

## Azure DevOps Personal Access Tokens

To interact with the Azure DevOps API, a **Personal Access Token** is required. This token can be generated by creating a **Personal Access Token** from one of your existing users.

Upon first login to the application (immediately after the onboarding screen), you will need to add the Personal Access Token.

<Frame>
  <img alt="CodeRabbit Azure DevOps integration modal" />
</Frame>

### Recommendations

**Best Practices for Azure DevOps Integration:**

* **Create a dedicated user for CodeRabbit** - This ensures the user is exclusively for CodeRabbit, allowing better access control
* **Use "CodeRabbit" as the username** - This makes the user easily recognizable for future reference
* **Use a dedicated email address** - This helps in easy identification and management
* **Use the CodeRabbit logo as the profile picture** - This further ensures easy recognition. You can download our logo from [here](https://www.coderabbit.ai/brand "download")

### Generating a Personal Access Token

Azure DevOps provides an option to generate a personal access token for a user. Follow these steps to generate the token:

<Steps>
  <Step title="Log in to Azure DevOps">
    Log in as the user intended for CodeRabbit reviews.
  </Step>

  <Step title="Access Personal Access Tokens">
    Next to your avatar on the header's right side is a settings icon, click it,
    then choose **Personal Access Tokens**.
  </Step>

  <Step title="Create new token">Click **New Token**.</Step>

  <Step title="Configure token scope">
    Select the organization you want to use the token with or select **All
    accessible organizations**.
  </Step>

  <Step title="Set token details">
    Enter a name and an expiry date for the token.
  </Step>

  <Step title="Grant permissions">
    Grant the following permissions:

    * **Read, write, & manage** access to **Work Items** and **Code** (required for code reviews)
    * **Read** access to **Build** (optional, for CodeRabbit Pro pipeline failure remediation)
  </Step>

  <Step title="Create and save token">
    Click **Create** and save the generated token securely as it will only be
    displayed once.
  </Step>
</Steps>

**Token Management:**

* Personal access tokens have expiration dates. Ensure the expiration date covers the duration of your intended use of the CodeRabbit app
* Code reviews will be attributed to the owner of the personal access token
* If the personal access token expires, you can add a new one via the CodeRabbit UI:
  * Navigate to the **Azure DevOps User** page in the sidebar
  * Add the new token and click **Save**

<Frame>
  <img alt="CodeRabbit Azure DevOps personal access token creation form" />
</Frame>

## What's next

<CardGroup>
  <Card title="Quickstart" href="/getting-started/quickstart" icon="rocket">
    Open your first pull request and watch CodeRabbit post an automated review in minutes.
  </Card>

  <Card title="Configure CodeRabbit" href="/getting-started/yaml-configuration" icon="settings">
    Customize review behavior, language settings, and rules for your Azure DevOps repositories.
  </Card>

  <Card title="Code review overview" href="/guides/code-review-overview" icon="search">
    Learn how CodeRabbit reviews your pull requests and delivers actionable feedback.
  </Card>
</CardGroup>


# Bitbucket Cloud
Source: https://docs.coderabbit.ai/platforms/bitbucket-cloud

Learn how to integrate CodeRabbit with Bitbucket Cloud repositories for automated AI-powered code reviews.

<BitbucketBadge />

<Info>
  For an overview of how CodeRabbit integrates with Git platforms, see [Add CodeRabbit to your repository](/platforms).

  For a hands-on tutorial with CodeRabbit performing code reviews on a live repository, see [Quickstart](/getting-started/quickstart).
</Info>

CodeRabbit integrates with Bitbucket Cloud to improve your development workflow by:

* **Automated code reviews** for newly created pull requests
* **Intelligent comments and suggestions** displayed directly on pull requests
* **Real-time bot interaction** for immediate feedback and assistance
* **Seamless webhook integration** for continuous monitoring

This guide walks you through integrating CodeRabbit with your Bitbucket Cloud repositories.

<Info>
  To interact with CodeRabbit in pull request comments, use `@coderabbitai` — or the username of the service account you configure below, if it differs.
</Info>

## Configure API Token

To enable CodeRabbit to interact with your Bitbucket repositories, you need to configure an API token. This token grants the necessary permissions for interacting with the Bitbucket pull request and discussion APIs.

<Warning>
  **Service Account Required**

  You must create a dedicated Bitbucket account specifically for CodeRabbit to ensure proper permissions and security isolation.
</Warning>

<Steps>
  <Step title="Create a CodeRabbit service account">
    Create a new Bitbucket account specifically for CodeRabbit and treat it as a
    service account.
  </Step>

  <Step title="Configure account settings">
    * Name the account "CodeRabbit" for easy identification
    * Use a dedicated email address for this service account
    * If your Bitbucket workspace requires two-step verification, enable it on this account as well
  </Step>

  <Step title="Generate API token">
    Generate an API Token to enable the integration between CodeRabbit and your
    Bitbucket repositories.
  </Step>
</Steps>

<Info>
  We recommend creating a dedicated service account and associating it with the
  workspace where you want to install CodeRabbit. During the installation
  process, CodeRabbit will automatically configure the required webhook for
  seamless integration.
</Info>

<Info>
  If you wish to change the review user, you must provide the API token for the
  new user who will post reviews and comments. However, this requires manually
  removing the previous user from the projects and associated webhooks. Once
  this is done, you will need to reinstall the CodeRabbit app for each project.
</Info>

### Best practices for service account setup

<CardGroup>
  <Card icon="user" title="Account Configuration">
    * **Use "CodeRabbit" as the username** for easy recognition
    * **Use a dedicated email address** for management
    * **Use the CodeRabbit logo** as the profile picture ([download here](https://www.coderabbit.ai/brand))
  </Card>

  <Card icon="shield" title="Access Control">
    * **Grant developer access** to target projects
    * **Ensure workspace membership** for the service account
    * **Enable two-factor authentication** if required by workspace
  </Card>
</CardGroup>

<Warning>
  **Important:** Code reviews will be attributed to the owner of the API token.
  Ensure the service account is properly configured and recognizable to your
  team.
</Warning>

### Generate an API token

Bitbucket provides an option to generate an API token for your CodeRabbit service account. Follow these steps:

<Steps>
  <Step title="Log in to your service account">
    Log in using the user designated for CodeRabbit reviews. This user serves as a service account for managing reviews and related activities.
  </Step>

  <Step title="Navigate to API tokens">
    Go to [API
    Tokens](https://id.atlassian.com/manage-profile/security/api-tokens) in your Atlassian account settings.
  </Step>

  <Step title="Configure token details">
    * Enter a recognizable name for this API token (e.g., "CodeRabbit Integration")
    * Set an expiration date based on your security policy
    * On the next step, select **Bitbucket**
  </Step>

  <Step title="Select required scopes">
    Ensure the following scopes are selected for CodeRabbit to function properly:

    | Category           | Scope                         | Description                                      |
    | ------------------ | ----------------------------- | ------------------------------------------------ |
    | **Account & User** | `read:account`                | Access account information                       |
    |                    | `read:user:bitbucket`         | Read user profile data                           |
    | **Repository**     | `read:repository:bitbucket`   | Read repository content and metadata             |
    |                    | `write:repository:bitbucket`  | Write access for code analysis                   |
    | **Pull Requests**  | `read:pullrequest:bitbucket`  | Read pull request information                    |
    |                    | `write:pullrequest:bitbucket` | Post reviews and comments                        |
    | **Issues**         | `read:issue:bitbucket`        | Read issue information                           |
    |                    | `write:issue:bitbucket`       | Create and update issues                         |
    | **Workspace**      | `read:workspace:bitbucket`    | Access workspace information                     |
    |                    | `admin:project:bitbucket`     | Manage all project webhooks <Tooltip>ⓘ</Tooltip> |
    | **Webhooks**       | `read:webhook:bitbucket`      | Read webhook configurations                      |
    |                    | `write:webhook:bitbucket`     | Create and manage webhooks                       |
    | **Pipelines**      | `read:pipeline:bitbucket`     | Read pipeline information                        |
    |                    | `read:runner:bitbucket`       | Access pipeline runner data                      |
  </Step>

  <Step title="Generate and save token">
    * Click **Create**
    * **Important:** Copy and securely store the API token immediately as it will only be displayed once
  </Step>
</Steps>

<Warning>
  **Security Note:** The API token will only be displayed once upon creation.
  Make sure to copy and store it securely before leaving the page.
</Warning>

### Configure API token in CodeRabbit

You can provide your API token to CodeRabbit in two ways:

<Tabs>
  <Tab title="During Installation">
    CodeRabbit will automatically prompt you to provide the API token during the repository installation process if none is configured.
  </Tab>

  <Tab title="Pre-configure Token">
    To provide the token beforehand:

    1. Navigate to **Organization Settings** in the CodeRabbit app
    2. Select the **Bitbucket User** tab in the sidebar
    3. Enter your API token
    4. The token will be validated and saved for future use

    <Tip>
      You can verify the correct service account is selected by comparing the user ID shown in the UI with your service account's user ID.
    </Tip>
  </Tab>
</Tabs>

## Install CodeRabbit in your repositories

Once your API token is configured, you can install CodeRabbit in your Bitbucket repositories.

<Steps>
  <Step title="Access repository settings">
    Navigate to the [Repositories
    page](https://app.coderabbit.ai/settings/repositories) in the CodeRabbit
    app.
  </Step>

  <Step title="Select repositories">
    * Check the boxes next to specific repositories where you want to install CodeRabbit
    * To install on all repositories at once, select the checkbox at the top
  </Step>

  <Step title="Install repositories">
    Click **Install Repositories** to complete the setup.
  </Step>
</Steps>

<img alt="Bitbucket Repo Install Modal" />

<Info>
  **Webhook Configuration:** The webhook
  `https://coderabbit.ai/bitbucketHandler` will be automatically installed for
  the selected projects, enabling CodeRabbit to monitor and review your pull
  requests.
</Info>

<img alt="Bitbucket Webhook Example" />

## Manual webhook installation

If you install repositories from the **Repositories** page, CodeRabbit configures the webhook automatically. Use this flow only when you need to install the webhook manually or rotate the shared webhook secret.

The **Webhook Secret** page is available to Bitbucket organizations with organization settings access.

<Steps>
  <Step title="Open Webhook Secret settings">
    In the CodeRabbit app, open **Account** and select **Webhook Secret** from
    the sidebar.
  </Step>

  <Step title="Copy the webhook URL">
    Use the **Webhook URL** field on that page to copy the exact endpoint that
    your Bitbucket Cloud webhook should call.
  </Step>

  <Step title="Save or change the webhook secret">
    Enter the secret that Bitbucket should send with webhook deliveries and
    save it in CodeRabbit.
  </Step>

  <Step title="Configure the Bitbucket webhook">
    When creating or editing the webhook in Bitbucket, use the copied webhook
    URL and enable these pull request events:

    * **Opened**
    * **Modified**
    * **Comment Added**
  </Step>
</Steps>

<Info>
  If you change an existing webhook secret, CodeRabbit attempts to update
  existing CodeRabbit-managed Bitbucket webhooks across installed repositories
  automatically and reports how many were updated, skipped, or failed. If a
  webhook was created manually, or if an automatic refresh fails, update the
  secret directly in Bitbucket.
</Info>

Manually configured Bitbucket webhooks can use the organization-level webhook secret when no per-repository secret is available.

## Configure network access

If your instance requires IP allowlisting, add these CodeRabbit IP addresses to your firewall:

```text IPs to allow list wrap theme={null}
35.222.179.152/32, 34.170.211.100/32, 136.113.208.247/32, 136.64.151.96/28, 34.122.160.224/29, 18.232.215.9/32, 98.89.212.255/32, 52.1.193.145/32, 44.199.13.86/32
```

## Troubleshooting

If you encounter issues during setup or operation, here are common solutions:

<AccordionGroup>
  <Accordion title="Webhook Issues">
    If CodeRabbit isn't accessing repositories or reviewing pull requests:

    1. **Check webhook status** in your Bitbucket repository settings
    2. **Manually delete the webhook** if it exists but isn't working
    3. **Refresh the repository page** in the CodeRabbit app
    4. **Reinstall the webhook** using the CodeRabbit interface
  </Accordion>

  <Accordion title="Webhook secret mismatch">
    If manually configured webhooks are rejected after saving or rotating a webhook secret:

    1. **Confirm the webhook secret** in Bitbucket matches the value saved on CodeRabbit's **Webhook Secret** page
    2. **Update manually created webhooks** directly in Bitbucket after rotating the secret
    3. **Review skipped or failed refreshes** reported by CodeRabbit and update those repository webhooks directly
  </Accordion>

  <Accordion title="Installation Problems">
    If you cannot install the webhook:

    * **Verify permissions**: Ensure your Bitbucket service account has the necessary permissions
    * **Check API token**: Confirm the API token is properly configured with all required scopes
    * **Validate account access**: Ensure the service account has developer access to target repositories
  </Accordion>

  <Accordion title="Authentication Errors">
    If you're seeing authentication issues:

    * **Regenerate API token** with the correct scopes
    * **Update token in CodeRabbit** Organization Settings
    * **Verify service account** has workspace membership
  </Accordion>
</AccordionGroup>

<Info>
  For additional support, visit the [support page](/support).
</Info>


# Bitbucket Data Center
Source: https://docs.coderabbit.ai/platforms/bitbucket-data-center

Learn how to integrate CodeRabbit with your self-hosted Bitbucket Data Center instance for AI-powered code reviews on pull requests.

<Info>
  For a hands-on tutorial with CodeRabbit performing code reviews on a live repository, see [Quickstart](/getting-started/quickstart).
</Info>

CodeRabbit integrates with Bitbucket Data Center to bring AI-powered code reviews to your self-hosted Bitbucket instance:

* **Automated code reviews** for newly created pull requests
* **Intelligent comments and suggestions** displayed directly on pull requests
* **Real-time bot interaction** for immediate feedback and assistance
* **Seamless webhook integration** for continuous monitoring

This guide walks you through connecting your Bitbucket Data Center instance to CodeRabbit.

<Info>
  To interact with CodeRabbit in pull request comments, use `@coderabbitai` — or the username of the bot user you create below, if it differs.
</Info>

## Prerequisites

Before starting, you need to set up the following in your Bitbucket Data Center instance:

<Steps>
  <Step title="Create a bot user">
    Create a dedicated Bitbucket user for CodeRabbit (e.g., "CodeRabbit"). This user will post code review comments on pull requests.

    * Add the bot user to each project where you want CodeRabbit to review pull requests
    * Grant the bot user **write** permissions on the relevant repositories
  </Step>

  <Step title="Generate an HTTP Access Token for the bot user">
    Generate an HTTP Access Token for the bot user:

    1. Log in as the bot user
    2. Navigate to **Manage Account** and select **HTTP Access Tokens**
    3. Create a new token with **repository write** permissions

    <Warning>
      Save the token securely. It will only be shown once.
    </Warning>
  </Step>

  <Step title="Create an OAuth consumer">
    Create an OAuth consumer in your Bitbucket Data Center administration:

    1. Navigate to **Administration** and then **Application Links**
    2. Create a new **External application** with an **Incoming link**
    3. Set the **Redirect URL** to: `https://app.coderabbit.ai/login`
    4. Grant the following permissions:
       * **Repository Read**
       * **Repository Write**
       * **Project Read**
    5. Note the **Client ID** and **Client Secret**
  </Step>
</Steps>

## Connect to CodeRabbit

<Steps>
  <Step title="Navigate to the CodeRabbit login page">
    Go to the [CodeRabbit login page](https://app.coderabbit.ai/login?free-trial=) and select **Bitbucket Data Center**.
  </Step>

  <Step title="Enter your Bitbucket Data Center URL">
    Enter the URL of your Bitbucket Data Center instance (e.g., `https://bitbucket.company.com`) and click **Submit**.

    If your instance is already registered, you will be redirected to the OAuth authorization flow. Otherwise, you will be prompted to provide your credentials.
  </Step>

  <Step title="Provide credentials">
    If this is the first time connecting your instance, provide:

    * **Bot Token**: The HTTP Access Token you generated for the bot user
    * **Client ID**: The OAuth consumer Client ID
    * **Client Secret**: The OAuth consumer Client Secret

    Click **Validate token** to verify the bot token before proceeding.
  </Step>

  <Step title="Authorize CodeRabbit">
    You will be redirected to your Bitbucket Data Center instance to authorize CodeRabbit. Review the requested permissions and click **Allow**.
  </Step>
</Steps>

## Install CodeRabbit on your repositories

After logging in, the onboarding wizard guides you through selecting projects and repositories.

<Steps>
  <Step title="Select a project">
    Choose the Bitbucket Data Center project containing the repositories you want CodeRabbit to review.
  </Step>

  <Step title="Select repositories">
    * Browse or search for repositories within the selected project
    * Select the repositories where you want to enable AI code reviews
    * Click **Install** to complete the setup
  </Step>
</Steps>

<Info>
  CodeRabbit will automatically configure webhooks for the selected repositories. Once installed, CodeRabbit begins reviewing new pull requests immediately.
</Info>

## Configure network access

If your Bitbucket Data Center instance requires IP allowlisting, add these CodeRabbit IP addresses:

```text IPs to allow list wrap theme={null}
35.222.179.152/32, 34.170.211.100/32, 136.113.208.247/32, 136.64.151.96/28, 34.122.160.224/29, 18.232.215.9/32, 98.89.212.255/32, 52.1.193.145/32, 44.199.13.86/32
```

## Manage credentials

You can update the bot user's HTTP Access Token at any time:

1. Navigate to **Organization Settings** in the CodeRabbit app
2. Select the **Bitbucket DC User** tab
3. Enter the new HTTP Access Token
4. Save your changes

## Manual webhook installation

If you install repositories from the CodeRabbit app, CodeRabbit configures the webhook automatically. Use this flow only when you need to install the webhook manually or rotate the shared webhook secret.

The **Webhook Secret** page is available to Bitbucket Data Center organizations with organization settings access.

<Steps>
  <Step title="Open Webhook Secret settings">
    In the CodeRabbit app, open **Account** and select **Webhook Secret** from the sidebar.
  </Step>

  <Step title="Copy the webhook URL">
    Use the **Webhook URL** field on that page to copy the exact endpoint that your Bitbucket Data Center project or repository webhook should call.
  </Step>

  <Step title="Save or change the webhook secret">
    Enter the secret that Bitbucket Data Center should send with webhook deliveries and save it in CodeRabbit.
  </Step>

  <Step title="Configure the Bitbucket Data Center webhook">
    When creating or editing the webhook in Bitbucket Data Center, use the copied webhook URL and enable these pull request events:

    * **Opened**
    * **Modified**
    * **Comment Added**
  </Step>
</Steps>

<Info>
  If you change an existing webhook secret, CodeRabbit attempts to update existing CodeRabbit-managed Bitbucket Data Center webhooks across installed repositories automatically and reports how many were updated, skipped, or failed. If a webhook was created manually, or if an automatic refresh fails, update the secret directly in Bitbucket Data Center.
</Info>

Manually configured Bitbucket Data Center webhooks are validated with the per-repository secret first, then the self-hosted instance-level secret when no per-repository secret is available. For self-hosted deployments, keep `BITBUCKET_SERVER_WEBHOOK_SECRET` aligned with the secret configured in CodeRabbit; see the [Bitbucket Data Center self-hosted `.env` file](/self-hosted/bitbucket#prepare-a-env-file).

## Troubleshooting

<AccordionGroup>
  <Accordion title="Bot token validation fails">
    * Verify the HTTP Access Token has the correct permissions (repository write)
    * Ensure the bot user account is active and not locked
    * Check that your Bitbucket Data Center URL is correct and accessible from the internet
  </Accordion>

  <Accordion title="OAuth authorization fails">
    * Verify the Client ID and Client Secret match the OAuth consumer configured in Bitbucket DC
    * Ensure the callback URL is set to `https://app.coderabbit.ai/login`
    * Check that the OAuth consumer has the required permissions
  </Accordion>

  <Accordion title="Webhooks not working">
    * Ensure your Bitbucket Data Center instance can reach CodeRabbit's servers
    * Check webhook configurations in your repository settings
    * Verify the bot user has write access to the repositories
  </Accordion>

  <Accordion title="Webhook secret mismatch">
    * Confirm the webhook secret in Bitbucket Data Center matches the value saved on CodeRabbit's **Webhook Secret** page
    * Update manually created webhooks directly in Bitbucket Data Center after rotating the secret
    * Review skipped or failed refreshes reported by CodeRabbit and update those repository webhooks directly
    * For self-hosted deployments, confirm `BITBUCKET_SERVER_WEBHOOK_SECRET` matches the secret configured in CodeRabbit
  </Accordion>

  <Accordion title="Reviews not posting">
    * Confirm the bot user is added to the project with write permissions
    * Verify the HTTP Access Token has not expired
    * Check that webhooks are properly configured and active
  </Accordion>
</AccordionGroup>

<Info>
  For additional support, visit the [support page](/support).
</Info>

## What's next

<CardGroup>
  <Card title="Configure CodeRabbit" icon="settings" href="/getting-started/yaml-configuration">
    Customize review behavior, language settings, and rules for your repositories.
  </Card>

  <Card title="Code Review Overview" icon="search" href="/guides/code-review-overview">
    Learn how CodeRabbit reviews your pull requests and provides actionable feedback.
  </Card>

  <Card title="Get Support" icon="life-buoy" href="/support">
    Reach out to the CodeRabbit team for help with setup or integration issues.
  </Card>
</CardGroup>


# GitHub
Source: https://docs.coderabbit.ai/platforms/github-com

Learn how to integrate CodeRabbit with GitHub.com repositories for automated AI-powered code reviews, including setup, permissions, and repository configuration.

<Info>
  For an overview of how CodeRabbit integrates with Git platforms, see [Add CodeRabbit to your repository](/platforms).

  For a hands-on tutorial with CodeRabbit performing code reviews on a live GitHub repository that you create, see [Quickstart](/getting-started/quickstart).

  GitHub Enterprise Cloud users on `*.ghe.com` should use the [Self-Hosted GitHub guide](/platforms/github-enterprise-server).
</Info>

## Prerequisites

<Warning>
  **Required permissions**

  You need to have a GitHub account with **owner-level permissions** for at least one repository associated with that account.

  If you want to authorize CodeRabbit for repositories in a GitHub organization, you need **organization owner permissions** as well.
</Warning>

## Authorize CodeRabbit with your GitHub account

<Steps>
  <Step title="Visit CodeRabbit login page">
    Navigate to [the CodeRabbit login page](https://app.coderabbit.ai/login).
  </Step>

  <Step title="Initiate GitHub login">
    Click **Login with GitHub**. Your browser will redirect to GitHub.com.
  </Step>

  <Step title="Sign in to GitHub (if required)">
    If GitHub prompts you to sign in, enter your GitHub login credentials as you normally would.
  </Step>

  <Step title="Review and authorize permissions">
    GitHub displays a summary of the information that CodeRabbit needs to integrate with your account. This includes read-only access to:

    * Organizations and teams associated with your GitHub account
    * Email addresses associated with your GitHub account

    Click **Authorize coderabbitai** to grant these permissions.
  </Step>

  <Step title="Select an organization">
    Choose the organization where you want to install CodeRabbit.

    * If you belong to multiple organizations, select from the list
    * For personal repositories, select your account name

    <Tip>
      If your organization doesn't appear in the list, add it from the organization switcher. If you select an organization with no repositories connected yet, CodeRabbit guides you through **Grant GitHub bot access** and **Select repositories**. See [Adding organizations](/management/adding-organizations) for details.
    </Tip>
  </Step>

  <Step title="Install and authorize CodeRabbit">
    Configure repository access and review the permissions CodeRabbit needs.

    ### Choose repository access

    Select which repositories CodeRabbit can access:

    **All repositories**: Grants access to all current and future repositories owned by this organization, including public repositories.

    **Only select repositories**: Limits access to specific repositories you choose from the list.

    <Tip>
      You can change this setting later if needed.
    </Tip>

    ### Review permissions

    CodeRabbit requires the following permissions to perform code reviews and manage pull requests:

    **Read-only access:**

    * Actions, checks, discussions, members, and metadata

    **Read-and-write access:**

    * Code, commit statuses, issues, and pull requests

    <Info>
      CodeRabbit requests read and write access to your repository for its code review, issue management, and pull request generation features to work. CodeRabbit does not retain your source code after review, except when [review caching](/reference/caching) is enabled to speed up future reviews. For more information, see [the CodeRabbit Trust Center](https://trust.coderabbit.ai).
    </Info>

    ### Complete installation

    Click **Install & Authorize** (for new integrations) or **Save** (for existing integrations).
  </Step>

  <Step title="Trigger your first review (optional)">
    After installation, you can immediately see CodeRabbit in action or skip to configure settings first.

    **Option 1: Trigger a review**

    1. Select a repository from your list
    2. Choose an existing pull request
    3. CodeRabbit will perform a code review on that pull request

    **Option 2: Skip to dashboard**

    Click **Skip to App** to access the CodeRabbit dashboard and configure settings before your first review.
  </Step>
</Steps>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Organization is blocked by a GitHub IP allow list">
    When you switch to a GitHub organization that is blocked by its IP allow list, CodeRabbit keeps you in your previous organization. The error identifies the blocked organization and its GitHub IP allow list instead of switching you elsewhere or showing a generic failure.

    **IP allow list configuration:**

    1. Ask a GitHub organization owner to open the organization's IP allow list settings.
    2. Add CodeRabbit's outbound IP addresses: `35.222.179.152/32`, `34.170.211.100/32`, and `136.113.208.247/32`.
    3. Save the policy changes, then switch to the organization again in CodeRabbit.

    Retrying the switch without changing the IP allow list will not resolve the issue.

    <Warning>
      If the organization remains blocked after updating its IP allow list, [contact our support team](/support).
    </Warning>
  </Accordion>
</AccordionGroup>


# GitHub Enterprise Server
Source: https://docs.coderabbit.ai/platforms/github-enterprise-server

Complete guide to integrate CodeRabbit with your self-hosted GitHub Enterprise Server. Set up OAuth apps, GitHub apps, webhooks, and configure AI-powered code reviews for your enterprise development workflow.

<GitHubBadge title="GitHub Enterprise" href="/platforms/github-com" />

CodeRabbit integrates seamlessly with your self-hosted GitHub Enterprise Server to provide AI-powered code reviews directly within your development workflow. This comprehensive guide walks you through the complete setup process.

GitHub Enterprise Cloud customers using a data-residency or Enterprise Managed Users host such as `https://example.ghe.com` should also use the **Self-Hosted GitHub** setup flow. Standard GitHub.com organizations should use the [GitHub guide](/platforms/github-com) instead.

For an overview of all supported Git platforms, see [Platform overview](/platforms/overview).

<Info>
  If your GHES instance cannot accept inbound network access from CodeRabbit, see the [CodeRabbit Reverse Tunnel reference](/self-hosted/coderabbit-reverse-tunnel) for the private-network connectivity option.
</Info>

<Warning>
  **Before you begin:** Ensure you have the following prerequisites before starting the integration process:

  * **Administrative privileges** on your GitHub Enterprise Server instance, or enterprise-owner access for a GitHub Enterprise Cloud data-residency host ending in `.ghe.com`
  * **Access to create OAuth Apps and GitHub Apps** in your organization
  * **Network connectivity** allowing webhooks from CodeRabbit to your instance
  * **Ability to allow list IP addresses** if required by your security policy
</Warning>

## Integration overview

The GitHub Enterprise Server integration requires several components working together:

<CardGroup>
  <Card title="OAuth App" icon="key">
    Handles user authentication and login flow
  </Card>

  <Card title="GitHub App" icon="github">
    Provides repository access and webhook functionality
  </Card>

  <Card title="Webhook Configuration" icon="webhook">
    Enables real-time event processing
  </Card>

  <Card title="Network Access" icon="network">
    Allows CodeRabbit to communicate with your instance
  </Card>
</CardGroup>

## Setup process

Follow these steps to integrate CodeRabbit with your GitHub Enterprise Server:

<Steps>
  <Step title="Initialize CodeRabbit connection">
    Visit the [CodeRabbit login page](https://app.coderabbit.ai/login?free-trial=) and select **Self-Hosted GitHub**.

    Enter the URL of your GitHub Enterprise Server instance and click submit. CodeRabbit will check for existing configurations and either:

    * Start the login process if your instance is already configured
    * Prompt for additional setup details if this is a new integration

      <img alt="Self-hosted GitHub enterprise connection page for CodeRabbit" />
  </Step>

  <Step title="Create GitHub OAuth App">
    Navigate to your GitHub Enterprise Server instance and create an OAuth App for user authentication.

    <Info>
      For detailed instructions, see GitHub's official documentation on [creating an OAuth App](https://docs.github.com/en/enterprise-server@latest/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app).
    </Info>

    **Configuration steps:**

    1. Sign in to your GitHub Enterprise Server as an administrator
    2. Navigate to **Settings** → **Developer settings** → **OAuth Apps**
    3. Click **New OAuth App**
    4. Configure the OAuth App with these exact settings:

    | Field                          | Value                                           |
    | ------------------------------ | ----------------------------------------------- |
    | **Application name**           | `CodeRabbit OAuth`                              |
    | **Homepage URL**               | `https://coderabbit.ai`                         |
    | **Application description**    | `OAuth application for signing into CodeRabbit` |
    | **Authorization callback URL** | `https://app.coderabbit.ai/login`               |

    5. Click **Register application**

       <img alt="GitHub Create OAuth App" />

    **Save OAuth credentials:**

    After creating the OAuth App:

    1. Click **Generate a new client secret** under the 'Client secrets' section
    2. Copy and securely store the following credentials:

       * **Client ID**
       * **Client secret** (visible only once)

       <img alt="GitHub OAuth Client ID & Secret" />

    <Warning>
      The client secret is only displayed once. Make sure to copy it immediately and store it securely.
    </Warning>
  </Step>

  <Step title="Create GitHub App">
    Create a GitHub App to enable CodeRabbit's repository access and webhook functionality.

    <Info>
      For detailed instructions, see GitHub's official documentation on [registering a GitHub App](https://docs.github.com/en/enterprise-server@latest/apps/creating-github-apps/registering-a-github-app/registering-a-github-app).
    </Info>

    **App configuration:**

    1. Navigate to **Settings** → **Developer settings** → **GitHub Apps**
    2. Click **New GitHub App**
    3. Configure the basic app settings:

    <Tabs>
      <Tab title="Basic Information">
        | Field                                                      | Value                             |
        | ---------------------------------------------------------- | --------------------------------- |
        | **GitHub App name**                                        | `CodeRabbit`                      |
        | **Description**                                            | `GitHub App for CodeRabbit`       |
        | **Homepage URL**                                           | `https://coderabbit.ai`           |
        | **Callback URL**                                           | `https://app.coderabbit.ai/login` |
        | **Request user authorization (OAuth) during installation** | ✓ Enabled                         |
        | **Where can this GitHub App be installed?**                | Any account                       |
      </Tab>

      <Tab title="Webhook Configuration">
        | Field              | Value                                     |
        | ------------------ | ----------------------------------------- |
        | **Webhook Active** | ✓ Enabled                                 |
        | **Webhook URL**    | `https://app.coderabbit.ai/githubHandler` |
        | **Webhook secret** | Generate a secure string and save it      |
      </Tab>

      <Tab title="Repository Permissions">
        | Permission          | Access Level   |
        | ------------------- | -------------- |
        | **Actions**         | Read-only      |
        | **Checks**          | Read-only      |
        | **Contents**        | Read and write |
        | **Commit statuses** | Read and write |
        | **Discussions**     | Read-only      |
        | **Issues**          | Read and write |
        | **Metadata**        | Read-only      |
        | **Pull requests**   | Read and write |
      </Tab>

      <Tab title="Organization & Events">
        **Organization permissions:**

        * **Members**: Read-only

        **Subscribe to events:**

        * Meta, Issue comment, Issues, Label, Public
        * Pull request, Pull request review, Pull request review comment
        * Pull request review thread, Push, Release
      </Tab>
    </Tabs>

    4. Click **Create GitHub App**

    **Generate app credentials:**

    After creating the GitHub App, you'll need to generate and save several credentials:

    1. **Client Secret**: Click **Generate a new client secret** and copy it immediately
    2. **Private Key**: Click **Generate a private key** and download the PEM file
    3. Note the **App ID** and **Client ID** displayed on the page

    <AccordionGroup>
      <Accordion title="Required credentials checklist">
        Make sure you have saved all of these:

        * ✅ App ID
        * ✅ Client ID
        * ✅ Client secret
        * ✅ Webhook secret
        * ✅ Private key (PEM file)
      </Accordion>
    </AccordionGroup>

    <img alt="GitHub App Client ID & Secret" />

    <Tip>
      **Customize the app appearance**: Use the CodeRabbit [logo](https://www.coderabbit.ai/brand) as the profile picture for easy recognition in your GitHub interface.
    </Tip>
  </Step>

  <Step title="Complete CodeRabbit setup">
    Submit all the credentials you've gathered to complete the integration setup.

    In the CodeRabbit onboarding form, enter the following information:

    <AccordionGroup>
      <Accordion title="GitHub instance configuration">
        * **Host URL**: Your GitHub Enterprise Server URL
      </Accordion>

      <Accordion title="OAuth App credentials">
        * **OAuth Client ID**: From Step 2
        * **OAuth Client Secret**: From Step 2
      </Accordion>

      <Accordion title="GitHub App credentials">
        * **GitHub App ID**: From Step 3
        * **GitHub App Client ID**: From Step 3
        * **GitHub App Client Secret**: From Step 3
        * **GitHub App Webhook Secret**: From Step 3
        * **GitHub App Private Key**: Upload the PEM file from Step 3
      </Accordion>
    </AccordionGroup>

    Click **Submit** to complete the setup. CodeRabbit will validate the configuration and initiate the login process. On subsequent visits, your setup will be automatically detected for direct login.
  </Step>

  <Step title="Install the GitHub App">
    Install the GitHub App to your organizations to enable CodeRabbit access to repositories.

    1. Navigate to your GitHub App in GitHub Enterprise Server
    2. Click the **Install App** tab
    3. Select the organization(s) where you want to install CodeRabbit
    4. Choose repository access:
       * **All repositories** (recommended for full integration)
       * **Selected repositories** (for limited access)
    5. Click **Install**

    <Warning>
      **Important timing**: If you install the GitHub App before completing Step 4 (CodeRabbit setup), the installation event will fail. If this happens:

      1. Go to your GitHub App's **Advanced** tab
      2. Find the failed `installation.created` event
      3. Click **Redeliver** to resend the webhook
    </Warning>
  </Step>

  <Step title="Configure network access">
    Ensure your GitHub Enterprise Server can communicate with CodeRabbit by configuring network access.

    **IP Allowlisting:**

    If your instance requires IP allowlisting, add these CodeRabbit IP addresses to your firewall:

    ```text IPs to allow list wrap theme={null}
    35.222.179.152/32, 34.170.211.100/32, 136.113.208.247/32, 136.64.151.96/28, 34.122.160.224/29, 18.232.215.9/32, 98.89.212.255/32, 52.1.193.145/32, 44.199.13.86/32
    ```
  </Step>
</Steps>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Who should create the OAuth App and GitHub App?">
    The OAuth App and GitHub App should be created by a user with **administrative privileges** on the GitHub Enterprise Server instance, or by an enterprise owner for a GitHub Enterprise Cloud data-residency host ending in `.ghe.com`. This user will be responsible for:

    * Managing the CodeRabbit integration
    * Handling app installations across organizations
    * Troubleshooting permission issues

    <Info>
      The administrator who creates these apps will have access to manage CodeRabbit's integration settings.
    </Info>
  </Accordion>

  <Accordion title="Which token should I use when resetting instance credentials?">
    When CodeRabbit asks you to validate or reset Self-Hosted GitHub instance credentials, the required token depends on your host type:

    | Host type                                            | Token owner        | Required scope    |
    | ---------------------------------------------------- | ------------------ | ----------------- |
    | GitHub Enterprise Server                             | Site administrator | `read:user`       |
    | GitHub Enterprise Cloud data residency (`*.ghe.com`) | Enterprise owner   | `read:enterprise` |

    GitHub Enterprise Cloud data-residency hosts do not expose the GitHub Enterprise Server `site_admin` role. For `*.ghe.com` hosts, CodeRabbit validates enterprise-owner access instead.
  </Accordion>

  <Accordion title="I see an error when trying to log in to CodeRabbit">
    If you encounter login errors, try these troubleshooting steps:

    **Configuration verification:**

    1. Verify all OAuth App and GitHub App settings match the required configuration
    2. Ensure webhook URLs are accessible from your GitHub Enterprise Server
    3. Confirm all credentials are correctly entered in CodeRabbit

    **Browser troubleshooting:**

    1. Clear browser cache and cookies for both CodeRabbit and your GitHub instance
    2. Try logging in from an incognito/private browser window
    3. Disable browser extensions that might interfere with authentication

    **Network issues:**

    1. Verify your GitHub Enterprise Server can reach `app.coderabbit.ai`
    2. Check firewall rules and proxy settings
    3. Ensure CodeRabbit IPs are allowlisted if required

    <Warning>
      If issues persist after trying these steps, [contact our support team](/support) with details about the error messages you're seeing.
    </Warning>
  </Accordion>

  <Accordion title="Webhook events are not being received">
    If CodeRabbit isn't responding to repository events:

    1. **Check webhook configuration:**
       * Verify the webhook URL is `https://app.coderabbit.ai/githubHandler`
       * Ensure webhook is active in your GitHub App settings
       * Confirm the webhook secret matches what you entered in CodeRabbit

    2. **Test webhook delivery:**
       * Go to your GitHub App's **Advanced** tab
       * Look for recent webhook deliveries and their response codes
       * Redeliver failed webhooks to test connectivity

    3. **Network connectivity:**
       * Ensure your GitHub Enterprise Server can reach CodeRabbit's webhook URL
       * Check for any proxy or firewall blocking outbound requests
  </Accordion>

  <Accordion title="CodeRabbit isn't reviewing pull requests">
    If CodeRabbit has access but isn't providing reviews:

    1. **Verify installation:**
       * Confirm the GitHub App is installed on the correct organization
       * Check that CodeRabbit has access to the specific repository
       * Ensure the repository isn't archived or has restrictions

    2. **Check permissions:**
       * Verify all required repository permissions are granted
       * Confirm CodeRabbit can read pull requests and write comments

    3. **Review configuration:**
       * Check if there are any custom review instructions blocking reviews
       * Verify the repository doesn't have CodeRabbit disabled in settings
  </Accordion>
</AccordionGroup>

## What's next

<CardGroup>
  <Card title="CodeRabbit Reverse Tunnel" href="/self-hosted/coderabbit-reverse-tunnel" icon="network">
    Connect CodeRabbit to a private-network GHES instance without opening inbound firewall access.
  </Card>

  <Card title="Platform overview" href="/platforms/overview" icon="git-branch">
    Review all supported Git platforms and choose the right integration path for your environment.
  </Card>

  <Card title="Support" href="/support" icon="life-buoy">
    Contact CodeRabbit for help with your GitHub Enterprise Server setup.
  </Card>
</CardGroup>


# GitLab
Source: https://docs.coderabbit.ai/platforms/gitlab-com

Learn how to integrate CodeRabbit with GitLab.com repositories using personal or group access tokens for automated AI-powered code reviews and collaboration.

For an overview of how CodeRabbit integrates with Git platforms, see [Platform Integration Overview](/platforms/overview).

For a hands-on tutorial with CodeRabbit performing code reviews on a live repository, see [Quickstart](/getting-started/quickstart).

CodeRabbit enhances your GitLab.com development workflow by providing:

* **Automated code reviews** for newly created merge requests
* **AI-powered suggestions** displayed directly on merge requests
* **Interactive assistance** through the CodeRabbit bot for real-time feedback
* **Seamless integration** with your existing GitLab workflow

<Info>
  To interact with CodeRabbit in merge request comments, use `@coderabbitai` — or the username of the service account you configure below, if it differs.
</Info>

<Info>
  **Using self-hosted GitLab?** See our [Self-managed
  GitLab](/platforms/self-hosted-gitlab) integration guide for on-premises
  installations.
</Info>

## GitLab Access Tokens

<Info>
  A GitLab admin is required for the one-time access token setup.
</Info>

To enable CodeRabbit to interact with your GitLab repositories, you need to provide an access token that grants the necessary permissions for the Merge Requests and Discussions APIs.

Choose the token type that best fits your organization's needs:

<CardGroup>
  <Card title="Personal Access Token" icon="user" href="#personal-access-token">
    Create a dedicated service account for CodeRabbit with a personal access
    token
  </Card>

  <Card title="Group Access Token" icon="users" href="#group-access-token">
    Use GitLab Premium/Ultimate's group tokens with automatic bot user creation
  </Card>
</CardGroup>

### Personal Access Token

We recommend creating a new user as a service account, associating this user to the group you'd like to install CodeRabbit on, and providing CodeRabbit with the personal access token to allow access. During the installation process, CodeRabbit will automatically configure the required webhook for seamless integration.

<img alt="GitLab user modal showing options to add a personal access token for CodeRabbit integration" />

<Note>
  If you wish to change the review user, you must provide the access token for
  the new user who will post reviews and comments. However, this requires
  manually removing the previous user from the projects and associated webhooks.
  Once this is done, you will need to reinstall the CodeRabbit app for each
  project.
</Note>

<img alt="GitLab organization user selection modal for configuring CodeRabbit access" />

#### Best Practices for Service Account Setup

<Tip>
  **Create a dedicated user for CodeRabbit** - This ensures the user is
  exclusively for CodeRabbit, allowing better access control and easier
  management.
</Tip>

Follow these recommendations when setting up your CodeRabbit service account:

* **Username**: Use "CodeRabbit" as the username for easy recognition
* **Email**: Use a dedicated email address for easy identification and management
* **Profile picture**: Use the CodeRabbit logo for easy recognition. [Download our logo here](https://www.coderabbit.ai/brand)
* **Permissions**: Ensure the dedicated user has at least **Developer** access to the group or projects where you want to install CodeRabbit

#### Important Considerations

<Warning>
  **Token Expiration**: Personal access tokens have expiration dates. Ensure the
  expiration date covers the duration of your intended use of CodeRabbit to
  avoid service interruption.
</Warning>

<Info>
  **Review Attribution**: Code reviews will be attributed to the owner of the
  personal access token, so they'll appear to come from your service account
  user.
</Info>

**Updating Expired Tokens**: If your personal access token expires, you can add a new one via the CodeRabbit UI:

1. Navigate to the **GitLab User** page in the sidebar
2. Enter the new access token and click the **Update** button

#### Generating a Personal Access Token

<Steps>
  <Step title="Log in to your CodeRabbit service account">
    Log in using the user designated for CodeRabbit reviews. This user serves as
    a service account for managing reviews and related activities.
  </Step>

  <Step title="Navigate to access tokens">
    1. Select your avatar on the left sidebar 2. Choose **Edit Profile** 3.
       Select **Access Tokens** from the left sidebar 4. Click [Add New
       Token](https://gitlab.com/-/user_settings/personal_access_tokens)
  </Step>

  <Step title="Configure token settings">
    1. Enter a descriptive name for the token (e.g., "CodeRabbit Integration")
    2. Set an expiry date for the token

    <Note>
      If no expiry date is entered, it defaults to 365 days from the current
      date.
    </Note>
  </Step>

  <Step title="Select required scopes">
    Ensure the following scopes are selected: - `api` - Full API access -
    `read_api` - Read-only API access - `read_user` - Read user information
  </Step>

  <Step title="Create and save the token">
    1. Click **Create Personal Access Token** 2. **Important:** Copy and
       securely store the token immediately as it will only be displayed once
  </Step>
</Steps>

<img alt="GitLab personal access token creation page showing required scopes and settings for CodeRabbit integration" />

***

### Group Access Token

Creating a Group Access Token in GitLab automatically generates a bot user. Ensure that the token is configured with Developer access. Once set up, you only need to provide this token for integration. Note that a Group Access Token is limited to the scope of the group where it was created. To configure additional groups, you will need to generate a separate Group Access Token for each group.

<Note>
  By default, GitLab restricts this option to users on the Premium or Ultimate
  tiers.
</Note>

#### Generating a Group Access Token

<Steps>
  <Step title="Navigate to your group">
    Navigate to the group you wish to install CodeRabbit on.
  </Step>

  <Step title="Access token settings">
    1. Select **Settings** from the left sidebar 2. Select **Access Tokens**
       within the Settings heading
  </Step>

  <Step title="Create the token">
    1. Create a Group Access Token 2. Ensure the `api` scope is selected 3.
       Ensure **Developer Access** is provided
  </Step>
</Steps>

<Check>
  Group Access Tokens create bot users with generic GitLab-generated usernames (like `group_63_bot_5753...`). If you prefer a more descriptive username for your CodeRabbit bot, you can customize it using the [GitLab API](https://docs.gitlab.com/api/users/#modify-a-user).

  You can find the bot's user ID through the CodeRabbit UI if connected, or by visiting the bot user's profile from your Group Members page in GitLab.
</Check>

### Configuring Access Tokens in CodeRabbit

GitLab project Owners and Maintainers can install CodeRabbit on individual projects from the **Repositories** page without requiring top-level GitLab group Owner access, including projects inside subgroups. The **Install Group** action is restricted to GitLab group Owners.

By default, if no access token is provided, CodeRabbit prompts you to provide one during installation. To provide the token beforehand, open **Account** in the left sidebar, then under **Provider settings**, click **GitLab User**. Once you enter the token, CodeRabbit validates it and saves it for future use.

You can confirm the correct user is being selected by verifying the user ID shown on the UI with the user ID of the service account user you created.

***

## Repository Installation

You can install CodeRabbit on individual GitLab projects or across a full GitLab group, depending on your GitLab role. Projects are selectable based on your permissions:

* **Project installation**: GitLab project Owners and Maintainers can install CodeRabbit on the selected projects without top-level group Owner access.
* **Group installation**: Installing CodeRabbit for an entire GitLab group requires GitLab group Owner access, and the installation covers repositories in that group and its subgroups, including [repositories added later](#automatic-installation-for-new-group-repositories). Group-wide install and uninstall actions are managed from the top-level group; when browsing a subgroup, the group-wide action is not shown, but you can still select individual repositories or, if you manage the top-level group, choose **View top-level group** to manage the group installation.

Projects where your GitLab user has Owner or Maintainer access are selectable. Projects where you do not have enough permission remain visible but cannot be selected; CodeRabbit shows a reason message explaining why the project is unavailable.

<Steps>
  <Step title="Access repository settings">
    Go to the [Repositories
    page](https://app.coderabbit.ai/settings/repositories) in the CodeRabbit
    app.
  </Step>

  <Step title="Select repositories">
    Select the checkbox next to the projects where you want to install CodeRabbit.

    <Tip>
      To install CodeRabbit on every project in a group, use the group-level installation option. This action requires GitLab group Owner access.
    </Tip>
  </Step>

  <Step title="Install CodeRabbit">
    Select **Install Repositories** to complete the installation.
  </Step>
</Steps>

<Frame>
  <img alt="CodeRabbit Repositories page showing selectable GitLab projects and unavailable projects based on user permissions" />
</Frame>

The webhook `https://coderabbit.ai/gitlabHandler` will now be installed for the projects selected.

<img alt="GitLab webhook configuration showing CodeRabbit's webhook URL installed in project settings" />

### Automatic installation for new group repositories

After a GitLab group Owner completes the **Install Group** action, CodeRabbit also covers repositories that are later created in or added to the installed group and its subgroups. You do not need to select and install each new repository individually.

This behavior relies on the group-level webhook and token installation. Use a Group Access Token where applicable, and complete the group installation as a GitLab group Owner.

<Info>
  On GitLab.com, Group Access Tokens are available on the Premium and Ultimate tiers.
</Info>

Activation is event-driven rather than immediate when the repository is created or added. CodeRabbit marks the repository as installed when its first merge request or pull request is opened and then begins the review.

After activation, use [Repository settings](/guides/repository-settings) to verify access or manage the repository in CodeRabbit.

## Manual webhook installation

If you install repositories from the **Repositories** page, CodeRabbit configures the webhook automatically. Use this flow only when you need to install the webhook manually or rotate the shared webhook secret.

The **Webhook Secret** page is available in CodeRabbit for supported Git providers, including GitLab.com and self-managed GitLab.

<Steps>
  <Step title="Open Webhook Secret settings">
    In the CodeRabbit app, open **Account** and select **Webhook Secret** from
    the sidebar.
  </Step>

  <Step title="Copy the webhook URL">
    Use the **Webhook URL** field on that page to copy the exact endpoint that
    your GitLab project or group should call.
  </Step>

  <Step title="Save or change the webhook secret">
    Enter the secret that GitLab should send with webhook deliveries and save
    it in CodeRabbit.
  </Step>

  <Step title="Configure the GitLab webhook">
    When creating or editing the webhook in GitLab, use the copied webhook URL
    and enable these settings:

    * **Merge request events**
    * **Comments**
    * **Issues events**
    * **SSL verification** enabled
  </Step>
</Steps>

<Info>
  If you change an existing webhook secret, CodeRabbit attempts to update existing CodeRabbit-managed GitLab project and group webhooks automatically. If a webhook was created manually, or if an automatic refresh fails, update the secret directly in GitLab.
</Info>

## Troubleshooting

<Note>
  If you are experiencing issues with the webhook, such as CodeRabbit not being able to access the repository, or not reviewing merge requests, you can manually delete the webhook from the repository.

  Then refresh the repository page in the CodeRabbit app and reinstall the webhook.

  If you cannot install the webhook, please check that your GitLab user has the necessary permissions to install the webhook and the PAT is not expired.
</Note>


# Overview
Source: https://docs.coderabbit.ai/platforms/overview

Connect CodeRabbit with your preferred Git platform including GitHub, GitLab, Azure DevOps, Bitbucket Cloud, and Bitbucket Data Center for AI-powered code reviews right in your PR.

CodeRabbit seamlessly integrates with all major Git platforms to bring AI-powered code reviews directly to your development workflow. Choose your platform below to get started with step-by-step integration guides.

## Integration process

While each Git platform has specific setup requirements, the general integration process follows these steps:

<Steps>
  <Step title="Authenticate with your Git platform">
    Log into CodeRabbit using your Git platform account credentials for secure,
    streamlined access.
  </Step>

  <Step title="Add your organizations">
    Connect the <Tooltip>organizations</Tooltip> containing repositories you want CodeRabbit to review. You'll need ownership-level permissions for these organizations.
  </Step>

  <Step title="Configure service account">
    Create a dedicated CodeRabbit service account if required. Some platforms
    like GitHub.com handle this automatically.
  </Step>

  <Step title="Grant repository permissions">
    Authorize CodeRabbit to access the specific repositories where you want AI
    code reviews enabled.
  </Step>
</Steps>

Once integration is complete, CodeRabbit immediately begins [reviewing pull requests](/guides/code-review-overview) with its default configuration. You can then [customize the configuration](/guides/configuration-overview) to match your team's specific needs and coding standards.

## Supported Git platforms

<Card title="GitHub.com" icon="github" href="/platforms/github-com">
  Connect your GitHub.com repositories for instant AI code reviews
</Card>

<Card title="GitHub Enterprise Server" icon="github" href="/platforms/github-enterprise-server">
  Self-hosted GitHub integration for enterprise teams
</Card>

<Card title="Private-network Git platform" icon="shield-check" href="/self-hosted/coderabbit-reverse-tunnel">
  Connect private network GitHub Enterprise Server or self-managed GitLab without opening inbound network access
</Card>

<Card title="GitLab.com" icon="gitlab" href="/platforms/gitlab-com">
  Integrate with GitLab.com for comprehensive code analysis
</Card>

<Card title="GitLab self-managed" icon="gitlab" href="/platforms/self-hosted-gitlab">
  Connect your on-premises GitLab instance
</Card>

<Tip>
  GitLab group installations can automatically cover repositories added later.
  Learn about [automatic installation for new group
  repositories](/platforms/gitlab-com#automatic-installation-for-new-group-repositories).
</Tip>

<Card title="Bitbucket Cloud" icon="bitbucket" href="/platforms/bitbucket-cloud">
  AI code reviews for your Bitbucket Cloud repositories
</Card>

<Card title="Bitbucket Data Center" icon="bitbucket" href="/platforms/bitbucket-data-center">
  Connect your self-hosted Bitbucket Data Center instance
</Card>

<Card title="Azure DevOps" icon="microsoft" href="/platforms/azure-devops">
  Seamless integration with Microsoft Azure DevOps
</Card>

<Info>
  **Need enterprise-grade deployment?** CodeRabbit offers a self-hosted option
  for Enterprise customers with 500+ user seats. [Contact our sales
  team](https://www.coderabbit.ai/contact-us/sales) to learn more about
  CodeRabbit Enterprise.
</Info>


# Self-managed GitLab
Source: https://docs.coderabbit.ai/platforms/self-hosted-gitlab

Learn how to integrate CodeRabbit with your self-managed GitLab instance through automated or manual onboarding, including OAuth setup, user configuration, and webhook installation.

<Info>
  For an overview of how CodeRabbit integrates with Git platforms, see [Add
  CodeRabbit to your repository](/platforms).
</Info>

<Warning>
  **Version Requirements**

  CodeRabbit supports GitLab `16.x` and above. Version `15.x` may experience unexpected issues such as review comments not being posted or the sign-up process not working at all. We recommend upgrading your GitLab instance to obtain the intended experience.
</Warning>

## Getting Started

To integrate your self-managed GitLab with CodeRabbit, we require specific information for the initial setup within your domain. Once this setup is complete, you can log in directly using the OAuth2 flow.

<Steps>
  <Step title="Visit CodeRabbit login page">
    Navigate to the [CodeRabbit login page](https://app.coderabbit.ai/login?free-trial=) and select **Self-Hosted GitLab**.

    <img alt="CodeRabbit login" />
  </Step>

  <Step title="Enter your GitLab instance URL">
    Enter the URL of your self-managed GitLab instance and click **Submit**. We'll check our database for an existing record of your organization and start the login process if found.

    <img alt="Self-hosted GitLab enterprise connection page" />

    If your self-managed GitLab instance is not found, we'll initiate the onboarding process.
  </Step>

  <Step title="Choose onboarding method">
    You can choose between automated or manual onboarding based on your security
    preferences and administrative access.
  </Step>
</Steps>

## Onboarding Options

### Automated Onboarding (Recommended)

<img alt="Self-managed GitLab connection page" />

<Info>
  **Why do we need the Admin Access Token?**

  The admin access token is required to set up a new CodeRabbit bot user within your self-managed instance. The token is needed only once during the initial setup process. Once generated, you can set its minimum expiration period. This is the standard approach used by other products in this category.

  This admin-token step configures the self-managed GitLab instance but does not select which projects or groups CodeRabbit can access. After onboarding, use [Repository installation](#repository-installation) to install CodeRabbit on individual projects or across a group.
</Info>

### Manual Onboarding

For the manual onboarding process, you need to create the [CodeRabbit user](#creating-coderabbit-user) and the [OAuth2 GitLab application](#creating-oauth2-application).

<img alt="Self-managed GitLab connection page" />

#### Creating CodeRabbit User

This feature will work with any user from your organization, but we strongly recommend creating a dedicated user called **CodeRabbitAI**. This ensures clarity about which user is used for our application and allows for better fine-grained access control.

<Info>
  To interact with CodeRabbit in merge request comments, use `@coderabbitai` — or the username of the user you create here, if it differs.
</Info>

<Steps>
  <Step title="Create the user">
    Log in with an instance admin account and follow the steps provided in the
    [GitLab
    documentation](https://docs.gitlab.com/ee/user/profile/account/create_accounts.html#create-users-in-admin-area)
    to create a new user.
  </Step>

  <Step title="Retrieve user information">
    After the user is created, retrieve the **User ID** from that user's profile.
  </Step>

  <Step title="Generate access token">
    Generate an [**access token**](#generating-personal-access-token) for this
    user. The access token is used to post reviews on merge requests.
  </Step>
</Steps>

<Tip>
  **Recommendations for the CodeRabbit user:** - Use **"CodeRabbitAI"** as the
  username for easy identification - Use the CodeRabbit
  [logo](https://www.coderabbit.ai/brand) as the profile picture for easy
  recognition - Ensure the user has appropriate permissions for the repositories
  you want to integrate
</Tip>

<Note>
  If you prefer, you can create a Group Access Token which will create a
  dedicated user on your behalf. For more information, see [Group Access
  Token](/platforms/gitlab-com#group-access-token).
</Note>

#### Creating OAuth2 Application

For self-managed GitLab, we recommend creating an instance-wide application unless you want the reviews to be limited to a single group or user.

Follow the steps outlined in the [GitLab documentation](https://docs.gitlab.com/ee/integration/oauth_provider.html#create-an-instance-wide-application) for creating the application.

<Check>
  **OAuth2 Application Requirements:**

  * **Scopes:** `api read_user email openid`
  * **Callback URL:** `https://app.coderabbit.ai/login`
</Check>

#### Generating Personal Access Token

GitLab offers an option to generate a personal access token for adding a new user and setting up the application in the self-managed instance.

<Steps>
  <Step title="Login to your instance">
    Login to your self-hosted instance. For [automated
    onboarding](#automated-onboarding-recommended), ensure you have admin rights.
  </Step>

  <Step title="Access user settings">
    On the left sidebar, select your avatar, then select **Edit profile**.
  </Step>

  <Step title="Navigate to Access Tokens">
    On the left sidebar, select **Access Tokens**.
  </Step>

  <Step title="Create new token">Select **Add new token**.</Step>

  <Step title="Configure token settings">
    * Enter a name and expiry date for the token
    * We need this for the initial setup, so the minimum expiry time is sufficient
    * If you do not enter an expiry date, it defaults to 365 days from the current date
    * Select the required scopes: `api`, `read_api`, `read_user`

      <img alt="GitLab personal access token configuration page" />
  </Step>

  <Step title="Generate and save token">
    Select **Create personal access token** and note down the token as it will
    only be displayed once.
  </Step>

  <Step title="Enter the token in CodeRabbit">
    To provide the personal access token, open CodeRabbit [web application](https://app.coderabbit.ai/), open **Account** in the left sidebar, then under **Provider settings**, click **GitLab User**. Once you enter the token, CodeRabbit validates it and saves it for future use.
  </Step>
</Steps>

### **Paste the details and click submit**

* Submit the form.
* We will handle the setup process for you.
* On subsequent visits, your setup will be automatically detected, allowing for direct login. <img alt="CodeRabbit authentication options page" />

### **Allow list CodeRabbit IP address**

Use these CodeRabbit IP addresses if your instance requires IP allow listing.

```text IPs to allow list wrap theme={null}
35.222.179.152/32, 34.170.211.100/32, 136.113.208.247/32, 136.64.151.96/28, 34.122.160.224/29, 18.232.215.9/32, 98.89.212.255/32, 52.1.193.145/32, 44.199.13.86/32
```

### Manual webhook installation

Use this flow when you need to install the webhook manually or rotate the shared webhook secret. The **Webhook Secret** page is available in CodeRabbit for supported Git providers, including GitLab.com and self-managed GitLab.

<Steps>
  <Step title="Open Webhook Secret settings">
    In the CodeRabbit app, open **Account** and select **Webhook Secret** from the sidebar.
  </Step>

  <Step title="Copy the webhook URL">
    Use the **Webhook URL** field on that page to copy the exact endpoint that your GitLab instance should call.
  </Step>

  <Step title="Save or change the webhook secret">
    Enter the secret that GitLab should send with webhook deliveries and save it in CodeRabbit.
  </Step>

  <Step title="Configure the GitLab webhook">
    When creating or editing the webhook in GitLab, use the copied webhook URL and enable these settings:

    * **Merge request events**
    * **Comments**
    * **Issues events**
    * **SSL verification** enabled
  </Step>
</Steps>

<Info>
  If you change an existing webhook secret, CodeRabbit attempts to update existing CodeRabbit-managed GitLab project and group webhooks automatically. If a webhook was created manually, or if an automatic refresh fails, update the secret directly in GitLab.
</Info>

### Bulk webhook installation

For administrators managing many GitLab projects, you can use a script to bulk-install webhooks across all projects.

<Steps>
  <Step title="Login to CodeRabbit UI">
    Login to CodeRabbit UI through your GitLab self-managed instance.
  </Step>

  <Step title="Copy the webhook URL and secret">
    Follow the [Manual webhook installation](#manual-webhook-installation) steps above to get your webhook URL and save a webhook secret in CodeRabbit.
  </Step>

  <Step title="Run script to install webhooks">
    Use a script to install webhooks across your GitLab projects or groups. Below is a sample script that requires:

    * Your GitLab host URL
    * The webhook URL you copied in the previous step
    * The webhook secret you saved in the previous step
    * A GitLab access token with API permissions

    <Accordion title="gitlab-webhook.sh script">
      ```bash theme={null}
      #!/usr/bin/env bash

      ## gitlab-webhook.sh

      # Add a webhook to one project, or every project in a subgroup tree

      set -euo pipefail

      usage() {
        cat <<EOF
      Usage:
        $0 -h <gitlab-host> -u <webhook-url> -s <webhook-secret> \\
           [-t <access-token>] [-A <auth-header>] [-p <project> | -g <group>] [-v]

      Required:
        -h  GitLab host (e.g. gitlab.example.com)
        -u  Webhook endpoint URL to receive POSTs
        -s  Webhook secret token (used for signature verification)

      Authentication (one of):
        -t  Access token (PAT, project, group or OAuth). If omitted, \$GITLAB_TOKEN is used
        -A  Auth header to use. Default detects:
              PAT → "PRIVATE-TOKEN"
              anything else → "Authorization: Bearer"

      Scope (choose one):
        -p  Project ID or full path (e.g. 42 or group/app)
        -g  Group ID or full path, recurse through all subgroups & projects

      Options:
        -v  Verbose output (show individual project IDs in final summary)
      EOF
        exit 1
      }

      HOST="" HOOK_URL="" HOOK_SECRET=""
      TOKEN="${GITLAB_TOKEN:-}" AUTH_HEADER=""
      PROJECT="" GROUP="" VERBOSE=false

      while getopts "h:u:s:t:A:p:g:v" opt; do
        case "$opt" in
          h) HOST=$OPTARG ;;
          u) HOOK_URL=$OPTARG ;;
          s) HOOK_SECRET=$OPTARG ;;
          t) TOKEN=$OPTARG ;;
          A) AUTH_HEADER=$OPTARG ;;
          p) PROJECT=$OPTARG ;;
          g) GROUP=$OPTARG ;;
          v) VERBOSE=true ;;
          *) usage ;;
        esac
      done

      # Mandatory checks

      [[ -z $HOST || -z $HOOK_URL || -z $HOOK_SECRET ]] && usage
      [[ -n $PROJECT && -n $GROUP ]] && usage
      [[ -z $PROJECT && -z $GROUP ]] && usage

      # Token handling

      if [[ -z $TOKEN ]]; then
        echo "[ERROR] No access token provided. Use -t or set \$GITLAB_TOKEN" >&2
        exit 1
      fi

      # Choose header if not forced

      if [[ -z $AUTH_HEADER ]]; then
        if [[ $TOKEN == glpat-* || $TOKEN == "PAT-"* ]]; then
          AUTH_HEADER="PRIVATE-TOKEN"
        else
          AUTH_HEADER="Authorization: Bearer"
        fi
      fi

      API="https://${HOST}/api/v4"
      CURL_BASE=(curl -sSf --header "${AUTH_HEADER}: ${TOKEN}")

      # Track processed projects to avoid duplicates

      declare -A PROCESSED_PROJECTS
      WEBHOOK_PROJECTS=()
      EXISTING_WEBHOOK_PROJECTS=()
      TOTAL_PROJECTS_FOUND=0
      PROJECTS_PROCESSED=0

      url_encode() {
        local string="$1"
        printf '%s' "$string" | sed 's/\//%2F/g; s/ /%20/g; s/@/%40/g; s/:/%3A/g; s/#/%23/g; s/?/%3F/g; s/&/%26/g; s/=/%3D/g; s/+/%2B/g'
      }

      fetch_paginated() {
        local url=$1
        local page=1
        local per_page=100

        while true; do
          local paginated_url
          if [[ "$url" == *"?"* ]]; then
            paginated_url="${url}&per_page=${per_page}&page=${page}"
          else
            paginated_url="${url}?per_page=${per_page}&page=${page}"
          fi

          local response
          response=$("${CURL_BASE[@]}" "$paginated_url" 2>/dev/null) || {
            echo "[ERROR] Failed to fetch page $page from $url" >&2
            return 1
          }

          if [[ "$response" == "[]" || "$response" == "null" ]]; then
            break
          fi

          local page_results
          page_results=$(echo "$response" | jq -r '.[].id' 2>/dev/null) || {
            echo "[ERROR] Failed to parse JSON response from page $page" >&2
            return 1
          }

          if [[ -z "$page_results" ]]; then
            break
          fi

          local page_count
          page_count=$(echo "$page_results" | wc -l)
          TOTAL_PROJECTS_FOUND=$((TOTAL_PROJECTS_FOUND + page_count))
          echo "[PROGRESS] Found $page_count projects on page $page (total: $TOTAL_PROJECTS_FOUND)" >&2

          echo "$page_results"

          local item_count
          item_count=$(echo "$response" | jq '. | length' 2>/dev/null) || 0
          if [[ "$item_count" -lt "$per_page" ]]; then
            break
          fi

          ((page++))
        done
      }

      create_hook() {
        local pid=$1

        if [[ -n "${PROCESSED_PROJECTS[$pid]:-}" ]]; then
          return 0
        fi

        PROCESSED_PROJECTS[$pid]=1
        PROJECTS_PROCESSED=$((PROJECTS_PROCESSED + 1))

        local encoded_pid
        if [[ $pid =~ ^[0-9]+$ ]]; then
          encoded_pid=$pid
        else
          encoded_pid=$(url_encode "$pid")
        fi

        local existing_webhooks
        existing_webhooks=$("${CURL_BASE[@]}" "${API}/projects/${encoded_pid}/hooks" 2>/dev/null) || {
          echo "[ERROR] Failed to fetch existing webhooks for project $pid" >&2
          return 1
        }

        if echo "$existing_webhooks" | jq -e --arg url "$HOOK_URL" '.[] | select(.url == $url)' >/dev/null 2>&1; then
          [[ "$VERBOSE" == "true" ]] && echo "[INFO] Webhook already exists for project: $pid" >&2
          EXISTING_WEBHOOK_PROJECTS+=("$pid")
          return 0
        fi

        [[ "$VERBOSE" == "true" ]] && echo "[INFO] Adding webhook to project: $pid" >&2

        "${CURL_BASE[@]}" --request POST \
          --data-urlencode "url=${HOOK_URL}" \
          --data "token=${HOOK_SECRET}" \
          --data "push_events=true" \
          --data "note_events=true" \
          --data "issues_events=true" \
          --data "merge_requests_events=true" \
          --data "enable_ssl_verification=true" \
          "${API}/projects/${encoded_pid}/hooks" \
          > /dev/null

        WEBHOOK_PROJECTS+=("$pid")
      }

      traverse_group() {
        local gid=$1
        local encoded_gid
        if [[ $gid =~ ^[0-9]+$ ]]; then
          encoded_gid=$gid
        else
          encoded_gid=$(url_encode "$gid")
        fi

        while IFS= read -r pid; do
          [[ -n "$pid" ]] && create_hook "$pid"
        done < <(
          fetch_paginated "${API}/groups/${encoded_gid}/projects?include_subgroups=true"
        )

        while IFS= read -r sg; do
          [[ -n "$sg" ]] && traverse_group "$sg"
        done < <(
          fetch_paginated "${API}/groups/${encoded_gid}/subgroups"
        )
      }

      echo "[INFO] Starting webhook processing..." >&2

      if [[ -n $PROJECT ]]; then
        echo "[INFO] Processing single project: $PROJECT" >&2
        create_hook "$PROJECT"
      else
        echo "[INFO] Processing group and subgroups: $GROUP" >&2
        traverse_group "$GROUP"
      fi

      echo "[INFO] Finished processing all projects" >&2

      total_projects=$((${#WEBHOOK_PROJECTS[@]} + ${#EXISTING_WEBHOOK_PROJECTS[@]}))

      if [[ $total_projects -eq 0 ]]; then
        echo "[INFO] No projects were processed"
      else
        if [[ ${#WEBHOOK_PROJECTS[@]} -gt 0 ]]; then
          if [[ "$VERBOSE" == "true" ]]; then
            echo "[INFO] Webhooks installed successfully on ${#WEBHOOK_PROJECTS[@]} project(s):"
            for pid in "${WEBHOOK_PROJECTS[@]}"; do
              echo "  - Project ID: $pid"
            done
          else
            echo "[INFO] Webhooks installed successfully on ${#WEBHOOK_PROJECTS[@]} project(s)"
          fi
        fi

        if [[ ${#EXISTING_WEBHOOK_PROJECTS[@]} -gt 0 ]]; then
          if [[ "$VERBOSE" == "true" ]]; then
            echo "[INFO] Webhooks already existed on ${#EXISTING_WEBHOOK_PROJECTS[@]} project(s):"
            for pid in "${EXISTING_WEBHOOK_PROJECTS[@]}"; do
              echo "  - Project ID: $pid"
            done
          else
            echo "[INFO] Webhooks already existed on ${#EXISTING_WEBHOOK_PROJECTS[@]} project(s)"
          fi
        fi

        echo "[INFO] Total projects processed: $total_projects"
      fi

      ```
    </Accordion>

    ```bash theme={null}
    # Make sure the script is executable:
    chmod +x gitlab-webhook.sh
    ```

    #### Example: Install webhook on a single project

    ```bash theme={null}
    export GITLAB_TOKEN="glpat-xxxxx"
    ./gitlab-webhook.sh \
      -h "gitlab.example.com" \
      -u "https://coderabbit.ai/gitlabHandler" \
      -s "your-webhook-secret" \
      -p 42
    ```

    #### Example: Install webhooks on all projects in a group (including subgroups)

    ```bash theme={null}
    export GITLAB_TOKEN="glpat-xxxxx"
    ./gitlab-webhook.sh \
      -h "gitlab.example.com" \
      -u "https://coderabbit.ai/gitlabHandler" \
      -s "your-webhook-secret" \
      -g "mygroup/mysubgroup"
    ```
  </Step>
</Steps>

## Repository installation

After completing onboarding, install CodeRabbit on individual projects or across a GitLab group from the [Repositories page](https://app.coderabbit.ai/settings/repositories) in the CodeRabbit app. The permission model and steps are the same as for GitLab.com — see [Repository installation](/platforms/gitlab-com#repository-installation) for details.

After a group installation, repositories later created in or added to that group and its subgroups are activated automatically when their first merge request or pull request is opened. See [Automatic installation for new group repositories](/platforms/gitlab-com#automatic-installation-for-new-group-repositories) for the prerequisites and expected behavior. GitLab.com tier restrictions described there do not necessarily apply to self-managed GitLab; availability depends on your GitLab license and instance configuration.

## SSH repository access

By default, CodeRabbit clones your GitLab projects over HTTPS. If HTTPS is not available or your organization prefers SSH for repository access, you can configure SSH clone credentials in the CodeRabbit web app.

### Prerequisites

* An SSH key pair generated **without a passphrase**. CodeRabbit cannot use passphrase-protected keys.
* The public key must be registered on the GitLab account used by CodeRabbit under **Edit profile → SSH Keys**. GitLab will deny SSH access if the public key is not registered!

  See the [GitLab documentation on SSH keys](https://docs.gitlab.com/ee/user/ssh.html).

### Configure SSH clone credentials

<Steps>
  <Step title="Log in to CodeRabbit">
    Navigate to [app.coderabbit.ai](https://app.coderabbit.ai) and log in with your self-managed GitLab account.
  </Step>

  <Step title="Open account settings">
    In the left navigation menu, click **Account** at the bottom.
  </Step>

  <Step title="Navigate to SSH Clone Credentials">
    In the left navigation of the Account page, under **Developer settings**, click **SSH Clone Credentials**.
  </Step>

  <Step title="Enter your SSH credentials">
    Fill in the fields as required for your setup:

    | Field               | Required    | Description                                                                                                          |
    | ------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------- |
    | **SSH Private Key** | Yes         | The private key used to authenticate with your GitLab instance. Must be generated **without a passphrase**.          |
    | **SSH Public Key**  | Recommended | The corresponding public key. Providing it allows CodeRabbit to verify the key pair.                                 |
    | **SSH Port**        | Optional    | Custom SSH port if your GitLab instance does not use the default port `22`.                                          |
    | **known\_hosts**    | Optional    | Contents of a `known_hosts` file for your GitLab host. Helps prevent man-in-the-middle warnings on first connection. |

    For most setups, providing the **SSH Private Key** and **SSH Public Key** is sufficient.

    <Info>
      To avoid common copy-paste problems, use `pbcopy` (macOS) or `xclip` (Linux) to copy each key file to your clipboard, then paste directly into the corresponding field.
    </Info>
  </Step>

  <Step title="Save your credentials">
    Click **Save** to apply the SSH clone credentials. CodeRabbit will attempt SSH cloning using these credentials for your self-managed GitLab repositories. If SSH credentials cannot be decrypted or are invalid, cloning falls back to HTTPS.

    <Info>
      After the initial setup, you can return to this page to update individual fields without re-entering all credentials.
    </Info>
  </Step>
</Steps>

## What's next

<CardGroup>
  <Card title="Platform overview" href="/platforms/overview" icon="layers">
    Overview of all Git platforms supported by CodeRabbit and how to get started.
  </Card>

  <Card title="Quickstart" href="/getting-started/quickstart" icon="rocket">
    Open your first merge request and see CodeRabbit post a review in minutes.
  </Card>
</CardGroup>


# Change Stack
Source: https://docs.coderabbit.ai/pr-reviews/change-stack

Change Stack is CodeRabbit's PR inspection interface. It reorganizes a pull request from a flat file list into a structured, layer-by-layer walkthrough. Reviewers can explore the change in a logical order instead of alphabetical file order. Each *cohort* includes range-specific summaries and, when useful, diagrams.

<GitHubBadge /> <GitLabBadge /> <BitbucketBadge /> <AzureBadge title="Azure DevOps *" /> | <ProPlusPlanBadge title="Pro+ Plan *" /> <EarlyAccessBadge />

## Overview

Change Stack is CodeRabbit's PR inspection interface. It takes any pull request and reorganizes it into a small number of independent **change cohorts**, logical groupings of related work, each broken into ordered **layers** that reflect the natural reading order of the change. Every layer anchors to specific line ranges in the diff, each with its own summary.

Reviewers open Change Stack from the [`Review Change Stack →`](#opening-change-stack) button that CodeRabbit posts in the <Hint type="walkthrough">PR Walkthrough</Hint> comment. Inside, they navigate cohorts and layers with the keyboard. On GitHub, GitLab, and Bitbucket, they can also drop inline comments against specific ranges and submit native review feedback without leaving the Change Stack tab.

<Info>
  Change Stack is available on GitHub Cloud, GitHub Enterprise Server, GitLab.com, self-managed GitLab, Bitbucket Cloud, Bitbucket Data Center, and Azure DevOps. Azure DevOps support is read-only during early access; inline commenting and review submission are not yet supported. Change Stack is in [early access](/early-access) and is available to all users during launch. It will be part of the Pro+ plan going forward.
</Info>

## Why Change Stack

AI-assisted development has made pull requests larger and more frequent; a single AI-authored change can touch dozens of files across multiple layers of a codebase. A git provider's or IDE's default diff view can present those files alphabetically without reflecting the logical dependencies between them. Change Stack reorganizes the diff into cohorts and layers that reflect the structure of the change:

* **Cohorts** group related files and hunks that belong together conceptually.
* **Layers** order those groups so foundational changes (data shapes, contracts) come before the code that depends on them (consumers, call sites, tests).
* **Range summaries** explain each contiguous block of changed lines in plain language.
* **Diagrams** are generated inline for layers where a visual earns its place, such as sequence diagrams for new call flows, state machines for lifecycle changes, and ERDs for data model updates. Layers that do not warrant a diagram do not get one.

## Opening Change Stack

Every pull request review comment from CodeRabbit includes a **Review Change Stack →** button above the standard walkthrough. Clicking it opens the review in the Change Stack interface.

<Frame>
  <img alt="CodeRabbit review comment showing the Review Change Stack button alongside Walkthrough and Pre-merge checks sections" />
</Frame>

Change Stack is opt-in per reviewer. Teammates who prefer their git provider's default review experience can ignore the button. Nothing about the PR workflow changes for them.

## The three-panel layout

Change Stack uses a fixed three-panel layout tuned for rapid navigation:

| Panel  | Contents                                                                                                                                                                                           |
| ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Left   | Cohort and layer navigation, plus an **All files** view for jumping to any file in CodeRabbit's review scope. Each layer shows its file count and comment count.                                   |
| Center | The unified, split, or semantic diff for the active layer, scoped to the relevant line ranges. Click a variable, function, class, or type name to look up its definition and usages via Code Peek. |
| Right  | Per-range AI summaries for the visible diff, plus Context, Comments, and Chat surfaces for inline discussion and follow-up questions.                                                              |

<Info>
  Change Stack reflects CodeRabbit's review scope, not necessarily the full pull request file list on the host platform. Files excluded by default ignore rules or configured [Path filters](/configuration/path-instructions#path-filters) are omitted from cohorts, layer file counts, and file navigation.
</Info>

### Overview

The left rail includes an **Overview** entry above the numbered layers when the Overview surface is available. Use it for a high-level read on the pull request: the PR description, CodeRabbit's Walkthrough, and anything that needs attention before merge, including blockers, unresolved CodeRabbit issues, and required actions.

The **Needs your attention** section focuses on pre-merge blockers, including CodeRabbit findings, minor findings, changes-requested reviews, build status signals, and merge conflicts. Use **All Reviews** to inspect the complete review history. Opening a review card displays the [review-conversation viewer](#review-conversations) in Change Stack. The Activity panel also opens matching reviews and comments in the in-app viewer when a target is available, and falls back to the host platform when no in-app target can be found.

The Overview rail entry shows merge status at a glance. Its status icon and subtitle summarize whether the pull request is ready to merge, has warnings, is blocked, is closed, or is already merged. Hover the Overview entry to see a richer status breakdown.

Overview has its own `/overview` path for sharing and browser navigation. A bare Change Stack deep link opens Layer 1 by default; use the Overview entry or the `/overview` path to open the summary view directly.

### All Reviews

The **All Reviews** section is open by default and consolidates the complete pull request review history on a chronological timeline. It includes human and automated (bot) **Approved**, **Comment**, and **Changes requested** reviews, **pending** reviews, and pull-request-level comments.

Filter the timeline by review **state** or **reviewer**, toggle between all entries and only the most recent entry per reviewer, and sort from oldest to newest or newest to oldest. Bot approvals and changes-requested reviews are shown by default, while bot **Comment** entries are hidden until you opt in with the bot Comment state filter.

Each entry shows the reviewer's action, relative time, unresolved inline-comment count when available, and a one-line content preview. Use **View review** or **View comment** to open the entry in the [review-conversation viewer](#review-conversations). Empty reviews with no body or inline content may not include a view action.

### Keyboard navigation

Change Stack is designed to be driven from the keyboard:

| Shortcut     | Action                                    |
| ------------ | ----------------------------------------- |
| <kbd>J</kbd> | Advance to the next layer                 |
| <kbd>K</kbd> | Go back to the previous layer             |
| <kbd>Z</kbd> | Toggle focus mode (hides the side panels) |

Reviewers can also switch between unified, split, and semantic diff views, hide whitespace-only changes, step through the review order using the arrow controls in the diff header, and use the **All files** view to search the reviewed file tree. Diff lines wrap automatically in all views.

## Reviewing in Change Stack

Change Stack supports native review workflows on the host platform, including inline comments and review submission without leaving the Change Stack interface. Reviews post back to GitHub, GitLab, or Bitbucket natively. With repository write access, reviewers can add inline comments and replies, resolve or reopen eligible threads, approve or request changes, mark pull requests ready for review, run CodeRabbit commands, and start coding-agent tasks that create commits or stacked pull requests.

<Frame>
  <img alt="Submit review dialog showing Comment selected, with Approve and Request changes options, and a Submit review button" />
</Frame>

### Inline comments

Every range summary in the right panel has an **Add block comment** action that opens a comment against the exact line range covered by the summary. Comments accumulate into a pending review, which you submit from the **Submit review** menu in the top-right corner.

The comment composer supports platform-native autocomplete for user and team mentions, issue references, pull request references, metadata references, and emoji shortcodes.

### Slack discussion threads

Use **Subscribe with Slack** to start a Slack thread for the review from inside Change Stack. You can choose a channel when the discussion belongs with a team, or start a direct-message thread when the discussion should stay between you and CodeRabbit.

Channel subscriptions use the workspace Slack app installation and search the channels available to the installed bot. Direct-message subscriptions require your Slack identity to be connected; if it is not connected yet, CodeRabbit sends you through Slack linking and returns you to the review.

You can create additional Slack discussion threads for the same pull request after one already exists. When a saved Slack channel destination is used for automatic PR thread subscriptions, new PR review threads start in that channel instead of falling back to a direct message.

### PR auto fix settings

Use **PR auto fix** settings in the Slack settings area to auto-subscribe to pull requests you open. You can choose whether new PR threads start in your Slack direct messages or in a channel, select which future PR events are posted there, and decide whether CodeRabbit can start CI fixes or review-comment fixes automatically in those auto-created threads.

CodeRabbit will not merge pull requests from this setting. It starts fix work in the configured thread so you can review the result before deciding what to do next.

### Review conversations

Opening a finding or changes-requested review from Overview shows an in-app viewer with grouped review threads: the pull-request-level review body first, followed by inline conversations. Each thread includes replies and resolved or outdated indicators, and you can use the existing review actions to reply and resolve eligible conversations. Changes-requested cards identify the reviewer and show the number of unresolved inline conversations.

For file-anchored conversations, **See in layer context** closes the viewer and selects the relevant code layer. Comments that CodeRabbit cannot map to a layer retain a validated link to the host platform.

The viewer appears as a dialog on desktop and a bottom drawer on mobile.

### Chat with AI

When AI chat is available for the session, the right rail can switch from review context into a dedicated chat panel. Reviewers can open chat from the main rail or directly from a range summary to ask follow-up questions about the current layer, file, or highlighted range.

The chat composer also supports voice input. Use the microphone button to record a prompt, then let CodeRabbit transcribe it into the chat before sending.

### Code Peek

Click a variable, function, class, or type name to look up its definition and usages. On GitHub, Code Peek uses GitHub code search to show likely definitions and references with surrounding context. On Bitbucket, Code Peek depends on code search being available for the connected account and installation.

Code Peek is available in GitHub Change Stack sessions when CodeRabbit has the GitHub access it needs for the repository. If GitHub needs to be reconnected or code search is unavailable for the session, Code Peek is not shown.

When a result points to a changed file in the pull request, **Open in Change Stack** jumps to that file. Change Stack keeps an in-page back trail so you can return to where you started.

### Finishing touches and coding tasks

Reviewers with write access can trigger coding tasks from CodeRabbit Review feedback, including finishing touches, unit tests, docstrings, and supported comment-driven tasks. These tasks are available independently of whether the AI chat panel is available for the session.

The coding panel tracks task progress as work moves through queued, running, patch-ready, and completed states, and it preserves the resulting patch, commit, or stacked PR details when those artifacts are created. If a task fails, CodeRabbit shows the failure and lets you retry when retry is available.

### Files viewed

On GitHub, marking a file as viewed in Change Stack syncs with GitHub's **Viewed** state on the same file, so your progress is visible to other reviewers and persists if you switch back to the GitHub UI.

On Bitbucket, viewed-file markers are stored in Change Stack.

## Snapshots and stale-state protection

Every time the PR author pushes a new commit, Change Stack generates a new **snapshot** of the change and retains previous ones. A snapshot dropdown in the header lets reviewers switch between snapshots to answer the question *"what changed since I last looked?"*, even across rebases and force-pushes.

<Info>
  While a new snapshot is being generated, Change Stack disables commenting on the current view and shows a banner until the new snapshot is ready. This prevents reviewers from leaving comments against a diff that no longer reflects the tip of the branch.
</Info>

## Access and permissions

Change Stack authenticates with a repo-scoped Git provider grant and preserves your return path through SSO, so links work end-to-end even on organizations with enforced SSO. For Bitbucket Cloud and Bitbucket Data Center, viewing requires an authenticated CodeRabbit connection and permission to view the pull request. Submitting reviews requires repository write or admin permission. Bitbucket Cloud uses its cloud sign-in and app-installation flow; Bitbucket Data Center uses the connected instance's sign-in and installation flow.

<Info>
  On private repositories, using Change Stack chat requires repository write permission from the Git provider (GitHub, GitLab, or Bitbucket). Users with read-only access can still view eligible private pull or merge requests, but they cannot use Change Stack chat. On public repositories, authenticated viewers can use Change Stack chat without write permission.
</Info>

### Bitbucket limitations

* Bitbucket pull requests cannot be viewed anonymously or through public links.
* Change Stack cannot apply Bitbucket review suggestions as commits.
* File-level review comments are not available on Bitbucket.
* Code Peek may be unavailable for a Bitbucket account or installation.

## What's next

<CardGroup>
  <Card title="PR Walkthroughs" href="/pr-reviews/walkthroughs" icon="list-tree">
    Learn how CodeRabbit's walkthrough comment structures every review and feeds the layer summaries you see in Change Stack.
  </Card>

  <Card title="PR Summaries" href="/pr-reviews/summaries" icon="file-text">
    See how CodeRabbit generates the plain-language summary that appears in the PR description alongside the Review Change Stack button.
  </Card>

  <Card title="Pre-Merge Checks" href="/pr-reviews/pre-merge-checks" icon="shield-check">
    Enforce review requirements, including linked issues, title conventions, and custom checks, before a PR can merge.
  </Card>
</CardGroup>


# CI/CD Pipeline Analysis
Source: https://docs.coderabbit.ai/pr-reviews/cicd-pipeline-analysis

How CodeRabbit reads CI/CD pipeline failures and posts inline fix suggestions directly on the relevant lines of your pull request.

When a CI/CD pipeline fails on a pull request, CodeRabbit reads the failure output and posts inline comments with suggested fixes — directly on the lines of code that caused the failure.

This works across multiple CI/CD platforms: GitHub Actions, GitLab CI/CD, CircleCI, and Azure DevOps Pipelines.

## How it works

1. A pull request is opened or updated and your CI/CD pipelines run.
2. CodeRabbit waits for pipeline results to become available.
3. CodeRabbit reads the failure logs and identifies the root cause.
4. Inline comments with suggested fixes are posted on the relevant lines of code.

## Supported platforms

| Platform               | How CodeRabbit reads pipeline output                                           |
| ---------------------- | ------------------------------------------------------------------------------ |
| GitHub Actions         | Via [GitHub Checks](/tools/github-checks)                                      |
| GitLab CI/CD           | Via GitLab pipeline API, including GitLab Advanced Security SAST/DAST findings |
| CircleCI               | Via CircleCI pipeline API (requires [integration](/integrations/circleci))     |
| Azure DevOps Pipelines | Via Azure DevOps Checks API                                                    |

For GitHub Actions specifically, pipeline analysis depends on the [`github-checks` tool configuration](/tools/github-checks).

## What failures are analyzed

CI/CD pipeline analysis covers a broad range of failure types:

* **Build failures** — Docker, Node.js, Java, Python, Go module errors
* **Test failures** — unit, integration, and end-to-end test output
* **Security scan findings** — SAST and DAST output from tools like GitLab Advanced Security or custom pipeline steps
* **Infrastructure-as-code validation** — Terraform, Kubernetes, Ansible, and CloudFormation errors
* **Linter and code quality output** — any linter running as a pipeline step

## Configuration

For GitHub Actions, use the [`github-checks` tool configuration](/tools/github-checks) to control whether GitHub Checks data is included in reviews.

For all other platforms (GitLab, CircleCI, Azure DevOps), CodeRabbit reads pipeline output automatically with no additional configuration required.

## What's next

<CardGroup>
  <Card title="GitHub Checks configuration" href="/tools/github-checks" icon="github">
    Configure whether GitHub Actions check results are included in pipeline analysis.
  </Card>

  <Card title="CircleCI integration" href="/integrations/circleci" icon="workflow">
    Connect your CircleCI account so CodeRabbit can read pipeline failure logs and post inline fix suggestions.
  </Card>

  <Card title="Pre-Merge Checks" href="/pr-reviews/pre-merge-checks" icon="shield">
    Define custom quality gates that block merges until your standards are met.
  </Card>
</CardGroup>


# Custom checks
Source: https://docs.coderabbit.ai/pr-reviews/custom-checks

Define your own validation logic using natural language instructions for pre-merge checks.

<ProPlusPlanBadge />

## How Custom Checks Work

Custom checks run in a secure, **read-only** environment against your PR.

**The agent has access to:**

* Changed files, code snippets, and relevant git history
* PR title, description, linked issues, and review discussion
* Pattern and code search tools (ast-grep, ripgrep)
* Sandboxed shell commands to inspect the repo
* Web lookups for public documentation
* Connected [MCP tools](/integrations/mcp-servers) for internal systems

**Process:**

<Steps>
  <Step title="Analyze">
    CodeRabbit interprets your instructions against the PR context
  </Step>

  <Step title="Verify">
    The agent gathers evidence using available tools to substantiate findings
  </Step>

  <Step title="Decide">
    Emits **Passed**, **Failed**, or **Inconclusive** with reasoning
  </Step>
</Steps>

## Limitations

<Warning>
  Custom checks run in a sandboxed environment. Instructions that rely on
  unavailable capabilities will return **Inconclusive** or produce unreliable
  results.
</Warning>

Custom checks cannot:

* **Run your test suite** — dependencies are not installed in the sandbox
* **Access `node_modules`, `dist`, or build artifacts** — build steps are not executed
* **Execute arbitrary repository code** — security restriction
* **Post inline comments on specific lines** — results appear in the summary table only
* **Check PR approval status or reviewer assignments** — not available to the agent
* **Modify the CodeRabbit review** — use [Path Instructions](/configuration/path-instructions) instead

## Writing Effective Instructions

Think of instructions as guidance for a smart teammate who needs explicit criteria, not subjective judgment.

<CardGroup>
  <Card title="Be specific and actionable" icon="pencil">
    Avoid vague instructions like "Check for security issues"
  </Card>

  <Card title="Define clear pass/fail criteria" icon="check">
    Say exactly what causes failure
  </Card>

  <Card title="One concern per check" icon="square">
    Don't bundle security, testing, and documentation into one instruction
  </Card>

  <Card title="Include examples for complex rules" icon="code">
    Show what passes and what fails
  </Card>
</CardGroup>

**Avoid these anti-patterns:**

| Anti-pattern            | Example                                                 | Why it fails                                                      |
| ----------------------- | ------------------------------------------------------- | ----------------------------------------------------------------- |
| Vague instructions      | "Verify best practices"                                 | No concrete pass/fail criteria                                    |
| Unavailable information | "Ensure PR is approved by @security-team"               | Agent cannot check approval status                                |
| Speculation             | "Assess if there are obvious performance optimizations" | No definitive criteria; relies on subjective judgment             |
| Review modifications    | "Keep review comments concise"                          | Use [Path Instructions](/configuration/path-instructions) instead |

## Examples

Custom checks can enforce a wide range of guardrails tailored to your team's needs. Here are a few examples to get you started.

<Accordion title="Sensitive Data in Logs">
  ```text theme={null}
  Fail if any log statement may include passwords, API keys, tokens,
  SSNs, or payment card data. Check print(), console.log, logger.*,
  System.out.println, and fmt.Print variants.
  ```
</Accordion>

<Accordion title="Hardcoded Credentials">
  ```text theme={null}
  Scan for hardcoded credentials matching: sk_live_*, AKIA[A-Z0-9]{16},
  ghp_[a-zA-Z0-9]{36}, or variables named *_SECRET, *_KEY, *_PASSWORD.
  Exclude test files and .example files.
  ```
</Accordion>

<Accordion title="Database Migrations">
  ```text theme={null}
  For files in db/migrations/: verify both up() and down() methods exist.
  Flag migrations dropping tables without restoration in down().
  ```
</Accordion>

<Accordion title="Breaking Changes">
  ```text theme={null}
  All breaking changes to public APIs, CLI flags, environment variables,
  or database schemas must be documented in the "Breaking Change" section
  of the PR description and in CHANGELOG.md.
  ```
</Accordion>

<Accordion title="Language Migration Policy">
  ```text theme={null}
  Disallow creation of new Java source files. Java may be modified,
  but new code should be written in Kotlin.

  Pass: PR modifies existing .java files or adds no new .java files.
  Fail: A new *.java file is added to source control.
  ```
</Accordion>


# Post-Merge Actions
Source: https://docs.coderabbit.ai/pr-reviews/post-merge-actions

Run automated follow-up work, including changelog updates, tickets, and notifications, after a pull request is merged.

<AllPlatformsBadge /> | <ProPlusPlanBadge />

Post-Merge Actions run automated follow-up work after a pull request is merged. Each action is a natural-language instruction that CodeRabbit executes agentically against the merged changes. It can open a follow-up pull request, post a report on the PR, or deliver output to a connected integration. Administrators configure actions at the organization or repository level. Post-Merge Actions are the merge-time counterpart to [Pre-Merge Checks](/pr-reviews/pre-merge-checks): pre-merge checks gate a PR *before* it lands, while post-merge actions do work *after* it lands.

## Why use Post-Merge Actions?

* **Automate the busywork after merge:** Append changelog entries, bump docs, or open cleanup PRs without a human remembering to.
* **Close the loop with your tools:** File a Linear or Jira ticket, open a GitHub issue, or post a Slack summary the moment work lands.
* **Keep authors in control:** Every action is previewed as a checkbox in the PR walkthrough before merge, so authors and reviewers can skip actions that do not fit.
* **Scoped to what merged:** Actions receive the merged diff, PR summary, and objectives, so their instructions can target exactly the changes that landed.

## How Post-Merge Actions work

<Steps>
  <Step title="Preview during review">
    While CodeRabbit reviews an open PR, each enabled action appears as a checkbox in the **🚀 Post-Merge Actions** section of the walkthrough. A box is checked only when CodeRabbit determines that the action applies to this PR's changes. If it cannot determine applicability, the box remains unchecked.
  </Step>

  <Step title="Skip actions (optional)">
    The PR author or a reviewer can skip actions they do not want with a [skip command](#skipping-actions) before merging.
  </Step>

  <Step title="Run on merge">
    When the PR is merged into the default branch, CodeRabbit runs every action whose box is still checked. Each action executes agentically in a secure sandbox clone of the repository with access to the merged diff and PR context.
  </Step>

  <Step title="Report results">
    CodeRabbit posts a single result comment on the merged PR summarizing each action's outcome. If any action fails, the PR author is @mentioned so the failure surfaces to them.
  </Step>
</Steps>

<Info>
  Actions run only when a PR is merged into the repository's **default branch**. Merges into other branches do not trigger post-merge actions.
</Info>

## Output modes

Each action picks the output mode that fits its instructions:

<CardGroup>
  <Card title="Code changes" icon="code-xml">
    The agent edits or creates files, such as appending to a changelog. The changes are opened as a **follow-up pull request** against the default branch.
  </Card>

  <Card title="Text report" icon="file-text">
    The agent produces a free-form report or summary, surfaced inline in the result comment on the merged PR.
  </Card>

  <Card title="Integration" icon="plug">
    The agent delivers output through a connected [MCP tool](/integrations/mcp-servers), for example by creating a Linear or Jira ticket, opening a GitHub issue, or posting to Slack.
  </Card>
</CardGroup>

Follow-up pull requests opened by a code-changes action are titled with a `🔧 CodeRabbit Post-Merge Recipe:` prefix. Merging one of these follow-up PRs never triggers another round of post-merge actions, so actions cannot recurse.

## Configuration

Post-Merge Actions can be configured via the web interface or the `.coderabbit.yaml` file. Each action has:

* **Enabled:** Whether the action runs after merge. The default is `true`.
* **Name:** A display name, unique among configured actions without regard to case, up to 100 characters.
* **Prompt:** Deterministic natural-language instructions describing the action to perform, up to 10,000 characters.

You can configure up to **5** post-merge actions.

<Info>
  To create tickets, post Slack messages, or use other integrations, first configure and enable the relevant [MCP server](/integrations/mcp-servers).
</Info>

<Tabs>
  <Tab title="Web interface" icon="browser">
    Configure Post-Merge Actions through the CodeRabbit dashboard:

    <Steps>
      <Step title="Navigate to Settings">
        In CodeRabbit, open **Settings** and configure actions at the organization or repository level.
      </Step>

      <Step title="Add an action">
        Add an action with:

        * **Name** (≤ 100 chars, unique within the org)
        * **Prompt** (≤ 10,000 chars; natural language)
        * **Enabled** (on | off)
      </Step>

      <Step title="Apply changes">
        Click **Apply Changes** to save. The new actions apply to subsequent reviews and merges.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Configuration file" icon="file-code">
    For version-controlled configuration, add actions to your `.coderabbit.yaml` file:

    ```yaml YAML icon=code wrap theme={null}
    reviews:
      post_merge_actions:
        - name: "Update changelog"
          enabled: true
          prompt: "If this PR contains user-facing changes, append a concise entry to CHANGELOG.md under the Unreleased section describing the change. Skip purely internal refactors, tests, and CI changes."
        - name: "File follow-up ticket"
          enabled: true
          prompt: "If this PR references a known TODO or leaves follow-up work described in the PR description, create a Linear ticket summarizing the follow-up and link back to this PR."
        - name: "Notify release channel"
          enabled: false
          prompt: "Post a one-paragraph summary of the merged changes to the #releases Slack channel."
    ```
  </Tab>
</Tabs>

The prompt can include filter conditions, such as labels, changed paths, or branch names. During review, CodeRabbit evaluates each enabled action against the pull request. Actions that do not apply, or whose applicability cannot be determined, remain unchecked and do not run after merge.

## Skipping actions

The PR author or a reviewer can opt out of actions before merging with a chat command.

### Skip all actions

```md theme={null}
@coderabbitai skip post-merge actions
```

### Skip specific actions

Pass one or more `--name` flags to skip only those actions (names are matched exactly, casing preserved):

```md theme={null}
@coderabbitai skip post-merge actions --name "Update changelog" --name "Notify release channel"
```

The skip command clears the selected action's checkbox in the **🚀 Post-Merge Actions** section. Only actions whose boxes are still checked at merge time run.

<Info>
  Skipping applies only to that PR. Future PRs still evaluate and offer actions as configured.
</Info>

## Results comment

After a merged PR's actions run, CodeRabbit posts a single **🚀 Post-Merge Actions** result comment listing each action and its outcome:

* ✅ **Success:** A detail line includes a link to the follow-up PR, the text report, or a note that output was delivered through a connected integration.
* ❌ **Failure:** A short reason is included. When any action fails, the PR author is @mentioned at the top of the comment.

Re-triggering post-merge actions after they run is not supported; the result comment is a record of the single run.

> See [**Manage code reviews**](/guides/commands) for more commands and behaviors.

## Examples

<Tabs>
  <Tab title="Changelog entry">
    Appends a changelog entry once the change is final. Running this post-merge avoids documenting in-progress work that may still change before the PR closes.

    ```yaml theme={null}
    reviews:
      post_merge_actions:
        - name: "Update changelog"
          enabled: true
          prompt: |
            Review the PR title, description, and full diff.
            Append a new entry to CHANGELOG.md at the top of the "Unreleased" section.

            Format: `- <type>(<scope>): <short description> (#<PR number>)`
            - Derive type from the changes: feat, fix, refactor, docs, chore
            - Derive scope from the primary directory or package touched
            - Keep the description under 80 characters in plain language

            Only proceed if the PR is a notable user-facing or API change.
            Skip for dependency bumps, typo fixes, and CI-only changes.
            Do not modify anything else in the file.
    ```
  </Tab>

  <Tab title="Update Notion page">
    <Info>
      Enable the [Notion MCP server](/integrations/mcp-servers) first.
    </Info>

    Posts a plain-language ship summary to a Notion page when a PR merges. Post-merge is the natural trigger — "this shipped" is a merge-time signal.

    ```yaml theme={null}
        - name: "Notify on ship"
          enabled: true
          prompt: |
            Read the PR title, description, and CodeRabbit summary.
            Write a 2-3 sentence plain-language summary of what this PR ships and why it matters.

            Use the Notion MCP tool to append the summary as a new row or block to the
            team's "What shipped this week" page. Include the PR URL and today's date.
    ```
  </Tab>

  <Tab title="Sync docs">
    Updates documentation to match the merged code. Post-merge timing ensures docs reflect the final implementation, not a draft.

    ```yaml theme={null}
        - name: "Sync docs"
          enabled: true
          prompt: |
            Check the diff for changes to any public API, configuration option, CLI flag,
            or user-facing behavior.

            For each change found, update the corresponding section in the docs/ directory:
            - API changes → docs/api-reference/
            - Config changes → docs/configuration.md
            - CLI changes → docs/cli.md

            If a relevant doc file does not exist, create a stub with the correct heading
            and a one-paragraph description derived from the code and PR description.

            Do not update docs for internal refactors, test changes, or CI changes.
    ```
  </Tab>

  <Tab title="Update Linear">
    <Info>
      Enable the [Linear MCP server](/integrations/mcp-servers) first.
    </Info>

    Closes the linked Linear issue and logs what shipped when the PR merges. Eliminates the manual step of updating ticket status after a merge.

    ```yaml theme={null}
        - name: "Update Linear ticket on merge"
          enabled: true
          prompt: |
            Extract the Linear ticket ID from the PR title or branch name.
            Common patterns: ABC-123, ENG-456, PROJ-789.

            If a ticket ID is found:
            1. Use the Linear MCP tool to update the issue status to "Done".
            2. Add a comment to the issue with:
               - One sentence summarizing what was shipped, derived from the PR description
                 and CodeRabbit summary
               - The PR URL
               - Today's date

            If no ticket ID is found, do nothing.
    ```
  </Tab>

  <Tab title="Create tickets">
    <Info>
      Enable the [Linear MCP server](/integrations/mcp-servers) first.
    </Info>

    Any CodeRabbit comment left unresolved at merge time becomes a tracked Linear issue, so review findings don't get lost. Only possible post-merge when the final unresolved state is known.

    ```yaml theme={null}
        - name: "Track unresolved review comments"
          enabled: true
          prompt: |
            Read all CodeRabbit inline review comments on this PR.
            Identify comments that were left unresolved at the time of merge —
            these are comments where the suggestion was not applied and the thread
            was not marked resolved.

            For each unresolved comment, use the Linear MCP tool to create a new issue with:
            - Title: a concise summary of the finding (under 80 characters)
            - Description: the full comment text, the file path and line number it refers to,
              and the PR URL for context
            - Priority: use the comment's severity as a signal — bugs or security findings
              are High, style or improvement suggestions are Medium
            - Label: "tech-debt" or "code-review-followup" if those labels exist in the workspace

            Do not create tickets for comments that were resolved or for nitpicks
            explicitly marked as non-blocking.
    ```
  </Tab>
</Tabs>

## What's next

<CardGroup>
  <Card title="Pre-Merge Checks" href="/pr-reviews/pre-merge-checks" icon="shield-check">
    Enforce quality gates and custom requirements before pull requests merge, the merge-time counterpart to post-merge actions.
  </Card>

  <Card title="MCP servers" href="/integrations/mcp-servers" icon="plug">
    Connect the tools that integration actions use to file Linear or Jira tickets, open GitHub issues, or post to Slack.
  </Card>

  <Card title="PR Walkthroughs" href="/pr-reviews/walkthroughs" icon="list-tree">
    See how the walkthrough comment surfaces each action as a checkbox before merge.
  </Card>
</CardGroup>


# Built-in Pre-Merge Checks
Source: https://docs.coderabbit.ai/pr-reviews/pre-merge-checks

Enforce quality gates and organization's custom requirements before pull requests are merged.

<ProPlanBadge />

Agentic Pre-Merge Checks provide automated validation of pull requests against standard quality metrics and organization-specific requirements. Use **Built-in Checks** for common requirements and add your own **Custom Checks** with natural language instructions tailored to your team’s policies. These AI-powered checks can be configured by an Admin user at the organization or repository level, and CodeRabbit automatically validates every pull request against these requirements.

## Why use Pre-Merge Checks?

* **Consistent standards:** Enforce naming, documentation, and change-management hygiene across every PR.
* **Safer merges:** Catch breaking API changes, security gaps, or policy violations before they land.
* **Team-specific guardrails:** Encode architectural patterns, compliance rules, or business logic as custom checks.
* **Faster reviews:** Surface blocking issues early in the PR <Hint type="walkthrough" /> so reviewers can act quickly.

## Built-in Checks

CodeRabbit includes four standard checks that address common organizational needs:

<CardGroup>
  <Card title="Docstring Coverage" icon="file-code">
    Verify PR docstring coverage against a configurable threshold (80% by
    default)
  </Card>

  <Card title="Pull Request Title" icon="heading">
    Validate PR titles accurately reflect changes made and follow your specified
    requirements
  </Card>

  <Card title="Pull Request Description" icon="file-text">
    Verify descriptions follow the template specified in your Git platform
  </Card>

  <Card title="Issue Assessment" icon="link">
    Verify PRs address linked issues without containing out-of-scope changes
  </Card>
</CardGroup>

## Custom Checks

Go beyond built-in checks by defining your own validation logic using natural language instructions. Custom checks leverage AI to understand and validate complex requirements specific to your team's policies, such as:

* Detecting sensitive data in logs
* Enforcing documentation for breaking changes
* Validating database migration patterns
* Ensuring compliance with language migration policies

Custom checks are available on the **Pro+ plan and above**. See [Plans and pricing — Custom Pre-Merge Checks](/management/plans#custom-pre-merge-checks) for current limits.

Custom checks run in a secure, read-only sandbox and can access the PR diff, linked issues, and external context via [MCP tools](/integrations/mcp-servers). Learn more about [writing custom checks](/pr-reviews/custom-checks), including limitations and examples.

## Configuring Pre-merge Checks

### Enforcement Modes

Each check can be configured with one of three enforcement modes:

* `off`: Check is disabled
* `warning`: Display warnings but don't block merges (default)
* `error`: When paired with [Request Changes Workflow](/reference/configuration#param-request-changes-workflow), block merges until resolved or manually overridden

<Info>
  Start new checks in `warning` mode to gather feedback, then move to `error`
  mode once your team is aligned on expectations.
</Info>

### Configuration

Pre-Merge Checks can be configured via web interface or using `.coderabbit.yaml` file.

<Tabs>
  <Tab title="Web Interface" icon="browser">
    Configure Pre-Merge Checks through the CodeRabbit dashboard:

    <Steps>
      <Step title="Navigate to Settings">
        In CodeRabbit, go to **Settings → Pre-merge checks** (org or repo scope)
      </Step>

      <Step title="Configure Built-in Checks">
        Update configuration and enforcement modes for **Built-in Checks**
      </Step>

      <Step title="Add Custom Checks">
        Add **Custom Checks**:

        * **Name** (≤ 50 chars, unique within the org)
        * **Instructions** (≤ 1000 chars; natural language)
        * **Mode** (off | warning | error)
      </Step>

      <Step title="Apply Changes">
        Click Apply Changes to save. The new checks are applied to subsequent reviews.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Configuration File" icon="file-code">
    For version-controlled configuration, add checks to your `.coderabbit.yaml` file:

    ```yaml YAML icon=code wrap theme={null}
    reviews:
      pre_merge_checks:
        docstrings:
          mode: "error"
          threshold: 85
        title:
          mode: "warning"
          requirements: "Start with an imperative verb; keep under 50 characters."
        description:
          mode: "error"
        issue_assessment:
          mode: "warning"
        custom_checks:
          - name: "Undocumented Breaking Changes"
            mode: "warning"
            instructions: "Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the Breaking Change section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal)."
    ```
  </Tab>
</Tabs>

## Results in the Walkthrough

Pre-Merge Check results appear alongside CodeRabbit's analysis in the PR **Walkthrough** with clear visual organization for quick assessment.

Results are organized into two tables:

* **Failed checks** — prominently displayed to show errors and warnings requiring attention
* **Passed checks** — expandable to review checks that were validated successfully

Each check displays:

* **Objective** — the name of the check being evaluated
* **Status** — one of:
  * ❌ Error — failed and will block merge when **Request Changes** is enabled
  * ⚠️ Warning — failed but non-blocking
  * ✅ Passed — requirements met
  * ❓ Inconclusive — incomplete instructions or insufficient information to decide
* **Explanation** — why the check passed or failed
* **Resolution** — what the author can do to remediate

### Unblocking a PR

If **Request Changes Workflow** is enabled and a check in **Error** mode fails, the PR is blocked until the issue is resolved or you explicitly ignore it. To ignore, select the **Ignore failed checks** checkbox in the PR Walkthrough. The PR is then unblocked and the affected rows are tagged **\[IGNORED]** for traceability.

<Note>
  The override applies only to that PR. Future PRs will still enforce checks as
  configured.
</Note>

<Note>
  You can restrict who can ignore failed checks by setting
  `reviews.pre_merge_checks.override_requested_reviewers_only: true` (default: `false`). When
  enabled, only requested reviewers (not the PR author) can use the checkbox
  or `@coderabbitai ignore pre-merge checks`, and CodeRabbit records who
  performed the override for auditability.
</Note>

## Manual commands

Trigger pre-merge checks manually using chat commands:

### Run All Checks

```md theme={null}
@coderabbitai run pre-merge checks
```

This reruns all configured checks and updates results in the walkthrough.

### Test Custom Check

```dotenv icon=text wrap theme={null}
@coderabbitai evaluate custom pre-merge check --name <check_name> --instructions <text> [--mode <error|warning>]
```

Tests custom check logic before saving to configuration.

### Ignore failures

```md theme={null}
@coderabbitai ignore pre-merge checks
```

Manually ignore failed checks and unblock the PR.

> See [**Manage code reviews**](/guides/commands) for more commands and behaviors.


# Slop Detection
Source: https://docs.coderabbit.ai/pr-reviews/slop-detection

Automatically detect low-quality, AI-generated pull requests on public GitHub repositories.

<GitHubBadge /> | <EarlyAccessBadge />

When a pull request is opened on a public GitHub repository, CodeRabbit analyzes the changes for signals of low-quality, AI-generated content. If the PR is classified as slop, CodeRabbit notes this in the PR Walkthrough comment. Additionally, you can configure a label in your settings to get the suspicious PRs labeled automatically.

The detection runs as part of CodeRabbit's standard review pipeline, no additional setup is required.

## Configuration

<Tabs>
  <Tab title="Configuration file">
    Configure the `slop_detection` section in your [`.coderabbit.yaml`](/getting-started/yaml-configuration) file:

    ```yaml .coderabbit.yaml wrap theme={null}
    reviews:
      slop_detection:
        enabled: true   # Runs automatically on public repos unless disabled
        label: "slop"   # Add a label to apply when slop is detected (no label applied by default)
    ```
  </Tab>

  <Tab title="Web UI">
    1. Go to `CodeRabbit settings` for your [repository](https://app.coderabbit.ai/settings/repositories) or [organization](https://app.coderabbit.ai/organization/settings/general).
    2. Switch the mode (bottom-left) to **All Settings**.
    3. Navigate to **Reviews → General**.
    4. Scroll down to the **Anti-Slop** section to toggle **Enabled** on or off, and optionally set a custom **Label**.
  </Tab>
</Tabs>

### Disabling Slop Detection

To disable Slop Detection on a repository, set `enabled` to `false` or disable it in the web UI:

```yaml .coderabbit.yaml theme={null}
reviews:
  slop_detection:
    enabled: false
```

### Label flagged PRs

By default, Slop Detection does not apply any label, it only adds a note to the PR Walkthrough comment. To also apply a label to flagged PRs, set the `label` field:

```yaml .coderabbit.yaml theme={null}
reviews:
  slop_detection:
    label: "slop"   # Or any label name you prefer, e.g. "ai-spam"
```

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Does Slop Detection work on private repositories?">
    No. Slop Detection only runs on public GitHub repositories.
  </Accordion>

  <Accordion title="Will Slop Detection block a PR from being merged?">
    No. Slop Detection does not block merges. When a PR is classified as slop, a note is added to the PR Walkthrough comment. If a label is configured, it is also applied so maintainers can filter and triage PRs at their discretion.
  </Accordion>

  <Accordion title="Can I automatically close slop PRs?">
    Not at the moment. CodeRabbit is currently gathering data and tuning the detection mechanism to ensure accuracy.
  </Accordion>
</AccordionGroup>

## What's next

<CardGroup>
  <Card title="Pre-Merge Checks" href="/pr-reviews/pre-merge-checks" icon="shield">
    Enforce quality gates and custom requirements before pull requests are merged
  </Card>

  <Card title="Automatic review controls" href="/configuration/auto-review" icon="settings">
    Fine-tune which PRs CodeRabbit reviews automatically using labels, branches, and author filters
  </Card>

  <Card title="Configuration reference" href="/reference/configuration" icon="book">
    See the full slop\_detection schema with types, defaults, and constraints
  </Card>
</CardGroup>


# PR Summaries
Source: https://docs.coderabbit.ai/pr-reviews/summaries

Every time CodeRabbit reviews a pull request, it writes a plain-language **summary** directly into the PR description. The summary is on by default and fully configurable.

## What is the PR summary

CodeRabbit appends a generated summary to the bottom of the PR description after a review. The summary groups changes by type — new features, bug fixes, documentation updates, and so on — so reviewers can quickly understand the scope of a PR before diving into individual files.

<Frame>
  <img alt="CodeRabbit Summary" />
</Frame>

The summary is regenerated on every incremental push, so it always reflects the latest state of the branch.

## Controlling placement

By default the summary is appended to the bottom of the description. You can pin it to a specific location by adding a `@coderabbitai summary` placeholder anywhere in the description:

<Frame>
  <img alt="GitHub PR description editor showing the @coderabbitai summary placeholder wrapped in separator lines" />
</Frame>

When the review runs, CodeRabbit replaces that placeholder with the generated summary. The placeholder text itself is configurable via [`high_level_summary_placeholder`](/reference/configuration#reviews) and defaults to `@coderabbitai summary`.

## Customizing the summary

<Info>
  The recommended way to configure summary settings is via the [`.coderabbit.yaml`](/getting-started/yaml-configuration) file. You can also adjust them through the CodeRabbit web interface at **Configuration → Reviews → Summary**.
</Info>

[`high_level_summary_instructions`](/reference/configuration#reviews) accepts free-form text that tells CodeRabbit what to include and how to structure the summary. CodeRabbit follows these instructions on every review.

<CodeGroup>
  ```yaml Structured sections wrap theme={null}
  reviews:
    high_level_summary_instructions: |
      Divide the summary into five sections:

      1. **📝 Description**: Describe the main change in the pull request in 60 words max. Explain what was changed, why it was needed, and the approach taken.
      2. **📓 References**: A list of links to discussions, issues and pull requests related to the changes. You can look up for documentation, issues, or other pull requests that provide context or background for the changes.
      3. **📦 Dependencies & Requirements**: List any new dependencies added or updated. Mention environment variable changes, configuration updates, or version requirements.
      4. **📊 Contributor Summary**: A table showing contributions (lines of code added, removed, files changed) made by the contributor in this pull request. Format: `| Contributor | Lines Added | Lines Removed | Files Changed |`

      Use bullet points or numbered lists for clarity. Keep it short and each section should be no more than 200 words. The Changes Summary table should be concise with only essential file paths (relative to repo root).
  ```

  ```yaml Release notes wrap theme={null}
  reviews:
    high_level_summary_instructions: |
      Write the summary as a changelog entry targeting external consumers
      of this codebase (API users, library consumers, end users).

      Include only sections that apply — omit any that are empty:
      - **Breaking Changes**: anything that requires callers to update their code or configuration.
      - **New Features**: user-visible additions and improvements.
      - **Bug Fixes**: user-visible fixes.
      - **Deprecations**: features or APIs marked for future removal.
      - **Migration Notes**: step-by-step instructions needed to upgrade.

      Keep each bullet to one sentence. Do not mention file names or
      internal implementation details.
  ```
</CodeGroup>

## Moving the summary to the walkthrough

To keep your PR description clean and consolidate all CodeRabbit output in one place, set [`high_level_summary_in_walkthrough`](/reference/configuration#reviews) to `true`. The summary will appear at the top of the [walkthrough comment](/pr-reviews/walkthroughs) instead of the description.

```yaml .coderabbit.yaml theme={null}
reviews:
  high_level_summary_in_walkthrough: true
```

## Disabling the summary

Set [`high_level_summary`](/reference/configuration#reviews) to `false` to stop CodeRabbit from writing a summary.

```yaml .coderabbit.yaml theme={null}
reviews:
  high_level_summary: false
```

<Note>
  When `high_level_summary` is `false`, the summary is still generated and inserted if the `@coderabbitai summary` placeholder is present in the description. The setting only suppresses the automatic append behaviour.
</Note>

For the full list of summary options with types and defaults, see the [configuration reference](/reference/configuration#reviews).


# PR Walkthroughs
Source: https://docs.coderabbit.ai/pr-reviews/walkthroughs

Every time CodeRabbit reviews a pull request, it posts a **walkthrough comment** — a structured overview of the changes that appears at the top of the PR comment thread, separate from inline code comments. The walkthrough is on by default and fully configurable.

## Overview

The walkthrough comment is made up of independent sections. Each section can be enabled or disabled separately to match your team's workflow.

By default the walkthrough is wrapped in a collapsible Markdown `<details>` block. Set [`collapse_walkthrough`](/reference/configuration#reviews) to `false` to keep it expanded.

```yaml .coderabbit.yaml theme={null}
reviews:
  collapse_walkthrough: false
```

## Walkthrough sections

### Changed files summary

A grouped summary of files changed in the PR. Related changes are consolidated into rows — for example, a PR that modifies one source file and 27 localization files produces two rows. Each row includes a plain-language description of what changed.

Enable/disable with [`changed_files_summary`](/reference/configuration#reviews) (default: `true`).

### Sequence diagrams

For PRs that affect component interactions — API calls, event flows, async workflows — CodeRabbit generates [Mermaid](https://mermaid.js.org/) sequence diagrams showing the updated flow. Diagrams are rendered inline in GitHub and GitLab.

Enable/disable with [`sequence_diagrams`](/reference/configuration#reviews) (default: `true`).

### Estimated review effort

A score from 1 (trivial) to 5 (very complex) estimating how much effort the PR requires to review thoroughly. The estimate considers the number of files changed, the nature of the changes, and logic complexity.

Enable/disable with [`estimate_code_review_effort`](/reference/configuration#reviews) (default: `true`).

### Related issues

Open and closed issues that are related to the PR changes, even if not explicitly linked. Useful for surfacing issues that may be affected by the change or provide useful context.

Enable/disable with [`related_issues`](/reference/configuration#reviews) (default: `true`).

### Linked issue assessment

When a PR references an issue via keywords like `Closes #123`, CodeRabbit reads the issue and checks whether the changes address it. It highlights gaps between what the issue requested and what the PR delivers.

See [PR Validation using Linked Issues](/issues/pr-validation) for guidance on writing effective issues and understanding how CodeRabbit evaluates Pull Requests against them.

Enable/disable with [`assess_linked_issues`](/reference/configuration#reviews) (default: `true`).

<Info>
  The linked issue assessment result also feeds into the [pre-merge checks](/pr-reviews/pre-merge-checks) system. See `issue_assessment` in the [configuration reference](/reference/configuration#reviews) to enforce this check as a merge requirement.
</Info>

### Related PRs

Merged and open PRs that touched the same areas of the codebase, helping reviewers understand the change history of a file or feature.

Enable/disable with [`related_prs`](/reference/configuration#reviews) (default: `true`).

### Suggested labels

Labels that describe the nature of the change, such as `bug`, `enhancement`, `frontend`, or `breaking-change`. When no [`labeling_instructions`](/reference/configuration#reviews) are configured, suggestions are inferred from labels used on similar past PRs.

Enable/disable with [`suggested_labels`](/reference/configuration#reviews) (default: `true`).

<Info>
  Labels can also be applied automatically — see [`auto_apply_labels`](/reference/configuration#reviews).
</Info>

### Suggested reviewers

Reviewers are suggested based on git history and code ownership. On GitHub and Bitbucket Cloud, CodeRabbit can also consider people who recently contributed to the exact files changed by the PR. This supplemental signal depends on the available repository history, so repositories with little history may see less benefit.

GitLab, Azure DevOps, and Bitbucket Data Center do not yet supply this additional signal. Reviewer suggestions on these platforms continue to rely on git history and code ownership. Suggestions are included in the walkthrough and can optionally be assigned automatically.

Enable/disable with [`suggested_reviewers`](/reference/configuration#reviews) (default: `true`).

#### Custom reviewer rules <GitHubBadge /> <GitLabBadge />

When your team has subject-matter experts for different areas of the codebase, use [`suggested_reviewers_instructions`](/reference/configuration#param-suggested-reviewers-instructions) to pair natural-language instructions with the reviewers that should be suggested when a PR matches. Each rule contains an `instructions` field describing when the rule applies and a `reviewers` list identifying who to suggest.

Each reviewer entry can be:

* **An individual user** — set `type: user` (or omit `type`, since `user` is the default).
* **A team** — set `type: group` to reference a team handle such as `security-team`. Supported on GitHub only.

A single rule can include multiple reviewers, so one matching condition can fan out to several people or teams at once.

```yaml .coderabbit.yaml wrap theme={null}
reviews:
  suggested_reviewers: true
  auto_assign_reviewers: true
  suggested_reviewers_instructions:
    - reviewers:
        - handle: security-team
          type: group
        - handle: octocat
          type: user
      instructions: "Assign when the PR modifies authentication, encryption, or access-control logic."
    - reviewers:
        - handle: infra-team
          type: group
      instructions: "Assign when the PR changes CI/CD pipeline configuration files."
```

Reviewers matched by your rules appear in the walkthrough summary alongside any reviewers suggested from git history. When [`auto_assign_reviewers`](/reference/configuration#reviews) is enabled, the matched reviewers are also assigned as PR reviewers automatically.

When the `suggested_reviewers_instructions` list is empty, CodeRabbit falls back to suggestions based on prior PRs.

### Review status messages

Brief status messages posted when a review is skipped or cannot proceed — for example when a PR is in draft, matches an ignored title keyword, or review was manually paused.

Enable/disable with [`review_status`](/reference/configuration#reviews) (default: `true`).

### Poem

A short poem at the end of the walkthrough, generated from the changeset. Can be disabled if you prefer a strictly professional output.

Enable/disable with [`poem`](/reference/configuration#reviews) (default: `true`).

## Fortune while you wait

While a review is in progress, CodeRabbit posts a fortune message as a placeholder in the walkthrough comment. The placeholder is replaced by the full walkthrough once the review completes.

Enable/disable with [`in_progress_fortune`](/reference/configuration#reviews) (default: `true`).

## Including the PR summary

By default the [PR summary](/pr-reviews/summaries) is written into the PR description. To move it into the walkthrough comment instead, set [`high_level_summary_in_walkthrough`](/reference/configuration#reviews) to `true`. The summary will appear at the top of the walkthrough, above the changed files table.

```yaml .coderabbit.yaml theme={null}
reviews:
  high_level_summary_in_walkthrough: true
```

For the full list of walkthrough options with types and defaults, see the [configuration reference](/reference/configuration#reviews).


# Caching
Source: https://docs.coderabbit.ai/reference/caching

CodeRabbit provides caching capabilities for code and dependencies to accelerate the review process. This feature enhances your development workflow by delivering faster feedback.

A reusable sandbox cache is a saved, prepared copy of a repository and its installed dependencies. CodeRabbit creates these caches during reviews, Change Stack chat, and Finishing Touch runs so later runs can start faster.

## Managing cache

Open [**Review > Caches**](https://app.coderabbit.ai/review/cache). You need **Read** access to **Repository Settings** to view and inspect caches.

<Info>
  This management page is not available on self-hosted CodeRabbit instances.
</Info>

### View caches

The list shows caches that are ready to use. Search, filter, or sort the list to find a cache, and use the pagination controls to move between result pages. When a Cache ID is shortened in the table, hover over it to reveal the full value.

### Delete a cache

<AdminRoleBadge />

Organization administrators with **Write** access to **Repository Settings** can delete a cache to force CodeRabbit to build a fresh copy. The next review, chat, or fix for that repository may take longer while the cache is rebuilt.

Caches expire automatically after seven days.

## Security and privacy

* Cached data is encrypted (except for OSS projects)
* Cached data is never used for training
* Cached data is used exclusively for speeding up reviews
* Cached data expires after a maximum of seven days

## Disable caching

To opt out of caching, set `reviews.disable_cache` to `true` in `.coderabbit.yaml`, or enable `Review - Disable Cache` in the dashboard at either the organization or repository level. The setting defaults to `false`.

Review details display `Cache: Disabled due to Reviews > Disable Cache setting` when this setting is active. This indicator is distinct from the data-retention opt-out message described below.

No migration is required. Caching remains enabled by default.

<Info>
  On self-hosted CodeRabbit, you can also disable all data retention organization-wide by setting `knowledge_base.opt_out` to `true`. See [Opt out of data retention](/knowledge-base#opt-out-of-data-retention).
</Info>


# Configuration reference
Source: https://docs.coderabbit.ai/reference/configuration

Complete reference for CodeRabbit configuration options with detailed explanations, types, and examples.

<Info>
  This reference is automatically generated from the CodeRabbit configuration schema.
  **Last updated: August 4, 2026**
</Info>

CodeRabbit's behavior can be customized using a `.coderabbit.yaml` file in your repository root. This reference covers all available configuration options with clear property names and examples.

<CardGroup>
  <Card title="Quick Start" icon="rocket" href="/getting-started/yaml-configuration">
    Get started with basic configuration
  </Card>

  <Card title="YAML config examples" icon="file-code" href="https://github.com/coderabbitai/awesome-coderabbit/tree/main/configs">
    Browse example configurations
  </Card>
</CardGroup>

## Configuration sections

<CardGroup>
  <Card title="General settings" icon="flag" href="#general-settings">
    Configure general settings
  </Card>

  <Card title="Code reviews" icon="git-pull-request" href="#reviews">
    Configure automatic code reviews, tools, and review behavior
  </Card>

  <Card title="Chat" icon="message-circle" href="#chat">
    Configure interactive chat features
  </Card>

  <Card title="Knowledge base" icon="brain" href="#knowledge-base">
    Configure knowledge base features
  </Card>

  <Card title="Code generation" icon="code" href="#code-generation">
    Configure code generation settings
  </Card>

  <Card title="Issue enrichment" icon="sparkles" href="#issue-enrichment">
    Configure automatic Issue enrichment and planning
  </Card>
</CardGroup>

## General settings

### Reference

<ResponseField name="language" type="enum">
  Set the language for reviews by using the corresponding ISO language code.

  One of the following: `de`, `de-DE`, `de-AT`, `de-CH`, `en`, `en-US`, `en-AU`, `en-GB`, `en-CA`, `en-NZ`, `en-ZA`, `es`, `es-AR`, `fr`, `fr-CA`, `fr-CH`, `fr-BE`, `nl`, `nl-BE`, `pt-AO`, `pt`, `pt-BR`, `pt-MZ`, `pt-PT`, `ar`, `ast-ES`, `ast`, `be-BY`, `be`, `br-FR`, `br`, `ca-ES`, `ca`, `ca-ES-valencia`, `ca-ES-balear`, `da-DK`, `da`, `de-DE-x-simple-language`, `el-GR`, `el`, `eo`, `fa`, `ga-IE`, `ga`, `gl-ES`, `gl`, `it`, `ja-JP`, `ja`, `km-KH`, `km`, `ko-KR`, `ko`, `pl-PL`, `pl`, `ro-RO`, `ro`, `ru-RU`, `ru`, `sk-SK`, `sk`, `sl-SI`, `sl`, `sv`, `ta-IN`, `ta`, `tl-PH`, `tl`, `tr`, `uk-UA`, `uk`, `zh-CN`, `zh`, `zh-TW`, `crh-UA`, `crh`, `cs-CZ`, `cs`, `nb`, `no`, `nl-NL`, `de-DE-x-simple-language-DE`, `es-ES`, `it-IT`, `fa-IR`, `sv-SE`, `de-LU`, `fr-FR`, `bg-BG`, `bg`, `he-IL`, `he`, `hi-IN`, `hi`, `vi-VN`, `vi`, `th-TH`, `th`, `bn-BD`, `bn`

  Defaults to `"en-US"`.
</ResponseField>

<ResponseField name="tone_instructions" type="string">
  Set the tone of reviews and chat. Example: 'You must talk like Mr. T. I pity the fool who doesn't!'

  Defaults to `""`.

  <Note>
    Max length: 250
  </Note>
</ResponseField>

<ResponseField name="early_access" type="boolean">
  Enable early-access features.

  Defaults to `false`.
</ResponseField>

<ResponseField name="enable_free_tier" type="boolean">
  Enable free tier features for users not on a paid plan.

  Defaults to `true`.
</ResponseField>

## Reviews

Settings related to reviews.

### Reference

<ResponseField name="profile" type="enum">
  Set the review profile: quiet for only the most important feedback, chill for balanced feedback, assertive for more feedback (which may feel nitpicky).

  One of the following: `quiet`, `chill`, `assertive`

  Defaults to `"chill"`.
</ResponseField>

<ResponseField name="request_changes_workflow" type="boolean">
  Automatically approve once CodeRabbit’s comments are resolved and no pre-merge checks are failing. Note: In GitLab, all discussions must be resolved.

  Defaults to `false`.
</ResponseField>

<ResponseField name="high_level_summary" type="boolean">
  Generate a high-level summary of the changes in the PR description or walkthrough.

  Defaults to `true`.
</ResponseField>

<ResponseField name="high_level_summary_instructions" type="string">
  By default, CodeRabbit generates release notes in the description. Use this to customize the summary content and format. Example: 'Create concise release notes as a bullet-point list, followed by a Markdown table showing lines added and removed by each contributing author.' Note: Use `high_level_summary_in_walkthrough` to place the summary in the walkthrough instead of the description.

  Defaults to `""`.
</ResponseField>

<ResponseField name="high_level_summary_placeholder" type="string">
  Placeholder in the PR description that CodeRabbit replaces with the high-level summary. If `high_level_summary` is false, the summary is still generated when this placeholder is present.

  Defaults to `"@coderabbitai summary"`.
</ResponseField>

<ResponseField name="high_level_summary_in_walkthrough" type="boolean">
  Include the high-level summary in the walkthrough comment.

  Defaults to `false`.
</ResponseField>

<ResponseField name="auto_title_placeholder" type="string">
  Add this keyword to the PR title to auto-generate a title.

  Defaults to `"@coderabbitai"`.
</ResponseField>

<ResponseField name="auto_title_instructions" type="string">
  Auto Title Instructions | Customize how CodeRabbit generates the PR title.

  Defaults to `""`.
</ResponseField>

<ResponseField name="review_status" type="boolean">
  Post review status messages (e.g., when a review is skipped) in the walkthrough summary comment.

  Defaults to `true`.
</ResponseField>

<ResponseField name="review_details" type="boolean">
  Post review details (ignored files, extra context used, suppressed comments, etc.).

  Defaults to `false`.
</ResponseField>

<ResponseField name="review_progress" type="boolean">
  Publish the canonical user-facing review status and progress updates (GitHub progress reports/check runs today; other platform equivalents may follow).

  Defaults to `true`.
</ResponseField>

<ResponseField name="commit_status" type="boolean">
  Mirror review progress using legacy commit statuses for compatibility with required checks and existing automations. This setting is only used when review\_progress is disabled.

  Defaults to `true`.
</ResponseField>

<ResponseField name="fail_commit_status" type="boolean">
  On review errors, fail the active outward review status surface. When review\_progress is enabled this applies to progress reporting; otherwise it applies to the legacy commit-status mirror when enabled.

  Defaults to `false`.
</ResponseField>

<ResponseField name="collapse_walkthrough" type="boolean">
  Wrap the walkthrough in a Markdown collapsible section.

  Defaults to `true`.
</ResponseField>

<ResponseField name="changed_files_summary" type="boolean">
  Include a summary of the changed files in the walkthrough.

  Defaults to `true`.
</ResponseField>

<ResponseField name="sequence_diagrams" type="boolean">
  Include sequence diagrams in the walkthrough.

  Defaults to `true`.
</ResponseField>

<ResponseField name="estimate_code_review_effort" type="boolean">
  Include an estimated code review effort in the walkthrough.

  Defaults to `true`.
</ResponseField>

<ResponseField name="assess_linked_issues" type="boolean">
  Include an assessment of how well the changes address linked issues in the walkthrough.

  Defaults to `true`.
</ResponseField>

<ResponseField name="related_issues" type="boolean">
  Include potentially related issues in the walkthrough.

  Defaults to `true`.
</ResponseField>

<ResponseField name="related_prs" type="boolean">
  Related PRs | Include potentially related PRs in the walkthrough.

  Defaults to `true`.
</ResponseField>

<ResponseField name="suggested_labels" type="boolean">
  Suggest labels based on the changes, and include them in the walkthrough.

  Defaults to `true`.
</ResponseField>

<ResponseField name="labeling_instructions" type="array of object">
  Labeling Instructions | Define allowed labels and when to suggest them. When provided, CodeRabbit suggests only from this list (still informed by prior PRs); when empty, suggestions rely entirely on prior PRs.

  Defaults to `[]`.

  <Expandable title="Array items">
    <ResponseField name="label" type="string">
      Label to suggest for the PR. Example: frontend
    </ResponseField>

    <ResponseField name="instructions" type="string">
      Instructions for the label. Example: Apply when the PR contains changes to React components.

      <Note>
        Max length: 3000
      </Note>
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="mutually_exclusive_groups" type="object">
  Mutually Exclusive Groups | Define labels that should not coexist. Example: `{ risk: ['critical', 'high', 'medium', 'low'] }`.

  Defaults to `{}`.
</ResponseField>

<ResponseField name="auto_apply_labels" type="boolean">
  Automatically apply suggested labels to the PR.

  Defaults to `false`.
</ResponseField>

<ResponseField name="suggested_reviewers" type="boolean">
  Suggest reviewers based on the changes, and include them in the walkthrough.

  Defaults to `true`.
</ResponseField>

<ResponseField name="auto_assign_reviewers" type="boolean">
  Automatically assign the suggested reviewers to the PR.

  Defaults to `false`.
</ResponseField>

<ResponseField name="suggested_reviewers_instructions" type="array of object">
  Reviewer Instructions | Map reviewers (users or team) to PR scenarios where they should be assigned. When empty, suggestions rely on prior PRs. Team handles are supported only on GitHub.

  Defaults to `[]`.

  <Expandable title="Array items">
    <ResponseField name="reviewers" type="array of object">
      List of reviewers to assign when the PR matches the instructions below. Each entry pairs a handle (username or team slug) with its type (user or group).

      <Expandable title="Array items">
        <ResponseField name="handle" type="string">
          Reviewer username or team slug to assign. Example: security-pdl

          <Note>
            Min length: 1
          </Note>
        </ResponseField>

        <ResponseField name="type" type="enum">
          Whether the reviewer is an individual user or a team/group.

          One of the following: `user`, `group`

          Defaults to `"user"`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="instructions" type="string">
      Instructions for when to assign these reviewers. Example: Assign when the PR contains Windows registry changes.

      <Note>
        Min length: 1, Max length: 3000
      </Note>
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="in_progress_fortune" type="boolean">
  Post a fortune message while the review is running.

  Defaults to `true`.
</ResponseField>

<ResponseField name="poem" type="boolean">
  Generate a poem in the walkthrough comment.

  Defaults to `false`.
</ResponseField>

<ResponseField name="enable_prompt_for_ai_agents" type="boolean">
  Prompt for AI Agents | Include the '🤖 Prompt for AI Agents' section in inline review comments to provide codegen instructions for AI agents.

  Defaults to `true`.
</ResponseField>

<ResponseField name="path_filters" type="array of string">
  Specify file patterns to include or exclude in a review using glob patterns (e.g., `!dist/**`, `src/**`). These patterns also apply to 'git sparse-checkout', including specified patterns and ignoring excluded ones (starting with '!') when cloning the repository.

  Defaults to `[]`.
</ResponseField>

<ResponseField name="path_instructions" type="array of object">
  Path Instructions | Add path-specific guidance for code review.

  Defaults to `[]`.

  <Expandable title="Array items">
    <ResponseField name="path" type="string">
      File path glob pattern. Example: `**/*.js`.
    </ResponseField>

    <ResponseField name="instructions" type="string">
      Additional review guidance for matching paths.

      <Note>
        Max length: 20000
      </Note>
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="abort_on_close" type="boolean">
  Abort the in-progress review if the PR is closed or merged.

  Defaults to `true`.
</ResponseField>

<ResponseField name="disable_cache" type="boolean">
  Disable caching of code and dependencies; fetch them fresh on each run.

  Defaults to `false`.
</ResponseField>

<ResponseField name="slop_detection" type="object">
  Anti-Slop | Settings for detecting and managing spam or low-quality PRs. Only for public repos, only for GitHub as of now.

  Defaults to `{}`.

  <Expandable title="Slop detection">
    <ResponseField name="enabled" type="boolean">
      Enable or disable slop and low-quality PR detection.

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="label" type="string">
      Label to apply to the PR when it is classified as slop. Example: slop

      <Note>
        Min length: 1
      </Note>
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="auto_review" type="object">
  Configuration for auto review

  Defaults to `{}`.

  <Expandable title="Auto review">
    <ResponseField name="enabled" type="boolean">
      Automatic Review | Review PRs automatically.

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="description_keyword" type="string">
      Keyword in the PR description that triggers a review when automatic reviews are disabled. If `enabled` is false and this field is not empty, CodeRabbit reviews the PR only when this keyword is present in the description.

      Defaults to `""`.
    </ResponseField>

    <ResponseField name="auto_incremental_review" type="boolean">
      Incremental Review | Re-run the review on each push.

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="auto_pause_after_reviewed_commits" type="integer">
      Auto Pause After Reviewed Commits | Pause automatic reviews after this many reviewed commits since the last pause. Set to 0 to disable.

      Defaults to `5`.

      <Note>
        Min: 0, Max: 9007199254740991
      </Note>
    </ResponseField>

    <ResponseField name="ignore_title_keywords" type="array of string">
      Skip reviews when the PR title contains any of these keywords (case-insensitive).

      Defaults to `[]`.
    </ResponseField>

    <ResponseField name="labels" type="array of string">
      Labels that control which PRs are reviewed. Labels starting with '!' are negative matches. Examples: \['bug', 'feature'] reviews PRs with either label. \['!wip'] reviews all PRs except those labeled 'wip' when automatic reviews are enabled. \['bug', '!wip'] reviews PRs labeled 'bug' but not 'wip'. When `enabled` is false, a positive label match (for example \['review-ready']) triggers a review; negative-only labels such as \['!wip'] remain exclusion filters and do not opt PRs in by themselves.

      Defaults to `[]`.
    </ResponseField>

    <ResponseField name="drafts" type="boolean">
      Include draft PRs.

      Defaults to `false`.
    </ResponseField>

    <ResponseField name="base_branches" type="array of string">
      Base branches (other than the default branch) to review. Accepts regex patterns. Use '.\*' to match all branches.

      Defaults to `[]`.
    </ResponseField>

    <ResponseField name="ignore_usernames" type="array of string">
      Skip reviews for PRs authored by these usernames (exact match; not email addresses).

      Defaults to `[]`.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="finishing_touches" type="object">
  Configuration for finishing touches

  Defaults to `{}`.

  <Expandable title="Finishing touches">
    <ResponseField name="docstrings" type="object">
      Docstrings | Configure docstring generation.

      Defaults to `{}`.

      <Expandable title="Docstrings">
        <ResponseField name="enabled" type="boolean">
          Docstrings | Enable the docstrings finishing touch (trigger via the 📝 Generate docstrings checkbox or `@coderabbitai generate docstrings`). CodeRabbit generates or improves docstrings for functions changed in the PR and opens a follow-up PR containing the docstring edits.

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="unit_tests" type="object">
      Unit Tests | Configure unit test generation.

      Defaults to `{}`.

      <Expandable title="Unit tests">
        <ResponseField name="enabled" type="boolean">
          Unit Tests | Generate unit tests for changes in PRs.

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="simplify" type="object">
      Simplify | Configure code simplification.

      Defaults to `{}`.

      <Expandable title="Simplify">
        <ResponseField name="enabled" type="boolean">
          Simplify | Enable the simplify finishing touch (trigger via the ✨ Simplify code checkbox). CodeRabbit reviews changed code for reuse, quality, and efficiency, then applies targeted improvements.

          Defaults to `false`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="autofix" type="object">
      Autofix | Configure autofix behavior.

      Defaults to `{}`.

      <Expandable title="Autofix">
        <ResponseField name="enabled" type="boolean">
          Autofix | Enable the autofix finishing touch (trigger via the 🪄 Autofix checkboxes under review comments or the `@coderabbitai autofix` command). When disabled, the autofix checkboxes are hidden, the command is removed from help, and CodeRabbit declines `@coderabbitai autofix` requests.

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="fix_ci" type="object">
      Fix Failing CI | Configure the CI fixer.

      Defaults to `{}`.

      <Expandable title="Fix ci">
        <ResponseField name="enabled" type="boolean">
          Fix Failing CI | Enable the fix-ci finishing touch. When CI fails on a pull request, Finishing Touches offers mutually exclusive options to open a stacked pull request or commit fixes directly to the current branch. The `@coderabbitai fix-ci` command opens a stacked pull request by default; `@coderabbitai fix-ci commit` commits directly. When disabled, both commands are removed from help and CodeRabbit declines fix-ci requests. GitHub only; requires a Pro Plus plan.

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="resolve_merge_conflict" type="object">
      Resolve Merge Conflicts | Configure the merge-conflict resolver.

      Defaults to `{}`.

      <Expandable title="Resolve merge conflict">
        <ResponseField name="enabled" type="boolean">
          Resolve Merge Conflicts | Enable the merge-conflict resolver (trigger via `@coderabbitai resolve merge conflict`). CodeRabbit analyzes the intent behind both sides of a conflict and commits a resolution to your branch. When disabled, the command is removed from help and CodeRabbit declines resolution requests. Available on GitHub and GitLab; requires a Pro Plus plan.

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="custom" type="array of object">
      Custom Recipes | Define up to 5 custom finishing touch recipes. Trigger a recipe with `@coderabbitai run <recipe name>`.

      Defaults to `[]`.

      <Expandable title="Array items">
        <ResponseField name="enabled" type="boolean">
          Enabled | Enable this custom finishing touch recipe.

          Defaults to `true`.
        </ResponseField>

        <ResponseField name="name" type="string">
          Name | Recipe name used in commands (for example: `@coderabbitai run cleanup stale imports`). Run with `@coderabbitai run <recipe name>`.

          Defaults to `""`.

          <Note>
            Min length: 1, Max length: 100
          </Note>
        </ResponseField>

        <ResponseField name="instructions" type="string">
          Instructions | Describe what this recipe should do. Trigger with `@coderabbitai run <recipe name>` or the checkbox under "✨ Finishing Touches". CodeRabbit provides PR context and runs this with an agent.

          Defaults to `""`.

          <Note>
            Min length: 1, Max length: 10000
          </Note>
        </ResponseField>
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="pre_merge_checks" type="object">
  Configuration for pre merge checks

  Defaults to `{}`.

  <Expandable title="Pre merge checks">
    <ResponseField name="override_requested_reviewers_only" type="boolean">
      Override Requested Reviewers Only | When enabled, only requested reviewers (and not the pull request author) can override/ignore failing pre-merge checks.

      Defaults to `false`.
    </ResponseField>

    <ResponseField name="docstrings" type="object">
      Docstring Coverage | Check that docstring coverage meets the configured threshold.

      Defaults to `{}`.

      <Expandable title="Docstrings">
        <ResponseField name="mode" type="enum">
          Mode | Enforcement level: `off` disables the check, `warning` posts a warning, and `error` requires resolution before merging. If the request-changes workflow is enabled, `error` can block the PR until the check passes.

          One of the following: `off`, `warning`, `error`

          Defaults to `"warning"`.
        </ResponseField>

        <ResponseField name="threshold" type="number">
          Threshold | Minimum docstring coverage (%) required to pass.

          Defaults to `80`.

          <Note>
            Min: 0, Max: 100
          </Note>
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="title" type="object">
      Title Check | Validate the PR title against the requirements.

      Defaults to `{}`.

      <Expandable title="Title">
        <ResponseField name="mode" type="enum">
          Mode | Enforcement level: `off` disables the check, `warning` posts a warning, and `error` requires resolution before merging. If the request-changes workflow is enabled, `error` can block the PR until the check passes.

          One of the following: `off`, `warning`, `error`

          Defaults to `"warning"`.
        </ResponseField>

        <ResponseField name="requirements" type="string">
          Requirements | Describe title requirements. Example: 'Title should be concise and descriptive, ideally under 50 characters.'

          Defaults to `""`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="description" type="object">
      Description Check | Check that the PR description follows best practices.

      Defaults to `{}`.

      <Expandable title="Description">
        <ResponseField name="mode" type="enum">
          Mode | Enforcement level: `off` disables the check, `warning` posts a warning, and `error` requires resolution before merging. If the request-changes workflow is enabled, `error` can block the PR until the check passes.

          One of the following: `off`, `warning`, `error`

          Defaults to `"warning"`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="issue_assessment" type="object">
      Linked Issue Assessment | Assess how well the PR addresses linked issues.

      Defaults to `{}`.

      <Expandable title="Issue assessment">
        <ResponseField name="mode" type="enum">
          Mode | Enforcement level: `off` disables the check, `warning` posts a warning, and `error` requires resolution before merging. If the request-changes workflow is enabled, `error` can block the PR until the check passes.

          One of the following: `off`, `warning`, `error`

          Defaults to `"warning"`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="custom_checks" type="array of object">
      Custom Pre-merge Checks | Define custom checks that must pass before merging. Each check needs a unique name (≤50 chars) and deterministic instructions (≤10,000 chars).

      Defaults to `[]`.

      <Expandable title="Array items">
        <ResponseField name="mode" type="enum">
          Mode | Enforcement level: `off` disables the check, `warning` posts a warning, and `error` requires resolution before merging. If the request-changes workflow is enabled, `error` can block the PR until the check passes.

          One of the following: `off`, `warning`, `error`

          Defaults to `"warning"`.
        </ResponseField>

        <ResponseField name="name" type="string">
          Name | Display name (max 50 characters).

          Defaults to `""`.

          <Note>
            Min length: 1, Max length: 50
          </Note>
        </ResponseField>

        <ResponseField name="instructions" type="string">
          Instructions | Deterministic pass/fail criteria (max 10,000 characters).

          Defaults to `""`.

          <Note>
            Min length: 1, Max length: 10000
          </Note>
        </ResponseField>
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="post_merge_actions" type="array of object">
  Custom Post-merge Actions | Define custom actions to run after merging. Each action needs a unique name (≤100 chars) and a deterministic prompt (≤10,000 chars).

  Defaults to `[]`.

  <Expandable title="Array items">
    <ResponseField name="enabled" type="boolean">
      Enabled | Run this action after a PR is merged.

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="name" type="string">
      Name | Display name (max 100 characters).

      Defaults to `""`.

      <Note>
        Min length: 1, Max length: 100
      </Note>
    </ResponseField>

    <ResponseField name="prompt" type="string">
      Prompt | Deterministic instructions describing the action to perform (max 10,000 characters).

      Defaults to `""`.

      <Note>
        Min length: 1, Max length: 10000
      </Note>
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="tools" type="object">
  Tools that provide additional context to code reviews.

  Defaults to `{}`.

  <Expandable title="Tools">
    <ResponseField name="ast-grep" type="object">
      Enable ast-grep | ast-grep is a code analysis tool that helps you to find patterns in your codebase using abstract syntax trees patterns. | v0.45.0

      Defaults to `{}`.

      <Expandable title="Ast-grep">
        <ResponseField name="rule_dirs" type="array of string">
          List of rules directories.

          Defaults to `[]`.
        </ResponseField>

        <ResponseField name="util_dirs" type="array of string">
          List of utils directories.

          Defaults to `[]`.
        </ResponseField>

        <ResponseField name="essential_rules" type="boolean">
          Use ast-grep essentials package.

          Defaults to `true`.
        </ResponseField>

        <ResponseField name="packages" type="array of string">
          Predefined packages to be used.

          Defaults to `[]`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="shellcheck" type="object">
      ShellCheck is a static analysis tool that finds bugs in your shell scripts.

      Defaults to `{}`.

      <Expandable title="Shellcheck">
        <ResponseField name="enabled" type="boolean">
          Enable ShellCheck | ShellCheck is a static analysis tool that finds bugs in your shell. | Enable ShellCheck integration. | v0.11.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="ruff" type="object">
      Ruff is a Python linter and code formatter.

      Defaults to `{}`.

      <Expandable title="Ruff">
        <ResponseField name="enabled" type="boolean">
          Enable Ruff | Ruff is a Python linter and code formatter. |  Enable Ruff integration. | v0.16.1

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="markdownlint" type="object">
      markdownlint-cli2 is a static analysis tool to enforce standards and consistency for Markdown files.

      Defaults to `{}`.

      <Expandable title="Markdownlint">
        <ResponseField name="enabled" type="boolean">
          Enable markdownlint | markdownlint-cli2 is a static analysis tool to enforce standards and consistency for Markdown files. | Enable markdownlint integration. | v0.23.2

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="github-checks" type="object">
      GitHub Checks integration configuration.

      Defaults to `{}`.

      <Expandable title="Github-checks">
        <ResponseField name="enabled" type="boolean">
          Enable GitHub Checks
          \| Enable integration, defaults to true
          \| Enable GitHub Checks integration.

          Defaults to `true`.
        </ResponseField>

        <ResponseField name="timeout_ms" type="number">
          Time in milliseconds to wait for all GitHub Checks to conclude. Default 90 seconds, max 15 minutes (900000ms).

          Defaults to `90000`.

          <Note>
            Min: 0, Max: 900000
          </Note>
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="languagetool" type="object">
      LanguageTool is a style and grammar checker for 30+ languages.

      Defaults to `{}`.

      <Expandable title="Languagetool">
        <ResponseField name="enabled" type="boolean">
          Enable LanguageTool | Enable LanguageTool integration.

          Defaults to `true`.
        </ResponseField>

        <ResponseField name="enabled_rules" type="array of string">
          IDs of rules to be enabled. The rule won't run unless 'level' is set to a level that activates the rule.

          Defaults to `[]`.
        </ResponseField>

        <ResponseField name="disabled_rules" type="array of string">
          IDs of rules to be disabled. Note: EN\_UNPAIRED\_BRACKETS, and EN\_UNPAIRED\_QUOTES are always disabled.

          Defaults to `[]`.
        </ResponseField>

        <ResponseField name="enabled_categories" type="array of string">
          IDs of categories to be enabled.

          Defaults to `[]`.
        </ResponseField>

        <ResponseField name="disabled_categories" type="array of string">
          IDs of categories to be disabled. Note: TYPOS, TYPOGRAPHY, and CASING are always disabled.

          Defaults to `[]`.
        </ResponseField>

        <ResponseField name="enabled_only" type="boolean">
          Only the rules and categories whose IDs are specified with 'enabledRules' or 'enabledCategories' are enabled.

          Defaults to `false`.
        </ResponseField>

        <ResponseField name="level" type="enum">
          If set to 'picky', additional rules will be activated, i.e. rules that you might only find useful when checking formal text.

          One of the following: `default`, `picky`

          Defaults to `"default"`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="biome" type="object">
      Biome is a fast formatter, linter, and analyzer for web projects.

      Defaults to `{}`.

      <Expandable title="Biome">
        <ResponseField name="enabled" type="boolean">
          Enable Biome | Biome is a fast formatter, linter, and analyzer for web projects. | Enable Biome integration. | v2.5.6

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="hadolint" type="object">
      Hadolint is a Dockerfile linter.

      Defaults to `{}`.

      <Expandable title="Hadolint">
        <ResponseField name="enabled" type="boolean">
          Enable Hadolint | Hadolint is a Dockerfile linter. | Enable Hadolint integration. | v2.15.1

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="swiftlint" type="object">
      SwiftLint integration configuration object.

      Defaults to `{}`.

      <Expandable title="Swiftlint">
        <ResponseField name="enabled" type="boolean">
          Enable SwiftLint | SwiftLint is a Swift linter. | Enable SwiftLint integration. | v0.65.0

          Defaults to `true`.
        </ResponseField>

        <ResponseField name="config_file" type="string">
          Optional path to the SwiftLint configuration file relative to the repository. This is useful when the configuration file is named differently than the default '.swiftlint.yml' or '.swiftlint.yaml'.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="phpstan" type="object">
      PHPStan is a tool to analyze PHP code.

      Defaults to `{}`.

      <Expandable title="Phpstan">
        <ResponseField name="enabled" type="boolean">
          Enable PHPStan | PHPStan requires [config file](https://phpstan.org/config-reference#config-file) in your repository root. Please ensure that this file contains the `paths:` parameter. | v2.2.7

          Defaults to `true`.
        </ResponseField>

        <ResponseField name="level" type="enum">
          Level | Specify the [rule level](https://phpstan.org/user-guide/rule-levels) to run. When set to `default`, the level is determined by the review profile: `chill` uses level 3 (real bugs only — return/property type mismatches, array offset errors) and `assertive` uses level 8 (adds dead code detection, argument type checking, null safety, and typehint checks). This setting is ignored if your configuration file already has a `level:` parameter.

          One of the following: `0`, `1`, `2`, `3`, `4`, `5`, `6`, `7`, `8`, `9`, `default`, `max`

          Defaults to `"default"`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="phpmd" type="object">
      PHPMD is a tool to find potential problems in PHP code.

      Defaults to `{}`.

      <Expandable title="Phpmd">
        <ResponseField name="enabled" type="boolean">
          Enable PHPMD | PHPMD is a tool to find potential problems in PHP code. | v2.15.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="phpcs" type="object">
      PHP CodeSniffer is a PHP linter and coding standard checker.

      Defaults to `{}`.

      <Expandable title="Phpcs">
        <ResponseField name="enabled" type="boolean">
          Enable PHP CodeSniffer | PHP CodeSniffer is a PHP linter and coding standard checker. | v3.7.2

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="golangci-lint" type="object">
      golangci-lint is a fast linters runner for Go.

      Defaults to `{}`.

      <Expandable title="Golangci-lint">
        <ResponseField name="enabled" type="boolean">
          Enable golangci-lint | golangci-lint is a fast linters runner for Go. | Enable golangci-lint integration. | v2.12.2

          Defaults to `true`.
        </ResponseField>

        <ResponseField name="config_file" type="string">
          Optional path to the golangci-lint configuration file relative to the repository. Useful when the configuration file is named differently than the default '.golangci.yml', '.golangci.yaml', '.golangci.toml', '.golangci.json'.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="yamllint" type="object">
      YAMLlint is a linter for YAML files.

      Defaults to `{}`.

      <Expandable title="Yamllint">
        <ResponseField name="enabled" type="boolean">
          Enable YAMLlint | YAMLlint is a linter for YAML files. | Enable YAMLlint integration. | v1.37.1

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="gitleaks" type="object">
      Betterleaks is a secret scanner (an improved version of Gitleaks).

      Defaults to `{}`.

      <Expandable title="Gitleaks">
        <ResponseField name="enabled" type="boolean">
          Enable Betterleaks | Betterleaks is a secret scanner (an improved version of Gitleaks). | Enable Betterleaks integration. | v1.7.3

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="trufflehog" type="object">
      TruffleHog is a secret scanner with verification capabilities that can detect and verify secrets in code.

      Defaults to `{}`.

      <Expandable title="Trufflehog">
        <ResponseField name="enabled" type="boolean">
          Enable TruffleHog | TruffleHog is a secret scanner with verification capabilities. | Enable TruffleHog integration. | v3.96.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="checkov" type="object">
      Checkov is a static code analysis tool for infrastructure-as-code files.

      Defaults to `{}`.

      <Expandable title="Checkov">
        <ResponseField name="enabled" type="boolean">
          Enable Checkov | Checkov is a static code analysis tool for infrastructure-as-code files. | v3.3.9

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="tflint" type="object">
      TFLint is a Terraform linter for finding potential errors and enforcing best practices.

      Defaults to `{}`.

      <Expandable title="Tflint">
        <ResponseField name="enabled" type="boolean">
          Enable TFLint | TFLint is a Terraform linter for finding potential errors. | v0.64.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="detekt" type="object">
      Detekt is a static code analysis tool for Kotlin files.

      Defaults to `{}`.

      <Expandable title="Detekt">
        <ResponseField name="enabled" type="boolean">
          Enable detekt | detekt is a static code analysis tool for Kotlin files. | v1.23.8

          Defaults to `true`.
        </ResponseField>

        <ResponseField name="config_file" type="string">
          Optional path to the detekt configuration file relative to the repository.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="eslint" type="object">
      ESLint is a static code analysis tool for JavaScript files.

      Defaults to `{}`.

      <Expandable title="Eslint">
        <ResponseField name="enabled" type="boolean">
          Enable ESLint | ESLint is a static code analysis tool for JavaScript files.

          Defaults to `true`.
        </ResponseField>

        <ResponseField name="e18e" type="object">
          @e18e/eslint-plugin modernization, performance, and dependency replacement checks.

          Defaults to `{}`.

          <Expandable title="E18e">
            <ResponseField name="enabled" type="boolean">
              Enable @e18e/eslint-plugin | Detects dependencies with modern replacements, flags unmaintained packages, and suggests native API alternatives or lighter replacements | v0.6.0

              Defaults to `true`.
            </ResponseField>
          </Expandable>
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="flake8" type="object">
      Flake8 is a Python linter that wraps PyFlakes, pycodestyle and Ned Batchelder's McCabe script.

      Defaults to `{}`.

      <Expandable title="Flake8">
        <ResponseField name="enabled" type="boolean">
          Enable Flake8 | Flake8 is a Python linter that wraps PyFlakes, pycodestyle and Ned Batchelder's McCabe script. | v7.3.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="fbinfer" type="object">
      Configuration for Infer to find bugs in Java and C/C++ code

      Defaults to `{}`.

      <Expandable title="Fbinfer">
        <ResponseField name="enabled" type="boolean">
          Enable Infer for static bug analysis in Java and C/C++ code | v1.3.0

          Defaults to `true`.
        </ResponseField>

        <ResponseField name="enable_java" type="boolean">
          Enable Java analysis | Disabled by default because Java analysis may require compiling more than the changed files.

          Defaults to `false`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="fortitudeLint" type="object">
      Fortitude is a Fortran linter that checks for code quality and style issues.

      Defaults to `{}`.

      <Expandable title="Fortitude Lint">
        <ResponseField name="enabled" type="boolean">
          Enable Fortitude | Fortitude is a Fortran linter that checks for code quality and style issues | v0.9.2

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="rubocop" type="object">
      RuboCop is a Ruby static code analyzer (a.k.a. linter ) and code formatter.

      Defaults to `{}`.

      <Expandable title="Rubocop">
        <ResponseField name="enabled" type="boolean">
          Enable RuboCop | RuboCop is a Ruby static code analyzer (a.k.a. linter ) and code formatter. | v1.88.2

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="buf" type="object">
      Buf offers linting for Protobuf files.

      Defaults to `{}`.

      <Expandable title="Buf">
        <ResponseField name="enabled" type="boolean">
          Enable Buf | Buf offers linting for Protobuf files. | v1.72.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="regal" type="object">
      Regal is a linter and language server for Rego.

      Defaults to `{}`.

      <Expandable title="Regal">
        <ResponseField name="enabled" type="boolean">
          Enable Regal | Regal is a linter and language server for Rego. | v0.42.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="actionlint" type="object">
      actionlint is a static checker for GitHub Actions workflow files.

      Defaults to `{}`.

      <Expandable title="Actionlint">
        <ResponseField name="enabled" type="boolean">
          Enable actionlint | actionlint is a static checker for GitHub Actions workflow files. | v1.7.12

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="zizmor" type="object">
      zizmor is a static security analyzer for GitHub Actions workflow files.

      Defaults to `{}`.

      <Expandable title="Zizmor">
        <ResponseField name="enabled" type="boolean">
          Enable zizmor | zizmor is a static security analyzer for GitHub Actions workflow files. | v1.29.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="pmd" type="object">
      PMD is an extensible multilanguage static code analyzer. It’s mainly concerned with Java.

      Defaults to `{}`.

      <Expandable title="Pmd">
        <ResponseField name="enabled" type="boolean">
          Enable PMD | PMD is an extensible multilanguage static code analyzer. It’s mainly concerned with Java. | v7.26.0

          Defaults to `true`.
        </ResponseField>

        <ResponseField name="config_file" type="string">
          Optional path to the PMD configuration file relative to the repository.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="clang" type="object">
      Configuration for Clang to perform static analysis on C and C++ code

      Defaults to `{}`.

      <Expandable title="Clang">
        <ResponseField name="enabled" type="boolean">
          Enable Clang for C/C++ static analysis and code quality checks | v14.0.6

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="cppcheck" type="object">
      Cppcheck is a static code analysis tool for the C and C++ programming languages.

      Defaults to `{}`.

      <Expandable title="Cppcheck">
        <ResponseField name="enabled" type="boolean">
          Enable Cppcheck | Cppcheck is a static code analysis tool for the C and C++ programming languages. | v2.21.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="opengrep" type="object">
      OpenGrep is a high-performance static code analysis engine, compatible with Semgrep configurations.

      Defaults to `{}`.

      <Expandable title="Opengrep">
        <ResponseField name="enabled" type="boolean">
          Enable OpenGrep | OpenGrep is a high-performance static code analysis engine for finding security vulnerabilities and bugs across 17+ languages. | v1.26.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="semgrep" type="object">
      Semgrep is a static analysis tool designed to scan code for security vulnerabilities and code quality issues.

      Defaults to `{}`.

      <Expandable title="Semgrep">
        <ResponseField name="enabled" type="boolean">
          Enable Semgrep | Semgrep is a static analysis tool designed to scan code for security vulnerabilities and code quality issues. | Enable Semgrep integration. | v1.170.0

          Defaults to `true`.
        </ResponseField>

        <ResponseField name="config_file" type="string">
          Optional path to the Semgrep configuration file relative to the repository.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="circleci" type="object">
      CircleCI tool is a static checker for CircleCI config files.

      Defaults to `{}`.

      <Expandable title="Circleci">
        <ResponseField name="enabled" type="boolean">
          Enable CircleCI | CircleCI tool is a static checker for CircleCI config files. | v0.1.38646

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="clippy" type="object">
      Clippy is a collection of lints to catch common mistakes and improve your Rust code.

      Defaults to `{}`.

      <Expandable title="Clippy">
        <ResponseField name="enabled" type="boolean">
          Enable Clippy | Clippy is a collection of lints to catch common mistakes and improve your Rust code. | Enable Clippy integration.

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="sqlfluff" type="object">
      SQLFluff is an open source, dialect-flexible and configurable SQL linter.

      Defaults to `{}`.

      <Expandable title="Sqlfluff">
        <ResponseField name="enabled" type="boolean">
          Enable SQLFluff | SQLFluff is an open source, dialect-flexible and configurable SQL linter. | v4.2.2

          Defaults to `true`.
        </ResponseField>

        <ResponseField name="config_file" type="string">
          Optional path to the SQLFluff configuration file relative to the repository. Use this when the config file is not named one of SQLFluff's default filenames.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="squawk" type="object">
      Configuration for Squawk to lint Postgres migrations and SQL for safe schema changes

      Defaults to `{}`.

      <Expandable title="Squawk">
        <ResponseField name="enabled" type="boolean">
          Enable Squawk for Postgres migration linting | Detects unsafe schema changes that can cause downtime or blocking locks | v2.61.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="trivy" type="object">
      Trivy is a comprehensive security scanner that detects misconfigurations and secrets in Infrastructure as Code files

      Defaults to `{}`.

      <Expandable title="Trivy">
        <ResponseField name="enabled" type="boolean">
          Enable Trivy for security scanning of IaC files (Terraform, Kubernetes, Docker, etc.) | v0.72.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="prismaLint" type="object">
      Configuration for Prisma Schema linting to ensure schema file quality

      Defaults to `{}`.

      <Expandable title="Prisma Lint">
        <ResponseField name="enabled" type="boolean">
          Enable Prisma Schema linting | Prisma Schema linting helps maintain consistent and error-free schema files | v0.13.1

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="pylint" type="object">
      Pylint is a Python static code analysis tool.

      Defaults to `{}`.

      <Expandable title="Pylint">
        <ResponseField name="enabled" type="boolean">
          Enable Pylint | Pylint is a Python static code analysis tool. | v4.0.6

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="oxc" type="object">
      Oxlint is a JavaScript/TypeScript linter for OXC written in Rust.

      Defaults to `{}`.

      <Expandable title="Oxc">
        <ResponseField name="enabled" type="boolean">
          Enable Oxlint | Oxlint is a JavaScript/TypeScript linter for OXC written in Rust. | v1.76.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="shopifyThemeCheck" type="object">
      Configuration for Shopify Theme Check to ensure theme quality and best practices

      Defaults to `{}`.

      <Expandable title="Shopify Theme Check">
        <ResponseField name="enabled" type="boolean">
          Enable Shopify Theme Check | A linter for Shopify themes that helps you follow Shopify theme & Liquid best practices | cli 4.1.0 | theme 3.58.2

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="luacheck" type="object">
      Configuration for Lua code linting to ensure code quality

      Defaults to `{}`.

      <Expandable title="Luacheck">
        <ResponseField name="enabled" type="boolean">
          Enable Lua code linting | Luacheck helps maintain consistent and error-free Lua code | v1.2.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="brakeman" type="object">
      Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications. | v8.0.5

      Defaults to `{}`.

      <Expandable title="Brakeman">
        <ResponseField name="enabled" type="boolean">
          Enable Brakeman | Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications. | v8.0.5

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="dotenvLint" type="object">
      dotenv-linter is a tool for checking and fixing .env files for problems and best practices

      Defaults to `{}`.

      <Expandable title="Dotenv Lint">
        <ResponseField name="enabled" type="boolean">
          Enable dotenv-linter | dotenv-linter is a tool for checking and fixing .env files for problems and best practices | v4.0.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="htmlhint" type="object">
      HTMLHint is a static code analysis tool for HTML files.

      Defaults to `{}`.

      <Expandable title="Htmlhint">
        <ResponseField name="enabled" type="boolean">
          Enable HTMLHint | HTMLHint is a static code analysis tool for HTML files. | Enable HTMLHint integration. | v1.9.2

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="stylelint" type="object">
      Stylelint is a linter for stylesheets (CSS, SCSS, Sass, Less, SugarSS, Stylus) that helps avoid errors and enforce conventions.

      Defaults to `{}`.

      <Expandable title="Stylelint">
        <ResponseField name="enabled" type="boolean">
          Enable Stylelint | Stylelint is a linter for stylesheets (CSS, SCSS, Sass, Less, SugarSS, Stylus) that helps avoid errors and enforce conventions. | Enable Stylelint integration. | v17.14.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="checkmake" type="object">
      checkmake is a linter for Makefiles.

      Defaults to `{}`.

      <Expandable title="Checkmake">
        <ResponseField name="enabled" type="boolean">
          Enable checkmake | checkmake is a linter for Makefiles. | v0.3.2

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="osvScanner" type="object">
      OSV Scanner is a tool for vulnerability package scanning.

      Defaults to `{}`.

      <Expandable title="Osv Scanner">
        <ResponseField name="enabled" type="boolean">
          Enable OSV Scanner | OSV Scanner is a tool for vulnerability package scanning | v2.4.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="oasdiff" type="object">
      oasdiff detects breaking changes between OpenAPI specifications.

      Defaults to `{}`.

      <Expandable title="Oasdiff">
        <ResponseField name="enabled" type="boolean">
          Enable oasdiff | oasdiff detects breaking changes between OpenAPI specifications. | v1.27.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="reactDoctor" type="object">
      React Doctor scans React codebases for security, performance, correctness, and accessibility issues.

      Defaults to `{}`.

      <Expandable title="React Doctor">
        <ResponseField name="enabled" type="boolean">
          Enable React Doctor | React Doctor scans React codebases for security, performance, correctness, and accessibility issues. | v0.9.3

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="presidio" type="object">
      Microsoft Presidio Analyzer 2.2.364 detects sensitive identifiers (including payment cards, US SSN, cryptocurrency wallets, and phone numbers) in changed files. Tune entities, thresholds, and languages in repository Presidio configuration (for example .presidiocli or AnalyzerEngineProvider YAML); the built-in scan uses fixed defaults and is skipped when that configuration is present.

      Defaults to `{}`.

      <Expandable title="Presidio">
        <ResponseField name="enabled" type="boolean">
          Enable Microsoft Presidio Analyzer for high-signal PII in changed files | v2.2.364

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="blinter" type="object">
      Blinter is a linter for Windows batch files that provides comprehensive static analysis to identify syntax errors, security vulnerabilities, performance issues, and style problems.

      Defaults to `{}`.

      <Expandable title="Blinter">
        <ResponseField name="enabled" type="boolean">
          Enable Blinter | Blinter is a linter for Windows batch files that provides comprehensive static analysis to identify syntax errors, security vulnerabilities, performance issues, and style problems. | v1.0.113

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="smartyLint" type="object">
      smarty-lint is a linter for Smarty 3 template files that checks for common issues such as incorrect operator usage, naming conventions, empty blocks, and unquoted strings.

      Defaults to `{}`.

      <Expandable title="Smarty Lint">
        <ResponseField name="enabled" type="boolean">
          Enable smarty-lint | smarty-lint is a linter for Smarty 3 template files that checks for common issues such as incorrect operator usage, naming conventions, empty blocks, and unquoted strings. | v0.3.3

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="emberTemplateLint" type="object">
      ember-template-lint is a linter for Handlebars template files that checks for common issues such as accessibility violations, deprecated patterns, and template anti-patterns.

      Defaults to `{}`.

      <Expandable title="Ember Template Lint">
        <ResponseField name="enabled" type="boolean">
          Enable ember-template-lint | ember-template-lint is a linter for Handlebars template files that checks for common issues such as accessibility violations, deprecated patterns, and template anti-patterns. | v7.9.3

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="skillspector" type="object">
      SkillSpector is a security scanner for AI agent skills that detects vulnerabilities, malicious patterns, and security risks

      Defaults to `{}`.

      <Expandable title="Skillspector">
        <ResponseField name="enabled" type="boolean">
          Enable SkillSpector | SkillSpector is a security scanner for AI agent skills. It detects vulnerabilities, malicious patterns, and security risks in SKILL.md manifests and MCP configurations. | v2.5.1

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="psscriptanalyzer" type="object">
      PSScriptAnalyzer is a static code checker for PowerShell scripts and modules.

      Defaults to `{}`.

      <Expandable title="Psscriptanalyzer">
        <ResponseField name="enabled" type="boolean">
          Enable PSScriptAnalyzer | PSScriptAnalyzer is a static code checker for PowerShell scripts and modules. | v1.25.0

          Defaults to `true`.
        </ResponseField>
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

## Chat

Configuration for chat

### Reference

<ResponseField name="art" type="boolean">
  Generate art in chat responses (ASCII or emoji).

  Defaults to `true`.
</ResponseField>

<ResponseField name="allow_non_org_members" type="boolean">
  Allow non-organization members to interact with CodeRabbit in comment chat. Set to false to restrict issue/review comment interactions to organization members on GitHub organization repositories. This does not affect automatic PR review eligibility.

  Defaults to `true`.
</ResponseField>

<ResponseField name="auto_reply" type="boolean">
  Let CodeRabbit reply automatically without requiring a mention/tag.

  Defaults to `true`.
</ResponseField>

<ResponseField name="integrations" type="object">
  Configuration for integrations

  Defaults to `{}`.

  <Expandable title="Integrations">
    <ResponseField name="jira" type="object">
      Configuration for jira

      Defaults to `{}`.

      <Expandable title="Jira">
        <ResponseField name="usage" type="enum">
          Jira | Allow creating Jira issues from chat. 'auto' disables the integration for public repositories.

          One of the following: `auto`, `enabled`, `disabled`

          Defaults to `"auto"`.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="linear" type="object">
      Configuration for linear

      Defaults to `{}`.

      <Expandable title="Linear">
        <ResponseField name="usage" type="enum">
          Linear | Allow creating Linear issues from chat. 'auto' disables the integration for public repositories.

          One of the following: `auto`, `enabled`, `disabled`

          Defaults to `"auto"`.
        </ResponseField>
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

## Knowledge base

Configuration for knowledge base

### Reference

<ResponseField name="opt_out" type="boolean">
  Opt Out | Disable knowledge base features that require data retention. Opting out removes any existing stored knowledge base data.

  Defaults to `false`.
</ResponseField>

<ResponseField name="web_search" type="object">
  Configuration for web search

  Defaults to `{}`.

  <Expandable title="Web search">
    <ResponseField name="enabled" type="boolean">
      Web Search | Use web search to gather additional context.

      Defaults to `true`.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="code_guidelines" type="object">
  Use your coding guideline documents (see File Patterns) as review criteria.

  Defaults to `{}`.

  <Expandable title="Code guidelines">
    <ResponseField name="enabled" type="boolean">
      Enabled | Apply your organization's coding standards during reviews.

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="filePatterns" type="array of object">
      File Patterns | Patterns for your coding guideline documents. CodeRabbit scans these files to learn your standards and apply them during reviews. Multiple files supported; file names are case-sensitive. Defaults include: (\*\*/.cursorrules, .github/copilot-instructions.md, \*\*/CLAUDE.md, \*\*/GEMINI.md, \*\*/.cursor/rules/*, \*\*/.windsurfrules, \*\*/.clinerules/*, \*\*/.rules/\*, \*\*/AGENT.md, \*\*/AGENTS.md, \*\*/REVIEW\.md).

      Defaults to `[]`.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="learnings" type="object">
  Configuration for learnings

  Defaults to `{}`.

  <Expandable title="Learnings">
    <ResponseField name="scope" type="enum">
      Learnings | Choose scope: 'local' (repo), 'global' (org), or 'auto' (local for public repos, global for private repos).

      One of the following: `local`, `global`, `auto`

      Defaults to `"auto"`.
    </ResponseField>

    <ResponseField name="approval_delay" type="integer">
      Days admins have to approve or reject a learning before it is automatically applied. Must be an integer between 0 and 30. Set to 0 to apply learnings immediately without approval.

      Defaults to `0`.

      <Note>
        Min: 0, Max: 30
      </Note>
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="issues" type="object">
  Configuration for issues

  Defaults to `{}`.

  <Expandable title="Issues">
    <ResponseField name="scope" type="enum">
      Issues | Choose scope for GitHub/GitLab issues: 'local' (repo), 'global' (org), or 'auto' (local for public repos, global for private repos).

      One of the following: `local`, `global`, `auto`

      Defaults to `"auto"`.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="jira" type="object">
  Configuration for jira

  Defaults to `{}`.

  <Expandable title="Jira">
    <ResponseField name="usage" type="enum">
      Jira | Use Jira as a knowledge source. 'auto' disables the integration for public repositories.

      One of the following: `auto`, `enabled`, `disabled`

      Defaults to `"auto"`.
    </ResponseField>

    <ResponseField name="project_keys" type="array of string">
      Jira Project Keys | Restrict Jira context to these projects.

      Defaults to `[]`.
    </ResponseField>

    <ResponseField name="excluded_project_keys" type="array of string">
      Jira Excluded Project Keys | Never use these Jira projects as CodeRabbit context, regardless of repository allowlists. Managed at the workspace level as a security policy; exclusions always take precedence over any allowlist.

      Defaults to `[]`.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="linear" type="object">
  Configuration for linear

  Defaults to `{}`.

  <Expandable title="Linear">
    <ResponseField name="usage" type="enum">
      Linear | Use Linear as a knowledge source. 'auto' disables the integration for public repositories.

      One of the following: `auto`, `enabled`, `disabled`

      Defaults to `"auto"`.
    </ResponseField>

    <ResponseField name="team_keys" type="array of string">
      Linear Team Keys | Restrict Linear context to these teams (e.g. 'ENG').

      Defaults to `[]`.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="pull_requests" type="object">
  Configuration for pull requests

  Defaults to `{}`.

  <Expandable title="Pull requests">
    <ResponseField name="scope" type="enum">
      PRs | Choose scope: 'local' (repo), 'global' (org), or 'auto' (local for public repos, global for private repos).

      One of the following: `local`, `global`, `auto`

      Defaults to `"auto"`.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="mcp" type="object">
  Configuration for mcp

  Defaults to `{}`.

  <Expandable title="Mcp">
    <ResponseField name="usage" type="enum">
      MCP | Use MCP servers as a knowledge source. 'auto' disables the integration for public repositories.

      One of the following: `auto`, `enabled`, `disabled`

      Defaults to `"auto"`.
    </ResponseField>

    <ResponseField name="disabled_servers" type="array of string">
      Disabled MCP Servers | Specify MCP server labels to disable (case-insensitive). These servers will be excluded from reviews and knowledge base queries.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="automatic_repository_linking" type="boolean">
  Automatic Repository Linking | When enabled, CodeRabbit automatically detects and links related repositories in your organization to identify breaking changes and downstream impact during PR reviews.

  Defaults to `false`.
</ResponseField>

<ResponseField name="linked_repositories" type="array of object">
  Linked Repositories | Repositories that CodeRabbit should consider when reviewing PRs in this repo. Use this to surface cross-repo dependencies and catch breaking changes across related codebases.

  Defaults to `[]`.

  <Expandable title="Array items">
    <ResponseField name="repository" type="string">
      Repository name in owner/repo format (e.g., GitHub: myorg/backend-api, Azure DevOps: My Project/backend-api, GitLab: group/subgroup/repo, Bitbucket: workspace/repo)
    </ResponseField>

    <ResponseField name="instructions" type="string">
      Optionally provide description and guidance on what this repository contains for CodeRabbit to consider during reviews. Example: 'Contains REST API endpoints and database models.'

      Defaults to `""`.

      <Note>
        Max length: 2000
      </Note>
    </ResponseField>
  </Expandable>
</ResponseField>

## Code generation

Configuration for code generation

### Reference

<ResponseField name="docstrings" type="object">
  Docstring Generation | Settings for generating docstrings.

  Defaults to `{"path_instructions":[]}`.

  <Expandable title="Docstrings">
    <ResponseField name="language" type="enum">
      Language for generated docstrings (ISO language code).

      One of the following: `de`, `de-DE`, `de-AT`, `de-CH`, `en`, `en-US`, `en-AU`, `en-GB`, `en-CA`, `en-NZ`, `en-ZA`, `es`, `es-AR`, `fr`, `fr-CA`, `fr-CH`, `fr-BE`, `nl`, `nl-BE`, `pt-AO`, `pt`, `pt-BR`, `pt-MZ`, `pt-PT`, `ar`, `ast-ES`, `ast`, `be-BY`, `be`, `br-FR`, `br`, `ca-ES`, `ca`, `ca-ES-valencia`, `ca-ES-balear`, `da-DK`, `da`, `de-DE-x-simple-language`, `el-GR`, `el`, `eo`, `fa`, `ga-IE`, `ga`, `gl-ES`, `gl`, `it`, `ja-JP`, `ja`, `km-KH`, `km`, `ko-KR`, `ko`, `pl-PL`, `pl`, `ro-RO`, `ro`, `ru-RU`, `ru`, `sk-SK`, `sk`, `sl-SI`, `sl`, `sv`, `ta-IN`, `ta`, `tl-PH`, `tl`, `tr`, `uk-UA`, `uk`, `zh-CN`, `zh`, `zh-TW`, `crh-UA`, `crh`, `cs-CZ`, `cs`, `nb`, `no`, `nl-NL`, `de-DE-x-simple-language-DE`, `es-ES`, `it-IT`, `fa-IR`, `sv-SE`, `de-LU`, `fr-FR`, `bg-BG`, `bg`, `he-IL`, `he`, `hi-IN`, `hi`, `vi-VN`, `vi`, `th-TH`, `th`, `bn-BD`, `bn`

      Defaults to `"en-US"`.
    </ResponseField>

    <ResponseField name="path_instructions" type="array of object">
      Path Instructions | Add path-specific guidelines for docstring generation.

      Defaults to `[]`.

      <Expandable title="Array items">
        <ResponseField name="path" type="string">
          File path glob pattern. Example: `**/*.js`.
        </ResponseField>

        <ResponseField name="instructions" type="string">
          Additional docstring-generation guidelines for matching paths.

          <Note>
            Max length: 20000
          </Note>
        </ResponseField>
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="unit_tests" type="object">
  Unit Test Generation | Settings for generating unit tests.

  Defaults to `{"path_instructions":[]}`.

  <Expandable title="Unit tests">
    <ResponseField name="path_instructions" type="array of object">
      Path Instructions | Add path-specific guidelines for unit test generation.

      Defaults to `[]`.

      <Expandable title="Array items">
        <ResponseField name="path" type="string">
          File path glob pattern. Example: `**/*.js`.
        </ResponseField>

        <ResponseField name="instructions" type="string">
          Additional unit-test-generation guidelines for matching paths.

          <Note>
            Max length: 20000
          </Note>
        </ResponseField>
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

## Issue enrichment

Configuration for issue enrichment

### Reference

<ResponseField name="auto_enrich" type="object">
  Settings for automatic issue enrichment.

  Defaults to `{}`.

  <Expandable title="Auto enrich">
    <ResponseField name="enabled" type="boolean">
      Automatic Issue Enrichment | Analyze and enrich issues with additional context (related code, potential solutions, complexity assessment).

      Defaults to `false`.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="planning" type="object">
  Settings for issue planning.

  Defaults to `{}`.

  <Expandable title="Planning">
    <ResponseField name="enabled" type="boolean">
      Issue Planning | Generate an implementation plan for issues (early preview).

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="auto_planning" type="object">
      Configuration for auto planning

      Defaults to `{}`.

      <Expandable title="Auto planning">
        <ResponseField name="enabled" type="boolean">
          Automatic Planning | Trigger issue planning based on labels.

          Defaults to `true`.
        </ResponseField>

        <ResponseField name="labels" type="array of string">
          Labels that trigger automatic issue planning. Labels starting with '!' are negative matches. Examples: \['feature', 'enhancement'] plans issues with either label. \['!wip'] plans all issues except those labeled 'wip'. \['feature', '!wip'] plans issues labeled 'feature' but not 'wip'.

          Defaults to `[]`.
        </ResponseField>
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="labeling" type="object">
  Settings for issue labeling.

  Defaults to `{}`.

  <Expandable title="Labeling">
    <ResponseField name="labeling_instructions" type="array of object">
      Labeling Instructions | Define issue labels to suggest and when to suggest them.

      Defaults to `[]`.

      <Expandable title="Array items">
        <ResponseField name="label" type="string">
          Label to suggest for the issue. Example: enhancement
        </ResponseField>

        <ResponseField name="instructions" type="string">
          Instructions for the label. Example: New feature or request.

          <Note>
            Max length: 3000
          </Note>
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="auto_apply_labels" type="boolean">
      Automatically apply suggested labels to the issue. When enabled without labeling instructions, labels are auto-suggested based on similar issues.

      Defaults to `false`.
    </ResponseField>
  </Expandable>
</ResponseField>

## Related resources

<CardGroup>
  <Card title="Review commands" icon="terminal" href="/reference/review-commands">
    Learn about @coderabbitai commands
  </Card>

  <Card title="Tools reference" icon="wrench" href="/tools/reference">
    Browse all supported linters and analyzers
  </Card>
</CardGroup>


# CodeRabbit glossary: review, Git, and code analysis terms
Source: https://docs.coderabbit.ai/reference/glossary

Definitions of CodeRabbit product terms, Git platform terminology across GitHub, GitLab, Bitbucket, and Azure DevOps, and common code review concepts.

This glossary covers terms specific to CodeRabbit, Git platform terminology that varies across GitHub, GitLab, Bitbucket, and Azure DevOps, and general software engineering concepts referenced in the documentation.

## CodeRabbit terms

### Code Guidelines

Files in your repository that describe your team's coding standards, such as `.cursorrules`, `CLAUDE.md`, or `AGENTS.md`. CodeRabbit reads these files and applies them as review criteria. Different from [Path-based Instructions](#path-based-instructions), which are rules you write directly in CodeRabbit's settings.

See [Knowledge Base](/knowledge-base).

### Finishing Touches

Automated actions in the PR for common cleanup tasks like generating docstrings and writing unit tests. Triggered through a checkbox in the [Walkthrough](#walkthrough) or by commenting `@coderabbitai`.

See [Docstrings](/finishing-touches/docstrings) and [Unit tests](/finishing-touches/unit-test-generation).

### Fortune

A random fun fact, tip, or trivia message displayed in the [Walkthrough](#walkthrough) while CodeRabbit is still processing the review. Replaced by the actual review summary content once complete. Named after the Unix `fortune` command.

### High-Level Summary

An AI-generated summary of a PR's purpose and key changes, written for human reviewers. By default appears in the PR description (at the end unless a placeholder string specifies a precise injection place) and can be moved to the [Walkthrough](#walkthrough) comment.

### Incremental Review

When new commits are pushed to a PR that has already been reviewed, CodeRabbit can re-review focusing on just the new changes rather than starting from scratch. This avoids repeating comments already made on previous commits.

### Knowledge Base

The collected context CodeRabbit draws on during reviews. This includes [Learnings](#learnings) from past review conversations, issues from your tracker, past PRs, [Code Guidelines](#code-guidelines) files, and integrations with Jira, Linear, and [MCP](#mcp) servers.

See [Knowledge Base](/knowledge-base).

### Learnings

When you respond to CodeRabbit's review comments (for example, "we prefer early returns over try-catch in this repo"), CodeRabbit remembers that preference and applies it to future reviews. These remembered preferences are called learnings. They can be scoped to a single repository or shared across your organization.

See [Learnings](/knowledge-base/learnings).

### Security Repository Learnings

Accepted-risk guidance saved when a code vulnerability is ignored. Security Agent can reuse this guidance in later scans to suppress equivalent findings when their behavior and file or repository scope match. Security repository Learnings are separate from the [Learnings](#learnings) used in pull request reviews.

See [Security Agent](/security-agent).

### Path Filters

Glob patterns that control which files CodeRabbit includes in or excludes from a review. For example, `!dist/**` excludes all files in the `dist` folder, and `!*.lock` excludes lock files. Files not matching any exclude pattern are included by default.

### Path-based Instructions

Custom review rules that only apply to files matching a [glob pattern](#glob-pattern). For example, you can tell CodeRabbit to "ensure all tests have meaningful descriptions" only for files matching `**/*.test.ts`. Different from [Code Guidelines](#code-guidelines), which are reference documents CodeRabbit reads.

See [Review instructions](/configuration/path-instructions).

### Pre-Merge Checks

Validation rules CodeRabbit evaluates before a PR is merged. Built-in checks include [docstring](#docstring) coverage, PR title quality, PR description completeness, and linked issue assessment. You can also define custom checks with your own pass/fail criteria.

See [Pre-merge checks](/pr-reviews/pre-merge-checks).

### Profile

Controls how much feedback CodeRabbit gives you and how strict its standards are. Think of it as a volume knob for review comments.

* **Quiet** posts only the most important comments inline — critical and major issues that are also high-impact — and groups everything else into collapsed sections in the review summary, so your pull request conversation stays focused without losing any feedback.
* **Chill** focuses on important issues — you get fewer, higher-signal comments focused on bugs, security issues, and essential fixes.
* **Assertive** provides comprehensive feedback with more comments overall, including style, best practices, and minor improvements.

### Request Changes Workflow

A two-step automation: when CodeRabbit finds issues, it submits a "Request changes" review on GitHub to signal the PR needs work. Once all CodeRabbit comments are resolved and [pre-merge checks](#pre-merge-checks) pass, CodeRabbit automatically switches its review to "Approve." This lets teams use CodeRabbit as a required reviewer that can block or unblock merging.

### Tone Instructions

A free-text field where you describe how CodeRabbit should communicate. This affects the writing style of all review comments and chat responses — for example, "Be concise and direct" or "Explain issues in detail for junior developers." Note that this only changes how comments are written, not how many are posted. Use [Profile](#profile) for that.

### Walkthrough

The main summary comment that CodeRabbit posts on every PR. It's a comprehensive, multi-section overview of everything that changed. Sections include a [high-level summary](#high-level-summary), a table of changed files, [sequence diagrams](#sequence-diagram), suggested [labels](#labels) and reviewers, and [Finishing Touches](#finishing-touches) among others. Which sections appear can be controlled through the review settings.

## Git platform terms

Terminology for the same concepts can vary across GitHub, GitLab, Bitbucket, and Azure DevOps. Where the naming differs, a comparison table is included.

### Base Branch

The branch that a PR is merging changes into. This is the destination, not the source.

| GitHub      | GitLab        | Bitbucket          | Azure DevOps  |
| ----------- | ------------- | ------------------ | ------------- |
| Base branch | Target branch | Destination branch | Target branch |

### Head / Source Branch

The branch that contains the new changes being proposed in the PR.

| GitHub      | GitLab        | Bitbucket     | Azure DevOps  |
| ----------- | ------------- | ------------- | ------------- |
| Head branch | Source branch | Source branch | Source branch |

### Status Check

An indicator (pass, pending, fail) shown on a PR that represents the result of an automated process like CI, tests, or a code review tool like CodeRabbit.

| GitHub                                    | GitLab                 | Bitbucket    | Azure DevOps             |
| ----------------------------------------- | ---------------------- | ------------ | ------------------------ |
| Status checks (UI), Commit statuses (API) | External status checks | Build status | PR status, Status checks |

### Labels

Tags attached to PRs or issues for categorization, such as `bug`, `feature`, or `urgent`. Used for filtering, automation, and organization.

| GitHub | GitLab | Bitbucket              | Azure DevOps              |
| ------ | ------ | ---------------------- | ------------------------- |
| Labels | Labels | Not supported natively | Labels (also called Tags) |

### Request Changes

A review action where the reviewer formally indicates the PR needs fixes before it can be merged. Can block merging if required reviews are configured. Not all platforms have this exact action.

| GitHub                         | GitLab                                   | Bitbucket                      | Azure DevOps             |
| ------------------------------ | ---------------------------------------- | ------------------------------ | ------------------------ |
| Request changes (blocks merge) | No direct equivalent (withhold approval) | No direct equivalent (decline) | Wait for author / Reject |

### Collapsed Section

A block of content in a PR comment that is hidden by default and expanded by clicking. Uses HTML `<details>` and `<summary>` tags. CodeRabbit wraps the [Walkthrough](#walkthrough) in one when "Collapse Walkthrough" is enabled.

| GitHub            | GitLab              | Bitbucket                    | Azure DevOps                 |
| ----------------- | ------------------- | ---------------------------- | ---------------------------- |
| Collapsed section | Collapsible section | Supported (no official name) | Supported (no official name) |

## General terms

Standard software engineering concepts referenced throughout CodeRabbit documentation.

### Docstring

A documentation comment embedded directly in source code that describes what a function, class, or module does. Format varies by language: Python uses triple-quoted strings (`"""..."""`), JavaScript uses JSDoc (`/** ... */`), etc. [Docstring coverage](/finishing-touches/docstrings) measures what percentage of functions have these.

### Glob Pattern

A file-matching syntax using wildcards. Used in [Path Filters](#path-filters) and [Path-based Instructions](#path-based-instructions) to specify which files a rule applies to. `*` matches any filename, `**` matches any directory depth, and `!` prefix excludes. Example: `src/**/*.ts` matches all TypeScript files under `src`.

### MCP

Model Context Protocol — an open standard for connecting AI tools to external data sources and services. CodeRabbit can use MCP servers configured for your organization as additional knowledge sources during reviews.

See [MCP server integrations](/integrations/mcp-servers).

### Regex

Regular expressions — a pattern-matching syntax more powerful than [glob](#glob-pattern). Used in the Base Branches setting to match branch names. Example: `release/.*` matches any branch starting with `release/`.

### Sequence Diagram

A standard UML diagram type that shows the order of interactions between components, functions, or services over time. CodeRabbit auto-generates these from changed code to help reviewers understand the flow.


# Code review commands
Source: https://docs.coderabbit.ai/reference/review-commands

Complete reference of CodeRabbit commands for controlling code reviews, generating documentation, and managing pull requests.

<Info>
  Examples on this page use `@coderabbitai`. If CodeRabbit is installed with a different service-account handle on your platform, use that handle instead in PR comments and PR descriptions.
</Info>

## Review control commands

These commands control CodeRabbit's automatic review behavior for your pull request.

### Manual review triggers

<Info>
  `@coderabbitai review` does incremental review (new changes), not a full review. Use `@coderabbitai full review` when you want a complete pass over the entire pull request. Both commands use one PR review from your allowance when the review runs.
</Info>

<AccordionGroup>
  <Accordion title="@coderabbitai review" icon="refresh-cw">
    **Description:** Triggers an incremental review of new changes only

    **Usage:** Post as a comment in your pull request

    **When to use:**

    * Automatic reviews are disabled
    * You want to manually request a review of recent changes
    * You've made updates and want focused feedback on new code
    * A full review already ran and you only want feedback on what changed since then (new commits)

    **Example:**

    ```
    @coderabbitai review
    ```
  </Accordion>

  <Accordion title="@coderabbitai full review" icon="scan">
    **Description:** Performs a complete review of all files from scratch

    **Usage:** Post as a comment in your pull request

    **When to use:**

    * You want a fresh view on the entire PR
    * Previous reviews may have missed something
    * You've made significant changes affecting the overall logic
    * A PR was moved from draft to open and you want the first complete review now

    **Example:**

    ```
    @coderabbitai full review
    ```
  </Accordion>
</AccordionGroup>

### Review flow control

<AccordionGroup>
  <Accordion title="@coderabbitai pause" icon="pause">
    **Description:** Temporarily stops automatic reviews on the PR

    **Usage:** Post as a comment in your pull request

    **When to use:**

    * Making multiple rapid changes
    * Want to avoid review spam during development
    * Need time to complete your implementation

    **Example:**

    ```
    @coderabbitai pause
    ```
  </Accordion>

  <Accordion title="@coderabbitai resume" icon="play">
    **Description:** Restarts automatic reviews after a pause

    **Usage:** Post as a comment in your pull request

    **When to use:**

    * Ready for CodeRabbit to review again
    * Completed your changes and want feedback

    **Example:**

    ```
    @coderabbitai resume
    ```
  </Accordion>

  <Accordion title="@coderabbitai ignore" icon="eye-off">
    **Description:** Permanently disables automatic reviews for this PR

    **Usage:** Add anywhere in the pull request description

    **When to use:**

    * Want to handle the review process manually
    * PR contains sensitive or experimental code
    * Working on a hotfix that needs immediate deployment

    **Example:**

    ```
    @coderabbitai ignore
    ```

    <Warning>
      This command must be placed in the PR description, not in comments. To re-enable reviews, remove this text from the description.
    </Warning>
  </Accordion>
</AccordionGroup>

## Content generation commands

These commands help generate and update PR content and documentation.

### Summary and documentation

<AccordionGroup>
  <Accordion title="@coderabbitai summary" icon="file-text">
    **Note:** This is not a command - it's a placeholder that you put in your PR description.

    **Description:** A placeholder in your PR description that gets replaced with CodeRabbit's high-level summary of the changes

    **How it works:**

    1. Add `@coderabbitai summary` anywhere in your PR description
    2. When CodeRabbit generates a summary, it replaces this placeholder instead of appending to the end
    3. You can customize this placeholder using the `reviews.high_level_summary_placeholder` configuration option

    **Usage:** Place directly in your PR description (not as a comment)

    **When to use:**

    * You want the summary in a specific location in your description
    * You want to control where the summary appears instead of it being appended at the end

    **Example PR description:**

    ```
    ## Overview
    This PR implements the new user authentication flow.

    @coderabbitai summary

    ## Testing
    - [ ] Unit tests pass
    - [ ] Integration tests pass
    ```

    <Info>
      You can change this placeholder to anything you like using the `reviews.high_level_summary_placeholder` configuration option. See the [configuration reference](/reference/configuration#param-high-level-summary-placeholder) for more details.
    </Info>
  </Accordion>

  <Accordion title="@coderabbitai generate docstrings" icon="book">
    **Description:** Generates docstrings for functions and classes in the PR

    **Usage:** Post as a comment in your pull request

    **When to use:**

    * Code lacks proper documentation
    * Want consistent docstring formatting
    * Need to improve code documentation quickly

    **Example:**

    ```
    @coderabbitai generate docstrings
    ```

    <Note>
      This feature must be enabled in your CodeRabbit configuration under `reviews.finishing_touches.docstrings.enabled`.
    </Note>
  </Accordion>

  <Accordion title="@coderabbitai generate unit tests" icon="test-tube">
    **Description:** Generates unit tests for the code in the PR

    **Usage:** Post as a comment in your pull request

    **When to use:**

    * Code lacks test coverage
    * Want to quickly scaffold test cases
    * Need examples of how to test your functions

    **Example:**

    ```
    @coderabbitai generate unit tests
    ```

    <Note>
      This feature must be enabled in your CodeRabbit configuration under `reviews.finishing_touches.unit_tests.enabled`.
    </Note>
  </Accordion>

  <Accordion title="@coderabbitai autofix" icon="wand-sparkles">
    <OpenBetaBadge />

    **Description:** Automatically applies fixes for unresolved CodeRabbit review findings on GitHub, GitLab, Azure DevOps, and Bitbucket Cloud pull requests. Fixes can be committed directly to the current branch or to a new branch, based on your preference. For full details, see [Finishing Touches / Autofix](/finishing-touches/autofix).

    **When to use:** You want CodeRabbit to automatically implement review fixes

    **Usage:**

    Post as a comment in your pull request

    ```text Commit changes directly to the current branch theme={null}
    @coderabbitai autofix
    ```

    ```text Commit changes to a new branch and open a stacked pull request against the current branch theme={null}
    @coderabbitai autofix stacked pr
    ```

    <Info>
      The aliases `auto-fix` and `auto fix` are also supported.
    </Info>

    <Info>
      Supported on GitHub, GitLab, Azure DevOps, and Bitbucket Cloud. The interactive **Autofix** checkboxes are available on supported GitHub pull-request flows only.
    </Info>

    <Info>
      No configuration required. Enabled by default for Pro and Enterprise plan users.
    </Info>

    <Info>
      If the pull request has merge conflicts, Autofix stops before making changes. The reply will suggest `@coderabbitai resolve merge conflict` as the next step. See [Resolve merge conflicts](/finishing-touches/resolve-merge-conflict) for details.
    </Info>

    <Info>
      Resolve Merge Conflicts must be enabled in your CodeRabbit configuration under `reviews.finishing_touches.resolve_merge_conflict.enabled`. It is enabled by default.
    </Info>
  </Accordion>

  <Accordion title="@coderabbitai fix-ci" icon="list-checks">
    **Description:** Investigates failing CI checks and applies generated fixes as a direct commit or a stacked pull request. For full details, see [Finishing Touches / Fix CI failures](/finishing-touches/fix-ci).

    **When to use:** A GitHub pull request has failing CI checks that CodeRabbit can investigate

    **Usage:**

    Post one of these commands as a pull request comment:

    <Tabs>
      <Tab title="Stacked pull request">
        ```text theme={null}
        @coderabbitai fix-ci
        ```
      </Tab>

      <Tab title="Direct commit">
        ```text theme={null}
        @coderabbitai fix-ci commit
        ```
      </Tab>
    </Tabs>

    <Info>
      The aliases `fix ci` and `fixci` are also supported. Add `commit` to any alias to request a direct commit.
    </Info>

    <Info>
      Natural-language Fix CI requests use a stacked pull request by default. Explicitly ask CodeRabbit to commit directly, commit to the current branch, or avoid a stacked pull request to select direct-commit delivery.
    </Info>

    <Info>
      On GitHub, CodeRabbit can also show mutually exclusive **Commit on current branch** and **Create stacked PR** options under **Fix failing CI** in Finishing Touches when it detects failing checks.
    </Info>

    <Info>
      Fix CI failures must be enabled under `reviews.finishing_touches.fix_ci.enabled`. It is available on GitHub and requires a Pro Plus plan.
    </Info>
  </Accordion>

  <Accordion title="@coderabbitai generate sequence diagram" icon="workflow">
    **Description:** Creates a sequence diagram visualizing the PR's history and changes

    **Usage:** Post as a comment in your pull request

    **When to use:**

    * Want to visualize complex interactions
    * Need to understand the flow of changes
    * Documentation requires visual aids

    **Example:**

    ```
    @coderabbitai generate sequence diagram
    ```
  </Accordion>
</AccordionGroup>

## Comment management

<AccordionGroup>
  <Accordion title="@coderabbitai approve" icon="badge-check">
    **Description:** Resolves all unresolved CodeRabbit review threads and then attempts to submit CodeRabbit's approval on the pull request

    **Usage:** Post as a new top-level comment in your pull request

    **When to use:**

    * You've addressed CodeRabbit's feedback and want a single command to resolve its threads and approve the PR
    * Your team uses CodeRabbit as a required reviewer and you want to request approval explicitly
    * You do not want to wait for the normal automatic approval path after resolving comments

    **Example:**

    ```
    @coderabbitai approve
    ```

    <Info>
      This command only submits an approval when `reviews.request_changes_workflow` is enabled. Without that setting, CodeRabbit resolves its review threads but reports that approval is disabled. See the [configuration reference](/reference/configuration#param-request-changes-workflow).
    </Info>

    <Warning>
      Post this as a new top-level PR comment. `@coderabbitai approve` is not supported in review-thread replies.
    </Warning>
  </Accordion>

  <Accordion title="@coderabbitai resolve" icon="circle-check">
    **Description:** Marks all CodeRabbit review comments as resolved

    **Usage:** Post as a new top-level comment in your pull request

    **When to use:**

    * Addressed all CodeRabbit feedback
    * Want to clean up resolved issues
    * Ready to merge and need clean comment state

    **Example:**

    ```
    @coderabbitai resolve
    ```

    <Warning>
      Post this as a new top-level PR comment. `@coderabbitai resolve` is not supported in review-thread or inline replies.

      This will resolve ALL CodeRabbit comments. Make sure you've actually addressed the feedback before using this command.
    </Warning>
  </Accordion>
</AccordionGroup>

## Information and configuration

<AccordionGroup>
  <Accordion title="@coderabbitai configuration" icon="settings">
    **Description:** Displays the resolved CodeRabbit configuration settings, with comments that identify where settings came from (repository YAML, inherited central configuration, UI settings, defaults, global overrides, etc.). When <Hint type="configuration-inheritance" /> is enabled, source comments let you trace exactly which level each merged value originated from.

    **Usage:** Post as a comment in your pull request

    **When to use:**

    * Need to check current settings
    * Troubleshooting configuration issues
    * Want to export or share your configuration
    * Need to understand which configuration layer supplied a setting

    **Example:**

    ```
    @coderabbitai configuration
    ```
  </Accordion>

  <Accordion title="@coderabbitai generate configuration" icon="settings">
    **Description:** Creates a PR that adds the current resolved configuration as `.coderabbit.yaml` (or shows it if already present).

    **Usage:** Post as a comment in your pull request

    **When to use:**

    * Want to export current settings to a file
    * Share configuration with team members
    * Create a baseline configuration for the repository

    **Example:**

    ```
    @coderabbitai generate configuration
    ```
  </Accordion>

  <Accordion title="@coderabbitai emit path instructions" icon="list-checks">
    **Description:** Opens a pull request that adds suggested <Hint type="path-instructions" /> to your `.coderabbit.yaml`. CodeRabbit collects path-instruction suggestions generated over the past 7 days, merges the new ones into the `reviews.path_instructions` section, and opens a PR titled "Update CodeRabbit path instructions".

    **Usage:** Post as a comment in your pull request

    **When to use:**

    * You want to capture recurring review guidance as durable, path-scoped configuration
    * CodeRabbit has surfaced path-instruction suggestions that you want to apply in bulk
    * You want a reviewable PR rather than hand-editing `.coderabbit.yaml`

    **Example:**

    ```
    @coderabbitai emit path instructions
    ```

    **How it works:**

    1. Reads path-instruction suggestions from the past 7 days, both those surfaced after reviews and those produced by CodeRabbit's path-instruction agent.
    2. If no recent agent suggestions exist, it runs the path-instruction agent inline to generate them.
    3. Merges the suggestions into your existing `.coderabbit.yaml` (or creates one if none exists), preserving your existing comments, formatting, and other settings. Entries are deduplicated by path, so existing path instructions are never overwritten.
    4. Opens a pull request with the updated configuration, including a summary of how many suggestions came from each source.

    **What you might see back:**

    * **A pull request** when new path instructions are added.
    * **No changes** when all recent suggestions already exist in your configuration.
    * **No suggestions** when no path-instruction suggestions were found in the last 7 days.

    <Info>
      The alias `emit path-instructions` is also supported.
    </Info>

    <Info>
      This command requires a platform that supports opening pull requests. Generating new suggestions with the path-instruction agent requires a Pro plan with an active subscription.
    </Info>
  </Accordion>

  <Accordion title="@coderabbitai help" icon="circle-question-mark">
    **Description:** Shows a quick reference guide of available commands

    **Usage:** Post as a comment in your pull request

    **When to use:**

    * Need a quick reminder of available commands
    * Want to see command syntax
    * Sharing CodeRabbit capabilities with team members

    **Example:**

    ```
    @coderabbitai help
    ```
  </Accordion>
</AccordionGroup>

## Command reference table

For quick reference, here's a summary of all available commands:

| Command                                   | Type       | Description                       | Location       |
| ----------------------------------------- | ---------- | --------------------------------- | -------------- |
| `@coderabbitai review`                    | Review     | Incremental review of new changes | PR comment     |
| `@coderabbitai full review`               | Review     | Complete review from scratch      | PR comment     |
| `@coderabbitai pause`                     | Control    | Temporarily stop reviews          | PR comment     |
| `@coderabbitai resume`                    | Control    | Restart reviews after pause       | PR comment     |
| `@coderabbitai ignore`                    | Control    | Permanently disable reviews       | PR description |
| `@coderabbitai summary`                   | Content    | Regenerate PR summary             | PR comment     |
| `@coderabbitai generate docstrings`       | Content    | Generate function documentation   | PR comment     |
| `@coderabbitai generate unit tests`       | Content    | Generate test cases               | PR comment     |
| `@coderabbitai autofix`                   | Content    | Auto-apply review fixes           | Review comment |
| `@coderabbitai autofix stacked pr`        | Content    | Auto-fix via stacked pull request | Review comment |
| `@coderabbitai fix-ci`                    | Content    | Fix CI via stacked pull request   | PR comment     |
| `@coderabbitai fix-ci commit`             | Content    | Fix CI via direct commit          | PR comment     |
| `@coderabbitai generate sequence diagram` | Content    | Create visual diagram             | PR comment     |
| `@coderabbitai approve`                   | Management | Resolve threads and approve PR    | PR comment     |
| `@coderabbitai resolve`                   | Management | Resolve all CR comments           | PR comment     |
| `@coderabbitai configuration`             | Info       | Show current settings             | PR comment     |
| `@coderabbitai generate configuration`    | Info       | Create/export configuration file  | PR comment     |
| `@coderabbitai emit path instructions`    | Info       | Suggest path instructions via PR  | PR comment     |
| `@coderabbitai help`                      | Info       | Show command reference            | PR comment     |

## Related configuration

Many of these commands are affected by your CodeRabbit configuration. Key configuration options include:

* **Automatic reviews**: `reviews.auto_review.enabled`
* **Docstring generation**: `reviews.finishing_touches.docstrings.enabled`
* **Unit test generation**: `reviews.finishing_touches.unit_tests.enabled`
* **Fix CI failures**: `reviews.finishing_touches.fix_ci.enabled`
* **Resolve Merge Conflicts**: `reviews.finishing_touches.resolve_merge_conflict.enabled`
* **High-level summaries**: `reviews.high_level_summary`
* **Sequence diagrams**: `reviews.sequence_diagrams`

For complete configuration options, see [Configuration Reference](/reference/configuration).


# Security Agent
Source: https://docs.coderabbit.ai/security-agent/index

Scan GitHub, GitLab, Azure DevOps, and Bitbucket Cloud repositories for potential security issues across the committed codebase.

<GitHubBadge /> <GitLabBadge /> <AzureBadge /> <BitbucketBadge /> | <EarlyAccessBadge href="/support" />

<Info>
  Security Agent is a stand-alone product and is not part of CodeRabbit's Pro, Pro+, or Enterprise plans.
</Info>

Security Agent scans a committed codebase for code vulnerabilities beyond the current pull request diff. Results appear in the CodeRabbit app under **Security > Agent Findings**, where you can inspect evidence, filter findings, export results, and start supported fixes.

Use Security Agent when you want a repository-level view of application security risk. It runs against the repository's configured scan branch, or the provider default branch when no custom branch is selected.

<Info>
  Security Agent findings are separate from **Pull Requests > PR Findings**. PR Findings come from security issues raised during pull request review comments, while Agent Findings come from full-codebase scans.
</Info>

## How Security Agent works

Security Agent runs a multi-stage pipeline rather than matching fixed rules against a single file or diff:

* **Map** — CodeRabbit builds a model of the repository so it can reason across files and services, not just within one file.
* **Investigate** — Agents examine likely vulnerable code paths and infrastructure misconfigurations, then trace how data flows through the codebase.
* **Verify** — A separate verification step reopens the cited code paths and infrastructure evidence, then rejects speculative, test-only, dead-code, and unreachable cases before a finding is surfaced.

Deterministic scanners are used only as hints into this pipeline. Every finding is adjudicated against code evidence before it reaches you, which is why Security Agent can surface issues that rule-based tools cannot express — such as authorization bypass, IDOR, and business-logic flaws — with less noise.

## What Security Agent scans for

Security Agent looks for practical code-level vulnerabilities across the selected repository. Findings can include issues such as injection, authorization bypass, IDOR, broken authentication, CSRF, sensitive data exposure, information disclosure, XSS, SSRF, open redirects, insecure deserialization, CORS issues, security misconfiguration, path traversal, weak cryptography, denial of service, LLM security risks, and other code security problems. LLM and AI application risks include prompt injection, improper output handling, and excessive agency.

Full-codebase scans also cover infrastructure-as-code misconfigurations in Terraform, OpenTofu, Kubernetes, Helm, Dockerfile, Containerfile, Bicep, CloudFormation, ARM templates, and Compose files. This coverage runs automatically without customer configuration. Repositories composed only of infrastructure files enter the same Map, Investigate, and Verify pipeline.

Each accepted finding is grounded in code evidence. When available, CodeRabbit shows:

* Category and severity
* Repository, file path, and line range
* CWE
* Description and recommendation
* Reachability: **External**, **Internal**, **Unreachable**, or **Unknown**
* Reachability call stack when CodeRabbit can trace a path from an entry point to the risky code
* Inline code context or a permalink to the scanned commit
* Status and fix status

Reachability affects how severity is presented. External and Unknown reachability leave the original severity unchanged, Internal reachability lowers severity by one level, and Unreachable findings are capped at low severity. Unknown means CodeRabbit could not determine the path confidently enough, not that the issue is exploitable.

## Run a scan

You can start a Security Agent scan from the Security area in CodeRabbit.

<Steps>
  <Step title="Open Security">
    In the CodeRabbit app, go to [Security](https://app.coderabbit.ai/security/overview).
  </Step>

  <Step title="Start a scan">
    Click **Scan repositories**.
  </Step>

  <Step title="Choose repositories">
    Select one or more supported repositories.
  </Step>

  <Step title="Choose Code findings">
    Select **Code findings** to run Security Agent. You can select other scan types in the same dialog when you also want dependencies, SBOM, or secrets scans.
  </Step>

  <Step title="Review the estimate">
    If code-scan credits apply, review the estimated total and per-repository credits before starting. Estimates are based on the effective scan branch and configured code path exclusions. For cap authorization behavior, see [Availability and limits](#availability-and-limits).
  </Step>

  <Step title="Start the scan">
    Click **Start**. Each selected scan type runs for every selected repository.
  </Step>
</Steps>

If one selected scan target is already running or blocked, other selected targets can still dispatch.

### Scan status and activity

Each scan target moves through **pending**, **running**, **completed**, and **failed** states. A scan that runs for too long is marked failed with a message telling you it timed out or was interrupted, so you can run it again.

`completed` describes the execution envelope only. A `completed` Deep Scan full-codebase scan can still show `partial` coverage and follow-up work when repository traversal or the coverage analysis reaches a file cap.

The activity log records each run's target, scan ID, status, duration, repository, who triggered it, and when. Completed and failed activity entries link to the matching repository scan tab: completed runs open that scan's results, while failed runs open the failed scan's status.

## Configure repository scan settings

Repository security settings control which branch Security Agent scans, which code paths it skips, and whether scans run on a schedule.

### Scan branch

For GitHub repositories, choose the branch CodeRabbit should scan. **Provider default** follows the repository default branch. Selecting the default branch clears the custom branch setting.

If a configured branch is deleted, CodeRabbit warns that future scans will fail until you select another branch or return to the provider default.

### Path exclusions

Use **Path Exclude** filters to skip code paths that should not count toward Security Agent scans.

* Add one repository-relative path or glob per line.
* You can add up to 100 excluded paths per repository.
* Each excluded path can be up to 512 characters.
* Absolute paths, Windows absolute paths, parent traversal, and control characters are rejected.
* Backslashes are normalized to `/`, leading `./` is removed, and duplicate entries are ignored.

The settings page also exposes path exclusions for Secrets scans. Dependency and SBOM path filters are not currently exposed in the customer-facing settings page.

### Repository context

Repository context is optional architecture and business-domain background that helps Security Agent interpret the repository during full-codebase scans. From **Security**, select **Repositories**, open the repository's settings, and enter up to 4,000 characters in the **Context** field under **AI Deep Scan**. The saved context applies to every subsequent scan for that repository across the Map, Investigate, and Verify phases.

Repository context is available for supported repositories to users who can edit Security Agent repository settings. Leaving the field empty removes the stored context. Edits are saved and reset alongside the repository's other security settings.

Context informs how Security Agent interprets the code, but it cannot override scan instructions. Security-relevant claims are still validated against the code before findings are reported.

### Recurring schedules

Set a recurring full scan schedule per repository when you want CodeRabbit to scan on specific days and times.

Schedules use 24-hour time, an IANA timezone, selectable days of the week, and selectable scan types: Code, Dependencies, SBOM, and Secrets. Each scheduled scan target dispatches independently. If one target is already active, CodeRabbit skips that target while other runnable targets can still start.

Automatically dispatched full scans follow the same authorization and charging behavior described in [Availability and limits](#availability-and-limits). A scheduled full scan does not run if its estimated code-scan credit charge exceeds the remaining monthly allowance or cap.

### Security repository Learnings

The **Learnings** tab in a repository's Security settings lists saved accepted-risk guidance for Security Agent scans. Each entry shows its guidance text, file scope, and last-updated time. Repository-wide guidance displays **All files** as its scope.

You can view, edit, and delete saved entries. The tab shows up to 100 of the newest entries for each repository. These Security repository Learnings are separate from the [Learnings used in pull request reviews](/knowledge-base/learnings).

<Info>
  Viewing saved guidance requires Security read access. Editing guidance requires Security write access, and deleting guidance requires Security delete access.
</Info>

### Scan Git History for secrets

**Scan Git History** is available under the **Secrets Scanner** repository settings at **Security > Repositories > repository settings**. It applies to secrets scans and is disabled by default.

When enabled, Secrets Scanner inspects commits reachable from the configured scan branch and surfaces credentials that existed in earlier commits but are absent from the latest code. Enabling it can materially increase scan duration.

Historical secret findings show the source commit where the secret was detected. Code context loads from that commit rather than the latest scan state.

## The Security area

The **Security** section in the CodeRabbit sidebar organizes the Security Suite into these pages:

* **Overview** — a dashboard of your latest security posture.
* **Repositories** — repository scan settings, including branch, path exclusions, and schedules.
* **Learnings** — saved accepted-risk guidance for Security Agent scans in each repository.
* **Agent Findings** — code vulnerability findings from Security Agent.
* **Dependencies** — vulnerable dependency findings.
* **SBOM** — resolved component inventory and license visibility.
* **Secrets Detection** — leaked secrets and hardcoded credential findings.
* **PR Findings** — security issues raised during pull request reviews.
* **Activity Log** — a record of scan runs.

The **Overview** dashboard summarizes your latest known security posture across Agent Findings, Secrets, Dependencies, and SBOM. It shows:

* Summary cards with finding counts, affected repository count, and critical/high totals for each scan type.
* A **Security Trend** chart of findings by severity over time, filterable by repository and finding type across 30-, 90-, and 180-day ranges.
* **Latest Findings**, the most recent critical and high Agent Findings with severity, category, repository, and file location.
* **Highest-Risk Repositories**, ranked by critical and high findings.

## Work with Agent Findings

The Agent Findings page gives you a triage surface for code findings from completed scans.

You can:

* Filter by repository, severity, category, and search text
* Open a finding drawer with evidence, recommendation, reachability, code context, and available actions
* Open **Share**, then choose **For humans** to copy the existing direct link to the finding to your clipboard, or **For agents** to copy self-contained, agent-ready Markdown to your clipboard
* Ignore a vulnerability warning with an optional accepted-risk note and scope
* Export findings as CSV, JSON, or SARIF
* Start **Fix with AI** for supported vulnerability findings
* View a generated fix pull request when one exists
* Retry failed fixes

**For agents** copies an agent-ready Markdown summary with the repository and relevant details such as severity or status, location, advisory details, description, and recommendation when present, so you can hand off to your coding agent without including the CodeRabbit app URL; it is available for code vulnerability, dependency vulnerability, and secret findings in their respective finding drawers.

Ignoring a finding changes its status. For code vulnerabilities, you can optionally save accepted-risk guidance with one of three scopes: **Auto**, **Current file**, or **Entire repository**. Auto infers whether the guidance should apply to the finding's file or the whole repository and defaults to the current file when the scope is unclear. Guidance capture does not apply when ignoring dependency or secret findings. The finding is still ignored if saving the optional guidance fails.

In later scans, Security Agent reuses saved guidance only to suppress equivalent findings when both the behavior and scope match. File-scoped guidance applies only to the exact repository-relative file, while repository-scoped guidance applies across the entire repository. A later scan can reopen an ignored finding when the saved guidance does not apply.

Fix with AI cannot start when another fix for the same finding is already pending or running, and is available only for findings from the current scan commit; historical findings remain available for investigation but cannot use Fix with AI. It opens a pull request for supported fixes; CodeRabbit does not merge those changes automatically.

## Related Security scans

The Security area also includes other committed-codebase scan targets. You can start them from the same run dialog, but each has its own source and findings surface.

| Scan target       | What it checks                                                       |
| ----------------- | -------------------------------------------------------------------- |
| Agent Findings    | Code vulnerability findings from Security Agent                      |
| Secrets Detection | Leaked secrets and hardcoded credential findings                     |
| Dependencies      | Known vulnerable dependencies from supported manifests and lockfiles |
| SBOM              | Resolved component inventory and license visibility                  |

### Secrets verification status

Secrets Detection assigns a verification status to help you prioritize credentials confirmed to be live while keeping unverified findings visible.

* **Verified Active**

  The scan confirmed that the credential is currently live.

* **Verified Inactive**

  The credential is invalid or has been revoked.

* **Unknown**

  Verification data is missing, unrecognized, or inconclusive. Existing findings without verification data also appear as Unknown.

In the Secrets findings list, you can filter findings by Verified Active, Verified Inactive, and Unknown verification status.

Agent Findings can be exported as CSV, JSON, and SARIF. SBOM exports support CycloneDX JSON, CycloneDX XML, SPDX JSON, and CSV. Secrets Detection appears as a separate scan surface so secret triage stays separate from Agent Findings. Fix with AI also supports eligible dependency and secrets findings in their respective scan surfaces.

## Availability and limits

Security Agent is available for GitHub (including GitHub Enterprise), GitLab (including self-hosted GitLab), Azure DevOps, and Bitbucket Cloud repositories. Repository security settings, code context links, and Fix with AI are available on these supported providers. Bitbucket Data Center is not currently supported.

Some capabilities remain GitHub-only: selecting a custom scan branch, scheduling full scans, and scanning Git history for secrets.

New workspaces include a free trial with 10 code scans.

Before a full code scan (Deep Scan) subject to usage billing runs, CodeRabbit authorizes it by checking the estimated code-scan credit charge against the remaining monthly allowance or cap. Pending and running full scans reserve their estimated code-scan credit charge against the remaining monthly allowance or cap, so a new scan does not run if completed charges plus those reservations plus its estimate would exceed that limit. If the estimate exceeds the remaining allowance or cap, the scan does not run and a message indicates that the estimated Deep Scan charge is too high. Code-scan credits are charged only after the scan completes successfully.

Security Agent does not prove that a repository has no vulnerabilities. It reports findings that CodeRabbit can support with code evidence, and it preserves **Unknown** reachability when CodeRabbit cannot determine a path confidently enough.

Code-scan credit estimates are estimates. They account for the effective scan branch and configured code path exclusions, but they should not be treated as a final invoice.

## What's next

<CardGroup>
  <Card title="Repository settings" href="/guides/repository-settings" icon="settings">
    Configure repository-level settings that control how CodeRabbit analyzes each repository.
  </Card>

  <Card title="Linters and security analysis tools" href="/tools" icon="wrench">
    Browse the static analysis and security tools CodeRabbit can run during pull request reviews.
  </Card>

  <Card title="OSV-Scanner" href="/tools/osv-scanner" icon="shield-alert">
    See how CodeRabbit uses OSV-Scanner for dependency vulnerability analysis in code reviews.
  </Card>
</CardGroup>


# CodeRabbit Reverse Tunnel
Source: https://docs.coderabbit.ai/self-hosted/coderabbit-reverse-tunnel

Connect CodeRabbit to a private-network Git platform without opening inbound network access. Available for GitHub Enterprise Server and self-managed GitLab.

<GitHubBadge title="GitHub Enterprise Server" href="/platforms/github-enterprise-server" /> <GitLabBadge title="GitLab Self-Managed" href="/platforms/self-hosted-gitlab" /> | <EnterprisePlanBadge />

The **CodeRabbit Reverse Tunnel** is a private-network connectivity option for Enterprise customers who cannot expose their Git platform to the public internet. A CodeRabbit-provided Connector runs inside your network, dials out to CodeRabbit over WebSocket Secure (WSS), and carries CodeRabbit-initiated API and HTTPS Git traffic through that existing outbound session.

## Intended use

The CodeRabbit Reverse Tunnel is intended for Enterprise customers with the constraints defined below:

* Your GitHub Enterprise Server or self-managed GitLab instance runs in a private subnet, private cloud account, or on-premises network.
* Your Git platform cannot receive inbound connections from CodeRabbit or the public internet.
* Your security policy does not allow inbound firewall exceptions, vendor IP allowlisting on the Git platform side, or external PrivateLink peering.

Use this option when CodeRabbit must review pull requests on a Git instance that has no public endpoint, no inbound firewall exceptions, no vendor IP allowlisting, and no PrivateLink or peering path.

<Info>
  For instances that CodeRabbit can already reach directly, use the standard [GitHub Enterprise Server guide](/platforms/github-enterprise-server) or [self-managed GitLab guide](/platforms/self-hosted-gitlab). At the moment there is no self-service interface; reverse tunnel setup is handled by [CodeRabbit Sales](https://www.coderabbit.ai/contact-us/sales) or [Support](/support).
</Info>

## Components

The CodeRabbit Reverse Tunnel has four components:

1. **Reverse Tunnel Gateway** — A CodeRabbit-managed edge service that accepts Connector sessions and exposes tenant-scoped HTTPS routes for CodeRabbit services to call into.

2. **Reverse Tunnel Connector** — A lightweight, CodeRabbit-provided container that runs inside your network and establishes a long-lived outbound connection (WSS over HTTPS) to the Reverse Tunnel Gateway. CodeRabbit then sends runtime requests — clone, read pull requests, post review comments — over this pre-established tunnel. The Connector dials out from your network; no inbound ports are opened.

3. **Route key** — A unique, opaque routing identifier issued by CodeRabbit for your tenant. CodeRabbit uses the route key to direct runtime traffic to the correct Connector session, so your private Git platform address is never exposed in the URL path.

4. **Connector token** — A bearer token issued by CodeRabbit for your tenant. Multiple Connector replicas can share the same token.

## Architecture

<Frame>
  <img alt="CodeRabbit Reverse Tunnel architecture showing the inbound path from CodeRabbit into a private Git platform through the Reverse Tunnel Gateway and Connector, and the outbound webhook path from the Git platform through the customer NAT gateway to the CodeRabbit webhook receiver" />
</Frame>

The CodeRabbit Reverse Tunnel uses two connectivity paths between the customer network and the CodeRabbit cloud. Direction is described from the customer's perspective:

| Direction                                     | Purpose                                                                                                                                         | Network path                                                                                                                                                                                                                              |
| --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Inbound**<br />(CodeRabbit → Git platform)  | Clone repositories over HTTPS, read pull requests, fetch files and commits, create reviews, post comments, and update checks or commit statuses | CodeRabbit services call the Reverse Tunnel Gateway, which forwards the request into your network over the long-lived WSS session opened by the Reverse Tunnel Connector. The Connector then makes an internal call to your Git platform. |
| **Outbound**<br />(Git platform → CodeRabbit) | Deliver webhook events such as pull request opened, synchronized, reviewed, or commented                                                        | Your Git platform sends standard HTTPS webhooks outbound through the customer NAT gateway to the CodeRabbit webhook receiver.                                                                                                             |

The tunnel carries only CodeRabbit-initiated inbound traffic. Outbound webhooks continue to flow through your existing customer NAT and use the webhook secret or token configured for that platform.

## PR review flow through the Tunnel

End-to-end view of how a single pull request moves through the CodeRabbit Reverse Tunnel. None of the network mechanics are visible to the developer — from their point of view, CodeRabbit simply reviews their change.

<Frame>
  <img alt="Sequence diagram showing a developer opening a pull request on a private Git platform, the Git platform sending a webhook outbound through the customer NAT to the CodeRabbit webhook receiver, CodeRabbit reading the change back through the Reverse Tunnel Gateway and Connector, and review comments being posted back the same way" />
</Frame>

* **Developer opens a pull request** inside your private Git platform.
* **Your Git platform sends a webhook to CodeRabbit** outbound through your customer NAT.
* **CodeRabbit reads the pull request through the tunnel.** The Reverse Tunnel Gateway routes the request over the existing WSS session; the Reverse Tunnel Connector forwards it to your Git platform and streams the response back.
* **CodeRabbit runs the review** and writes the feedback.
* **CodeRabbit posts the comments back through the same tunnel**, and the review appears on the pull request.

## High availability

Run at least two connector replicas for production.

All replicas for the same tenant normally share the same gateway URL, connector token, route key, target base URL, and origin TLS policy. By default, the gateway tracks the live connector sessions for the route and uses an active session for each new request. Round-robin routing is also supported with `REVERSE_TUNNEL_DIRECT_CONNECTOR_ROUTING=true`.

Important behavior:

* New requests can use another live connector after a connector disconnects.
* In-flight requests are not transparently moved to another connector.
* The connector reconnects automatically with exponential backoff after a lost WSS session.

## Capacity and limitations

The tunnel streams request and response bodies with backpressure, so it supports large HTTPS clone/fetch traffic. Capacity is still bounded by your connector replicas, network egress, and Git platform origin capacity.

| Area             | Behavior                                                                                                                                                                                                                                                                                                                                                                                                                  |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Concurrency      | The gateway enforces a per-connector concurrent stream limit. CodeRabbit provides the active limit during onboarding. Add connector replicas to increase available concurrency.                                                                                                                                                                                                                                           |
| Buffering        | The connector does not provide durable buffering while offline. If a connector is down, new runtime calls to your Git platform fail until another connector is available.                                                                                                                                                                                                                                                 |
| Git protocol     | HTTPS only.                                                                                                                                                                                                                                                                                                                                                                                                               |
| Platform support | Available for **GitHub Enterprise Server** and **self-managed GitLab**. GitLab reverse-tunnel setup requires contacting [CodeRabbit Support](/support) (existing customers) or [CodeRabbit Sales](https://www.coderabbit.ai/contact-us/sales) (new customers). For information about support for Azure DevOps and other Git platforms please contact [CodeRabbit Sales team](https://www.coderabbit.ai/contact-us/sales). |

## FAQ

<AccordionGroup>
  <Accordion title="Does CodeRabbit need inbound access to our network?">
    No. The connector opens an outbound WSS session to CodeRabbit. CodeRabbit-initiated Git platform traffic rides over that existing session.
  </Accordion>

  <Accordion title="Can we run multiple connector pods?">
    Yes. Multiple connector replicas can serve the same route key. Default routing uses an active live session for each new request, and round-robin routing is also supported with `REVERSE_TUNNEL_DIRECT_CONNECTOR_ROUTING=true`. Give each live replica a unique `REVERSE_TUNNEL_CONNECTOR_ID`.
  </Accordion>

  <Accordion title="Can we restrict outbound destinations?">
    Yes. The connector needs outbound HTTPS to the CodeRabbit gateway and HTTPS reachability to your Git platform origin. Your Git platform needs outbound HTTPS to the CodeRabbit webhook receiver.
  </Accordion>

  <Accordion title="What happens if the tunnel drops during a review?">
    The connector reconnects automatically. In-flight requests fail and are retried only when CodeRabbit can safely retry the operation.
  </Accordion>

  <Accordion title="Can this forward other internal services?">
    No. The tunnel is scoped to CodeRabbit HTTP(S) and HTTPS Git traffic for the configured Git platform. It is not a general-purpose private-network proxy.
  </Accordion>
</AccordionGroup>

## What's next

<CardGroup>
  <Card title="GitHub Enterprise Server setup" href="/platforms/github-enterprise-server" icon="github">
    Create the OAuth App, GitHub App, webhook secret, and permissions used by the GHES integration.
  </Card>

  <Card title="Self-managed GitLab setup" href="/platforms/self-hosted-gitlab" icon="gitlab">
    Review the standard self-managed GitLab requirements used with reverse-tunnel onboarding.
  </Card>

  <Card title="Platform overview" href="/platforms/overview" icon="git-branch">
    Review all supported Git platforms and choose the right integration path for your environment.
  </Card>
</CardGroup>


# Self-hosted CodeRabbit
Source: https://docs.coderabbit.ai/self-hosted/overview

Run CodeRabbit inside your own infrastructure for full control over code, data, and network access. Available for Enterprise customers on GitHub, GitLab, Azure DevOps, and Bitbucket Data Center.

<AllPlatformsBadge /> | <EnterprisePlanBadge />

Self-hosted CodeRabbit runs the CodeRabbit review agent inside your own infrastructure instead of CodeRabbit's cloud. Your source code, pull request data, and review traffic stay within a network boundary that you control, which makes self-hosting a good fit for teams with strict data-residency, compliance, or air-gapped requirements.

<Info>
  The self-hosted option is available for CodeRabbit Enterprise customers with 500 or more user seats. [Contact CodeRabbit Sales](https://www.coderabbit.ai/contact-us/sales) to learn more about CodeRabbit Enterprise.
</Info>

## Who it's for

Self-hosting is intended for organizations that cannot send code or metadata to an external service, or that must keep CodeRabbit inside a private network. Common reasons teams choose self-hosting include:

* **Data residency and privacy** — code and pull request content never leave your environment.
* **Compliance** — meet internal security policies and regulatory requirements that prohibit third-party cloud processing.
* **Network isolation** — deploy alongside Git platforms that have no public endpoint or inbound access.
* **Bring your own model** — connect CodeRabbit to your own large language model provider or account.

## How it works

CodeRabbit ships as a container image that you run in your own environment — on a server, in a container platform, or as a serverless workload. At a high level:

* The CodeRabbit agent and its Git-platform integration run inside your infrastructure, connecting to your Git platform using a dedicated service account or app.
* Your Git platform sends pull request events to the agent, and the agent posts reviews and comments back.
* The agent sends review prompts, source code, and related data to your configured large language model provider for inference.
* Pull request orchestration and review results stay within your environment; code and prompt data leave it only to reach the LLM provider.

Detailed configuration and deployment instructions are provided to Enterprise customers during onboarding.

## Supported platforms

Self-hosted CodeRabbit supports the major Git platforms used in enterprise environments:

* GitHub Enterprise Server
* GitLab self-managed
* Azure DevOps
* Bitbucket Data Center

## Private-network connectivity

If your Git platform cannot accept inbound network access from CodeRabbit, the CodeRabbit Reverse Tunnel provides a private-network connectivity option that keeps all connections outbound from your network.

## Get started

Self-hosted deployment is set up together with the CodeRabbit team. [Contact CodeRabbit Sales](https://www.coderabbit.ai/contact-us/sales) to get started, or reach out to [CodeRabbit Support](/support) if you are an existing customer with deployment questions.

## What's next

<CardGroup>
  <Card title="CodeRabbit Reverse Tunnel" href="/self-hosted/coderabbit-reverse-tunnel" icon="network">
    Connect CodeRabbit to a private-network Git platform without opening inbound network access.
  </Card>

  <Card title="Platform overview" href="/platforms/overview" icon="git-branch">
    Review all supported Git platforms and choose the right integration path for your environment.
  </Card>

  <Card title="Contact sales" href="https://www.coderabbit.ai/contact-us/sales" icon="mail">
    Talk to the CodeRabbit team about Enterprise plans and self-hosted deployment.
  </Card>
</CardGroup>


# Admin roles and security
Source: https://docs.coderabbit.ai/slack-agent/admin-and-security

Understand global admin, automation admin, and scope admin permissions, usage visibility, and how CodeRabbit Agent for Slack keeps private conversation knowledge isolated.

Control who can configure, who can see, and what stays private. CodeRabbit Agent for Slack uses both Slack-native admin status and CodeRabbit-specific roles. Everyone in the workspace can sign in, but elevated access is required for workspace-wide settings and some web app surfaces.

## Global, automation and scope admins

### Global admins

Global admins are the people who can manage the workspace as a whole.

They include:

* Native Slack admins
* Slack workspace owners and primary owners
* Users with the CodeRabbit `cr_admin` override

### Automation admins

Automation admins are CodeRabbit Agent users who can help manage automations without receiving full workspace-admin access. Workspace admins assign this role from **Slack Settings** > **Workspace Users**.

When Automation admin management is enabled, Automation admins can view automation admin surfaces and manage same-workspace automations. Any linked workspace user can create automations, but Automation admins can manage more than their own created automations when this setting is enabled. They cannot manage the full workspace, reset workspace connections, manage users, or administer scopes unless they also have another role that grants those permissions.

### Scope admins

<Hint type="scope">Scope</Hint> admins can manage only the scopes assigned to them. They can tune repositories, connections, spend settings, and channel targeting for those scopes, but they cannot manage the full workspace or admin-only web surfaces such as Automations, Sandboxes, or workspace user management.

<Info>
  Scope admins cannot edit the Base Scope. The Base Scope remains reserved for global admins, although scope admins can still view it in read-only mode.
</Info>

## What each role can do

<Info>
  Global admins have full access to all workspace actions and settings. Every action listed in the table below is always available to global admins regardless of any other configuration.
</Info>

| Action                                                  | Automation admin                                 | Scope admin         | Member                   |
| ------------------------------------------------------- | ------------------------------------------------ | ------------------- | ------------------------ |
| Sign in and access the UI                               | Yes                                              | Yes                 | Yes                      |
| View the Connections page                               | Yes                                              | Yes                 | Yes                      |
| Create or edit connections                              | No                                               | Yes                 | No                       |
| Create or delete scopes                                 | No                                               | No                  | No                       |
| View the Base Scope                                     | No                                               | Yes                 | No                       |
| Edit the Base Scope                                     | No                                               | No                  | No                       |
| Edit assigned scopes                                    | No                                               | Yes                 | No                       |
| Create automations                                      | Yes                                              | Yes                 | Yes                      |
| Edit, pause, resume, or delete automations              | Yes, when Automation admin management is enabled | No                  | Created automations only |
| Run immediately or stop a running channel automation    | Yes (channels only)                              | Yes (channels only) | Yes (channels only)      |
| Access the Sandboxes page in the web app                | No                                               | No                  | No                       |
| Manage workspace users or other workspace-wide settings | No                                               | No                  | No                       |
| Reset the workspace GitHub connection                   | No                                               | No                  | No                       |
| Delete the Slack or Discord workspace connection        | No                                               | No                  | No                       |

## Account Settings and account removal

The [Account Settings](https://agent.coderabbit.ai/account-settings) page is visible only to workspace (global) admins. Account Settings includes workspace-wide controls such as resetting the GitHub connection and permanently removing the CodeRabbit Agent account.

<Danger>
  Only workspace admins can access the **Danger Zone** controls in Account Settings, including **Delete account**. If you need to remove the account, sign in as a workspace admin before opening that page.
</Danger>

## Workspace activity visibility

Usage visibility is role-aware.

| Viewer           | What they can see                                                                                           |
| ---------------- | ----------------------------------------------------------------------------------------------------------- |
| Global admin     | All workspace activity                                                                                      |
| Automation admin | Automation surfaces and activity available through automation management, plus their own activity elsewhere |
| Scope admin      | Activity for the scopes they manage, plus their own activity elsewhere                                      |
| Member           | Their own activity                                                                                          |

## Knowledge Base privacy

Knowledge follows Slack privacy boundaries.

| Slack surface                             | Knowledge behavior                        |
| ----------------------------------------- | ----------------------------------------- |
| Public channels and other shared surfaces | Use the global workspace Knowledge Base   |
| Private channels                          | Use a private conversation Knowledge Base |
| DMs and group DMs                         | Use a private conversation Knowledge Base |

Agent-authored Skills follow these same public and private conversation boundaries, so skills created in private channels, DMs, or group DMs stay isolated to that conversation.

Private knowledge can reference shared knowledge, but it should not be silently treated as shared workspace memory.

## Shared sandbox access

CodeRabbit Agent currently uses a shared workspace sandbox model rather than a private sandbox for every individual user.

That makes workspace governance important:

* Configuration changes affect the workspace environment
* Saved state can be reused across runs
* Admins should be deliberate about who can manage sandbox settings

## Good rollout practices

* Keep the Base Scope conservative at first
* Delegate scopes only where needed
* Review usage visibility before wider rollout
* Treat private channels and DM knowledge as materially different from shared workspace memory

## What's next

<CardGroup>
  <Card title="Slack permissions" href="/slack-agent/slack-permissions" icon="key-round">
    Review the Slack app and OAuth permissions CodeRabbit Agent requests and why they are needed.
  </Card>

  <Card title="Usage" href="/slack-agent/usage" icon="bar-chart-3">
    See what activity global admins, scope admins, and other members can inspect after rollout.
  </Card>

  <Card title="Sandboxes" href="/slack-agent/sandboxes" icon="box">
    Understand the shared sandbox model and how workspace-level execution state is managed.
  </Card>
</CardGroup>


# Automations
Source: https://docs.coderabbit.ai/slack-agent/automations

Create scheduled, webhook and message-triggered tasks that CodeRabbit Agent runs automatically.

Automations let CodeRabbit Agent run recurring or event-driven tasks for you. They can run on a **recurring schedule**, react to top-level **channel messages**, or run from a saved trigger such as a **webhook event**. You can create and edit scheduled automations in the web app automation editor, or create them conversationally from Slack. The web app also includes a `Triggers` tab for creating and managing trigger-based automations.

Each automation runs under the <Hint type="scope">scope</Hint> that applies to the channel or DM where it lives, so it only accesses the repositories, connections, and spend limits that surface is allowed to use.

## Examples

<Tabs>
  <Tab title="Scheduled check">
    A platform team wants CodeRabbit Agent to check for new security advisories every morning. An engineer goes to `#platform-eng` and sends:

    ```
    @coderabbit Check for new dependency vulnerabilities in the main branch
    and summarize anything critical. Run this daily.
    ```

    CodeRabbit Agent runs it once as a trial. After reviewing the output, the engineer confirms the automation. From that point on, a fresh thread appears in `#platform-eng` every morning with the results.
  </Tab>

  <Tab title="Message triggered">
    A reliability team wants CodeRabbit Agent to investigate each new Datadog alert posted in `#prod-alerts`. An engineer asks CodeRabbit to save an automation that watches new channel messages from the Datadog bot, enters `datadog` as the bot name, checks whether each alert looks real, and replies with the next step.

    From that point on, every matching top-level alert message in `#prod-alerts` gets a thread reply from CodeRabbit Agent. The automation stays in that same channel and only runs when a new message matches the saved trigger.
  </Tab>

  <Tab title="Webhook triggered">
    An on-call team wants CodeRabbit Agent to triage every new PagerDuty incident automatically. An admin creates a webhook trigger with PagerDuty as the source, connects PagerDuty, and selects the incident event types to receive. The agent instructions tell CodeRabbit to look up the affected service, check recent deploys, and post a summary with a suggested next step.

    After saving, CodeRabbit automatically creates and maintains the account-wide PagerDuty webhook subscription. From that point on, every selected incident event fires the trigger and CodeRabbit Agent posts a triage summary to the configured Slack channel. See [Connections](/slack-agent/connections) for setup and permissions.
  </Tab>
</Tabs>

## Creating an automation

Create a scheduled automation in the web app automation editor, or ask `@coderabbit` to create one in any channel or DM. In Slack, CodeRabbit Agent walks you through the setup in a thread. When you create an automation conversationally, it runs once as a **trial** before activating it, so you can review the output and iterate on the prompt before it starts running on its own.

Edited automation prompts and new scheduled automations can be saved directly from the web app. You do not need to start a Slack or Discord conversation just to schedule an automation or update its prompt.

<Info>
  In channels, you can also use the `/automations` slash command as a shortcut. Slash commands are not available in Direct Messages or threads.
</Info>

Any linked workspace user can create automations. Broader management remains permission-based: workspace admins can manage every automation and trigger, Automation admins can manage same-workspace automations when Automation admin management is enabled, and other users can manage the automations they created.

## Schedules

Recurring schedules are configured in the automation editor. Depending on the frequency you choose, schedule controls include interval, time, timezone, weekdays, and day of month.

Recurring automations can run:

* Every `x` minutes (10 minutes minimum)
* Hourly
* Daily at a selected time
* Weekly on selected weekdays
* Monthly on a selected day of the month

All schedules are timezone-aware.

## Triggers

Triggers are rules that start CodeRabbit Agent when a matching event arrives.

When you create an automation, you can save it as a paused draft or save and enable it immediately. A paused automation keeps its configuration but does not process new events until you enable it. Existing triggers can be switched between active and paused before saving changes.

Each automation trigger has:

* **Source**: where the event comes from
* **Matching rules**: which events should run the trigger
* **Agent instructions**: what CodeRabbit Agent should do when the trigger runs, including invoking an existing [durable skill](/agent/skills) so recurring or triggered runs reuse an established procedure
* **Destination**: where CodeRabbit Agent posts the result

### Slack channel messages

Slack channel message triggers run when a new top-level bot or app message appears in a selected channel. Instead of waiting for a clock-based schedule, they fire when a matching message arrives.

Use them when you want CodeRabbit Agent to react to repeated operational events, such as new alerts, queue-health posts, or deployment notices.

Slack channel message triggers support:

* **All new top-level bot or app messages** in the channel
* A required **Bot name** field that identifies the Slack bot CodeRabbit should respond to, such as `datadog`
* **Text filters** using case-insensitive substring matching

CodeRabbit Agent always replies in the triggering thread. In the current version, these triggers must use **Same thread** delivery.

Human-authored messages never fire this trigger type. A Slack channel message trigger only runs when a new top-level message comes from a bot or app whose name matches the trigger's Bot name field. `Run now` is also unavailable for these triggers. To test one, post a matching message in the channel from that bot or app.

### Webhook events

Webhook triggers run when an external service sends a matching webhook event:

* Any service can be connected via a **custom webhook**
* **Natively supported providers** (with pre-configured event types and payload schemas): Datadog, Sentry, PagerDuty, Linear, Jira, Fin (formerly Intercom), Zendesk, and Pylon

Providers with managed webhook connections, such as PagerDuty, let CodeRabbit provision and synchronize the provider's webhook subscription automatically. Managed PagerDuty webhooks support both Slack and workspace automations. The subscription is account-wide rather than scoped to a single PagerDuty service or team, and a global admin must connect PagerDuty. See [Connections](/slack-agent/connections) for setup and permissions.

Linear also uses a managed webhook connection. After you connect a Linear authorization with the required access, CodeRabbit automatically provisions and maintains the Linear webhook subscription. In the automation editor, select an existing Linear authorization or choose **Connect another Linear workspace** to add one. CodeRabbit preserves the automation draft during the OAuth handoff and returns to the editor with the new authorization selected. Webhook administration requires Linear `read`, `write`, and `admin` access. These authorizations are used only to administer triggers and are not available as destination connections. See [Connections](/slack-agent/connections) for setup and permissions.

For custom webhooks and providers without a managed webhook connection, CodeRabbit shows the webhook URL, required header, and sample payload to configure in the source service after you save the trigger. Webhook events are processed only when the trigger is active.

Webhook triggers can match by provider event type, by JSON payload fields, or both. If no matching rule passes, the event is dropped.

## Delivery

Each automation uses one of two delivery modes:

* **Fresh thread**: starts a new thread for every run
* **Same thread**: posts into the same thread each time (required for Slack channel message triggers, and also available when a recurring automation was created from a thread with a concrete root message)

## Deduplication

Webhook-triggered automations deduplicate repeated deliveries when the complete payload is byte-for-byte identical. A repeated delivery can match a trigger rule but still be intentionally ignored instead of starting another run.

* **Window**: Identical payloads are deduplicated for 1 minute.
* **Trigger another run**: Include a varying field, such as a timestamp, to make otherwise-identical payloads unique.

Deduplicated webhook deliveries return counters that distinguish matching events from accepted runs:

```json theme={null}
  {
    "ok": true,
    "matched": 1,
    "accepted": 0,
    "deduplicated": 1
  }
```

| Field          | Type    | Description                                                                                                                                                                                                                 |
| -------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `ok`           | Boolean | Whether the webhook request was processed successfully.                                                                                                                                                                     |
| `matched`      | Number  | Number of automation triggers whose matching rules matched the event. This can be positive while `accepted` is `0` when the delivery was deduplicated, meaning the event matched a trigger rule but no new run was started. |
| `accepted`     | Number  | Number of new automation runs started. This is `0` when a matching delivery is deduplicated.                                                                                                                                |
| `deduplicated` | Number  | Number of matching deliveries ignored because an identical payload was already received within the 1-minute window.                                                                                                         |

## Who can manage automations

| Action                           | Creator | Workspace admin | Automation admin                                 | Other channel members |
| -------------------------------- | ------- | --------------- | ------------------------------------------------ | --------------------- |
| Edit, pause, resume, or delete   | Yes     | Yes             | Yes, when Automation admin management is enabled | No                    |
| Run immediately (recurring only) | Yes     | Yes             | Yes (channels only)                              | Yes (channels only)   |
| Stop a running automation        | Yes     | Yes             | Yes (channels only)                              | Yes (channels only)   |

Automations in DMs can be edited, paused, resumed, or deleted by the creator, a workspace admin, or an Automation admin when Automation admin management is enabled. Stopping a running DM automation is limited to the creator or a workspace admin. Other users cannot run or stop DM automations.

Slack channel message automations cannot be run manually. To test one, post a matching message in the channel from the configured bot or app.

## Archival

Automations are archived automatically when their place becomes unavailable:

* **DM automations** archive when the DM becomes unusable, the creator leaves the workspace, or the required `same_thread` root message disappears.
* **Channel automations** archive when the channel is deleted, the bot loses access, or the required `same_thread` root message disappears.

Archived automations are distinct from paused automations and cannot be resumed.

## Managing automations in the web app

The Automations page in the web app is available to all workspace users. It lets you create and edit scheduled automations, manage triggers, review delivery mode and inspect recent run history.

Workspace admins can see every automation and trigger in the workspace. Automation admins can see and manage same-workspace automations when Automation admin management is enabled. Other users can see automations and triggers they created. Available actions depend on your permissions and the automation type.

## What's next

<CardGroup>
  <Card title="Scopes" href="/slack-agent/scopes" icon="shield">
    Control which repositories and tools automation runs can access.
  </Card>

  <Card title="Thread reviews" href="/slack-agent/thread-reviews" icon="file-search">
    Inspect the output of an automation run.
  </Card>

  <Card title="Usage" href="/slack-agent/usage" icon="chart-column-big">
    Review activity after automations run.
  </Card>

  <Card title="Agent skills" href="/agent/skills" icon="book-copy">
    Reuse established procedures in automation runs.
  </Card>
</CardGroup>


# Connections
Source: https://docs.coderabbit.ai/slack-agent/connections

Connect external tools and APIs to your workspace so CodeRabbit Agent for Slack can access issue trackers, documentation, observability, and custom integrations.

Connections give CodeRabbit Agent for Slack access to external tools like issue trackers, documentation, observability dashboards, MCP servers and custom APIs. Repository-provider credentials separately give the Agent access to repositories on supported providers. You configure both at the workspace level and assign them to the <Hint type="scope">scopes</Hint> that need them.

All signed-in users can open the Connections page from **Slack Settings** in the [web app](https://app.coderabbit.ai). Creating, editing, reconnecting, or deleting a connection requires either workspace admin access or assigned scope-admin access.

## How connections are organized

Each service type (Jira, Linear, Notion, Sentry, Google Drive, etc.) is a **connector**. A **connection** is a specific account or credential under that connector. You can create multiple connections for the same connector if different teams need separate accounts or permissions.

Repository-provider credentials are distinct from these third-party SaaS connections. They authorize repository access for a supported provider and are assigned to scopes alongside the repositories that the Agent can use.

## Repository-provider credentials

Add repository-provider credentials from the Connections page, then assign them to the Base Scope or another scope. CodeRabbit validates each credential before it can be used for repository access.

You can manage a provider credential throughout its lifecycle:

<Tabs>
  <Tab title="Add and validate">
    Enter the provider's required credential values and save them. CodeRabbit validates the credential before making it available for scope assignment.
  </Tab>

  <Tab title="Replace">
    Replace a stored credential when its token expires, its permissions change, or a different account should provide repository access. The provider-owned Base Scope credential can be replaced, but it cannot be deleted.
  </Tab>

  <Tab title="Assign">
    Assign a validated credential to the [Base Scope or a child scope](/slack-agent/scopes). Child scopes can inherit the Base Scope credential or select another stored credential for that provider.
  </Tab>

  <Tab title="Deactivate">
    Deactivating a stored GitLab, Bitbucket, or Azure DevOps credential requires global admin access. Before deactivating a credential, update any scopes that depend on it so they retain usable repository access.
  </Tab>
</Tabs>

## Supported connection categories

CodeRabbit Agent groups connections by category in the connection catalog:

| Category                | Services                                                                    |
| ----------------------- | --------------------------------------------------------------------------- |
| Docs & Knowledge        | Notion, Google Drive, OneDrive                                              |
| Issue tracking          | Jira, Linear, Asana                                                         |
| Observability           | Datadog, Sentry                                                             |
| Incident Management     | PagerDuty                                                                   |
| Development & DevOps    | GitHub, GitLab, GitLab Self-Hosted, Bitbucket Cloud, Azure DevOps, CircleCI |
| Product Analytics       | PostHog, Google Analytics, Google Ads, Google Search Console, Reddit Ads    |
| Marketing & advertising | Semrush                                                                     |
| Customer Data           | Customer.io                                                                 |
| CRM                     | HubSpot, Salesforce                                                         |
| Support                 | Zendesk, Fin (formerly Intercom), Pylon                                     |
| Sales Intelligence      | Amplemarket, Gong                                                           |
| Design                  | Figma, Canva                                                                |
| Infrastructure          | AWS, GCP                                                                    |
| Custom                  | MCP servers and APIs                                                        |

The exact catalog is product-defined and evolving. The important model is that connections are created once at the workspace level and then selected where needed.

## Add a connection

<Steps>
  <Step title="Open Connections in the web app">
    Go to [app.coderabbit.ai/slack](https://app.coderabbit.ai/slack), open **Connections**, and click **Add connection**. To add or edit a connection, you need either workspace admin access (Slack admin, workspace owner, or `cr_admin` holder) or assigned scope-admin access.
  </Step>

  <Step title="Pick a connector">
    Connectors are grouped under always-visible product categories, with every non-empty category shown at once. Search filters connectors by name while keeping matching results under their category headings. Select the service you want to connect. If your tool is not listed, choose **Custom** to connect it through an MCP server, API endpoint, or other custom integration.
  </Step>

  <Step title="Name and describe the connection">
    Give the connection a **name** (required, at least 2 characters) and an optional **description**. The name defaults to something like "Jira OAuth RO" but you can change it to anything that helps your team identify this connection.
  </Step>

  <Step title="Authenticate">
    The form shows one or more authentication tabs depending on what the connector supports:

    <Tabs>
      <Tab title="OAuth">
        1. Fill in any required fields (such as a site URL for Jira, customer IDs for Google Ads, etc.)
        2. **Save** the connection first
        3. Click **Connect \[Service]** to open the provider's authorization page in a new tab
        4. Authorize CodeRabbit in the provider
        5. You are redirected back, and the form shows a "Connected" status with the account email and granted scopes
      </Tab>

      <Tab title="API key / Credentials">
        Paste a token, API key, or structured credentials depending on the service:

        * **Most services**: A single API key or token field
        * **Amplemarket**: API key from Amplemarket Settings > API
        * **Semrush**: Dedicated read-only Semrush v4 API key
        * **Jira**: Atlassian account email + API token
        * **Gong**: Access key + access key secret
        * **Datadog**: API key + a site selector (e.g., datadoghq.com vs datadoghq.eu)

        Credential values are masked by default and stored securely.
      </Tab>

      <Tab title="MCP server">
        For custom tool integrations using the Model Context Protocol:

        1. Enter a **server name** and **server URL** (HTTP, HTTPS, or WebSocket)
        2. Choose a **transport type**: SSE, Streamable HTTP, or WebSocket
        3. Add an **auth header name** and **auth header value** if the server requires authentication
        4. Click **Discover tools** to check the server connection and load the tools it exposes. This discovery step is the connectivity check for MCP connections. If you change the server target later, click **Refresh tools** to discover tools again; this resets the previous tool selection.
        5. Select at least one tool CodeRabbit is allowed to use. MCP connections are deny-by-default, so **Save** stays disabled until you select a tool.

        See [MCP servers](/integrations/mcp-servers) for more on setting up MCP integrations.
      </Tab>
    </Tabs>
  </Step>

  <Step title="Test the connection">
    Click **Test** to validate that the credentials work. This is available for most connectors after saving. If the test fails, check your credentials or URL fields and try again.

    MCP server connections use the tool-discovery step in **Authenticate** as their connectivity check instead of the generic **Test** action. The **Test** action does not appear during MCP setup.
  </Step>

  <Step title="Save">
    Click **Save** to create the connection at the workspace level. The connection is now available but not yet assigned to any scope.
  </Step>

  <Step title="Assign to a scope">
    Go to [Scopes](/slack-agent/scopes) and add the new connection to the Base Scope or a scope. The connection does nothing until at least one scope includes it.
  </Step>
</Steps>

## Connector-specific notes

Some connectors require additional fields during setup:

| Connector             | Extra configuration                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Amplemarket           | API key. CodeRabbit uses the fixed Amplemarket API host, `https://api.amplemarket.com`, for connection testing and Agent access.                                                                                                                                                                                                                                                                                                                                       |
| Semrush               | Read-only access only. Direct connections use a Semrush v4 API key and default to `api.semrush.com`. Hosted MCP uses Semrush's canonical endpoint with OAuth or API-key authentication and its documented read-only tool set. Connection testing reads one owned project and may consume Semrush API units. Access depends on the customer's Semrush plan and key permissions.                                                                                         |
| Jira                  | Site URL (required for both OAuth and credential modes)                                                                                                                                                                                                                                                                                                                                                                                                                |
| Sentry                | Base URL (sentry.io or a regional variant)                                                                                                                                                                                                                                                                                                                                                                                                                             |
| PagerDuty             | Base URL (api.pagerduty.com or regional) and API key for direct REST access. PagerDuty also supports managed webhook connections for Automations. A user with permission to manage workspace integrations must connect it with a read/write General Access API key or a User Token whose user can manage webhook subscriptions. OAuth and MCP are not available for managed webhook setup; the resulting subscription is account-wide and shared across the workspace. |
| Datadog               | Site selector (datadoghq.com, datadoghq.eu, etc.)                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Google Ads            | Customer ID (required) and optional Login Customer ID for manager-account access                                                                                                                                                                                                                                                                                                                                                                                       |
| Google Search Console | Search Console property, such as a URL-prefix property or domain property                                                                                                                                                                                                                                                                                                                                                                                              |
| Reddit Ads            | Optional Reddit Ads account ID when the connection should target one account                                                                                                                                                                                                                                                                                                                                                                                           |
| Google Drive          | Service account JSON upload when using service account mode                                                                                                                                                                                                                                                                                                                                                                                                            |
| Customer.io           | Account region (`US` or `EU`) and either a Customer.io App API key for direct API access or the regional Customer.io MCP server URL                                                                                                                                                                                                                                                                                                                                    |
| Linear                | Policy mode choice: read-only or read-write (OAuth only; read-write is required to post comments and results). Enable **Manage Linear webhooks for automations** during setup to create a separate authorization with `read`, `write`, and `admin` access.                                                                                                                                                                                                             |
| AWS                   | Account ID (12 digits) + region                                                                                                                                                                                                                                                                                                                                                                                                                                        |

## How connections work with scopes

Creating a connection or provider credential does not grant CodeRabbit Agent access on its own. A connection only becomes available when a [scope](/slack-agent/scopes) explicitly includes it, and a provider credential must be assigned to a scope before the Agent can use that provider's repositories. This means you can configure access at the workspace level and then decide, scope by scope, which teams or channels should be able to use it.

For most service types, a scope can include one connection per service. MCP connections are the exception: they are additive, so a scope's MCP servers stack on top of those already included in the Base Scope.

The Connections list shows a **Scopes** column so admins can see where each connection is currently assigned. Linked scopes appear by name, and unassigned connections show **No scopes**. Search also matches linked scope names, which helps you find all connections used by a specific team, channel, or workflow.

## Who can do what

| Action                                                       | Global admin | Scope admin | Member |
| ------------------------------------------------------------ | ------------ | ----------- | ------ |
| View configured connections                                  | Yes          | Yes         | Yes    |
| Create or edit connections                                   | Yes          | Yes         | No     |
| Reconnect or rotate credentials                              | Yes          | Yes         | No     |
| Deactivate a stored repository-provider credential           | Yes          | No          | No     |
| Connect PagerDuty with REST credentials for managed webhooks | Yes          | No          | No     |
| Create a Linear authorization for managed webhooks           | Yes          | No          | No     |
| Delete connections                                           | Yes          | Yes         | No     |

## Reusing existing integrations and creating new ones

If your team already uses CodeRabbit for pull request reviews, you may already have integrations configured for services like Jira or Linear. CodeRabbit Agent can reuse those existing integrations as connections, so you do not need to set them up again from scratch.

An older Linear connection that was authorized by a person may prompt you to **Reconnect Linear as CodeRabbit** rather than use the standard connect action when you save or edit it. This is expected and does not require setting up the connection again from scratch. Reconnecting grants the connection read/write access, which CodeRabbit requires to publish automation comments and final results to Linear; without it, automation output can fail or remain attributed to the person who originally authorized the connection. After you reconnect, actions such as comments on Linear issues are attributed to the CodeRabbit application instead of the person who originally authorized the connection, while existing connections keep their current action attribution until they are reconnected.

To create a Linear authorization for managed webhooks, enable **Manage Linear webhooks for automations** during setup and edit the connection name if needed. CodeRabbit rejects an incomplete OAuth grant that is missing `read`, `write`, or `admin` access and asks you to reconnect. A complete authorization remains valid for Linear trigger administration but is excluded from automation destination choices. Create a separate eligible Linear destination connection when an automation must post results to Linear.

Managed PagerDuty webhooks require a PagerDuty REST connection with an API key. When an Automation needs PagerDuty webhook access, a user with permission to manage workspace integrations is directed to the Connections page to enter a read/write General Access API key or a User Token whose user can manage webhook subscriptions. Existing PagerDuty OAuth and MCP connections cannot be used for managed webhook administration.

Create a separate connection when the existing one does not fit: for example, when a different team needs its own account for the same service, when you want a stricter permission mode (read-only instead of read-write), or when a specific scope should only see a subset of a service's data.

## What's next

<CardGroup>
  <Card title="Scopes" href="/slack-agent/scopes" icon="shield">
    Decide which scopes should be allowed to use each connection.
  </Card>

  <Card title="Knowledge Base" href="/slack-agent/knowledge-base" icon="brain">
    Learn how CodeRabbit Agent uses connected systems to build and refine durable workspace knowledge.
  </Card>

  <Card title="MCP servers" href="/integrations/mcp-servers" icon="server">
    See the canonical docs for MCP-based integrations that CodeRabbit Agent can use through workspace connections.
  </Card>
</CardGroup>


# CodeRabbit Agent for Slack
Source: https://docs.coderabbit.ai/slack-agent/index

Bring AI-powered investigation, planning, and action into your Slack workspace with shared controls, persistent knowledge, and governed access.

<EarlyAccessBadge />

CodeRabbit Agent is an AI agent for **your entire SDLC** right in Slack. Investigate issues, generate implementation plans, discuss requirements with colleagues, pull in context from tools like Linear or Figma, and ask CodeRabbit to open a pull request — all from the channel or thread where the conversation is already happening, or in a direct conversation through the CodeRabbit Slack app. Context carries over between messages, durable facts are saved for future conversations, and every run can be reviewed after the fact.

<Warning>
  CodeRabbit application for Slack uses AI (Large Language Models) to generate responses, which may occasionally be inaccurate. Verify important information independently because responses do not constitute professional advice. Some features, including the AI Agent/Assistant, require a paid Slack plan and may not be available on free plans.
</Warning>

## What you can do

CodeRabbit Agent covers the full arc from investigation through implementation. Here are some of the things your team can do without leaving Slack.

<Tabs>
  <Tab title="Design and implement" icon="search">
    Ask the Agent to explore your codebase, review merged PRs and design documents, and surface the approach your team already follows. Once the investigation is complete, the Agent can suggest changes and open a pull request, all within the same Slack thread.

    <Frame>
      <img alt="Slack conversation where a developer asks CodeRabbit how rate limiting was handled on an existing endpoint, CodeRabbit finds the pattern across merged PRs and ADRs, recommends a lower default for the new endpoint, and opens a pull request after approval" />
    </Frame>
  </Tab>

  <Tab title="Triage and respond" icon="siren">
    Let the Agent pull telemetry from connected tools, correlate the data with recent code changes, and pinpoint the root cause. Once the team agrees on the fix, the Agent can open a surgical revert or patch PR.

    <Frame>
      <img alt="Slack conversation where a Datadog alert fires for checkout-service latency, CodeRabbit traces the bottleneck to an inventory-service scaling misconfiguration from a recent PR, and opens a revert PR on request" />
    </Frame>
  </Tab>

  <Tab title="Issues and PRs" icon="git-pull-request">
    When investigation turns into action, your team can continue the discussion in a thread — referencing context from connected tools like Jira, Linear, or Notion — and then ask CodeRabbit Agent to open a pull request that incorporates the full conversation, or create issues in your connected trackers.

    <Frame>
      <img alt="Slack conversation where a developer reports a red nightly build, CodeRabbit traces the failure to an openapi-gen v3.2.0 breaking type change, opens a PR to pin the dependency and update the type, and creates a Linear ticket for the future enum migration" />
    </Frame>
  </Tab>

  <Tab title="Automate tasks" icon="clock">
    Schedule tasks that CodeRabbit Agent can run [on a cadence](/slack-agent/automations) (*run this task every day*) or on each new **matching channel message**. Message-triggered automations can watch a channel for new alerts, notices, or other repeated inputs and reply in the triggering thread.

    <Frame>
      <img alt="Slack conversation where a user asks CodeRabbit to create a weekly Monday automation summarizing the most important customer-facing changes from the previous week, and CodeRabbit confirms and posts a preview of the weekly release update" />
    </Frame>
  </Tab>
</Tabs>

## Core Concepts

<Tabs>
  <Tab title="Context" icon="radar">
    The agent pulls your org's context together, across every tool and team conversation, into one place.

    * **Code** · The repositories, recent changes, and opened PRs.
    * **Tickets** · Jira, Linear, or wherever your team tracks work.
    * **Docs** · Notion pages, Confluence wikis, internal runbooks.
    * **Monitoring** · Datadog, PostHog, Sentry, and your observability stack.
    * **Cloud** · AWS, GCP, and the infra that runs under it all.

    Set up external tools and APIs through [Connections](/slack-agent/connections).
  </Tab>

  <Tab title="Memory" icon="brain">
    The agent builds a Knowledge base from Slack and your systems. Decisions, fixes, and patterns are captured as they happen and refined through daily use, so it reflects how your team actually works.

    * **Team knowledge** · Org-wide know-how, shared across teams, channels, and repos.
    * **Channel memory** · Retains team-specific patterns, runbooks, and conventions.
    * **Thread memory** · Carries forward everything from the current task.

    Learn more about how facts are stored and scoped in the [CodeRabbit Agent Knowledge Base](/slack-agent/knowledge-base).
  </Tab>

  <Tab title="Multi-player" icon="users">
    The agent works in a shared thread alongside your team. Anyone can guide, contribute, and move tasks forward. It learns from team conversations and stays aligned as work evolves.

    * **Synchronous** · The agent lives in the Slack thread.
    * **Steerable** · Redirect or expand the work mid-task.
    * **Resumable** · Stop, switch devices, come back tomorrow.

    See [Working in Slack](/slack-agent/use-in-slack) for how mentions, threads, and direct conversations work day to day.
  </Tab>

  <Tab title="Governance" icon="shield-check">
    Access, knowledge, and spend, scoped to the channel and user. Every run is explainable and attributed, so you see what the agent did, for whom, and what it cost.

    * **Access** · Scoped to who you are and what you do. See [Admin and security](/slack-agent/admin-and-security).
    * **Knowledge** · Scoped to the channel where it belongs.
    * **Tool control** · Decide which integrations are available where. See [Scopes](/slack-agent/scopes).
    * **Cost control** · Attributed by team and channel, not individual keys. See [Usage](/slack-agent/usage).
  </Tab>
</Tabs>

## Billing

CodeRabbit Agent is billed separately from CodeRabbit [review subscriptions](/management/plans). Your CodeRabbit plan covers pull request reviews, IDE and CLI reviews, and related features. CodeRabbit Agent usage is measured in **agent minutes**, the actual runtime each Agent run spends working, and is billed independently.

Agent billing resolves to a canonical billing subject: the workspace for supported cloud providers, with an organization-level fallback when no workspace exists. Slack and Discord connected to that subject share one paid Agent entitlement and one Agent-minute pool.

This means:

* A CodeRabbit Pro, Pro+, or Enterprise subscription does **not** include Agent usage.
* Agent charges are based on accumulated agent minutes, not on the number of seats or reviews in your CodeRabbit plan.
* You can use Agent without a paid CodeRabbit review plan, and vice versa.

Some Agent trials include a limited Agent Minutes grant. While that grant is active, CodeRabbit Agent uses the included minutes first. When the trial grant is exhausted or expires, CodeRabbit Agent pauses new work for the workspace until an admin activates the Agent plan.

During a trial, included Agent Minutes govern usage. After that, on an active Agent plan, [scope spend controls](/slack-agent/scopes#spend-controls) set billing-period guardrails for user-started runs and automation or trigger runs.

Track your agent-minute consumption from the [Usage](/slack-agent/usage) dashboard.

## What's next

Whether you are setting up CodeRabbit Agent for Slack for the first time or exploring what it can do, start at [app.coderabbit.ai/slack](https://app.coderabbit.ai/slack).

<CardGroup>
  <Card title="Quickstart" href="/slack-agent/onboarding" icon="rocket">
    Get CodeRabbit Agent for Slack running in your workspace in minutes.
  </Card>

  <Card title="Working in Slack" href="/slack-agent/use-in-slack" icon="messages-square">
    Learn how mentions and direct conversations work day to day.
  </Card>

  <Card title="Connections" href="/slack-agent/connections" icon="plug">
    Connect external tools like Jira, Notion, Sentry, and Google Drive to your workspace.
  </Card>
</CardGroup>


# Knowledge Base
Source: https://docs.coderabbit.ai/slack-agent/knowledge-base

Understand how CodeRabbit Agent for Slack stores facts, separates public and private knowledge, and lets teams review fact history.

The Knowledge Base stores facts so CodeRabbit Agent for Slack can reference them in future conversations instead of starting from scratch. Knowledge follows Slack's privacy model: public channels write to shared workspace knowledge, while private channels and DMs keep their own isolated facts. Durable facts preserve knowledge, while [skills](/agent/skills) preserve reusable procedures. Together, they give the Agent both the context to remember and an established way to perform recurring work.

## Three ways to build knowledge

* **Explicit capture**: Tell CodeRabbit Agent to remember a fact from a thread or provide it directly. The most common way to add knowledge.
* **Knowledge proposals**: After a run, the Agent may offer to save durable facts it discovered. Public channel proposals can auto-apply; private channels require confirmation.
* **Background curation**: A weekly workflow refreshes existing knowledge from connected upstream systems automatically.

## Public vs. private knowledge

Knowledge boundaries follow Slack privacy boundaries.

| Slack surface                       | Knowledge behavior                        |
| ----------------------------------- | ----------------------------------------- |
| Public channels and shared surfaces | Use the global workspace Knowledge Base   |
| Private channels                    | Use a private conversation Knowledge Base |
| DMs and group DMs                   | Use a private conversation Knowledge Base |

<Info>
  Think of the global Knowledge Base as shared memory and private conversation knowledge as an isolated overlay with selective shared context available for reference.
</Info>

## Capturing knowledge

Ask the Agent to remember anything worth keeping: architectural decisions, operational facts, team conventions, or clarifications that would otherwise be lost. For example:

```
@coderabbit Remember that our payments service retries failed charges
exactly three times with exponential backoff. After the third failure
it marks the invoice as requires_manual_review.
```

CodeRabbit Agent saves the fact and references it in future conversations. You can review and manage saved facts in the web app.

<Info>
  In channels, you can also use the `/learn` slash command as a shortcut. Slash commands are not available in Direct Messages or threads.
</Info>

## What's next

<CardGroup>
  <Card title="Durable skills" href="/agent/skills" icon="book-copy">
    Learn how the Agent stores and reuses procedures alongside durable facts.
  </Card>

  <Card title="Working in Slack" href="/slack-agent/use-in-slack" icon="messages-square">
    See how knowledge capture fits into normal Slack workflows.
  </Card>

  <Card title="Thread reviews" href="/slack-agent/thread-reviews" icon="file-search">
    Inspect the run details and artifacts behind a conversation before deciding what knowledge should be preserved.
  </Card>
</CardGroup>


# Quickstart
Source: https://docs.coderabbit.ai/slack-agent/onboarding

Set up CodeRabbit Agent for Slack with your Git platform, create the Base Scope, and start working.

The setup flow connects your Slack workspace to a Git provider, makes approved repositories available to CodeRabbit Agent, and creates a <Hint type="scope">Base Scope</Hint> that defines which repositories, connections, and spend controls apply by default. Once the Base Scope is saved, anyone in the workspace can mention `@coderabbit` in a channel, or open the CodeRabbit app to start a direct conversation.

## Prerequisites

Before you start, make sure you have:

* Permission to install or reauthorize apps in the Slack workspace
* Access to the Git organization, workspace, or account whose repositories CodeRabbit Agent should use
* Permission to install or configure CodeRabbit for those repositories

## Setup steps

<Steps>
  <Step title="Sign in with Slack">
    Go to [app.coderabbit.ai/slack](https://app.coderabbit.ai/slack) to begin. Authenticate with Slack to establish the workspace identity.

    * **New workspace**: Click **Add to Slack** to trigger the full app install flow, grant workspace-level [Slack permissions](/slack-agent/slack-permissions), and enter the setup wizard.
    * **Returning to an existing workspace**: Click **Sign in with Slack**. CodeRabbit identifies the workspace and resumes from whichever setup stage was last completed.
  </Step>

  <Step title="Choose your Git platform">
    Choose the Git platform that should back CodeRabbit Agent for the Slack workspace: GitHub, GitLab (cloud or self-hosted), Bitbucket Cloud, or Azure DevOps.
  </Step>

  <Step title="Complete provider setup">
    Follow the setup prompts to authenticate with your Git platform, select the organization, workspace, or account, and make the approved repositories available to Agent.
  </Step>

  <Step title="Create the Base Scope">
    Choose the default repositories, [connections](/slack-agent/connections), and spend baseline that should apply across the workspace. The [Base Scope](/slack-agent/scopes) is required before CodeRabbit Agent can be used.
  </Step>

  <Step title="Start using CodeRabbit Agent">
    Once the Base Scope is saved, open CodeRabbit from Slack's **Apps** sidebar or search for "CodeRabbit" in Slack — the Chat tab shows starter prompts to help you begin. You can also mention `@coderabbit` in any channel to start a conversation there. In the [web app](https://app.coderabbit.ai), Slack-specific administration now lives under **Slack** settings. You can refine [scopes](/slack-agent/scopes), [connections](/slack-agent/connections), and [sandbox settings](/slack-agent/sandboxes) at any time.
  </Step>
</Steps>

## What the Base Scope does

The Base Scope is required to complete setup. It sets the default repositories, connections, and spend controls that apply across the workspace. Scopes can override or extend these defaults for specific channels or teams. See [Scopes](/slack-agent/scopes) for the full model.

## Resuming setup

The setup flow is resumable. If provider access is still propagating or a required step is incomplete, the Agent returns the workspace to the next missing requirement instead of forcing admins to start over.

## Fixing an incorrect GitHub connection

If the wrong GitHub account or organization was connected, a global admin can reset the workspace GitHub connection from account settings and restart setup with the correct identity.

<Warning>
  Resetting the workspace GitHub connection is destructive. It removes existing scopes and workspace usage history for that Slack workspace. Treat it as a recovery path, not a normal reconfiguration step.
</Warning>

## What's next

<CardGroup>
  <Card title="Working in Slack" href="/slack-agent/use-in-slack" icon="messages-square">
    Learn how mentions and direct conversations work day to day.
  </Card>

  <Card title="Connections" href="/slack-agent/connections" icon="plug">
    Add external systems like Jira, Notion, or Sentry for CodeRabbit Agent to use.
  </Card>

  <Card title="Scopes" href="/slack-agent/scopes" icon="shield">
    Add scopes to tailor repositories, connections, and spend limits for specific channels or teams.
  </Card>
</CardGroup>


# Coding Plans
Source: https://docs.coderabbit.ai/slack-agent/plans

Turn Slack discussions into structured implementation plans — with file references, design rationale, and one-click handoff to an agent for implementation.

CodeRabbit turns Slack conversations into structured implementation plans. CodeRabbit Agent for Slack analyzes the thread, the repositories in scope, and the Knowledge Base, then produces an implementation plan that you can refine and pass to any agent.

## How plans are created

Planning is explicit. CodeRabbit Agent starts a planning workflow when you use one of these entry points:

* Type `/plan <task description>` in a channel.
* Type `/plan` with no text to open the Plan Changes modal.
* Use the **Plan this work** message shortcut on a Slack message.
* Click **Plan this work** on a planning offer from CodeRabbit Agent.

For example, after discussing a new feature in `#backend-eng`, an engineer can type:

```text wrap theme={null}
/plan Add rate limiting to the public API endpoints based on the approach we discussed above
```

The Agent reads the thread, checks the repositories and knowledge available through the channel's <Hint type="scope">scope</Hint>, and generates a coding plan with implementation phases, file references, and design rationale grounded in the actual codebase.

<Info>
  Slash commands are available in channels, not in Direct Messages or threads. Use the message shortcut or a planning offer when you want to start from an existing Slack message.
</Info>

## Planning process

CodeRabbit posts an initial implementation plan in the Slack thread, covering the likely change area, key tasks, and open risks. Select **Dive deeper** to refine the plan with additional codebase research. CodeRabbit saves the result and adds an **Open Plan** link back to the thread.

You can hand the plan off to CodeRabbit Agent for implementation at any point, or stop planning and switch to implementation straight away.

## Review and handoff

Open saved plans from Slack or from the [web app](https://app.coderabbit.ai/plan/plans). Saved plans preserve the research, assumptions, phases, tasks, summary, and version history for the work. Use the Slack action buttons to hand either the first-pass plan or the saved plan back to CodeRabbit Agent for implementation.

## Relationship to CodeRabbit Plan

CodeRabbit Agent planning builds on the broader CodeRabbit planning model. Coding Plans created from Slack appear alongside plans created from the web app or issue trackers.

For the canonical product docs covering plan structure, refinement, and agent handoff, see [CodeRabbit Plan](/plan).

## What's next

<CardGroup>
  <Card title="Working in Slack" href="/slack-agent/use-in-slack" icon="messages-square">
    See how `/plan` starts from Slack and when that work moves into the web UI.
  </Card>

  <Card title="CodeRabbit Plan overview" href="/plan" icon="list-check">
    Read the canonical planning docs for plan structure, refinement, and handoff behavior across CodeRabbit.
  </Card>

  <Card title="Thread reviews" href="/slack-agent/thread-reviews" icon="file-search">
    Inspect the run history behind a planning conversation when you need more context than the final plan alone.
  </Card>
</CardGroup>


# Sandboxes
Source: https://docs.coderabbit.ai/slack-agent/sandboxes

Configure the shared workspace sandbox CodeRabbit Agent for Slack uses for reproducible execution, package setup, and saved snapshots.

CodeRabbit Agent for Slack uses a shared workspace sandbox for code execution, not a private environment per user. Saved state, installed packages, and snapshots benefit the entire team. Configuration changes affect every run in the workspace, so coordinate with your team before making changes.

The Sandboxes page is a workspace-admin surface. <Hint type="scope">Scope</Hint> admins and regular members do not get direct sandbox management access in the web app.

## How sandboxes work

Each Slack thread maps 1:1 to a sandbox instance with its own git worktree branch and snapshot chain. CodeRabbit Agent restores from the most recent snapshot when a thread starts work and snapshots the sandbox when a run completes. The shared base snapshot provides the starting point for all new threads.

## Guaranteed tools

Every sandbox includes:

| Category              | Tools                         |
| --------------------- | ----------------------------- |
| Version control       | `git`                         |
| Network and archive   | `curl`, `tar`, `zip`, `unzip` |
| Languages             | `python3`                     |
| Search and navigation | `rg` (ripgrep), `fd`, `tree`  |
| Data processing       | `jq`, `yq`, `sqlite3`, `gawk` |
| Build and patch       | `make`, `patch`, `file`       |
| System                | `time`, `procps`              |

Optional: `gh` (GitHub CLI), `glab` (GitLab CLI) on a best-effort basis.

## What admins can configure

* Runtime selection (curated set including modern Node.js and Python, not arbitrary environments)
* Package setup
* Saved snapshots
* Reset-to-clean behavior
* Live terminal and command access in the web app where supported

## Lifecycle states

| Status     | Meaning                                     |
| ---------- | ------------------------------------------- |
| `draft`    | Configuration exists, no snapshot saved yet |
| `saving`   | Snapshot save in progress                   |
| `ready`    | Saved snapshot available                    |
| `failed`   | Most recent operation failed                |
| `archived` | Sandbox retired                             |

## What's next

<CardGroup>
  <Card title="Admin roles and security" href="/slack-agent/admin-and-security" icon="lock">
    Confirm who should be allowed to manage shared workspace execution settings.
  </Card>

  <Card title="Working in Slack" href="/slack-agent/use-in-slack" icon="messages-square">
    Understand when CodeRabbit Agent might rely on the shared sandbox during real conversations.
  </Card>

  <Card title="Thread reviews" href="/slack-agent/thread-reviews" icon="file-search">
    Inspect the resulting runs and diffs after sandbox-backed work completes.
  </Card>
</CardGroup>


# Scopes
Source: https://docs.coderabbit.ai/slack-agent/scopes

Use scopes to control which Slack conversations can access which repositories, connections, and spend limits in CodeRabbit Agent for Slack.

Scopes control which repositories, [connections](/slack-agent/connections), and spend limits CodeRabbit Agent for Slack can use in each conversation. Every workspace has a **Base Scope** that applies everywhere by default. Scopes let you override or extend those defaults for specific channels or DMs. When you create or edit a Slack scope, you can also search and select active user groups directly from the connected Slack workspace.

<Info>
  If channel or user-group search fails because Slack workspace authorization is missing, expired, or invalid, the picker shows a **Reconnect Slack** action so you can restore access and search again. Other Slack errors still appear as ordinary errors. For workspace-level reconnection steps, see [Connections](/slack-agent/connections).
</Info>

## Start with the Base Scope

The Base Scope is created during the [Quickstart](/slack-agent/onboarding) setup flow. It sets the default repositories, connections, and spend controls. Scopes build on top of it by adding repositories, swapping connections, or setting tighter limits. If a conversation does not match any scope, the Base Scope governs it entirely.

## One scope per conversation

For any given conversation, CodeRabbit Agent resolves:

1. The **Base Scope**, which always applies
2. At most one matching **scope**, when the current channel or DM pattern matches one

That means the Base Scope is the workspace-wide baseline and a scope is the targeted override or extension for that specific Slack surface.

<Warning>
  If more than one scope matches the same conversation, CodeRabbit Agent treats the match as **ambiguous and blocks the request** rather than guessing. Ensure scope patterns do not overlap.
</Warning>

## Scope types

| Scope type | Use it for                                            | What it controls                                                                        |
| ---------- | ----------------------------------------------------- | --------------------------------------------------------------------------------------- |
| Base Scope | Workspace-wide defaults                               | Default provider credential, repositories, connections, and spend limit                 |
| Scope      | Targeted access for specific channels or DM workflows | Channel- or DM-specific provider credential, repositories, connections, and spend rules |

## Inheritance rules

Scopes build on top of the Base Scope.

| Behavior            | How it works                                                                                                                                                                              |
| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Provider credential | The Base Scope holds a repository-provider credential. A child scope inherits that credential unless it selects another stored credential for the same provider                           |
| Repositories        | A scope inherits the Base Scope repositories, then adds any extra repositories selected in that scope                                                                                     |
| Non-MCP connections | A scope keeps the Base Scope service choice unless the same service is explicitly replaced. Only **one** connection per non-MCP service type is allowed per scope. Duplicates are blocked |
| MCP connections     | MCP connections are additive, so scope-level MCP access combines with Base Scope MCP access. Duplicate MCP server selections are also blocked                                             |
| Spend limit         | A scope can inherit the Base Scope baseline or set a narrower or different policy                                                                                                         |

In practice, the effective repository set is usually the union of Base Scope repositories and scope repositories.

If a scope does not have a usable provider credential, repository setup is required. Administrators are redirected to the setup or scoping step to add, replace, or select a credential before the scope can use repositories from that provider.

### Repository access warnings

Repository warnings are grouped by provider so administrators can resolve access differences between the selected credential and the CodeRabbit installation.

| Warning group                                                        | Why the Agent will not use the repository                                                                                 | Administrator action                                                                                       |
| -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
| Installed for CodeRabbit, but unreachable by the selected credential | CodeRabbit is installed for the repository, but the credential assigned to the scope does not have permission to reach it | Adjust the credential's provider permissions, or select a stored credential that can access the repository |
| Visible to the selected credential, but CodeRabbit is not installed  | The credential can see the repository, but CodeRabbit has not been installed or enabled for it                            | Install or enable CodeRabbit for the repository, then return to the scope and select it                    |

## Spend controls

Spend controls are configured at the scope level.

| Scope type | Blank value behavior                      | Explicit unlimited behavior |
| ---------- | ----------------------------------------- | --------------------------- |
| Base Scope | Defaults to a baseline when left blank    | Set **No limit** explicitly |
| Scope      | Inherits or remains unset when left blank | Set **No limit** explicitly |

Use scope spend limits when a team, channel, or workflow should be more tightly controlled than the workspace default.

Spend enforcement uses the same **agent minutes** metric shown in [Usage](/slack-agent/usage). Each run records how long the Agent spent working, and longer runs consume more of a paid workspace's spend allowance than shorter runs.

Workspaces can have separate spend limits for user-started runs and for automation or trigger runs. Those limits act as billing-period guardrails for the matching scope. Free trials use the included Agent Minutes grant instead of scope spend limits, so trial access pauses only when the included minutes are exhausted or the trial expires.

## Scope admins

Scopes can be managed by assigned **scope admins**, but the **Base Scope** remains reserved for global admins.

That lets workspace admins delegate day-to-day scope tuning without giving every scope owner control over the entire CodeRabbit Agent workspace.

## Roll out safely

For most teams, the safest rollout path is:

1. Keep the Base Scope relatively conservative
2. Add scopes only where a team needs different repositories, tools, or limits
3. Expand gradually as usage patterns become clearer

## What's next

<CardGroup>
  <Card title="Connections" href="/slack-agent/connections" icon="plug">
    Learn how workspace-level connections are created once and then selected per scope.
  </Card>

  <Card title="Admin roles and security" href="/slack-agent/admin-and-security" icon="lock">
    See who can create scopes, who can edit them, and who can see activity across the workspace.
  </Card>

  <Card title="Working in Slack" href="/slack-agent/use-in-slack" icon="messages-square">
    Understand how the current scope changes what CodeRabbit Agent can do in a real conversation.
  </Card>
</CardGroup>


# Slack permissions
Source: https://docs.coderabbit.ai/slack-agent/slack-permissions

Review the Slack app install, user OAuth, and sign-in permissions CodeRabbit Agent requests.

**Understand why each Slack permission is needed.** CodeRabbit Agent for Slack uses three distinct permission surfaces, each for a different purpose:

* **App install scopes** are granted to the workspace-installed Slack app
* **User OAuth scopes** are granted only when a user explicitly connects their Slack account for actor-scoped behavior
* **Slack sign-in scopes** are used for web authentication and session bootstrap

## App install scope categories

| Capability                         | Example scopes                                                                                                                               | Why CodeRabbit Agent needs them                                                                                    |
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
| Start and route work               | `app_mentions:read`, `assistant:write`, `commands`                                                                                           | Lets CodeRabbit Agent respond to mentions, direct messages, and slash commands                                     |
| Read conversation context          | `channels:history`, `groups:history`, `im:history`, `mpim:history`                                                                           | Lets the Agent read the thread history and surrounding conversation where it is allowed to operate                 |
| Discover Slack surfaces and people | `channels:read`, `groups:read`, `im:read`, `mpim:read`, `team:read`, `users:read`, `users:read.email`, `usergroups:read`                     | Helps the Agent identify the workspace, resolve channels, and map users and groups during setup and access control |
| Write back into Slack              | `chat:write`, `reactions:write`, `files:write`, `canvases:write`, `im:write`, `mpim:write`                                                   | Lets the Agent post replies, upload artifacts, update canvases, and signal progress                                |
| Search and additional context      | `search:read.files`, `search:read.public`, `search:read.users`, plus related read scopes such as bookmarks, pins, canvases, lists, and emoji | Expands the context the Agent can inspect when the product flow calls for it                                       |

## User OAuth scopes

User OAuth scopes are the explicit “act as you” path.

They are useful when CodeRabbit Agent needs user-scoped behavior that should not be performed broadly with the bot token alone.

| Capability                     | Example scopes                                                   | Why it matters                                                                              |
| ------------------------------ | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
| User-authored Slack actions    | `chat:write`, `reactions:write`, `files:write`, `canvases:write` | Lets the Agent take selected actions on behalf of the connected user after explicit consent |
| Private search                 | `search:read.private`, `search:read.im`, `search:read.mpim`      | Allows more private, actor-scoped search behavior where the user has the right visibility   |
| Workspace lookup in user flows | selected read scopes for channels and users                      | Supports channel selection, people lookup, and setup UX tied to the authenticated user      |

## Slack sign-in scopes

Slack sign-in scopes are only for identity and session establishment.

| Scope family                 | Why it matters                                                                                                    |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| `openid`, `profile`, `email` | Lets the web app authenticate the Slack user and bind the correct Slack identity to the correct workspace session |

## Notes

* App install scopes are the baseline workspace permissions.
* User OAuth scopes are an explicit escalation path, not the default for every interaction.
* Slack sign-in scopes are used for identity, not for general bot runtime behavior.
* Slack's permission wording can be broader than the exact operation used in one specific workflow.

## What's next

<CardGroup>
  <Card title="Admin roles and security" href="/slack-agent/admin-and-security" icon="lock">
    See how Slack admin status and CodeRabbit roles map to workspace permissions.
  </Card>

  <Card title="Quickstart" href="/slack-agent/onboarding" icon="rocket">
    Walk through the setup flow that triggers these permission grants for the first time.
  </Card>

  <Card title="Connections" href="/slack-agent/connections" icon="plug">
    Learn how OAuth and API key credentials are managed for external service access.
  </Card>
</CardGroup>


# Thread reviews
Source: https://docs.coderabbit.ai/slack-agent/thread-reviews

Inspect what CodeRabbit Agent for Slack did in a Slack thread with run history, context, diffs, and execution details.

**See exactly what happened and why.** Thread reviews give you a web-based inspection surface for any CodeRabbit Agent for Slack conversation, from the high-level outcome down to individual commands, diffs, and execution detail. Use them when you need more than the final Slack reply.

## How to open a thread review

Teams typically reach a thread review from:

* A link in [Usage](/slack-agent/usage)
* A direct thread review URL
* Links CodeRabbit Agent provides in a specific run or thread, when available

Slack-backed authorization still applies. If the viewer does not have access to the underlying Slack thread, the review cannot be opened.

Thread review access is also tied to the same Slack workspace as the original thread. For private channels and non-bot DMs, the web app may require Slack authorization to verify that the viewer can still see the conversation. A user can still reopen reviews for their own 1:1 bot DM without that extra visibility check.

## From overview to execution detail

Thread reviews are organized in three layers:

1. **Thread overview**: the high-level summary covering all runs in the thread
2. **Individual runs**: each run's outcome, timing, context usage, and status
3. **Execution detail**: the deepest layer showing commands, tool calls, and moment-by-moment activity

## Two inspection tabs

Thread reviews provide two main views:

<Tabs>
  <Tab title="Conversation">
    The **Conversation** tab shows the narrative flow of the run:

    * The execution hero (goal, outcome, draft status)
    * Key moments such as investigation, editing, tool use, and recovery
    * Proof sections linking to the commands and changes that produced the result
    * Why the result should be trusted (the narrative "review story")
  </Tab>

  <Tab title="Diff">
    The **Diff** tab shows the code changes produced by the run:

    * **Draft** diff: current live or unsaved work
    * **Run** diff: changes from a single selected run
    * **All** diff: combined history of changes across the entire thread

    Each mode shows repo-level and per-file patches with direct links to changed files.
  </Tab>
</Tabs>

## What you can inspect

Across both tabs, common review layers include:

* Run history and status across the thread
* Context used during each run (repositories, connections, knowledge)
* Diffs and changed files with per-file patches
* Narrative moments (investigate, edit, tool use, recovery, reply)
* Exported artifacts and deep links

## Navigating between runs

When a thread has multiple runs, the thread overview lists them in order. Select any run to see its execution hero, conversation narrative, and diffs. Earlier runs are compressed so you can focus on the most recent result while still having full history available.

## Best way to read a thread review

1. Start with the thread overview and execution hero.
2. Open the most relevant run.
3. Check the Conversation tab for the narrative and proof.
4. Switch to the Diff tab when you need to see exactly what changed.
5. Drop into deeper execution layers only when you need to understand *how* the result was produced.

## What's next

<CardGroup>
  <Card title="Usage" href="/slack-agent/usage" icon="bar-chart-3">
    Find the run you care about and jump into its review surface.
  </Card>

  <Card title="Knowledge Base" href="/slack-agent/knowledge-base" icon="brain">
    Preserve useful facts after reviewing what actually happened in the thread.
  </Card>

  <Card title="Plans" href="/slack-agent/plans" icon="list-checks">
    Review how planning work created in Slack is preserved, compared, and handed off.
  </Card>
</CardGroup>


# Usage
Source: https://docs.coderabbit.ai/slack-agent/usage

Review CodeRabbit Agent for Slack activity across your workspace, including when runs happened, which scope handled them, how many agent minutes they used, and where to inspect each thread.

**Know what CodeRabbit Agent for Slack has been doing across your workspace.** The Usage view answers the questions that matter after rollout: what ran, when, who triggered it, which <Hint type="scope">scope</Hint> handled it, how much runtime it used, and where to dig deeper.

## Who can see usage

Usage visibility depends on role:

| Viewer       | What they can see                                                  |
| ------------ | ------------------------------------------------------------------ |
| Global admin | All workspace activity                                             |
| Scope admin  | Activity for the scopes they manage, plus their own runs elsewhere |
| Member       | Their own runs only                                                |

## What the table shows

| Column        | What it shows                                                                                   | Example                         |
| ------------- | ----------------------------------------------------------------------------------------------- | ------------------------------- |
| Run At        | When the CodeRabbit Agent run happened, shown in your browser's timezone with UTC as a fallback | `Apr 3, 2025 2:22 PM`           |
| Agent minutes | How long the run spent working, shown in minutes                                                | `3.1`                           |
| Scope         | The resolved scope name for that run                                                            | `Base Scope` or `frontend-team` |
| Triggered By  | The Slack user who started it                                                                   | `@jane`                         |
| Thread        | Links to the original Slack conversation and the thread review UI                               | Slack link + review link        |

## What agent minutes mean

Agent minutes are the runtime unit CodeRabbit Agent uses for usage tracking and billing. For each run, CodeRabbit measures how long the run spent working in the sandbox, stores that time in seconds, and shows it in the UI as minutes.

Slack and Discord usage tied to the same billing subject draws from the subject's shared Agent-minute pool.

This is a runtime metric, not a token metric. It reflects the duration of the Agent run while work is in progress, so it is easier to understand and closer to how CodeRabbit Agent usage is governed in the product.

In practice:

* Short runs use fewer agent minutes than long runs.
* Automation runs and human-triggered runs are measured the same way.
* Values can be fractional because the underlying runtime is recorded in seconds and then converted to minutes for display.

## Trial Agent Minutes

Some workspaces receive an included Agent Minutes grant during their Agent trial. The Usage view uses the same agent-minute metric for both trial and paid usage, so trial runs still appear with their measured runtime.

When a trial grant is exhausted or expires, CodeRabbit Agent pauses new work for that workspace and asks an admin to activate the Agent plan before runs can continue.

## Human vs. automation runs

Usage shows both human-triggered and automation-triggered runs in the same view:

* **Human runs** appear when someone mentions `@coderabbit`, uses a slash command, or sends CodeRabbit Agent a direct message.
* **Automation runs** appear either on their configured schedule or when a matching message triggers them. They show the automation name and the channel where they ran.

Both types resolve to a scope the same way. Filtering by scope is the fastest way to narrow down what you are looking for, and filtering by agent minutes helps you spot unusually short or unusually long runs.

## Common actions from Usage

From the Usage view, teams can:

* Open the related [thread review](/slack-agent/thread-reviews) for full run detail
* Jump back to the original Slack conversation
* Confirm which scope handled a request
* Review recent workspace activity without searching Slack first
* Trace an unexpected result back to its scope, triggering user, and execution detail

## Filtering and navigation

The Usage view supports text search across scope names and triggering users, scope-based filtering to focus on a specific team or channel, agent-minute filtering for minimum and maximum runtime, and sorting by time, agent minutes, scope, or user. Results are paginated so you can browse recent and historical runs without loading everything at once.

## What's next

<CardGroup>
  <Card title="Thread reviews" href="/slack-agent/thread-reviews" icon="file-search">
    Open a run in detail when you need to inspect context, diffs, and execution history.
  </Card>

  <Card title="Admin roles and security" href="/slack-agent/admin-and-security" icon="lock">
    Review how activity visibility changes for global admins, scope admins, and individual members.
  </Card>

  <Card title="Automations" href="/slack-agent/automations" icon="repeat">
    Create and manage scheduled and message-triggered CodeRabbit Agent automations.
  </Card>
</CardGroup>


# Working in Slack
Source: https://docs.coderabbit.ai/slack-agent/use-in-slack

Start work with CodeRabbit Agent from mentions, direct conversations, and slash commands.

Once your workspace is set up, most day-to-day use happens directly in Slack. You can start with an `@coderabbit` mention in any channel or thread, or open the CodeRabbit app to chat directly. Slash commands are also available for specific actions.

<Warning>
  CodeRabbit application for Slack uses AI (Large Language Models) to generate responses, which may occasionally be inaccurate. Verify important information independently because responses do not constitute professional advice. Some features, including the AI Agent/Assistant, require a paid Slack plan and may not be available on free plans.
</Warning>

## Entry points

| Entry point           | What it does                                                                                                                                                                                | Details                       |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- |
| `@coderabbit` mention | Investigate, explain, plan, or act on anything in the current conversation. The run uses the <Hint type="scope">scope</Hint> matching the current channel, thread, or DM.                   | [Scopes](/slack-agent/scopes) |
| Direct conversation   | Open CodeRabbit from Slack's **Apps** sidebar or search for "CodeRabbit" in Slack. The Chat tab shows starter prompts when empty and does not require an @mention — just type your message. | —                             |

### Slash commands

Slash commands provide shortcuts for specific actions. You can also trigger all of these actions by asking `@coderabbit` directly.

<Warning>
  Slash commands are only available in **channels**. They do not work in Direct Messages or threads. Use an `@coderabbit` mention instead when working in a DM or thread.
</Warning>

| Command        | What it does                                                                            | Details                                       |
| -------------- | --------------------------------------------------------------------------------------- | --------------------------------------------- |
| `/plan`        | Generate a structured implementation plan from a request or thread.                     | [Plans](/slack-agent/plans)                   |
| `/learn`       | Capture a durable fact from the current thread or from text you provide directly.       | [Knowledge Base](/slack-agent/knowledge-base) |
| `/automations` | Open a shortcut for scheduled and message-triggered automations in the current channel. | [Automations](/slack-agent/automations)       |

## How conversation behavior works

CodeRabbit Agent behaves differently depending on the Slack surface:

<Tabs>
  <Tab title="Direct conversations">
    Open CodeRabbit from the **Apps** sidebar or search for "CodeRabbit" in Slack to start a direct conversation. Each top-level message starts a new conversation. Threaded replies continue that same conversation. There is no need to @mention the bot — it stays active automatically.
  </Tab>

  <Tab title="Channel threads">
    A thread is armed when the bot is mentioned in the root message. Once armed, CodeRabbit Agent replies within that thread. If the thread remains single-player, continued interaction does not require re-mentioning.

    <Info>
      Once multiple humans participate in a thread, the Agent becomes more mention-driven to avoid taking over the conversation. Mention `@coderabbit` when you want it to respond.
    </Info>
  </Tab>
</Tabs>

<Tip>
  **CodeRabbit Agent uses the scope matching the current surface. You never need to select a scope manually.** The matching scope determines repositories, connections, spend limits, and knowledge privacy automatically.
</Tip>

<Warning>
  If multiple scopes match the current surface, requests are blocked as ambiguous rather than auto-selecting one. Learn more about [scope resolution and ambiguous matches](/slack-agent/scopes#one-scope-per-conversation).
</Warning>

## What determines what CodeRabbit Agent can use

Each run is governed by the scope that matches the current Slack surface.

That scope determines:

* Which repositories are available
* Which [connections](/slack-agent/connections) can be used
* What spend limit applies
* Whether the shared [sandbox](/slack-agent/sandboxes) is available
* Whether knowledge should be shared or private

## Who can use CodeRabbit Agent

CodeRabbit Agent responds to workspace members only.

<Warning>
  External users (guests) are blocked by default. Channels marked as externally shared are unsupported for CodeRabbit Agent workflows. If CodeRabbit is mentioned in a Slack Connect channel, it may reply once with a denial notice, but it does not start a run or otherwise participate in that channel.
</Warning>

## After a run

After completing a task, the Agent replies in the thread with its findings, a proposed plan, follow-up actions like opening a PR, or an offer to save what it learned to the [Knowledge Base](/slack-agent/knowledge-base).

For deeper inspection and management, the companion web app provides [thread reviews](/slack-agent/thread-reviews) for run-by-run execution detail, [usage](/slack-agent/usage) for workspace-wide activity, [plans](/slack-agent/plans) for saved Coding Plan history, and scheduled automation editing.

## Slack vs. the web app

| Use Slack when you want to...                                       | Use the web app when you want to...                                 |
| ------------------------------------------------------------------- | ------------------------------------------------------------------- |
| Ask CodeRabbit Agent to investigate, plan, learn, or act in context | Inspect what happened after a run in more detail                    |
| Create automations conversationally from the current channel or DM  | Create and edit scheduled automations in the automation editor      |
| Manage automations from the conversation where they apply           | Configure scopes, connections, or sandbox settings                  |
| Confirm knowledge proposals from the same thread                    | Browse knowledge history, plans, usage, and thread review artifacts |

## What's next

<CardGroup>
  <Card title="Scopes" href="/slack-agent/scopes" icon="shield">
    Learn how CodeRabbit Agent decides which repositories, tools, and limits apply in each conversation.
  </Card>

  <Card title="Automations" href="/slack-agent/automations" icon="repeat">
    See how recurring CodeRabbit Agent tasks work for channels and other Slack surfaces.
  </Card>

  <Card title="Plans" href="/slack-agent/plans" icon="list-checks">
    Review how planning work moves from Slack into a structured implementation plan and handoff flow.
  </Card>
</CardGroup>


# actionlint
Source: https://docs.coderabbit.ai/tools/actionlint

CodeRabbit's guide to actionlint.

[`actionlint`](https://github.com/rhysd/actionlint/) is a static checker for
GitHub Actions workflow files.

## Files

We look for `GitHub Action` files specifically in the following directory:

* `.github/workflows/**/*.yml`
* `.github/workflows/**/*.yaml`

## Configuration

CodeRabbit will use the default configuration.

## When we skip actionlint

CodeRabbit will skip running actionlint when:

* No workflow files are found in `.github/workflows/`.
* actionlint is already running in GitHub workflows.

## Links

* [`actionlint` Configuration](https://github.com/rhysd/actionlint/blob/main/docs/config.md/)


# ast-grep
Source: https://docs.coderabbit.ai/tools/ast-grep

CodeRabbit's guide to ast-grep.

<AllPlatformsBadge />

[ast-grep](https://ast-grep.github.io) is an open-source static analysis tool that uses abstract syntax trees (AST) to find patterns in your codebase, helping identify security vulnerabilities and enforce code quality standards. CodeRabbit runs ast-grep version 0.45.0.

## Configuration Options

You can configure ast-grep in your `.coderabbit.yaml` file or through CodeRabbit's settings page under "Reviews → Tools → ast-grep". The following options are available:

* **`rule_dirs`**: List of directories containing your custom ast-grep rules (relative to repository root)
* **`util_dirs`**: List of directories containing utility configs to support rule management (relative to repository root)
* **`essential_rules`**: Enable the ast-grep essentials package (default: `true`)
* **`packages`**: List of GitHub packages to use (format: `owner/repo`)

## Example Configuration

```yaml theme={null}
reviews:
  tools:
    ast-grep:
      rule_dirs:
        - "rules/javascript"
        - "rules/python"
      util_dirs:
        - "utils"
      essential_rules: true
      packages:
        - "owner/custom-rules"
```

<Info>
  CodeRabbit will only run ast-grep if you have configured at least one of the following:

  * Custom rule directories (`rule_dirs`)
  * Essential rules enabled (`essential_rules: true`)
  * Custom packages (`packages`)

  `util_dirs` can be used to support shared utility configs, but by itself it does not cause ast-grep to run.
</Info>

## Links

* [ast-grep Documentation](https://ast-grep.github.io)
* [Writing ast-grep Rules](https://ast-grep.github.io/reference/yaml.html)
* [ast-grep Rule Object Properties](https://ast-grep.github.io/reference/rule.html)
* [ast-grep Essentials Package](https://github.com/coderabbitai/ast-grep-essentials)

## Files

ast-grep will run on the following file types:

* Bash (.bash, .bats, .command, .env, .ksh, .sh, .sh.in, .tmux, .tool, .zsh)
* Bicep (.bicep)
* C (.c, .h)
* C++ (.c++, .cc, .cpp, .cu, .cxx, .hh, .hpp, .ino)
* C# (.cs)
* CSS (.css)
* Dart (.dart)
* Elixir (.ex, .exs)
* Glimmer JavaScript (.gjs)
* Glimmer TypeScript (.gts)
* Go (.go)
* Haskell (.hs)
* HTML (.htm, .html, .xhtml)
* Java (.java)
* JavaScript (.cjs, .js, .jsx, .mjs)
* JSON (.json)
* Kotlin (.kt, .ktm, .kts)
* Lua (.lua)
* Markdown (.md)
* PHP (.php)
* Python (.py, .py3, .pyi)
* Ruby (.gemspec, .rb, .rbw)
* Rust (.rs)
* Scala (.sc, .scala)
* SQL (.sql)
* Swift (.swift)
* TOML (.toml)
* TSX (.tsx)
* TypeScript (.cts, .mts, .ts)
* YAML (.yaml, .yml)


# Betterleaks
Source: https://docs.coderabbit.ai/tools/betterleaks

CodeRabbit's guide to Betterleaks, an improved secret scanner based on Gitleaks.

[Betterleaks](https://github.com/betterleaks/betterleaks) is a secret scanner built on top of [Gitleaks](https://gitleaks.io/). It offers enhanced secret detection compared to the original Gitleaks tool. CodeRabbit runs Betterleaks version 1.7.0.

## Files

Betterleaks runs on changed files in the pull request, regardless of file type.

## Configuration

Betterleaks is configured using the `gitleaks` key in your `.coderabbit.yaml` file. The key name is preserved for backward compatibility; existing configurations continue to work without any changes.

```yaml theme={null}
reviews:
  tools:
    gitleaks:
      enabled: true
```

Betterleaks supports the following config files:

* `betterleaks.toml`
* `gitleaks.toml` (backwards compatibility)

## When we skip Betterleaks

CodeRabbit will skip running Betterleaks when:

* Gitleaks (or a compatible secret scanner) is already running in GitHub workflows.

## Notes

* Betterleaks runs on the changed files in the pull request (not just specific file types).
* Betterleaks uses `--no-git` flag, so it scans files directly rather than scanning git history.
* The configuration key in `.coderabbit.yaml` remains `gitleaks` for backward compatibility. No changes to your existing configuration are required.

## What's next

<CardGroup>
  <Card title="Trivy" href="/tools/trivy" icon="shield-check">
    Scan container images and filesystems for known vulnerabilities, misconfigurations, and exposed secrets.
  </Card>

  <Card title="OSV-Scanner" href="/tools/osv-scanner" icon="shield-alert">
    Identify known vulnerabilities in your project's dependencies using Google's OSV.dev database.
  </Card>

  <Card title="Linters & security analysis tools" href="/tools" icon="wrench">
    Explore all 50+ tools CodeRabbit integrates with for code quality and security analysis.
  </Card>
</CardGroup>


# Biome
Source: https://docs.coderabbit.ai/tools/biome

CodeRabbit's guide to Biome.

[Biome](https://biomejs.dev/) is a linter for JavaScript, TypeScript, JSX, TSX, JSON, JSONC, and CSS. CodeRabbit runs Biome version 2.5.5.

## Files

Biome will run on files with the following extensions:

* `.js`
* `.mjs`
* `.cjs`
* `.jsx`
* `.ts`
* `.mts`
* `.cts`
* `.tsx`
* `.vue`
* `.astro`
* `.svelte`
* `.json`
* `.jsonc`
* `.css`

## Configuration

Biome supports the following config files:

* `biome.jsonc`
* `biome.json`

CodeRabbit will use the default settings based on the profile selected if no config file is found.

## When we skip Biome

CodeRabbit will skip running Biome when:

* Biome is already running in GitHub workflows.
* The config file schema version is greater than the Biome version used by CodeRabbit.
* The repository's Biome config is invalid or contains unsupported keys.

## Notes

* Files in `node_modules/` directories are automatically excluded.
* Biome configuration is validated against the schema version; if the config uses a newer schema version than the installed Biome version, the tool will be skipped.

## Links

* [Biome Configuration](https://biomejs.dev/reference/configuration/)


# Blinter
Source: https://docs.coderabbit.ai/tools/blinter

CodeRabbit's guide to Blinter.

[Blinter](https://github.com/tboy1337/Blinter) is a linter for Windows batch files that provides comprehensive static analysis to identify syntax errors, security vulnerabilities, performance issues, and style problems.

## Files

Blinter will run on files with the following extensions:

* `.bat`
* `.cmd`

## Configuration

Blinter supports the following config files:

* `blinter.ini`

CodeRabbit will use the default settings if no config file is found.

## When we skip Blinter

CodeRabbit will skip running Blinter when:

* No batch files are found in the pull request.
* Blinter is already running in GitHub workflows.

## Features

Blinter provides comprehensive static analysis with:

* **159 Built-in Rules** across 5 severity levels:
  * **Error Level (E001-E999)**: Critical syntax errors that prevent execution
  * **Warning Level (W001-W999)**: Potential runtime issues and bad practices
  * **Style Level (S001-S999)**: Code formatting and readability improvements
  * **Security Level (SEC001+)**: Security vulnerabilities and dangerous operations
  * **Performance Level (P001-P999)**: Optimization opportunities and efficiency improvements

## Profile behavior

* Style findings are suppressed in all profiles.
* In non-assertive profiles, warning-level findings are also suppressed.

## Links

* [Blinter GitHub Repository](https://github.com/tboy1337/Blinter)


# Brakeman
Source: https://docs.coderabbit.ai/tools/brakeman

CodeRabbit's guide to Brakeman.

[Brakeman](https://brakemanscanner.org/) is a static analysis tool which checks Ruby on Rails applications for security vulnerabilities. It scans your application's code for potential security issues and provides detailed reports about any vulnerabilities it finds.

## Supported Files

Brakeman will run on files with the following extensions:

* `Gemfile`
* `*.rb`
* `*.erb`

## When we skip Brakeman

CodeRabbit will skip running Brakeman when:

* No Rails files are found in the pull request.
* Brakeman is already running in GitHub workflows.

## Features

Brakeman can detect many critical vulnerabilities such as:

* SQL injection
* Cross-site scripting (XSS)
* Mass assignment
* Remote code execution
* And many more security vulnerabilities
* Out of date package versions
* Etc

## Links

* [Brakeman Official Website](https://brakemanscanner.org/)
* [Brakeman GitHub Repository](https://github.com/presidentbeef/brakeman)
* [Brakeman Documentation](https://brakemanscanner.org/docs/)
* [Warning Types](https://brakemanscanner.org/docs/warning_types/)


# Buf
Source: https://docs.coderabbit.ai/tools/buf

CodeRabbit's guide to Buf.

[Buf](https://buf.build/) offers linting for Protobuf files.

## Files

Buf will run on files with the following extensions:

* `.proto`

## Configuration

Buf uses a YAML style configuration file. We look for the following file anywhere in the repository:

* `buf.yaml`

If no config file is found, CodeRabbit will consider the following categories of strictness based on the profile selected:

### Chill

* `MINIMAL`

### Assertive

* `BASIC`

## When we skip Buf

CodeRabbit will skip running Buf when:

* Buf is already running in GitHub workflows.

## Links

* [Buf Configuration](https://buf.build/docs/configuration/v2/buf-yaml#lint)


# Checkmake
Source: https://docs.coderabbit.ai/tools/checkmake

CodeRabbit's guide to Checkmake.

[Checkmake](https://github.com/mrtazz/checkmake) is a linter for Makefiles.

## Files

Checkmake will run checks against any `Makefile`.

## Configuration

Checkmake supports the following config files:

* `checkmake.yml`
* `checkmake.yaml`

CodeRabbit will use Checkmake's default settings if no config file is found.

## When we skip checkmake

CodeRabbit will skip running checkmake when:

* No Makefiles are found in the pull request.
* checkmake is already running in GitHub workflows.

## Links

* [Checkmake Configuration](https://github.com/mrtazz/checkmake#configuration)


# Checkov
Source: https://docs.coderabbit.ai/tools/checkov

CodeRabbit's guide to Checkov.

[Checkov](https://www.checkov.io/) is a static code analysis tool for scanning Infrastructure as Code (IaC) files for misconfigurations. CodeRabbit runs Checkov version 3.3.8.

## Files

Checkov will run on files with the following names and extensions:

* `.tf`
* `.yml`
* `.yaml`
* `.json`
* `.template`
* `.bicep`
* `.hcl`
* `bower.json`
* `build.gradle`
* `build.gradle.kts`
* `go.sum`
* `gradle.properties`
* `METADATA`
* `npm-shrinkwrap.json`
* `package.json`
* `package-lock.json`
* `pom.xml`
* `requirements.txt`
* `Dockerfile`
* `.dockerfile`
* `Dockerfile.*`
* `.csproj`
* `yarn.lock`
* `Gemfile`
* `Gemfile.lock`
* `go.mod`
* `paket.dependencies`
* `paket.lock`
* `packages.config`
* `composer.json`
* `composer.lock`

## Configuration

CodeRabbit will include the following severity levels based on the profile selected:

### Chill

* `MEDIUM`
* `HIGH`
* `CRITICAL`

### Assertive

* `LOW`
* `MEDIUM`
* `HIGH`
* `CRITICAL`

## When we skip Checkov

CodeRabbit will skip running Checkov when:

* Checkov is already running in GitHub workflows.
* The repository's `.checkov.yml` or `.checkov.yaml` config enables `external-checks-dir` or `external-checks-git`.

## Links

* [Checkov All Resource Scans](https://www.checkov.io/5.Policy%20Index/all.html)


# CircleCI
Source: https://docs.coderabbit.ai/tools/circleci

CodeRabbit's guide to CircleCI.

[CircleCI](https://circleci.com/) is a static checker and validator for circleci config files.

## Files

We look for `CircleCI Configuration` files specifically in the following directory:

* `.circleci/config.yml`
* `.circleci/config.yaml`

## Configuration

CodeRabbit will use the default configuration and runs `circleci config validate` to check for configuration errors.

## Notes

* CircleCI validates YAML syntax and workflow configuration errors.
* Errors are reported with line numbers when available.

## Links

* [CircleCI Configuration](https://circleci.com/docs/configuration-reference/)


# Clang-Tidy
Source: https://docs.coderabbit.ai/tools/clang-tidy

CodeRabbit's guide to Clang-Tidy.

[Clang-Tidy](https://clang.llvm.org/extra/clang-tidy/) is a static code analysis tool for the C and C++ programming languages.

## Files

Clang-Tidy will run on files with the following extensions:

* `**/*.cpp`
* `**/*.cxx`
* `**/*.cc`
* `**/*.c`
* `**/*.hpp`
* `**/*.hxx`
* `**/*.hh`
* `**/*.h`

## Configuration

* Enable or disable it with `reviews.tools.clang.enabled` or via **Reviews → Tools → Clang → Enabled** in CodeRabbit's settings page.
* When present, your repository's standard Clang-Tidy configuration (such as a `.clang-tidy` file) will be used to further customize checks and rule severities.

CodeRabbit will use the default settings based on the profile selected if no config file is found.

## Links

* [Clang-Tidy Documentation](https://clang.llvm.org/extra/clang-tidy/)
* [Available Clang-Tidy Checks](https://clang.llvm.org/extra/clang-tidy/checks/list.html)


# Clippy
Source: https://docs.coderabbit.ai/tools/clippy

CodeRabbit's guide to Clippy.

[Clippy](https://github.com/rust-lang/rust-clippy) is a collection of lints to catch common mistakes and improve your Rust code. It is the official linter for the Rust programming language.

## Supported Files

Clippy will run on files with the following extensions:

* `*.rs`

## Configuration

Clippy supports the following configuration files:

* `clippy.toml`
* `.clippy.toml`

<Note>
  Clippy does not require configuration to run. If no configuration file is found, it will use default settings.

  A Cargo.toml is required.
</Note>

## When we skip Clippy

CodeRabbit will skip running Clippy when:

* No Rust files (`.rs`) are found in the pull request.
* No `Cargo.toml` file is found in the repository.
* Clippy is already running in GitHub workflows.

## Features

Clippy can detect many code quality issues such as:

* Style violations
* Common mistakes
* Performance issues
* Deprecated code patterns
* And many more Rust-specific issues

## Links

* [Clippy GitHub Repository](https://github.com/rust-lang/rust-clippy)
* [Clippy Documentation](https://rust-lang.github.io/rust-clippy/master/)
* [Available Lints](https://rust-lang.github.io/rust-clippy/master/index.html)


# Cppcheck
Source: https://docs.coderabbit.ai/tools/cppcheck

CodeRabbit's guide to Cppcheck.

[Cppcheck](https://cppcheck.sourceforge.io/) is a static code analysis tool for the C and C++ programming languages.

## Files

Cppcheck will run on files with the following extensions:

* `.cpp`
* `.cxx`
* `.cc`
* `.c`
* `.tpp`
* `.txx`

## Configuration

CodeRabbit will use the following settings based on the profile selected:

### Chill

```shell theme={null}
--disable=warning,style,information,portability,unusedFunction
```

### Assertive

```shell theme={null}
--disable=warning,style,information
```

CodeRabbit will use the default settings based on the profile selected if no config file is found.

## When we skip Cppcheck

CodeRabbit will skip running Cppcheck when:

* Cppcheck is already running in GitHub workflows.

## Filtered categories

The following categories are automatically filtered out in **Chill** mode:

* `normalCheckLevelMaxBranches` - too many branches
* `toomanyconfigs` - too many configurations
* `missingIncludeSystem` - missing system includes
* `missingInclude` - missing includes
* `unmatchedSuppression` - unmatched suppressions

## Profile behavior

In **Chill** mode:

* Disables: `warning`, `style`, `information`, `portability`, `unusedFunction`
* Suppresses the filtered categories listed above
* Only reports findings with severity "warning" or "error"
* Filters out the noisy categories listed above

In **Assertive** mode:

* Disables: `warning`, `style`, `information`
* Reports all findings regardless of category
* Does not suppress any categories

## Include directory discovery

Cppcheck automatically discovers top-level directories containing header files (`.h`, `.hpp`, `.hxx`, `.hh`) and adds them as include directories. This discovery is limited to a maximum depth of 5 levels to avoid scanning very large repositories.

## Links

* [Cppcheck Configuration](https://sourceforge.net/p/cppcheck/wiki/ListOfChecks/)


# detekt
Source: https://docs.coderabbit.ai/tools/detekt

CodeRabbit's guide to detekt.

[`detekt`](https://detekt.dev/) is a static code analysis tool specifically designed for Kotlin projects

## Files

`detekt` will run on files with the following extensions:

* `.kt`
* `.kts`

## Configuration

`detekt` uses a YAML style configuration file.

`detekt` supports the following config files:

* User-defined config file set at `reviews.tools.detekt.config_file` in your project's `.coderabbit.yaml` file or setting the "Reviews → Tools → `detekt` → Config File" field in CodeRabbit's settings page.

If no user-defined config file is found, CodeRabbit will generate a `detekt-config.yaml` file based on the selected profile.

## When we skip detekt

CodeRabbit will skip running detekt when:

* No Kotlin files are found in the pull request.
* detekt is already running in GitHub workflows.

## Profile behavior

CodeRabbit generates different detekt configurations based on the review profile:

* **Chill Mode**: Uses a focused configuration with fewer rules enabled.
* **Assertive Mode**: Uses a more comprehensive configuration with additional rules enabled.

If you provide your own config file, it will be used instead of the generated one.

## Links

* [`detekt` Configuration](https://detekt.dev/docs/introduction/configurations/)


# Dotenv Linter
Source: https://docs.coderabbit.ai/tools/dotenv

CodeRabbit's guide to Dotenv Linter.

[Dotenv Linter](https://github.com/dotenv-linter/dotenv-linter) is a lightning-fast linter for `.env` files. It helps ensure your environment files are consistent, typo-free, and follow best practices.

## Files

Dotenv Linter will run on files with the following patterns:

* `**/.env`
* `**/.env.*`

We will not run against files that do not start with `.env` (e.g., `test.env`). However `.env.dev` or `.env.local` is fine.

<Note>
  Dotenv Linter does not require configuration to run and automatically anlysises `.env` files. If no configuration file is found, it will use default settings.
</Note>

## When we skip dotenv-linter

CodeRabbit will skip running dotenv-linter when:

* No `.env` files are found in the pull request.
* dotenv-linter is already running in GitHub workflows.

## Notes

* All dotenv-linter issues are treated as warnings (dotenv-linter does not distinguish severity levels).

## Features

Dotenv Linter can detect:

* Key duplication
* Missing values
* Incorrect formatting
* Invalid characters
* And many more issues

## Links

* [Dotenv Linter GitHub Repository](https://github.com/dotenv-linter/dotenv-linter)


# ember-template-lint
Source: https://docs.coderabbit.ai/tools/ember-template-lint

How CodeRabbit runs ember-template-lint to lint Ember Handlebars template files on pull requests — including supported file types, project detection, configuration, and skip conditions.

[ember-template-lint](https://github.com/ember-template-lint/ember-template-lint) is a linter for Ember and Glimmer Handlebars (`.hbs`) template files. It checks for accessibility violations, deprecated patterns, template anti-patterns, and style issues in Ember.js and Glimmer templates.

## Files

ember-template-lint considers files with the following extensions:

* `.hbs`

## Project detection

CodeRabbit runs ember-template-lint only when changed `.hbs` files appear to belong to an Ember project. A pull request is treated as Ember-related when at least one of these signals is present:

* A changed `.hbs` file is under a standard Ember template or component path, such as `app/templates/`, `app/components/`, `addon/templates/`, `addon/components/`, or `tests/dummy/app/`.
* The repository contains an Ember project marker, such as `.ember-cli`, `ember-cli-build.js`, `ember-cli-build.cjs`, or `ember-cli-build.mjs`.
* A nearby `package.json` or the repository-root `package.json` includes Ember dependencies, such as packages named `ember`, `ember-*`, or `@ember/*`.

This avoids running ember-template-lint on unrelated Handlebars files, such as generator templates, when the repository does not contain Ember project signals.

## Configuration

ember-template-lint reads its configuration from your repository automatically. Supported config files include:

* `.template-lintrc.js`
* `.template-lintrc.cjs`
* `.template-lintrc.mjs`
* `.template-lintrc.json`
* `.template-lintrc.yaml`
* `.template-lintrc.yml`

If no config file is found, ember-template-lint runs with its default rule set.

To enable or disable ember-template-lint, use your `.coderabbit.yaml` file or the CodeRabbit web UI:

<Tabs>
  <Tab title=".coderabbit.yaml">
    ```yaml .coderabbit.yaml theme={null}
    reviews:
      tools:
        emberTemplateLint:
          enabled: true
    ```
  </Tab>

  <Tab title="Web UI">
    Go to **Reviews → Tools → ember-template-lint** in your organization or repository settings and toggle ember-template-lint `on` or `off`.

    ***
  </Tab>
</Tabs>

## When CodeRabbit skips ember-template-lint

CodeRabbit skips ember-template-lint when:

* No `.hbs` files are present in the pull request diff.
* Changed `.hbs` files are not under standard Ember template paths and CodeRabbit cannot find Ember project markers or Ember dependencies nearby.
* ember-template-lint is already running as a step in your CI pipeline (detected via GitHub Checks).

## What's next

<CardGroup>
  <Card title="All supported tools" href="/tools/list" icon="list">
    Browse the complete list of linters, security analyzers, and CI/CD integrations available in CodeRabbit.
  </Card>

  <Card title="Tools reference" href="/reference/tools-reference" icon="wrench">
    Explore detailed specifications and capabilities of all available CodeRabbit tools.
  </Card>

  <Card title="Configuration reference" href="/reference/configuration" icon="settings">
    Full reference for all available options, including how to enable, disable, and tune individual tools.
  </Card>
</CardGroup>


# ESLint
Source: https://docs.coderabbit.ai/tools/eslint

How CodeRabbit runs ESLint to lint JavaScript, TypeScript, and framework files on every pull request — including supported plugins, sandboxed execution, and skip conditions.

[ESLint](https://eslint.org/) is a linter for JavaScript, TypeScript, JSX, TSX, CSS, etc. CodeRabbit runs ESLint automatically on every pull request in a secure sandbox, using your repository's own ESLint configuration when present and posting results as inline review comments.

## Files

ESLint will run on `package.json` and files with the following extensions: `.js`, `.ts`, `.cjs`, `.mjs`, `.d.cts`, `.d.mts`, `.jsx`, `.tsx`, `.css`, `.vue`, `.svelte`, `.astro`, `.graphql`, `.gql`, `.mdx`

## Configuration

* ESLint configuration is read from the repository and is used as is. If no applicable ESLint configuration file is found for a changed file, CodeRabbit skips ESLint for that file.
* Please ensure that all ESLint dependencies are defined in your `package.json` file(s).
* Yarn and PNPM workspaces are supported.
* Private ESLint plugins or configurations are not supported at the moment. Please [reach out to support](/support) if you would like us to add support for this.
* For `@typescript-eslint`, linting with type information is not supported at the moment. The [type checking rules](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/src/configs/eslintrc/disable-type-checked.ts) are disabled.
* For `eslint-plugin-import`, the following rules are disabled:
  * `import/no-unresolved`
* For the `eslint-plugin-n`, the following rules are disabled:
  * `n/no-missing-import`
  * `n/no-missing-require`
* For the `eslint-plugin-node`, the following rules are disabled:
  * `node/no-missing-import`
  * `node/no-missing-require`

### Configuration file discovery

CodeRabbit searches the repository recursively for ESLint configuration files. It supports both flat-config and legacy-config filenames:

* Flat config: `eslint.config.js`, `eslint.config.mjs`, `eslint.config.cjs`, `eslint.config.ts`, `eslint.config.mts`, and `eslint.config.cts`
* Legacy config: `.eslintrc`, `.eslintrc.js`, `.eslintrc.cjs`, `.eslintrc.json`, `.eslintrc.yml`, and `.eslintrc.yaml`

For each changed file, CodeRabbit uses the closest discovered ESLint config in that file's directory ancestry. For example, `foo/bar/.eslintrc.js` is automatically used for files under `foo/bar/` and its subdirectories, but not for files outside `foo/bar/`.

CodeRabbit does not use an `eslintConfig` field in `package.json` as a configuration source. Use one of the supported configuration files instead.

To enable or disable ESLint, use your `.coderabbit.yaml` file or the CodeRabbit web UI:

The `e18e.enabled` option controls CodeRabbit-managed `@e18e/eslint-plugin` modernization, performance, and dependency replacement checks. It defaults to `true`. The managed overlay is temporarily disabled at runtime while an installation hotfix is active, so changing this option currently has no effect. When the overlay is active, the Chill profile reports its recommended rules and `e18e/ban-dependencies` as warnings, while the Assertive profile uses the recommended severities and reports `e18e/ban-dependencies` as an error. CodeRabbit does not add the managed overlay when your ESLint configuration already references e18e.

<Tabs>
  <Tab title=".coderabbit.yaml">
    ```yaml .coderabbit.yaml theme={null}
    reviews:
      tools:
        eslint:
          enabled: true
          e18e:
            enabled: true
    ```
  </Tab>

  <Tab title="Web UI">
    Go to **Reviews → Tools → ESLint** in your organization or repository settings and toggle ESLint `on` or `off`.

    ***
  </Tab>
</Tabs>

## Security policy and restrictions

ESLint runs in a sandbox. CodeRabbit scans ESLint config files before any `npm`/`yarn`/`pnpm` installs and only permits a curated allow-list of plugins.

* CodeRabbit extracts referenced plugins from configs (the `plugins` array, `extends: "plugin:..."`, `eslint-plugin-...` mentions).
* If any plugin outside the allow-list is referenced, CodeRabbit skips ESLint for the run.
* CodeRabbit does not install or execute arbitrary third-party plugins from the repository.

The following plugins are currently allowed, grouped by category:

| Category               | Plugins                                                                                                                                                     |
| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| TypeScript / Stylistic | `@typescript-eslint`, `@stylistic`                                                                                                                          |
| Import / Module        | `import`, `simple-import-sort`, `unused-imports`, `n`, `node`                                                                                               |
| React ecosystem        | `react`, `react-hooks`, `react-native`, `jsx-a11y`, `next`                                                                                                  |
| Testing                | `jest`, `vitest`, `testing-library`, `cypress`, `playwright`, `mocha`                                                                                       |
| Frameworks             | `vue`, `nuxt`, `angular`, `@angular-eslint`, `@angular-eslint/template`, `svelte`, `astro`, `solid`, `qwik`, `turbo`, `hydrogen`, `storybook`               |
| Code quality           | `sonarjs`, `security`, `unicorn`, `promise`, `regexp`, `compat`, `jsdoc`, `deprecation`, `lodash`, `boundaries`, `perfectionist`, `eslint-comments`, `e18e` |
| Formatting             | `prettier`, `tailwindcss`                                                                                                                                   |
| Other                  | `mdx`                                                                                                                                                       |

## When CodeRabbit skips ESLint

CodeRabbit will skip running ESLint when:

* The config references a plugin not in the allow-list.
* The config can't be parsed or is otherwise unsafe.
* No `package.json` can be found for the relevant project.

## What's next

<CardGroup>
  <Card title="All supported tools" href="/tools/list" icon="list">
    Browse the complete list of linters, security analyzers, and CI/CD integrations available in CodeRabbit.
  </Card>

  <Card title="Tools reference" href="/reference/tools-reference" icon="wrench">
    Explore detailed specifications and capabilities of all available CodeRabbit tools.
  </Card>

  <Card title="Configuration reference" href="/reference/configuration" icon="settings">
    Full reference for all available options, including how to enable, disable, and tune individual tools.
  </Card>
</CardGroup>


# Infer
Source: https://docs.coderabbit.ai/tools/fbinfer

CodeRabbit's guide to Infer.

<AllPlatformsBadge /> | <ProPlanBadge />

[Infer](https://fbinfer.com/) is a static analysis tool for finding bugs in C, C++, and Java code. CodeRabbit runs Infer version 1.2.0 to report issues such as null dereferences, resource leaks, and concurrency bugs on changed files.

## Files

Infer will run on changed files with the following extensions:

* `.c`
* `.cc`
* `.cpp`
* `.cxx`
* `.h`
* `.hh`
* `.hpp`
* `.hxx`
* `.java`

Java analysis is disabled by default. Enable `reviews.tools.fbinfer.enable_java` when you want CodeRabbit to analyze changed Java files with Infer.

## Configuration

Infer is disabled by default. Set `reviews.tools.fbinfer.enabled` to `true` when you want CodeRabbit to run it, and leave `reviews.tools.fbinfer.enable_java` as `false` unless Java analysis should be included.

<Tabs>
  <Tab title="Using configuration file">
    ```yaml theme={null}
    reviews:
      tools:
        fbinfer:
          enabled: false
          enable_java: false
    ```
  </Tab>

  <Tab title="Using web interface">
    Enable or disable Infer from **Reviews → Tools → Infer** in CodeRabbit's settings page. Infer is disabled by default. Turn on **Enable Java analysis** when Java files should be included.
  </Tab>
</Tabs>

## Compilation database discovery

Infer uses a compilation database for C and C++ analysis. CodeRabbit searches the repository for `compile_commands.json` files while skipping dependency and VCS directories such as `.git`, `node_modules`, `vendor`, `third_party`, `external`, and `subprojects`.

When no compilation database is available, CodeRabbit skips C and C++ analysis. Java files are analyzed only when Java analysis is enabled.

## When we skip Infer

CodeRabbit will skip running Infer when:

* Infer is disabled in CodeRabbit settings or `.coderabbit.yaml`.
* No changed files match the supported file types.
* Java is the only matching language and Java analysis is not enabled.
* Infer is already running in GitHub workflows.
* C or C++ files changed but no compilation database is available.

## Links

* [Infer documentation](https://fbinfer.com/docs/getting-started)
* [Infer on GitHub](https://github.com/facebook/infer)

## What's next

<CardGroup>
  <Card title="Tool catalog" href="/tools/list" icon="list">
    Browse all linters, security analyzers, and CI/CD integrations by category and technology.
  </Card>

  <Card title="Tools reference" href="/tools/reference" icon="wrench">
    Explore detailed specifications and configuration options for CodeRabbit tools.
  </Card>
</CardGroup>


# Flake8
Source: https://docs.coderabbit.ai/tools/flake8

CodeRabbit's guide to Flake8.

[Flake8](https://flake8.pycqa.org/) is a Python linting utility that wraps PyFlakes, pycodestyle, and Mccabe to check your Python or Jupiter Notebook code for style and logical errors.

## Supported Files

Flake8 will run on files with the following extensions:

* `*.py`
* `*.ipynb` (using nbQA)

## Configuration

Flake8 supports the following config files:

* `.flake8`

CodeRabbit will not run Flake8 if no config file is found.

## When we skip Flake8

CodeRabbit will skip running Flake8 when:

* No config file is found (`.flake8`).
* Flake8 is already running in GitHub workflows.

## Excluded codes

The following Flake8 codes are automatically excluded (style and whitespace issues that won't cause runtime errors):

* `E501` - line too long
* `E302`, `E303`, `E305` - blank line issues
* `W291`, `W292`, `W293`, `W391` - whitespace issues
* `E201`, `E202`, `E203`, `E211` - whitespace around brackets
* `E221`, `E222`, `E225`, `E226`, `E227`, `E228` - whitespace around operators
* `E231`, `E241`, `E242`, `E251` - whitespace around commas
* `E261`, `E262` - inline comment spacing
* `E271`, `E272`, `E273`, `E274`, `E275` - whitespace around keywords
* `E301`, `E304`, `E306` - blank line issues
* `E401`, `E402`, `E411` - import grouping issues
* `E502` - redundant backslash
* `W191` - indentation contains tabs
* `E266` - too many leading '#' for block comment

## Profile behavior

In **Chill** mode, Flake8 filters out warnings and conventions, reporting only errors.

In **Assertive** mode, all findings (errors, warnings, and conventions) are reported.

## Features

Flake8 can detect many issues such as:

* Style violations (PEP 8)
* Logical errors and unused imports
* Code complexity issues
* Syntax errors
* And many more

## Links

* [Flake8 Official Website](https://flake8.pycqa.org/)
* [Flake8 GitHub Repository](https://github.com/pycqa/flake8)
* [Flake8 Documentation](https://flake8.pycqa.org/en/latest/)
* [Flake8 Configuration](https://flake8.pycqa.org/en/latest/user/configuration.html)
* [nbQA Documentation](https://github.com/nbQA-dev/nbQA)


# Fortitude
Source: https://docs.coderabbit.ai/tools/fortitude

CodeRabbit's guide to Fortitude.

[Fortitude](https://github.com/PlasmaFAIR/fortitude) is a Fortran linter, written in Rust. It's inspired by Ruff and provides blazingly fast linting for Fortran code. CodeRabbit runs Fortitude version 0.9.2.

## Files

Fortitude will run on files with the following extensions:

* `.f90`, `.F90`
* `.f95`, `.F95`
* `.f03`, `.F03`
* `.f08`, `.F08`
* `.f18`, `.F18`
* `.f23`, `.F23`

## When we skip Fortitude

CodeRabbit will skip running Fortitude when:

* No Fortran files are found in the pull request.
* Fortitude is already running in GitHub workflows.

## Links

* [Fortitude GitHub Repository](https://github.com/PlasmaFAIR/fortitude)
* [Fortitude Documentation](https://fortitude.readthedocs.io/en/stable/)


# GitHub Checks
Source: https://docs.coderabbit.ai/tools/github-checks

How CodeRabbit integrates with GitHub Checks to surface CI/CD pipeline failures and provide automated remediation suggestions on every pull request.

GitHub Checks is a CodeRabbit integration that reads the results of your GitHub Actions workflows and other CI/CD checks and incorporates them into the pull request review. When a check fails, CodeRabbit analyzes the failure logs and posts inline comments with remediation suggestions.

## How it works

When a pull request is opened or updated, CodeRabbit waits for GitHub Checks to finish and then reads their output. Any failures are analyzed and surfaced as inline review comments on the relevant lines of code, alongside suggested fixes.

This integration covers a broad range of check types including:

* Build failures (Docker, Node.js, Java, Python, Go, etc.)
* Test failures (unit, integration, end-to-end)
* Security scan findings (SAST, DAST, container scanning)
* Infrastructure-as-code validation (Terraform, Kubernetes, Ansible)
* Linter output from tools running in your CI pipeline

## Configuration

GitHub Checks integration is enabled by default. You can configure whether it is enabled using your `.coderabbit.yaml` file or the CodeRabbit web UI.

<Tabs>
  <Tab title=".coderabbit.yaml">
    ```yaml .coderabbit.yaml theme={null}
    reviews:
      tools:
        github-checks:
          enabled: true
    ```
  </Tab>

  <Tab title="Web UI">
    Go to **Reviews → Tools → GitHub Checks** in your organization or repository settings to toggle the integration on or off.

    ***
  </Tab>
</Tabs>

### Options

| Option    | Type    | Default | Description                                      |
| --------- | ------- | ------- | ------------------------------------------------ |
| `enabled` | boolean | `true`  | Enable or disable the GitHub Checks integration. |

## When CodeRabbit skips GitHub Checks

CodeRabbit skips the GitHub Checks integration when:

* `enabled` is set to `false`.
* The repository is not hosted on GitHub.
* No GitHub Checks data is available for the review.

## What's next

<CardGroup>
  <Card title="CI/CD pipeline analysis" href="/pr-reviews/cicd-pipeline-analysis" icon="wrench">
    Learn how CodeRabbit reads CI/CD pipeline failures and posts inline remediation suggestions across GitHub Actions, GitLab, CircleCI, and Azure DevOps.
  </Card>

  <Card title="All supported tools" href="/tools/list" icon="list">
    Browse the complete list of linters, security analyzers, and CI/CD integrations available in CodeRabbit.
  </Card>

  <Card title="Configuration reference" href="/reference/configuration" icon="settings">
    Full reference for all available options, including how to enable, disable, and tune individual tools.
  </Card>
</CardGroup>


# golangci-lint
Source: https://docs.coderabbit.ai/tools/golangci-lint

CodeRabbit's guide to golangci-lint.

[golangci-lint](https://golangci-lint.run/) is a fast Go linters runner.

## Files

golangci-lint will run on files with the following extensions:

* `.go`
* `go.mod`

## Configuration

golangci-lint supports the following config files:

* User-defined config file set at `reviews.tools.golangci-lint.config_file` in your project's `.coderabbit.yaml` file or setting the "Reviews → Tools → golangci-lint → Config File" field in CodeRabbit's settings page.
* `.golangci.yml`
* `.golangci.yaml`
* `.golangci.toml`
* `.golangci.json`

## What CodeRabbit runs

We run golangci-lint in a sandbox with `--out-format=json` and per-module scoping. No plugins or external binaries are loaded.

## Security policy and restrictions

* Plugins are disallowed. If plugins are referenced in config, we skip.
* Advanced or unsafe options cause a skip: top-level plugins, non-empty `linters-settings` that imply external executors, or preset bundles that expand to plugins.
* Config version is validated; an “unsafe” evaluation returns version `0` and we fail-closed.
* Blocked configurations include:
  * Any `plugins` entries (in any form)
  * Non-empty `linters-settings` values that imply external executors
  * Presets that expand to plugins

## When we skip golangci-lint

CodeRabbit will skip running golangci-lint when:

* The config references plugins (in any form).
* The config contains advanced or unsafe options we can’t guarantee are safe.
* The config cannot be parsed confidently (YAML/JSON/TOML errors).

## Links

* [golangci-lint Configuration](https://golangci-lint.run/usage/configuration/)


# Hadolint
Source: https://docs.coderabbit.ai/tools/hadolint

CodeRabbit's guide to Hadolint.

[Hadolint](https://github.com/hadolint/hadolint) is a Dockerfile linter.

## Files

Hadolint will run on files with the following file names:

* `Dockerfile`
* `*.dockerfile`
* `Dockerfile.*`

## Configuration

Hadolint supports the following config files:

* `.hadolint.yaml`

CodeRabbit filters the following severity levels based on the selected review profile:

### Chill

* `none`
* `ignore`
* `style`
* `info`
* `warning`

### Assertive

* `none`
* `ignore`
* `style`

## When we skip Hadolint

CodeRabbit will skip running Hadolint when:

* Hadolint is already running in GitHub workflows.

## Links

* [Hadolint Configuration](https://github.com/hadolint/hadolint?tab=readme-ov-file#configure)


# HTMLHint
Source: https://docs.coderabbit.ai/tools/htmlhint

CodeRabbit's guide to HTMLHint.

[HTMLHint](https://htmlhint.com/) is a static code analysis tool for HTML.

## Files

HTMLHint will run checks against `*.html` files.

## Configuration

HTMLHint supports the following config files:

* `.htmlhintrc`
* `.htmlhintrc.json`
* `htmlhintrc.json`

CodeRabbit will use the default settings based on the profile selected if no config file is found.

## When we skip HTMLHint

CodeRabbit will skip running HTMLHint when:

* HTMLHint is already running in GitHub workflows.

## Profile behavior

CodeRabbit filters out the following categories and does not report them:

* `attr-lowercase` - attribute names must be lowercase
* `attr-value-double-quotes` - attribute values must use double quotes

In **Assertive** mode, all findings are reported.

## Links

* [HTMLHint Configuration](https://htmlhint.com/getting-started/)


# Third-party tools overview
Source: https://docs.coderabbit.ai/tools/index

Integrate 50+ third-party tools like ESLint, Ruff, and Betterleaks into CodeRabbit reviews for enhanced code quality and 1-click fixes.

<AllPlatformsBadge /> | <ProPlanBadge />

CodeRabbit integrates with [50+](/tools/list) third-party linters and security analysis tools to enhance your code reviews. These tools run automatically in secure sandboxed environments, providing detailed feedback and 1-click fixes for common issues.

## Default behavior

Almost all tools are enabled by default. CodeRabbit automatically determines which tools are relevant for each project, for example, PHP linters won't run on a Java project, and Rust linters won't run on a Python codebase. Tools are only invoked when the repository contains files they understand.

This means most projects require no tool configuration at all. The defaults work well out of the box. Configuration is typically only needed when you want to:

* **Disable a specific tool** that is not relevant or causes too much noise for your project.
* **Point to a non-default config file location**, for example if your ESLint config is in a custom path rather than the project root.

For details on how a specific tool behaves, what file types it targets, and what configuration options it supports, see that tool's individual page in the [tool catalog](/tools/list).

## Configuration methods

### Individual tool settings

<Tabs>
  <Tab title="YAML configuration">
    Add tools to your repository's `.coderabbit.yaml` file:

    ```yaml .coderabbit.yaml lines wrap icon="code" theme={null}
    reviews:
      tools:
        eslint:
          enabled: true
        ruff:
          enabled: true
          config_file: "pyproject.toml"
    ```

    Use `reviews.tools.<tool>.enabled` to enable or disable individual tools. The optional `config_file` field points to your existing tool-specific configuration file (for example `.eslintrc.js` or `pyproject.toml`), letting you control which rules are active and their severity. See [specific tool guides](/tools/list) for more detailed instructions.
  </Tab>

  <Tab title="Settings page">
    Configure tools through CodeRabbit's web interface:

    1. Navigate to **Reviews → Tools** in your settings (use **All Settings** mode)
    2. Toggle individual tools on/off
    3. Save changes to apply across all repositories
  </Tab>
</Tabs>

### Configuration files

When a tool-specific configuration file is present in your repository (such as `.eslintrc.js` or `pyproject.toml`), CodeRabbit uses it as-is. When no configuration file is found, most tools fall back to a profile-based default configuration so reviews still run without any setup required.

### Profiles

CodeRabbit offers two review profiles that control tool strictness:

* `Chill`: Focuses on critical issues and reduces noise from minor style violations
* `Assertive`: Provides comprehensive feedback including style and best practice suggestions

  ```yaml .coderabbit.yaml lines wrap icon="code" theme={null}
  reviews:
    profile: assertive
  ```

## Tool output and fixes

When tools detect issues, CodeRabbit attaches structured output under the **"Review details"** comment in your pull or merge request. Each entry shows the file path, line number, and the issue detected:

```shell lines wrap icon="code" theme={null}
ESLint
src/components/Button.tsx
12-12: 'React' must be in scope when using JSX

Add React import statement

(react/react-in-jsx-scope)
```

Many tools provide 1-click fixes that CodeRabbit can apply directly to your pull request, streamlining the review process.

## What's next

<CardGroup>
  <Card title="Tool catalog" href="/tools/list" icon="list">
    Browse all linters, security analyzers, and CI/CD integrations by category and technology.
  </Card>

  <Card title="Tool configuration reference" href="/tools/reference" icon="settings">
    See every YAML configuration option for each supported tool.
  </Card>

  <Card title="YAML configuration" href="/reference/configuration" icon="file-text">
    Full reference for all `.coderabbit.yaml` configuration options.
  </Card>
</CardGroup>


# LanguageTool
Source: https://docs.coderabbit.ai/tools/languagetool

CodeRabbit's guide to LanguageTool.

[LanguageTool](https://github.com/languagetool-org/languagetool) is a style and grammar checker.

## Files

LanguageTool will run on files with the following extensions:

* `.md`
* `.mdx`
* `.markdown`
* `.txt`

The following files are excluded:

* `CMakeLists.txt`
* `requirements.txt`

## Configuration

LanguageTool's style and grammar check depends on the language selected in CodeRabbit's configuration. You can set the language by setting the `language` field in your project's `.coderabbit.yaml` file or setting the "Review Language" field in CodeRabbit's settings page.

LanguageTool only runs when the hosted LanguageTool service credentials are available in the CodeRabbit environment.

CodeRabbit allows further configuring LanguageTool by setting specific rules and categories to be enabled/disabled. This can be done under the `reviews.tools.languagetool` field in your project's `.coderabbit.yaml` file or setting the various options under "Reviews → Tools → LanguageTool" in CodeRabbit's settings page. The following options are available:

* `enabled` - Enable or disable LanguageTool.
* `enabled_rules` - Enable specific rules.
* `disabled_rules` - Disable specific rules.
* `enabled_categories` - Enable specific categories.
* `disabled_categories` - Disable specific categories.
* `enabled_only`- Enable only the rules and categories of IDs are specified with 'enabledRules' or 'enabledCategories'.
* `level` - Set the level of feedback to be provided by LanguageTool. The following levels are available:
  * `default` - Provides feedback on common issues.
  * `picky` - Provides feedback on more issues, rules that you might only find useful when checking formal text.

## Default disabled categories and rules

The following categories are disabled by default:

* `TYPOS` - Typo detection
* `TYPOGRAPHY` - Typography issues
* `CASING` - Casing issues

The following rules are disabled by default:

* `EN_UNPAIRED_BRACKETS` - Unpaired brackets
* `EN_UNPAIRED_QUOTES` - Unpaired quotes

## Profile behavior

In **Chill** mode, LanguageTool filters out noisy rule patterns:

* `QB_NEW_EN*` - Experimental "There might be a mistake here" rules that generate many false positives

In **Assertive** mode, CodeRabbit still filters the noisy `QB_NEW_EN*` rules, but reports the remaining findings.

## Links

* [LanguageTool Rules](https://community.languagetool.org/rule/list?lang=en)


# Tool catalog
Source: https://docs.coderabbit.ai/tools/list

Browse all linters, security analyzers, and CI/CD tools supported by CodeRabbit.

Browse all third-party open-source linters, security analyzers, and CI/CD tools that CodeRabbit uses in code reviews. Click any tool name for its configuration guide.

## Multipurpose tools

These tools run on many or all file types in your repository. They identify general bugs and security risks, including pattern-based and semantic code analysis, secret exposure, insecure dependencies, misconfigured infrastructure-as-code, and causes of failing CI/CD pipelines.

| Tool                                                                                | Category                        |
| ----------------------------------------------------------------------------------- | ------------------------------- |
| [ast-grep](/tools/ast-grep), [OpenGrep](/tools/opengrep), [Semgrep](/tools/semgrep) | Code Quality, Code Security     |
| [Betterleaks](/tools/betterleaks), [SkillSpector](/tools/skillspector)              | Secret and Agent Skill Scanning |
| [Microsoft Presidio Analyzer](/tools/presidio)                                      | PII detection                   |
| [OSV-Scanner](/tools/osv-scanner)                                                   | Package Version Security        |
| [CI/CD Pipeline Analysis](/pr-reviews/cicd-pipeline-analysis)                       | CI/CD Generic User Configured   |
| [Checkov](/tools/checkov), [Trivy](/tools/trivy)                                    | IaC Code Security               |
| [TruffleHog](/tools/trufflehog)                                                     | Secret Scanning                 |
| [oasdiff](/tools/oasdiff)                                                           | API Compatibility               |

## Tools by category

| Category               | Tools                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Multipurpose           | [ast-grep](/tools/ast-grep), [OpenGrep](/tools/opengrep), [Semgrep](/tools/semgrep)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Security               | [Betterleaks](/tools/betterleaks), [SkillSpector](/tools/skillspector), [TruffleHog](/tools/trufflehog), [Microsoft Presidio Analyzer](/tools/presidio), [OSV-Scanner](/tools/osv-scanner), [Brakeman](/tools/brakeman)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Languages              | [ESLint](/tools/eslint), [Biome](/tools/biome), [Oxlint](/tools/oxlint), [React Doctor](/tools/react-doctor), [Ruff](/tools/ruff), [Pylint](/tools/pylint), [Flake8](/tools/flake8), [golangci-lint](/tools/golangci-lint), [Clippy](/tools/clippy), [RuboCop](/tools/rubocop), [SwiftLint](/tools/swiftlint), [PHPStan](/tools/phpstan), [PHPMD](/tools/phpmd), [PHPCS](/tools/phpcs), [PMD](/tools/pmd), [detekt](/tools/detekt), [Clang-Tidy](/tools/clang-tidy), [Cppcheck](/tools/cppcheck), [Infer](/tools/fbinfer), [Luacheck](/tools/luacheck), [ShellCheck](/tools/shellcheck), [Blinter](/tools/blinter), [Fortitude](/tools/fortitude), [Regal](/tools/regal), [PSScriptAnalyzer](/tools/psscriptanalyzer), [smarty-lint](/tools/smarty-lint), [SQLFluff](/tools/sqlfluff), [Squawk](/tools/squawk), [Prisma Lint](/tools/prisma-lint), [Stylelint](/tools/stylelint), [HTMLHint](/tools/htmlhint), [ember-template-lint](/tools/ember-template-lint), [YAMLlint](/tools/yamllint), [Dotenv Linter](/tools/dotenv), [Buf](/tools/buf), [oasdiff](/tools/oasdiff), [checkmake](/tools/checkmake), [Shopify Theme Check](/tools/shopify-cli) |
| Infrastructure as code | [Checkov](/tools/checkov), [Trivy](/tools/trivy), [TFLint](/tools/tflint), [Hadolint](/tools/hadolint)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| CI/CD                  | [actionlint](/tools/actionlint), [zizmor](/tools/zizmor), [CircleCI](/tools/circleci), [GitHub Checks](/tools/github-checks), [CI/CD Pipeline Analysis](/pr-reviews/cicd-pipeline-analysis)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| API specifications     | [oasdiff](/tools/oasdiff)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Docs and prose         | [markdownlint](/tools/markdownlint), [LanguageTool](/tools/languagetool)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |

## Tools by technology

The following tools are automatically selected and run based on the specific languages, file types, or frameworks detected in your repositories. CodeRabbit determines which tools to run depending on the contents of your codebase, recent changes, or the presence of relevant configuration files. Pipeline tools will only trigger based on platform or configured CircleCI integration.

| Technology                     | Tools                                                                                                        | Category                                             |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------- |
| Astro                          | [Biome](/tools/biome), [oxlint](/tools/oxlint), [ESLint](/tools/eslint)                                      | Code Quality                                         |
| Azure ARM                      | [Checkov](/tools/checkov), [Trivy](/tools/trivy)                                                             | Code Security                                        |
| Azure DevOps Pipelines         | [CI/CD Pipeline Analysis](/pr-reviews/cicd-pipeline-analysis)                                                | CI/CD Pipeline Analysis                              |
| CircleCI                       | [CircleCI](/tools/circleci)                                                                                  | Configuration Validation                             |
| CloudFormation                 | [Checkov](/tools/checkov), [Trivy](/tools/trivy)                                                             | Code Security                                        |
| C                              | [Infer](/tools/fbinfer), [Clang-Tidy](/tools/clang-tidy), [Cppcheck](/tools/cppcheck)                        | Code Quality                                         |
| C++                            | [Infer](/tools/fbinfer), [Clang-Tidy](/tools/clang-tidy), [Cppcheck](/tools/cppcheck)                        | Code Quality                                         |
| CSS                            | [Biome](/tools/biome), [Stylelint](/tools/stylelint), [ESLint](/tools/eslint)                                | Code Quality                                         |
| Docker                         | [Hadolint](/tools/hadolint), [Checkov](/tools/checkov), [Trivy](/tools/trivy)                                | Code Quality, Code Security                          |
| Docker Compose                 | [Checkov](/tools/checkov), [Trivy](/tools/trivy)                                                             | Code Security                                        |
| Environment Files (.env)       | [Dotenv Linter](/tools/dotenv)                                                                               | Code Quality                                         |
| Fortran                        | [Fortitude](/tools/fortitude)                                                                                | Code Quality                                         |
| GraphQL                        | [ESLint](/tools/eslint)                                                                                      | Code Quality                                         |
| GitHub Actions                 | [actionlint](/tools/actionlint), [zizmor](/tools/zizmor)                                                     | Code Quality, Code Security, CI/CD Pipeline Analysis |
| GitLab Pipelines               | [CI/CD Pipeline Analysis](/pr-reviews/cicd-pipeline-analysis)                                                | CI/CD Pipeline Analysis                              |
| Go                             | [golangci-lint](/tools/golangci-lint)                                                                        | Code Quality                                         |
| Helm                           | [Checkov](/tools/checkov), [Trivy](/tools/trivy)                                                             | Code Security                                        |
| HTML                           | [HTMLHint](/tools/htmlhint)                                                                                  | Code Quality                                         |
| Javascript                     | [Biome](/tools/biome), [oxlint](/tools/oxlint), [ESLint](/tools/eslint), [React Doctor](/tools/react-doctor) | Code Quality                                         |
| JSON, JSONC                    | [Biome](/tools/biome), [Checkov](/tools/checkov)                                                             | Code Quality                                         |
| JSX                            | [Biome](/tools/biome), [oxlint](/tools/oxlint), [ESLint](/tools/eslint), [React Doctor](/tools/react-doctor) | Code Quality                                         |
| Kotlin                         | [detekt](/tools/detekt)                                                                                      | Code Quality                                         |
| Kubernetes                     | [Checkov](/tools/checkov), [Trivy](/tools/trivy)                                                             | Code Security                                        |
| Less                           | [Stylelint](/tools/stylelint)                                                                                | Code Quality                                         |
| Lua                            | [Luacheck](/tools/luacheck)                                                                                  | Code Quality                                         |
| Makefile                       | [Checkmake](/tools/checkmake)                                                                                | Code Quality                                         |
| Markdown                       | [markdownlint](/tools/markdownlint), [LanguageTool](/tools/languagetool)                                     | Code Quality, Grammar Checking                       |
| OpenAPI, Swagger               | [oasdiff](/tools/oasdiff)                                                                                    | API Compatibility                                    |
| PHP                            | [PHPStan](/tools/phpstan), [PHPMD](/tools/phpmd), [PHPCS](/tools/phpcs)                                      | Code Quality                                         |
| Plaintext                      | [LanguageTool](/tools/languagetool)                                                                          | Grammar and Spell Checking                           |
| Java                           | [Infer](/tools/fbinfer), [PMD](/tools/pmd)                                                                   | Code Quality                                         |
| Protobuf                       | [Buf](/tools/buf)                                                                                            | Code Quality                                         |
| Python                         | [Ruff](/tools/ruff), [Pylint](/tools/pylint), [Flake8](/tools/flake8)                                        | Code Quality                                         |
| Jupyter Notebooks              | [Ruff](/tools/ruff), [Pylint](/tools/pylint), [Flake8](/tools/flake8)                                        | Code Quality                                         |
| React                          | [React Doctor](/tools/react-doctor), [ESLint](/tools/eslint), [Biome](/tools/biome), [oxlint](/tools/oxlint) | Code Quality                                         |
| Regal                          | [Regal](/tools/regal)                                                                                        | Code Quality                                         |
| OpenAPI                        | [oasdiff](/tools/oasdiff)                                                                                    | Code Quality                                         |
| PowerShell                     | [PSScriptAnalyzer](/tools/psscriptanalyzer)                                                                  | Code Quality                                         |
| Ruby                           | [RuboCop](/tools/rubocop), [Brakeman](/tools/brakeman)                                                       | Code Quality, Code Security                          |
| Rust                           | [Clippy](/tools/clippy)                                                                                      | Code Quality                                         |
| Sass                           | [Stylelint](/tools/stylelint)                                                                                | Code Quality                                         |
| Shell (sh, bash, ksh, dash)    | [ShellCheck](/tools/shellcheck)                                                                              | Code Quality                                         |
| Smarty                         | [smarty-lint](/tools/smarty-lint)                                                                            | Code Quality                                         |
| Windows Batch Files (bat, cmd) | [Blinter](/tools/blinter)                                                                                    | Code Quality                                         |
| Shopify                        | [Shopify Theme Check](/tools/shopify-cli)                                                                    | Code Quality                                         |
| SQL                            | [SQLFluff](/tools/sqlfluff), [Squawk](/tools/squawk)                                                         | Code Quality                                         |
| SCSS                           | [Stylelint](/tools/stylelint)                                                                                | Code Quality                                         |
| Stylus                         | [Stylelint](/tools/stylelint)                                                                                | Code Quality                                         |
| SugarSS                        | [Stylelint](/tools/stylelint)                                                                                | Code Quality                                         |
| Svelte                         | [Biome](/tools/biome), [oxlint](/tools/oxlint), [ESLint](/tools/eslint)                                      | Code Quality                                         |
| Swift                          | [SwiftLint](/tools/swiftlint)                                                                                | Code Quality                                         |
| Terraform                      | [TFLint](/tools/tflint), [Checkov](/tools/checkov), [Trivy](/tools/trivy)                                    | Code Quality, Code Security                          |
| TSX                            | [Biome](/tools/biome), [oxlint](/tools/oxlint), [ESLint](/tools/eslint), [React Doctor](/tools/react-doctor) | Code Quality                                         |
| Typescript                     | [Biome](/tools/biome), [oxlint](/tools/oxlint), [ESLint](/tools/eslint), [React Doctor](/tools/react-doctor) | Code Quality                                         |
| Vue                            | [Biome](/tools/biome), [oxlint](/tools/oxlint), [ESLint](/tools/eslint)                                      | Code Quality                                         |
| YAML                           | [YAMLlint](/tools/yamllint), [Checkov](/tools/checkov)                                                       | Code Quality, Code Security                          |
| Prisma                         | [Prisma Lint](/tools/prisma-lint)                                                                            | Code Quality                                         |

## What's next

<CardGroup>
  <Card title="Configuration reference" href="/tools/reference" icon="settings">
    See every YAML configuration option for each supported tool.
  </Card>

  <Card title="Configure your repository" href="/guides/configuration-overview" icon="file-text">
    Learn how to set up and customize CodeRabbit for your repository.
  </Card>
</CardGroup>


# Luacheck
Source: https://docs.coderabbit.ai/tools/luacheck

CodeRabbit's guide to Luacheck.

[Luacheck](https://github.com/mpeterv/luacheck) is a static analyzer and linter for Lua code that detects various issues such as undefined global variables, unused variables and values, accessing uninitialized variables, unreachable code, and more.

## Supported Files

Luacheck will run on files with the following extensions:

* `.lua`

## Configuration

Luacheck supports the following configuration files:

* `.luacheckrc`
* `luacheckrc`
* `.luacheckrc.lua`
* `luacheckrc.lua`

<Note>
  Luacheck does not require configuration to run. If no configuration file is found, it will use default settings.
</Note>

## When we skip LuaCheck

CodeRabbit will skip running LuaCheck when:

* LuaCheck is already running in GitHub workflows.

## Ignored rules

The following LuaCheck rules are automatically ignored:

* `W113` - accessing undefined variable
* `W611` - line too long
* `W112` - line contains only whitespace
* `W631` - line that ends with whitespace

## Profile behavior

In **Chill** mode, LuaCheck only reports errors (not warnings).

In **Assertive** mode, LuaCheck reports both errors and warnings.

## Features

Luacheck can detect:

* Usage of undefined global variables
* Unused variables and values
* Accessing uninitialized variables
* Unreachable code
* And many more issues

## Links

* [Luacheck GitHub Repository](https://github.com/mpeterv/luacheck)
* [Luacheck Documentation](https://luacheck.readthedocs.io/)


# markdownlint
Source: https://docs.coderabbit.ai/tools/markdownlint

CodeRabbit's guide to markdownlint.

[`markdownlint-cli2`](https://github.com/DavidAnson/markdownlint) is a linter for Markdown. CodeRabbit runs markdownlint-cli2 version 0.23.1.

## Files

Markdownlint will run on files with the following extensions:

* `.md`
* `.markdown`

## Configuration

`markdownlint-cli2` supports the following config files:

* `.markdownlint.jsonc`
* `.markdownlint.json`
* `.markdownlint.yaml`
* `.markdownlint.yml`
* `.markdownlint-cli2.json`
* `.markdownlint-cli2.yaml`
* `.markdownlint-cli2.js`

CodeRabbit will use the default settings based on the profile selected if no config file is found.

## When we skip markdownlint

CodeRabbit will skip running markdownlint when:

* markdownlint is already running in GitHub workflows.

## Ignored rules

The following markdownlint rules are automatically ignored:

* `MD004` - ul-style (disallows mixing of list markers)
* `MD012` - no-multiple-blanks (disallows multiple blank lines)
* `MD013` - line-length (enforces maximum line length)
* `MD025` - single-title, single-h1 (ensures only one H1 heading per file)
* `MD026` - no-trailing-punctuation (disallows trailing punctuation in headings)
* `MD032` - blanks-around-lists (disallows multiple blank lines around lists)
* `MD033` - no-inline-html (disallows inline HTML inside Markdown)
* `MD034` - no-bare-urls (disallows bare URLs)
* `MD036` - no-emphasis-as-heading (disallows emphasis instead of headings)
* `MD060` - table-column-count (table column count)
* `MD007` - ul-indent (unordered list indentation)
* `MD010` - no-hard-tabs (hard tabs)

## Links

* [`markdownlint-cli2` Configuration](https://github.com/DavidAnson/markdownlint?tab=readme-ov-file#configuration)


# oasdiff
Source: https://docs.coderabbit.ai/tools/oasdiff

How CodeRabbit runs oasdiff to detect breaking changes in OpenAPI and Swagger specifications.

[oasdiff](https://github.com/oasdiff/oasdiff) detects breaking changes between OpenAPI and Swagger specifications. CodeRabbit runs oasdiff version 1.26.0 and reports supported breaking API changes as review comments.

## Files

oasdiff runs on changed OpenAPI and Swagger specification files that match these patterns:

* `**/openapi.yaml`
* `**/openapi.yml`
* `**/openapi.json`
* `**/swagger.yaml`
* `**/swagger.yml`
* `**/swagger.json`
* `**/*.openapi.yaml`
* `**/*.openapi.yml`
* `**/*.openapi.json`
* `**/*.swagger.yaml`
* `**/*.swagger.yml`
* `**/*.swagger.json`

## How it works

When a supported specification file changes, CodeRabbit compares the previous version from the pull request base with the changed version and reports breaking API changes found by oasdiff. Findings are posted as review comments with the affected operation, path, section, and oasdiff fingerprint when available.

oasdiff findings use these severities:

* oasdiff error-level breaking changes are reported as errors.
* oasdiff warning-level breaking changes are reported as warnings.
* Lower-level findings are ignored by default.

## Configuration

oasdiff is enabled by default. You can disable it in `.coderabbit.yaml`:

```yaml .coderabbit.yaml lines theme={null}
reviews:
  tools:
    oasdiff:
      enabled: false
```

oasdiff can also use a repository configuration file. CodeRabbit looks for these files, preferring dotfile names first:

* `.oasdiff.yaml`
* `.oasdiff.yml`
* `.oasdiff.json`
* `.oasdiff.toml`
* `.oasdiff.hcl`
* `oasdiff.yaml`
* `oasdiff.yml`
* `oasdiff.json`
* `oasdiff.toml`
* `oasdiff.hcl`

If no oasdiff config file is present, CodeRabbit generates a profile-based config for the review.

## Profiles

* `Chill`: Reports higher-confidence breaking changes with reduced noise.
* `Assertive`: Reports a broader set of oasdiff warnings and errors.

## When we skip oasdiff

CodeRabbit skips oasdiff when:

* The pull request does not change a supported OpenAPI or Swagger specification file.
* The changed specification file has no previous version in the pull request base.
* oasdiff is already running in GitHub workflows.

## What's next

<CardGroup>
  <Card title="Buf" href="/tools/buf" icon="package">
    Lint Protobuf files for API consistency and style using Buf.
  </Card>

  <Card title="All supported tools" href="/tools/list" icon="list">
    Browse the complete list of linters, security analyzers, and CI/CD integrations available in CodeRabbit.
  </Card>

  <Card title="Configuration reference" href="/reference/configuration" icon="settings">
    Full reference for all available options, including how to enable, disable, and tune individual tools.
  </Card>
</CardGroup>


# OpenGrep
Source: https://docs.coderabbit.ai/tools/opengrep

CodeRabbit's guide to OpenGrep.

[OpenGrep](https://github.com/opengrep/opengrep) is a high-performance static code analysis engine for finding security vulnerabilities and bugs across many languages. It is compatible with Semgrep configurations, so you can use existing Semgrep rule sets. CodeRabbit runs OpenGrep version 1.26.0.

## Files

OpenGrep runs on files with the following extensions:

* **C/C++**: `.c`, `.cpp`, `.cc`, `.cxx`, `.c++`, `.h`, `.hpp`, `.hh`, `.hxx`, `.h++`
* **C#**: `.cs`
* **Go**: `.go`
* **Java**: `.java`
* **JavaScript/TypeScript**: `.js`, `.jsx`, `.ts`, `.tsx`
* **Kotlin**: `.kt`, `.kts`
* **Python**: `.py`
* **Ruby**: `.rb`
* **Rust**: `.rs`
* **PHP**: `.php`
* **Scala**: `.scala`
* **Swift**: `.swift`
* **Terraform**: `.tf`
* **JSON**: `.json`

## Configuration

OpenGrep is **Semgrep-compatible**. CodeRabbit looks for a config file in this order:

* `opengrep.yml`
* `opengrep.yaml`
* `opengrep.config.yml`
* `opengrep.config.yaml`
* `semgrep.yml`
* `semgrep.yaml`
* `semgrep.config.yml`
* `semgrep.config.yaml`

Search starts in the repository root and in PR-changed files, then falls back to a broader repository search. If no config file is found, CodeRabbit writes a temporary fallback config based on the selected review profile. If a repository's OpenGrep or Semgrep-compatible configuration cannot be loaded or contains an invalid rule, CodeRabbit falls back to its built-in rules so the scan still produces findings. A valid repository configuration is used as-is and keeps precedence—CodeRabbit does not rewrite or remove it.

## When we skip OpenGrep

CodeRabbit skips OpenGrep when:

* OpenGrep is disabled in your CodeRabbit configuration.
* No files in the pull request match the supported extensions.
* OpenGrep is already running in GitHub workflows.

## Links

* [OpenGrep GitHub](https://github.com/opengrep/opengrep)
* [Semgrep rule syntax](https://semgrep.dev/docs/writing-rules/rule-syntax/) (OpenGrep is compatible)


# OSV-Scanner
Source: https://docs.coderabbit.ai/tools/osv-scanner

Guide to using the OSV-Scanner tool with CodeRabbit's AI code reviews.

[OSV-Scanner](https://github.com/google/osv-scanner) is Google's vulnerability scanner that identifies vulnerabilities in your project's dependencies using the [OSV.dev](https://osv.dev) database.

## Files

OSV-Scanner scans the following manifest and lock files:

* `bun.lock`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`
* `requirements.txt`, `Pipfile.lock`, `poetry.lock`, `pdm.lock`, `pylock.toml`, `uv.lock`
* `go.mod`
* `pom.xml`, `buildscript-gradle.lockfile`, `gradle.lockfile`, `gradle/verification-metadata.xml`
* `Gemfile.lock`, `gems.locked`
* `composer.lock`
* `Cargo.lock`
* `pubspec.lock`
* `mix.lock`
* `renv.lock`
* `cabal.project.freeze`, `stack.yaml.lock`
* `conan.lock`
* `deps.json`
* `packages.lock.json`, `packages.config`

## Configuration

You can customize OSV-Scanner by adding an optional `osv-scanner.toml` configuration file to your repository.

<Note>
  OSV-Scanner runs without a config file. If your repository contains an `osv-scanner.toml` file, CodeRabbit uses it when running OSV-Scanner.
</Note>

## Notes

* OSV-Scanner scans dependency manifest and lock files to identify known vulnerabilities.
* Findings include vulnerability severity scores and details from the OSV.dev database.

## Profile behavior

* In **Chill** mode, CodeRabbit keeps only `high` and `critical` findings.
* In **Assertive** mode, CodeRabbit reports findings across all severities.

## Links

* [OSV-Scanner GitHub Repository](https://github.com/google/osv-scanner)
* [OSV-Scanner Documentation](https://google.github.io/osv-scanner/)
* [OSV.dev Database](https://osv.dev)


# Oxlint
Source: https://docs.coderabbit.ai/tools/oxlint

CodeRabbit's guide to Oxlint.

[Oxlint](https://oxc.rs/docs/guide/usage/linter) is a blazingly fast JavaScript/TypeScript linter written in Rust that is 50-100x faster than ESLint. CodeRabbit runs Oxlint version 1.75.0.

## Supported Files

Oxlint will run on files with the following extensions:

* `.js`
* `.mjs`
* `.cjs`
* `.jsx`
* `.ts`
* `.mts`
* `.cts`
* `.tsx`
* `.vue`
* `.astro`
* `.svelte`

## Configuration

Oxlint supports the following configuration files:

* `.oxlintrc.json`
* `oxlintrc.json`
* `.oxlintrc`
* `oxlint.json`

<Info>
  CodeRabbit only runs Oxlint when an Oxlint config file is present and Biome is disabled.
</Info>

## Security policy and restrictions

CodeRabbit runs Oxlint in a sandbox. Because JavaScript-based plugins can execute repository-controlled code, CodeRabbit does not run Oxlint analysis when the Oxlint configuration enables them. A non-empty `jsPlugins` array at the top level or inside any `overrides` entry causes CodeRabbit to skip Oxlint analysis. Configurations that omit `jsPlugins` or set it to an empty array continue to receive Oxlint findings as before.

Oxlint's built-in `plugins` setting continues to work and does not affect eligibility.

## When we skip Oxlint

CodeRabbit will skip running Oxlint when:

* Oxlint is already running in GitHub workflows.
* No Oxlint config file is found.
* Biome is enabled.
* The Oxlint configuration declares a non-empty JavaScript plugins array (`jsPlugins`) at the top level or inside any `overrides` entry.
* The repository's Oxlint configuration cannot be read, is not valid JSON, or does not parse to a JSON object.

## Links

* [Oxlint GitHub Repository](https://github.com/oxc-project/oxc/releases/)
* [Oxlint Website](https://oxc.rs/docs/guide/usage/linter)


# PHPCS
Source: https://docs.coderabbit.ai/tools/phpcs

CodeRabbit's guide to PHPCS.

[PHPCS](https://github.com/squizlabs/PHP_CodeSniffer) (PHP CodeSniffer) is a development tool that ensures your code conforms to a coding standard. It is an essential tool for any development team that wants to ensure their code is consistent and follows best practices.

## Files

PHPCS will run on files with the following extensions:

* `.php`

## Features

PHPCS can detect and fix various coding standard violations including:

* **PSR Standards**: Enforces PSR-1, PSR-2, PSR-12, and other coding standards
* **Custom Standards**: Supports custom coding standards and rules
* **Auto-fixing**: Can automatically fix many coding standard violations
* **Custom Rules**: Allows creation of custom sniff rules
* **Multiple Standards**: Can enforce multiple coding standards simultaneously

## Popular Standards

PHPCS supports many coding standards including:

* **PSR-1**: Basic Coding Standard
* **PSR-2**: Coding Style Guide
* **PSR-12**: Extended Coding Style
* **Squiz**: Squiz Labs coding standard
* **PEAR**: PEAR coding standard
* **Zend**: Zend Framework coding standard

## Configuration

PHPCS requires a configuration file to run. CodeRabbit will only run PHPCS if one of the following configuration files is found:

* `phpcs.xml` - XML configuration file
* `phpcs.xml.dist` - Distributed XML configuration file

CodeRabbit will not run PHPCS if no configuration file is found.

## When we skip PHPCS

CodeRabbit will skip running PHPCS when:

* PHPCS is disabled in the review profile (only runs in **Assertive** mode).
* No config file is found (`phpcs.xml` or `phpcs.xml.dist`).
* The config file does not appear to be a valid PHPCS ruleset (missing `<ruleset` or `<?xml` tags).

## Profile behavior

PHPCS only runs in **Assertive** mode. In **Chill** mode, PHPCS is skipped entirely.

## Links

* [PHPCS GitHub Repository](https://github.com/squizlabs/PHP_CodeSniffer)
* [PHPCS Documentation](https://github.com/squizlabs/PHP_CodeSniffer/wiki)
* [Available Coding Standards](https://github.com/squizlabs/PHP_CodeSniffer/wiki/Coding-Standards)
* [Creating Custom Standards](https://github.com/squizlabs/PHP_CodeSniffer/wiki/Coding-Standards#creating-a-coding-standard)


# PHPMD
Source: https://docs.coderabbit.ai/tools/phpmd

CodeRabbit's guide to PHPMD.

[PHPMD](https://phpmd.org/) (PHP Mess Detector) is a static analysis tool for PHP that detects potential problems in your code such as possible bugs, suboptimal code, overcomplicated expressions, and unused parameters, variables, methods, and classes.

## Files

PHPMD will run on files with the following extensions:

* `.php`

## Features

PHPMD can detect various code quality issues including:

* **Clean Code Rules**: Detects code smells and violations of clean code principles
* **Controversial Rules**: Identifies potentially problematic code patterns
* **Design Rules**: Finds design-related issues and architectural problems
* **Naming Rules**: Checks for naming convention violations
* **Unused Code Rules**: Detects unused variables, parameters, methods, and classes
* **Size Rules**: Identifies overly complex methods and classes

## When we skip PHPMD

CodeRabbit will skip running PHPMD when:

* PHPMD is already running in GitHub workflows.

## Profile behavior

CodeRabbit's review profile affects which PHPMD rules are applied:

* **Chill Mode**: Only checks for unused code (`unusedcode` rule set)
* **Assertive Mode**: Checks all rule sets including clean code, code size, controversial rules, design issues, naming conventions, and unused code (`cleancode,codesize,controversial,design,naming,unusedcode`)

## Links

* [PHPMD Official Website](https://phpmd.org/)
* [PHPMD GitHub Repository](https://github.com/phpmd/phpmd)
* [PHPMD Documentation](https://phpmd.org/documentation/index.html)
* [Available Rules](https://phpmd.org/rules/index.html)


# PHPStan
Source: https://docs.coderabbit.ai/tools/phpstan

CodeRabbit's guide to PHPStan.

[PHPStan](https://phpstan.org/) is a static analysis tool for PHP. CodeRabbit runs PHPStan version 2.2.6.

## Files

PHPStan will run on files with the following extensions:

* `.php`

## Configuration

PHPStan supports the following config files:

* `phpstan.neon`
* `phpstan.neon.dist`
* `phpstan.dist.neon`

If no PHPStan config file is found, CodeRabbit writes a temporary config based on the selected review profile.

## What CodeRabbit runs

PHPStan runs in a sandbox with the project config if present. If a project config is present, we parse and validate the config before execution.

## Security policy and restrictions

* We reject `phpstan.neon`/`phpstan.neon.dist` that declare `bootstrapFile` or `bootstrapFiles` to prevent executing arbitrary project bootstrap code.
* Blocked configuration keys include:
  * `bootstrapFiles`
  * `bootstrapFile`

## When we skip PHPStan

CodeRabbit will skip running PHPStan when:

* The config file does not contain a `paths:` parameter.
* The config contains `bootstrapFile` or `bootstrapFiles`.
* PHPStan is already running in GitHub workflows.
* Config parsing fails or appears unsafe.

## Links

* [PHPStan Configuration](https://phpstan.org/config-reference)


# PMD
Source: https://docs.coderabbit.ai/tools/pmd

CodeRabbit's guide to PMD.

[PMD](https://pmd.github.io/) is an extensible multilanguage static code analyzer. It's mainly concerned with Java. CodeRabbit runs PMD version 7.26.0.

## Files

PMD will run on files with the following extensions:

* `.java`
* `.jsp`
* `.kt` (Kotlin)
* `.apex` (Salesforce Apex)
* `pom.xml` (Maven)

## Configuration

PMD uses an XML configuration file when one is available. If no PMD configuration is present, CodeRabbit generates a default ruleset based on the selected review profile.

PMD supports the following config files:

* User-defined config file set at `reviews.tools.pmd.config_file` in your project's `.coderabbit.yaml` file or setting the "Reviews → Tools → PMD → Config File" field in CodeRabbit's settings page.

* If no user-defined config file is found, CodeRabbit looks for the following config file in the repo:
  * `ruleset.xml`

If neither a user-defined config file nor `ruleset.xml` is found, CodeRabbit uses its generated default ruleset.

## When we skip PMD

CodeRabbit will skip running PMD when:

* PMD is disabled in CodeRabbit settings or `.coderabbit.yaml`.
* PMD is already running in GitHub workflows.

## Links

* [PMD Configuring rules](https://pmd.github.io/pmd/pmd_userdocs_configuring_rules.html)


# Microsoft Presidio Analyzer
Source: https://docs.coderabbit.ai/tools/presidio

CodeRabbit's guide to Microsoft Presidio Analyzer.

[Microsoft Presidio Analyzer](https://microsoft.github.io/presidio/) detects sensitive data patterns in text. CodeRabbit can use it to scan changed text files for high-signal personally identifiable information (PII) and surface findings directly in pull request reviews.

Presidio is opt-in. Enable it in your `.coderabbit.yaml` file or in CodeRabbit settings before expecting Presidio findings in reviews.

```yaml theme={null}
reviews:
  tools:
    presidio:
      enabled: true
```

## Files

When enabled, Presidio runs against all non-binary files changed in any pull request.

## Configuration File

If your repository includes a `.presidiocli` configuration file, CodeRabbit will run Presidio using your `.presidiocli`. If you enable Presidio without adding this file, CodeRabbit will generate and use the following default `.presidiocli`:

```
language: en
threshold: 0.35
ignore: |
  .git
entities:
  - CREDIT_CARD
  - US_SSN
  - CRYPTO
  - PHONE_NUMBER
```

### Supported entities

CodeRabbit supports the following Presidio entity types:

* `CREDIT_CARD`
* `CRYPTO`
* `EMAIL_ADDRESS`
* `IBAN_CODE`
* `PHONE_NUMBER`
* `US_BANK_NUMBER`
* `US_ITIN`
* `US_SSN`

## Links

* [Microsoft Presidio documentation](https://microsoft.github.io/presidio/)
* [GitHub Repository](https://github.com/microsoft/presidio)


# Prisma Lint
Source: https://docs.coderabbit.ai/tools/prisma-lint

CodeRabbit's guide to Prisma Lint.

[Prisma Lint](https://github.com/loop-payments/prisma-lint) is a linter for Prisma schema files that helps enforce consistent conventions and best practices in your Prisma schemas.

## Files

Prisma Lint will run on files with the following extensions:

* `.prisma`

## Configuration

Prisma Lint supports the following config files:

* `.prismalintrc.json`
* `.prismalintrc`
* `.prismalintrc.js`
* `.prismalintrc.yaml`
* `.prismalintrc.yml`
* `prismalint.config.js`

<Note>
  CodeRabbit runs Prisma Lint against changed `.prisma` files in the pull request.
</Note>

## When we skip Prisma Lint

CodeRabbit will skip running Prisma Lint when:

* No Prisma schema files are found in the pull request.
* No config file is found.
* Prisma Lint is already running in GitHub workflows.

## Rule Configuration

Rules can be configured in your `.prismalintrc.json` file. See the [Prisma Lint Rules Documentation](https://github.com/loop-payments/prisma-lint/blob/main/RULES.md) for more information on the available rules and their configuration options.

## Links

* [Prisma Lint GitHub Repository](https://github.com/loop-payments/prisma-lint)
* [Prisma Lint Rules Documentation](https://github.com/loop-payments/prisma-lint/blob/main/RULES.md)


# PSScriptAnalyzer
Source: https://docs.coderabbit.ai/tools/psscriptanalyzer

CodeRabbit's guide to PSScriptAnalyzer.

[PSScriptAnalyzer](https://github.com/PowerShell/PSScriptAnalyzer) is a static code checker for PowerShell scripts and modules. It checks script and module code for best-practice violations and common issues.

## Files

PSScriptAnalyzer runs on files with the following extensions:

* `.ps1` (PowerShell scripts)
* `.psm1` (PowerShell modules)
* `.psd1` (PowerShell data files / module manifests)

## Configuration

You can enable or disable PSScriptAnalyzer in your CodeRabbit configuration (see [Tools reference](/reference/tools-reference) and [Configuration reference](/reference/configuration)).

## Links

* [PSScriptAnalyzer GitHub](https://github.com/PowerShell/PSScriptAnalyzer)
* [PSScriptAnalyzer documentation](https://learn.microsoft.com/en-us/powershell/utility-modules/psscriptanalyzer/overview?view=ps-modules)


# Pylint
Source: https://docs.coderabbit.ai/tools/pylint

CodeRabbit's guide to Pylint.

[Pylint](https://pylint.pycqa.org/) is a static code analysis tool for Python or Jupiter Notebooks. It checks your Python code for errors, enforces a coding standard, and looks for code smells.

## Supported Files

Pylint will run on files with the following extensions:

* `*.py`
* `.ipynb` (using nbQA)

## Configuration

Pylint supports the following config files:

* `.pylintrc`
* `pylintrc`
* `.pylintrc.toml`
* `pylintrc.toml`

CodeRabbit will not run Pylint if no config file is found.

## What CodeRabbit runs

Pylint runs per-file in a sandbox. We validate the config before execution.

## Security policy and restrictions

* We skip if the config declares `init-hook`, which can execute arbitrary Python code at startup.

## When we skip Pylint

CodeRabbit will skip running Pylint when:

* No config file is found.
* The config contains `init-hook`.
* Pylint is already running in GitHub workflows.
* Config parsing fails or appears unsafe.

## Profile behavior

In **Chill** mode, Pylint filters out:

* Warnings and conventions
* `E0401` (Unable to import)
* `C0301` (Line too long)

In **Assertive** mode, all findings are reported.

## Features

Pylint can detect many issues such as:

* Coding standard violations (PEP8)
* Unused variables and imports
* Undefined variables
* Code smells and refactoring suggestions
* Error-prone constructs
* And many more

## Links

* [Pylint Official Website](https://pylint.pycqa.org/)
* [Pylint GitHub Repository](https://github.com/pylint-dev/pylint)
* [Pylint Documentation](https://pylint.pycqa.org/en/latest/)
* [Message Control](https://pylint.pycqa.org/en/latest/user_guide/message-control.html)
* [nbQA Documentation](https://github.com/nbQA-dev/nbQA)


# React Doctor
Source: https://docs.coderabbit.ai/tools/react-doctor

How CodeRabbit runs React Doctor to find React security, performance, correctness, and accessibility issues.

[React Doctor](https://github.com/millionco/react-doctor) scans React codebases for security, performance, correctness, and accessibility issues. CodeRabbit runs React Doctor version 0.9.1 on relevant changed files in a secure sandbox.

## Files

React Doctor runs on changed files with these extensions:

* `.jsx`
* `.tsx`
* `.ts`
* `.js`
* `.mjs`
* `.cjs`

CodeRabbit only runs React Doctor when the changed files include a JSX file (`.jsx` or `.tsx`) or when a nearby `package.json` declares a React project dependency such as `react`, `react-dom`, `react-native`, `preact`, or `@preact/compat`.

## Configuration

React Doctor is enabled by default. You can disable it in `.coderabbit.yaml`:

```yaml .coderabbit.yaml lines theme={null}
reviews:
  tools:
    reactDoctor:
      enabled: false
```

React Doctor also appears in the CodeRabbit web UI under **Reviews → Tools → React Doctor**.

CodeRabbit supports these static React Doctor config files:

* `doctor.config.json`
* `doctor.config.jsonc`
* `react-doctor.config.json`

CodeRabbit also reads `reactDoctor` configuration from `package.json`. If a package uses `package.json` configuration without a supported static config file, CodeRabbit writes a temporary `doctor.config.json` beside that `package.json` using the selected review profile.

## Profiles

* `Chill`: Reports security findings and definite bug findings. Performance, accessibility, maintainability, design-tagged, and test-noise-tagged rules are disabled.
* `Assertive`: Reports security and bug findings, plus performance and accessibility findings at their React Doctor default severity. Maintainability and test-noise-tagged rules remain disabled.

CodeRabbit also disables these React Doctor rules in both profiles:

* `react-doctor/no-vulnerable-react-server-components`
* `react-doctor/no-barrel-import`
* `react-doctor/nextjs-no-img-element`
* `react-doctor/js-combine-iterations`
* `react-doctor/prefer-module-scope-pure-function`
* `react-doctor/prefer-module-scope-static-value`
* `react-doctor/only-export-components`
* `react-doctor/no-giant-component`
* `react-doctor/no-multi-comp`

## Security policy and restrictions

React Doctor runs inside the CodeRabbit sandbox with the sandbox-installed `react-doctor` package. CodeRabbit does not install project npm packages or run repository-supplied React Doctor plugins.

Executable React Doctor config files are not supported:

* `doctor.config.ts`
* `doctor.config.js`
* `doctor.config.mjs`
* `doctor.config.cjs`
* `doctor.config.mts`
* `doctor.config.cts`

CodeRabbit skips React Doctor if a supported static config file or `package.json` `reactDoctor` configuration declares a non-empty `plugins` array. React Doctor dead-code analysis is disabled in CodeRabbit runs.

## When we skip React Doctor

CodeRabbit skips React Doctor when:

* React Doctor is disabled in CodeRabbit settings.
* The pull request does not change a supported file type.
* The changed files do not include JSX and no nearby `package.json` declares a React project dependency.
* React Doctor is already running in GitHub workflows.
* The repository contains an executable React Doctor config file.
* A React Doctor config declares non-empty plugins.

## What's next

<CardGroup>
  <Card title="ESLint" href="/tools/eslint" icon="file-code">
    Review how CodeRabbit runs ESLint for JavaScript, TypeScript, and framework files.
  </Card>

  <Card title="Oxlint" href="/tools/oxlint" icon="zap">
    Learn how CodeRabbit runs Oxlint for JavaScript and TypeScript projects.
  </Card>

  <Card title="All supported tools" href="/tools/list" icon="list">
    Browse the complete list of linters, security analyzers, and CI/CD integrations available in CodeRabbit.
  </Card>
</CardGroup>


# Tools configuration reference
Source: https://docs.coderabbit.ai/tools/reference

Complete reference for all CodeRabbit supported tools and their configuration options.

<Info>
  This reference is generated automatically. **Last updated: August 4, 2026**
</Info>

CodeRabbit supports integration with **57 static analysis tools**, linters, and security scanners. You can configure each tool individually via the web interface or your `.coderabbit.yaml` file, see the [configuration overview](/guides/configuration-overview) for details.

## All tools

<AccordionGroup>
  <Accordion title="actionlint" icon="github">
    actionlint is a static checker for GitHub Actions workflow files.

    * [Configuration guide](/tools/actionlint)
    * [actionlint web page](https://github.com/rhysd/actionlint)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable actionlint | actionlint is a static checker for GitHub Actions workflow files. | v1.7.12

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        actionlint:
          enabled: true
    ```
  </Accordion>

  <Accordion title="ast-grep" icon="search">
    Enable ast-grep | ast-grep is a code analysis tool that helps you to find patterns in your codebase using abstract syntax trees patterns. | v0.45.0

    * [Configuration guide](/tools/ast-grep)
    * [ast-grep web page](https://ast-grep.github.io)

    **Configuration options:**

    <ResponseField name="rule_dirs" type="array of string">
      List of rules directories.

      Defaults to `[]`.
    </ResponseField>

    <ResponseField name="util_dirs" type="array of string">
      List of utils directories.

      Defaults to `[]`.
    </ResponseField>

    <ResponseField name="essential_rules" type="boolean">
      Use ast-grep essentials package.

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="packages" type="array of string">
      Predefined packages to be used.

      Defaults to `[]`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        ast-grep:
          rule_dirs: []
          util_dirs: []
          essential_rules: true
          packages: []
    ```
  </Accordion>

  <Accordion title="Biome" icon="wind">
    Biome is a fast formatter, linter, and analyzer for web projects.

    * [Configuration guide](/tools/biome)
    * [Biome web page](https://biomejs.dev)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Biome | Biome is a fast formatter, linter, and analyzer for web projects. | Enable Biome integration. | v2.5.6

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        biome:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Blinter" icon="terminal">
    Blinter is a linter for Windows batch files that provides comprehensive static analysis to identify syntax errors, security vulnerabilities, performance issues, and style problems.

    * [Configuration guide](/tools/blinter)
    * [Blinter web page](https://github.com/tboy1337/Blinter)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Blinter | Blinter is a linter for Windows batch files that provides comprehensive static analysis to identify syntax errors, security vulnerabilities, performance issues, and style problems. | v1.0.113

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        blinter:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Brakeman" icon="shield">
    Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications. | v8.0.5

    * [Configuration guide](/tools/brakeman)
    * [Brakeman web page](https://brakemanscanner.org)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Brakeman | Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications. | v8.0.5

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        brakeman:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Buf" icon="package">
    Buf offers linting for Protobuf files.

    * [Configuration guide](/tools/buf)
    * [Buf web page](https://buf.build)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Buf | Buf offers linting for Protobuf files. | v1.72.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        buf:
          enabled: true
    ```
  </Accordion>

  <Accordion title="checkmake" icon="hammer">
    checkmake is a linter for Makefiles.

    * [Configuration guide](/tools/checkmake)
    * [checkmake web page](https://github.com/mrtazz/checkmake)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable checkmake | checkmake is a linter for Makefiles. | v0.3.2

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        checkmake:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Checkov" icon="cloud">
    Checkov is a static code analysis tool for infrastructure-as-code files.

    * [Configuration guide](/tools/checkov)
    * [Checkov web page](https://www.checkov.io)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Checkov | Checkov is a static code analysis tool for infrastructure-as-code files. | v3.3.9

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        checkov:
          enabled: true
    ```
  </Accordion>

  <Accordion title="CircleCI" icon="circle">
    CircleCI tool is a static checker for CircleCI config files.

    * [Configuration guide](/tools/circleci)
    * [CircleCI web page](https://circleci.com)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable CircleCI | CircleCI tool is a static checker for CircleCI config files. | v0.1.38646

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        circleci:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Clang" icon="wrench">
    Configuration for Clang to perform static analysis on C and C++ code

    * [Configuration guide](/tools/clang-tidy)
    * [Clang web page](https://clang.llvm.org/extra/clang-tidy)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Clang for C/C++ static analysis and code quality checks | v14.0.6

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        clang:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Clippy" icon="wrench">
    Clippy is a collection of lints to catch common mistakes and improve your Rust code.

    * [Configuration guide](/tools/clippy)
    * [Clippy web page](https://github.com/rust-lang/rust-clippy)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Clippy | Clippy is a collection of lints to catch common mistakes and improve your Rust code. | Enable Clippy integration.

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        clippy:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Cppcheck" icon="code">
    Cppcheck is a static code analysis tool for the C and C++ programming languages.

    * [Configuration guide](/tools/cppcheck)
    * [Cppcheck web page](https://cppcheck.sourceforge.io)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Cppcheck | Cppcheck is a static code analysis tool for the C and C++ programming languages. | v2.21.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        cppcheck:
          enabled: true
    ```
  </Accordion>

  <Accordion title="detekt" icon="braces">
    Detekt is a static code analysis tool for Kotlin files.

    * [Configuration guide](/tools/detekt)
    * [detekt web page](https://detekt.dev)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable detekt | detekt is a static code analysis tool for Kotlin files. | v1.23.8

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="config_file" type="string">
      Optional path to the detekt configuration file relative to the repository.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        detekt:
          enabled: true
          config_file: "detekt.yml"
    ```
  </Accordion>

  <Accordion title="Dotenv Lint" icon="file-key">
    dotenv-linter is a tool for checking and fixing .env files for problems and best practices

    * [Configuration guide](/tools/dotenv)
    * [Dotenv Lint web page](https://github.com/dotenv-linter/dotenv-linter)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable dotenv-linter | dotenv-linter is a tool for checking and fixing .env files for problems and best practices | v4.0.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        dotenvLint:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Ember Template Lint" icon="braces">
    ember-template-lint is a linter for Handlebars template files that checks for common issues such as accessibility violations, deprecated patterns, and template anti-patterns.

    * [Configuration guide](/tools/ember-template-lint)
    * [Ember Template Lint web page](https://github.com/ember-template-lint/ember-template-lint)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable ember-template-lint | ember-template-lint is a linter for Handlebars template files that checks for common issues such as accessibility violations, deprecated patterns, and template anti-patterns. | v7.9.3

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        emberTemplateLint:
          enabled: true
    ```
  </Accordion>

  <Accordion title="ESLint" icon="code">
    ESLint is a static code analysis tool for JavaScript files.

    * [Configuration guide](/tools/eslint)
    * [ESLint web page](https://eslint.org)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable ESLint | ESLint is a static code analysis tool for JavaScript files.

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="e18e" type="object">
      @e18e/eslint-plugin modernization, performance, and dependency replacement checks.

      Defaults to `{}`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        eslint:
          enabled: true
          e18e: {}
    ```
  </Accordion>

  <Accordion title="Flake8" icon="python">
    Flake8 is a Python linter that wraps PyFlakes, pycodestyle and Ned Batchelder's McCabe script.

    * [Configuration guide](/tools/flake8)
    * [Flake8 web page](https://flake8.pycqa.org)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Flake8 | Flake8 is a Python linter that wraps PyFlakes, pycodestyle and Ned Batchelder's McCabe script. | v7.3.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        flake8:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Fortitude" icon="code">
    Fortitude is a Fortran linter that checks for code quality and style issues.

    * [Configuration guide](/tools/fortitude)
    * [Fortitude web page](https://github.com/PlasmaFAIR/fortitude)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Fortitude | Fortitude is a Fortran linter that checks for code quality and style issues | v0.9.2

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        fortitudeLint:
          enabled: true
    ```
  </Accordion>

  <Accordion title="GitHub Checks" icon="github">
    GitHub Checks integration configuration.

    * [Configuration guide](/tools/github-checks)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable GitHub Checks
      \| Enable integration, defaults to true
      \| Enable GitHub Checks integration.

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="timeout_ms" type="number">
      Time in milliseconds to wait for all GitHub Checks to conclude. Default 90 seconds, max 15 minutes (900000ms).

      Defaults to `90000`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        github-checks:
          enabled: true
          timeout_ms: 90000
    ```
  </Accordion>

  <Accordion title="Gitleaks" icon="key">
    Betterleaks is a secret scanner (an improved version of Gitleaks).

    * [Configuration guide](/tools/betterleaks)
    * [Gitleaks web page](https://github.com/betterleaks/betterleaks)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Betterleaks | Betterleaks is a secret scanner (an improved version of Gitleaks). | Enable Betterleaks integration. | v1.7.3

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        gitleaks:
          enabled: true
    ```
  </Accordion>

  <Accordion title="golangci-lint" icon="braces">
    golangci-lint is a fast linters runner for Go.

    * [Configuration guide](/tools/golangci-lint)
    * [golangci-lint web page](https://golangci-lint.run)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable golangci-lint | golangci-lint is a fast linters runner for Go. | Enable golangci-lint integration. | v2.12.2

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="config_file" type="string">
      Optional path to the golangci-lint configuration file relative to the repository. Useful when the configuration file is named differently than the default '.golangci.yml', '.golangci.yaml', '.golangci.toml', '.golangci.json'.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        golangci-lint:
          enabled: true
          config_file: ".golangci.yml"
    ```
  </Accordion>

  <Accordion title="Hadolint" icon="box">
    Hadolint is a Dockerfile linter.

    * [Configuration guide](/tools/hadolint)
    * [Hadolint web page](https://github.com/hadolint/hadolint)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Hadolint | Hadolint is a Dockerfile linter. | Enable Hadolint integration. | v2.15.1

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        hadolint:
          enabled: true
    ```
  </Accordion>

  <Accordion title="HTMLHint" icon="code">
    HTMLHint is a static code analysis tool for HTML files.

    * [Configuration guide](/tools/htmlhint)
    * [HTMLHint web page](https://htmlhint.com)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable HTMLHint | HTMLHint is a static code analysis tool for HTML files. | Enable HTMLHint integration. | v1.9.2

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        htmlhint:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Infer" icon="code">
    Configuration for Infer to find bugs in Java and C/C++ code

    * [Configuration guide](/tools/fbinfer)
    * [Infer web page](https://fbinfer.com)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Infer for static bug analysis in Java and C/C++ code | v1.3.0

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="enable_java" type="boolean">
      Enable Java analysis | Disabled by default because Java analysis may require compiling more than the changed files.

      Defaults to `false`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        fbinfer:
          enabled: true
    ```
  </Accordion>

  <Accordion title="LanguageTool" icon="languages">
    LanguageTool is a style and grammar checker for 30+ languages.

    * [Configuration guide](/tools/languagetool)
    * [LanguageTool web page](https://languagetool.org)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable LanguageTool | Enable LanguageTool integration.

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="enabled_rules" type="array of string">
      IDs of rules to be enabled. The rule won't run unless 'level' is set to a level that activates the rule.

      Defaults to `[]`.
    </ResponseField>

    <ResponseField name="disabled_rules" type="array of string">
      IDs of rules to be disabled. Note: EN\_UNPAIRED\_BRACKETS, and EN\_UNPAIRED\_QUOTES are always disabled.

      Defaults to `[]`.
    </ResponseField>

    <ResponseField name="enabled_categories" type="array of string">
      IDs of categories to be enabled.

      Defaults to `[]`.
    </ResponseField>

    <ResponseField name="disabled_categories" type="array of string">
      IDs of categories to be disabled. Note: TYPOS, TYPOGRAPHY, and CASING are always disabled.

      Defaults to `[]`.
    </ResponseField>

    <ResponseField name="enabled_only" type="boolean">
      Only the rules and categories whose IDs are specified with 'enabledRules' or 'enabledCategories' are enabled.

      Defaults to `false`.
    </ResponseField>

    <ResponseField name="level" type="enum">
      If set to 'picky', additional rules will be activated, i.e. rules that you might only find useful when checking formal text.

      One of: `default`, `picky`

      Defaults to `"default"`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        languagetool:
          enabled: true
          enabled_rules: []
          disabled_rules: []
          enabled_categories: []
          disabled_categories: []
          level: "default"
    ```
  </Accordion>

  <Accordion title="Luacheck" icon="moon">
    Configuration for Lua code linting to ensure code quality

    * [Configuration guide](/tools/luacheck)
    * [Luacheck web page](https://github.com/mpeterv/luacheck)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Lua code linting | Luacheck helps maintain consistent and error-free Lua code | v1.2.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        luacheck:
          enabled: true
    ```
  </Accordion>

  <Accordion title="markdownlint" icon="file-text">
    markdownlint-cli2 is a static analysis tool to enforce standards and consistency for Markdown files.

    * [Configuration guide](/tools/markdownlint)
    * [markdownlint web page](https://github.com/DavidAnson/markdownlint)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable markdownlint | markdownlint-cli2 is a static analysis tool to enforce standards and consistency for Markdown files. | Enable markdownlint integration. | v0.23.2

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        markdownlint:
          enabled: true
    ```
  </Accordion>

  <Accordion title="oasdiff" icon="git-compare">
    oasdiff detects breaking changes between OpenAPI specifications.

    * [Configuration guide](/tools/oasdiff)
    * [oasdiff web page](https://github.com/oasdiff/oasdiff)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable oasdiff | oasdiff detects breaking changes between OpenAPI specifications. | v1.27.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        oasdiff:
          enabled: true
    ```
  </Accordion>

  <Accordion title="OpenGrep" icon="search">
    OpenGrep is a high-performance static code analysis engine, compatible with Semgrep configurations.

    * [Configuration guide](/tools/opengrep)
    * [OpenGrep web page](https://github.com/opengrep/opengrep)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable OpenGrep | OpenGrep is a high-performance static code analysis engine for finding security vulnerabilities and bugs across 17+ languages. | v1.26.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        opengrep:
          enabled: true
    ```
  </Accordion>

  <Accordion title="OSV Scanner" icon="shield">
    OSV Scanner is a tool for vulnerability package scanning.

    * [Configuration guide](/tools/osv-scanner)
    * [OSV Scanner web page](https://google.github.io/osv-scanner)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable OSV Scanner | OSV Scanner is a tool for vulnerability package scanning | v2.4.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        osvScanner:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Oxlint" icon="zap">
    Oxlint is a JavaScript/TypeScript linter for OXC written in Rust.

    * [Configuration guide](/tools/oxlint)
    * [Oxlint web page](https://oxc.rs/docs/guide/usage/linter)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Oxlint | Oxlint is a JavaScript/TypeScript linter for OXC written in Rust. | v1.76.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        oxc:
          enabled: true
    ```
  </Accordion>

  <Accordion title="PHP CodeSniffer" icon="php">
    PHP CodeSniffer is a PHP linter and coding standard checker.

    * [Configuration guide](/tools/phpcs)
    * [PHP CodeSniffer web page](https://github.com/squizlabs/PHP_CodeSniffer)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable PHP CodeSniffer | PHP CodeSniffer is a PHP linter and coding standard checker. | v3.7.2

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        phpcs:
          enabled: true
    ```
  </Accordion>

  <Accordion title="PHPMD" icon="php">
    PHPMD is a tool to find potential problems in PHP code.

    * [Configuration guide](/tools/phpmd)
    * [PHPMD web page](https://phpmd.org)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable PHPMD | PHPMD is a tool to find potential problems in PHP code. | v2.15.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        phpmd:
          enabled: true
    ```
  </Accordion>

  <Accordion title="PHPStan" icon="php">
    PHPStan is a tool to analyze PHP code.

    * [Configuration guide](/tools/phpstan)
    * [PHPStan web page](https://phpstan.org)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable PHPStan | PHPStan requires [config file](https://phpstan.org/config-reference#config-file) in your repository root. Please ensure that this file contains the `paths:` parameter. | v2.2.7

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="level" type="enum">
      Level | Specify the [rule level](https://phpstan.org/user-guide/rule-levels) to run. When set to `default`, the level is determined by the review profile: `chill` uses level 3 (real bugs only — return/property type mismatches, array offset errors) and `assertive` uses level 8 (adds dead code detection, argument type checking, null safety, and typehint checks). This setting is ignored if your configuration file already has a `level:` parameter.

      One of: `0`, `1`, `2`, `3`, `4`, `5`, `6`, `7`, `8`, `9`, `default`, `max`

      Defaults to `"default"`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        phpstan:
          enabled: true
          level: "default"
    ```
  </Accordion>

  <Accordion title="PMD" icon="coffee">
    PMD is an extensible multilanguage static code analyzer. It’s mainly concerned with Java.

    * [Configuration guide](/tools/pmd)
    * [PMD web page](https://pmd.github.io)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable PMD | PMD is an extensible multilanguage static code analyzer. It’s mainly concerned with Java. | v7.26.0

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="config_file" type="string">
      Optional path to the PMD configuration file relative to the repository.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        pmd:
          enabled: true
          config_file: "ruleset.xml"
    ```
  </Accordion>

  <Accordion title="Presidio" icon="shield">
    Microsoft Presidio Analyzer 2.2.364 detects sensitive identifiers (including payment cards, US SSN, cryptocurrency wallets, and phone numbers) in changed files. Tune entities, thresholds, and languages in repository Presidio configuration (for example .presidiocli or AnalyzerEngineProvider YAML); the built-in scan uses fixed defaults and is skipped when that configuration is present.

    * [Configuration guide](/tools/presidio)
    * [Presidio web page](https://microsoft.github.io/presidio)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Microsoft Presidio Analyzer for high-signal PII in changed files | v2.2.364

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        presidio:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Prisma Lint" icon="database">
    Configuration for Prisma Schema linting to ensure schema file quality

    * [Configuration guide](/tools/prisma-lint)
    * [Prisma Lint web page](https://github.com/loop-payments/prisma-lint)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Prisma Schema linting | Prisma Schema linting helps maintain consistent and error-free schema files | v0.13.1

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        prismaLint:
          enabled: true
    ```
  </Accordion>

  <Accordion title="PSScriptAnalyzer" icon="terminal">
    PSScriptAnalyzer is a static code checker for PowerShell scripts and modules.

    * [Configuration guide](/tools/psscriptanalyzer)
    * [PSScriptAnalyzer web page](https://github.com/PowerShell/PSScriptAnalyzer)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable PSScriptAnalyzer | PSScriptAnalyzer is a static code checker for PowerShell scripts and modules. | v1.25.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        psscriptanalyzer:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Pylint" icon="python">
    Pylint is a Python static code analysis tool.

    * [Configuration guide](/tools/pylint)
    * [Pylint web page](https://pylint.pycqa.org)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Pylint | Pylint is a Python static code analysis tool. | v4.0.6

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        pylint:
          enabled: true
    ```
  </Accordion>

  <Accordion title="React Doctor" icon="stethoscope">
    React Doctor scans React codebases for security, performance, correctness, and accessibility issues.

    * [Configuration guide](/tools/react-doctor)
    * [React Doctor web page](https://github.com/millionco/react-doctor)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable React Doctor | React Doctor scans React codebases for security, performance, correctness, and accessibility issues. | v0.9.3

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        reactDoctor:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Regal" icon="shield-check">
    Regal is a linter and language server for Rego.

    * [Configuration guide](/tools/regal)
    * [Regal web page](https://www.openpolicyagent.org/projects/regal)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Regal | Regal is a linter and language server for Rego. | v0.42.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        regal:
          enabled: true
    ```
  </Accordion>

  <Accordion title="RuboCop" icon="gem">
    RuboCop is a Ruby static code analyzer (a.k.a. linter ) and code formatter.

    * [Configuration guide](/tools/rubocop)
    * [RuboCop web page](https://rubocop.org)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable RuboCop | RuboCop is a Ruby static code analyzer (a.k.a. linter ) and code formatter. | v1.88.2

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        rubocop:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Ruff" icon="flame">
    Ruff is a Python linter and code formatter.

    * [Configuration guide](/tools/ruff)
    * [Ruff web page](https://docs.astral.sh/ruff)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Ruff | Ruff is a Python linter and code formatter. |  Enable Ruff integration. | v0.16.1

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        ruff:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Semgrep" icon="shield-alert">
    Semgrep is a static analysis tool designed to scan code for security vulnerabilities and code quality issues.

    * [Configuration guide](/tools/semgrep)
    * [Semgrep web page](https://semgrep.dev)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Semgrep | Semgrep is a static analysis tool designed to scan code for security vulnerabilities and code quality issues. | Enable Semgrep integration. | v1.170.0

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="config_file" type="string">
      Optional path to the Semgrep configuration file relative to the repository.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        semgrep:
          enabled: true
          config_file: ".semgrep.yml"
    ```
  </Accordion>

  <Accordion title="ShellCheck" icon="terminal">
    ShellCheck is a static analysis tool that finds bugs in your shell scripts.

    * [Configuration guide](/tools/shellcheck)
    * [ShellCheck web page](https://www.shellcheck.net)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable ShellCheck | ShellCheck is a static analysis tool that finds bugs in your shell. | Enable ShellCheck integration. | v0.11.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        shellcheck:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Shopify Theme Check" icon="shopping-bag">
    Configuration for Shopify Theme Check to ensure theme quality and best practices

    * [Configuration guide](/tools/shopify-cli)
    * [Shopify Theme Check web page](https://shopify.dev/docs/themes/tools/theme-check)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Shopify Theme Check | A linter for Shopify themes that helps you follow Shopify theme & Liquid best practices | cli 4.1.0 | theme 3.58.2

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        shopifyThemeCheck:
          enabled: true
    ```
  </Accordion>

  <Accordion title="SkillSpector" icon="shield">
    SkillSpector is a security scanner for AI agent skills that detects vulnerabilities, malicious patterns, and security risks

    * [Configuration guide](/tools/skillspector)
    * [SkillSpector web page](https://github.com/nvidia/skillspector)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable SkillSpector | SkillSpector is a security scanner for AI agent skills. It detects vulnerabilities, malicious patterns, and security risks in SKILL.md manifests and MCP configurations. | v2.5.1

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        skillspector:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Smarty Lint" icon="braces">
    smarty-lint is a linter for Smarty 3 template files that checks for common issues such as incorrect operator usage, naming conventions, empty blocks, and unquoted strings.

    * [Configuration guide](/tools/smarty-lint)
    * [Smarty Lint web page](https://github.com/modix/smarty-lint)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable smarty-lint | smarty-lint is a linter for Smarty 3 template files that checks for common issues such as incorrect operator usage, naming conventions, empty blocks, and unquoted strings. | v0.3.3

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        smartyLint:
          enabled: true
    ```
  </Accordion>

  <Accordion title="SQLFluff" icon="database">
    SQLFluff is an open source, dialect-flexible and configurable SQL linter.

    * [Configuration guide](/tools/sqlfluff)
    * [SQLFluff web page](https://sqlfluff.com)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable SQLFluff | SQLFluff is an open source, dialect-flexible and configurable SQL linter. | v4.2.2

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="config_file" type="string">
      Optional path to the SQLFluff configuration file relative to the repository. Use this when the config file is not named one of SQLFluff's default filenames.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        sqlfluff:
          enabled: true
          config_file: "custom/.sqlfluff"
    ```
  </Accordion>

  <Accordion title="Squawk" icon="wrench">
    Configuration for Squawk to lint Postgres migrations and SQL for safe schema changes

    * [Configuration guide](/tools/squawk)
    * [Squawk web page](https://squawkhq.com)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Squawk for Postgres migration linting | Detects unsafe schema changes that can cause downtime or blocking locks | v2.61.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        squawk:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Stylelint" icon="paint-bucket">
    Stylelint is a linter for stylesheets (CSS, SCSS, Sass, Less, SugarSS, Stylus) that helps avoid errors and enforce conventions.

    * [Configuration guide](/tools/stylelint)
    * [Stylelint web page](https://stylelint.io)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Stylelint | Stylelint is a linter for stylesheets (CSS, SCSS, Sass, Less, SugarSS, Stylus) that helps avoid errors and enforce conventions. | Enable Stylelint integration. | v17.14.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        stylelint:
          enabled: true
    ```
  </Accordion>

  <Accordion title="SwiftLint" icon="smartphone">
    SwiftLint integration configuration object.

    * [Configuration guide](/tools/swiftlint)
    * [SwiftLint web page](https://realm.github.io/SwiftLint)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable SwiftLint | SwiftLint is a Swift linter. | Enable SwiftLint integration. | v0.65.0

      Defaults to `true`.
    </ResponseField>

    <ResponseField name="config_file" type="string">
      Optional path to the SwiftLint configuration file relative to the repository. This is useful when the configuration file is named differently than the default '.swiftlint.yml' or '.swiftlint.yaml'.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        swiftlint:
          enabled: true
          config_file: ".swiftlint.yml"
    ```
  </Accordion>

  <Accordion title="TFLint" icon="layers">
    TFLint is a Terraform linter for finding potential errors and enforcing best practices.

    * [Configuration guide](/tools/tflint)
    * [TFLint web page](https://github.com/terraform-linters/tflint)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable TFLint | TFLint is a Terraform linter for finding potential errors. | v0.64.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        tflint:
          enabled: true
    ```
  </Accordion>

  <Accordion title="Trivy" icon="scan">
    Trivy is a comprehensive security scanner that detects misconfigurations and secrets in Infrastructure as Code files

    * [Configuration guide](/tools/trivy)
    * [Trivy web page](https://trivy.dev)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable Trivy for security scanning of IaC files (Terraform, Kubernetes, Docker, etc.) | v0.72.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        trivy:
          enabled: true
    ```
  </Accordion>

  <Accordion title="TruffleHog" icon="key">
    TruffleHog is a secret scanner with verification capabilities that can detect and verify secrets in code.

    * [Configuration guide](/tools/trufflehog)
    * [TruffleHog web page](https://github.com/trufflesecurity/trufflehog)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable TruffleHog | TruffleHog is a secret scanner with verification capabilities. | Enable TruffleHog integration. | v3.96.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        trufflehog:
          enabled: true
    ```
  </Accordion>

  <Accordion title="YAMLlint" icon="file-code">
    YAMLlint is a linter for YAML files.

    * [Configuration guide](/tools/yamllint)
    * [YAMLlint web page](https://yamllint.readthedocs.io)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable YAMLlint | YAMLlint is a linter for YAML files. | Enable YAMLlint integration. | v1.37.1

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        yamllint:
          enabled: true
    ```
  </Accordion>

  <Accordion title="zizmor" icon="shield">
    zizmor is a static security analyzer for GitHub Actions workflow files.

    * [Configuration guide](/tools/zizmor)
    * [zizmor web page](https://docs.zizmor.sh)

    **Configuration options:**

    <ResponseField name="enabled" type="boolean">
      Enable zizmor | zizmor is a static security analyzer for GitHub Actions workflow files. | v1.29.0

      Defaults to `true`.
    </ResponseField>

    **Example configuration:**

    ```yaml .coderabbit.yaml lines theme={null}
    reviews:
      tools:
        zizmor:
          enabled: true
    ```
  </Accordion>
</AccordionGroup>

## What's next

<CardGroup>
  <Card title="Configuration reference" icon="settings" href="/reference/configuration">
    View the complete reference for all CodeRabbit configuration options and settings.
  </Card>

  <Card title="Review commands" icon="terminal" href="/reference/review-commands">
    Learn how to control and customize code reviews using @coderabbitai commands.
  </Card>
</CardGroup>


# Regal
Source: https://docs.coderabbit.ai/tools/regal

CodeRabbit's guide to Regal.

[Regal](https://www.openpolicyagent.org/projects/regal) is a linter and language server for Rego, the language of [Open Policy Agent](http://openpolicyagent.org) (OPA).

## Files

Regal will run on files with the following extensions:

* `.rego`

## Configuration

Regal uses a YAML configuration file located at `.regal/config.yaml`.

CodeRabbit will use the default settings based on the profile selected if no configuration file is found.

## When we skip Regal

CodeRabbit will skip running Regal when:

* No Rego files are found in the pull request.
* Regal is already running in GitHub workflows.

## Profile behavior

CodeRabbit generates different Regal configurations based on the review profile:

* **Chill Mode**: Uses a focused configuration with fewer rules enabled.
* **Assertive Mode**: Uses a more comprehensive configuration with additional rules enabled.

If you provide your own config file (`.regal/config.yaml`), it will be used instead of the generated one.

## Disabled categories

Regal automatically disables the following categories:

* `style` - style-related issues
* `testing` - testing-related issues

## Links

* [Regal Configuration](https://www.openpolicyagent.org/projects/regal/configuration)


# RuboCop
Source: https://docs.coderabbit.ai/tools/rubocop

CodeRabbit's guide to RuboCop.

[RuboCop](https://rubocop.org/) is a Ruby static code analyzer and formatter, based on the community Ruby style guide. CodeRabbit runs RuboCop version 1.88.2.

## Files

RuboCop will run on the following files and extensions:

* `.rb`
* `.arb`
* `.axlsx`
* `.builder`
* `.fcgi`
* `.gemfile`
* `.gemspec`
* `.god`
* `.jb`
* `.jbuilder`
* `.mspec`
* `.opal`
* `.pluginspec`
* `.podspec`
* `.rabl`
* `.rake`
* `.rbuild`
* `.rbw`
* `.rbx`
* `.ru`
* `.ruby`
* `.schema`
* `.spec`
* `.thor`
* `.watchr`
* `.irbrc`
* `.pryrc`
* `.simplecov`
* `buildfile`
* `Appraisals`
* `Berksfile`
* `Brewfile`
* `Buildfile`
* `Capfile`
* `Cheffile`
* `Dangerfile`
* `Deliverfile`
* `Fastfile`
* `*Fastfile`
* `Gemfile`
* `Guardfile`
* `Jarfile`
* `Mavenfile`
* `Podfile`
* `Puppetfile`
* `Rakefile`
* `rakefile`
* `Schemafile`
* `Snapfile`
* `Steepfile`
* `Thorfile`
* `Vagabondfile`
* `Vagrantfile`

## Configuration

RuboCop uses a YAML style configuration file. We look for the following files anywhere in the repository:

* `.rubocop.yml`
* `.rubocop.yaml`

CodeRabbit will use the default settings based on the profile selected if no config file is found.

## What CodeRabbit runs

We run RuboCop inside a locked-down sandbox with an explicit `--config` that we generate or wrap. We do not load repository-specified Ruby plugins beyond a minimal safe set.

## Security policy and restrictions

* We skip RuboCop if the config (`.rubocop.yml`/`.rubocop.yaml`) includes `inherit_from`, `inherit_gem`, or unsafe `require` or `plugins` entries.
* Only a small, standardized `require` and `plugins` list is allowed. Custom gems/plugins loaded through either key are blocked.
* The following `require` and `plugins` entries are currently allowed:
  * `rubocop`
  * `rubocop-performance`
  * `rubocop-rails`
  * `rubocop-rspec`
  * `rubocop-minitest`
  * `rubocop-rake`
  * `rubocop-sequel`
  * `rubocop-capybara`
  * `rubocop-factory_bot`
  * `rubocop-i18n`
  * `rubocop-packaging`
  * `rubocop-sorbet`
  * `rubocop-thread_safety`
  * `rubocop-graphql`
  * `standard`

## When we skip RuboCop

CodeRabbit will skip running RuboCop when:

* The config contains `inherit_from`, `inherit_gem`, or disallowed `require` or `plugins` entries.
* The config cannot be validated or parsed safely.
* RuboCop is already running in GitHub workflows.

## Links

* [RuboCop Configuration](https://docs.rubocop.org/rubocop/configuration.html)


# Ruff
Source: https://docs.coderabbit.ai/tools/ruff

CodeRabbit's guide to Ruff.

[Ruff](https://docs.astral.sh/ruff/) is a linter for Python and Jupyter Notebooks. CodeRabbit runs Ruff version 0.16.0.

## Files

Ruff will run on files with the following extensions:

* `.py`
* `.ipynb` (using nbQA)

## Configuration

Ruff supports the following config files:

* `pyproject.toml`
* `ruff.toml`
* `.ruff.toml`

CodeRabbit will use the default settings based on the profile selected if no config file is found.

## When we skip Ruff

CodeRabbit will skip running Ruff when:

* Ruff is already running in GitHub workflows.

## Ignored codes

The following Ruff codes are automatically ignored:

* `I001` - unsorted imports
* `F401` - unused imports
* `F405` - undefined name from star import
* `W291` - trailing whitespace
* `W293` - blank line contains whitespace
* `Q000` - bad quotes
* `ANN001` - missing type annotation
* `ANN201` - missing return type annotation
* `UP006` - deprecated type alias
* `UP045` - deprecated import
* `E501` - line too long
* `S101` - use of assert detected
* `EXE001` - Shebang is present but file is not executable
* `RUF100` - unused `noqa` directive
* `PT009` - pytest unittest assertion
* `LOG015` - root logger call
* `PLR2004` - magic-value-comparison
* `PLR0913` - too-many-arguments
* `PLR0917` - too-many-positional-arguments
* `F841` - unused-variable
* `F811` - redefinition-of-unused-name
* `PIE794` - duplicate class field definition

## Profile behavior

In **Chill** mode, Ruff uses a focused set of rule codes including Pyflakes (F), flake8-bugbear (B), flake8-bandit (S), flake8-blind-except (BLE), flake8-debugger (T10), flake8-executable (EXE), Ruff-specific bug rules (RUF), Pylint error checks (PLE), flake8-builtins (A), and selected pycodestyle error checks.

In **Assertive** mode, Ruff additionally enables:

* `ANN` - flake8-annotations (type annotations)
* `ASYNC` - flake8-async (async/await issues)
* `FBT` - flake8-boolean-trap
* `C4` - flake8-comprehensions
* `DTZ` - flake8-datetimez (timezone issues)
* `DJ` - flake8-django
* `ISC` - flake8-implicit-str-concat
* `LOG` - flake8-logging
* `G` - flake8-logging-format
* `PIE` - flake8-pie
* `PT` - flake8-pytest-style
* `FLY` - flynt (f-string opportunities)
* `UP` - pyupgrade (upgrade opportunities)
* `PLR` - Pylint refactor checks
* `SIM` - flake8-simplify
* `PERF` - perflint
* `RET` - flake8-return
* `ARG` - flake8-unused-arguments
* `TRY` - tryceratops
* `PLW` - Pylint warning checks

## Links

* [Ruff Configuration](https://docs.astral.sh/ruff/configuration/)
* [nbQA Documentation](https://github.com/nbQA-dev/nbQA)


# Semgrep
Source: https://docs.coderabbit.ai/tools/semgrep

CodeRabbit's guide to Semgrep.

[Semgrep](https://github.com/semgrep/semgrep) is an open-source static analysis tool designed to scan code for security vulnerabilities and code quality issues. CodeRabbit runs Semgrep version 1.170.0.

## Configuration

Semgrep uses a YAML style configuration file. By default, we will automatically
use the following files if any are set in the root directory of your
repository.

* `semgrep.yml` or `semgrep.yaml`
* `semgrep.config.yml` or `semgrep.config.yaml`

Semgrep supports the following config files:

* User-defined config file set at `reviews.tools.semgrep.config_file` in your
  project's `.coderabbit.yaml` file or setting the "Reviews → Tools → Semgrep →
  Config File" field in CodeRabbit's settings page.

Due to licensing, CodeRabbit does not ship with the [community-created Semgrep rules](https://github.com/returntocorp/semgrep-rules).

<Info>
  CodeRabbit will only run Semgrep if your repository contains a Semgrep config file. This config must use the default file names, or you must define the path to this file in the `.coderabbit.yaml` or config UI.
</Info>

## Links

* [Semgrep CLI Reference](https://semgrep.dev/docs/cli-reference)
* [Writing Semgrep Rules for Config Files](https://semgrep.dev/docs/running-rules)

## Files

Semgrep will run on the following file types:

* C/C++ (`.c`, `.cpp`, `.cc`, `.cxx`, `.c++`, `.h`, `.hpp`, `.hh`, `.hxx`, `.h++`)
* C# (`.cs`)
* Go (`.go`)
* Java (`.java`)
* JavaScript (`.js`, `.jsx`)
* Kotlin (`.kt`)
* Python (`.py`)
* TypeScript (`.ts`)
* Ruby (`.rb`)
* Rust (`.rs`)
* PHP (`.php`)
* Scala (`.scala`)
* Swift (`.swift`)
* Terraform (`.tf`)
* JSON (`.json`)


# ShellCheck
Source: https://docs.coderabbit.ai/tools/shellcheck

CodeRabbit's guide to ShellCheck.

[ShellCheck](https://www.shellcheck.net/) is a linter for shell scripts.

## Files

ShellCheck will run on files with the following extensions:

* `.sh`
* `.bash`
* `.ksh`
* `.dash`

## Configuration

CodeRabbit will use the following settings based on the profile selected:

### Chill

```shell theme={null}
--severity=warning
```

### Assertive

```shell theme={null}
--severity=style
```

## When we skip ShellCheck

CodeRabbit will skip running ShellCheck when:

* ShellCheck is already running in GitHub workflows.

## Links

* [ShellCheck Wiki](https://www.shellcheck.net/wiki/)


# Shopify Theme Check
Source: https://docs.coderabbit.ai/tools/shopify-cli

How CodeRabbit handles Shopify Theme Check for Liquid theme files.

[Shopify Theme Check](https://shopify.dev/docs/themes/tools/theme-check) is a linter for Shopify themes and Liquid files. CodeRabbit's configuration reference pins Shopify CLI version 4.1.0 and Shopify Theme version 3.58.2, but CodeRabbit currently skips Shopify Theme Check because the CLI is not installed in the sandbox tools image.

## Files

Shopify Theme Check applies to changed files with the `.liquid` extension when the runner is available.

## Configuration

Shopify Theme Check is enabled by default. You can disable it in `.coderabbit.yaml`:

```yaml .coderabbit.yaml lines theme={null}
reviews:
  tools:
    shopifyThemeCheck:
      enabled: false
```

When the runner is available, CodeRabbit requires one of these configuration files:

* `.theme-check.yml`
* `.theme-check.yaml`

CodeRabbit also requires the standard Shopify theme directory structure at the project root:

* `assets/`
* `config/`
* `layout/`
* `locales/`
* `sections/`
* `snippets/`
* `templates/`

## Security policy and restrictions

Shopify Theme Check runs inside the CodeRabbit sandbox when the runner is available. CodeRabbit invokes `shopify theme check` with JSON output and the detected `.theme-check.yml` or `.theme-check.yaml` file.

## When we skip Shopify Theme Check

CodeRabbit will skip running Shopify Theme Check when:

* The Shopify CLI is unavailable in the sandbox tools image.
* No `.liquid` files are changed in the pull request.
* The repository does not have the required Shopify theme directory structure.
* No config file is found (`.theme-check.yml` or `.theme-check.yaml`).
* Shopify Theme Check is already running in GitHub workflows.

## Validation Rules

When the runner is available, CodeRabbit reports Shopify Theme Check offenses with `error` or `warning` severity. CodeRabbit filters out the `UndefinedObject` and `MissingTemplate` checks.

## Links

* [Shopify CLI GitHub Repository](https://github.com/Shopify/cli)
* [Shopify CLI Theme Documentation](https://shopify.dev/docs/api/shopify-cli/theme)
* [Theme Development Requirements](https://shopify.dev/docs/themes/store/requirements)


# SkillSpector
Source: https://docs.coderabbit.ai/tools/skillspector

CodeRabbit uses SkillSpector to scan AI agent skill and MCP configuration files for security risks.

[SkillSpector](https://github.com/nvidia/skillspector) is a security scanner for AI agent skills and MCP configuration files. CodeRabbit runs SkillSpector version 2.4.4 to detect vulnerabilities, malicious patterns, and security risks in changed agent configuration files.

## Files

SkillSpector will run on changed files with the following names:

* `SKILL.md`
* `mcp.json`
* `mcp-config.json`
* `claude_desktop_config.json`
* `.cursorrules`
* `codex.yaml`

## Configuration

<Tabs>
  <Tab title="Using configuration file">
    ```yaml theme={null}
    reviews:
      tools:
        skillspector:
          enabled: true
    ```
  </Tab>

  <Tab title="Using web interface">
    Enable or disable SkillSpector from **Reviews → Tools → SkillSpector** in CodeRabbit's organization or repository settings page.
  </Tab>
</Tabs>

## Security policy and restrictions

CodeRabbit runs SkillSpector inside the sandbox with LLM analysis disabled. SkillSpector scans each changed file independently with static analysis and does not make LLM or network calls.

## When we skip SkillSpector

CodeRabbit will skip running SkillSpector when:

* SkillSpector is disabled in CodeRabbit settings or `.coderabbit.yaml`.
* No changed files match the supported file names.

## Profile behavior

SkillSpector uses the same rules in Chill and Assertive modes.

## What's next

<CardGroup>
  <Card title="Tool catalog" href="/tools/list" icon="list">
    Browse all linters, security analyzers, and CI/CD integrations by category and technology.
  </Card>

  <Card title="Tools reference" href="/tools/reference" icon="wrench">
    Explore detailed specifications and configuration options for CodeRabbit tools.
  </Card>
</CardGroup>


# smarty-lint
Source: https://docs.coderabbit.ai/tools/smarty-lint

CodeRabbit's guide to smarty-lint.

smarty-lint is a linter for Smarty 3 template files that checks for common issues such as incorrect operator usage, naming conventions, empty blocks, and unquoted strings.

## Files

smarty-lint runs on files with the following extension:

* `.tpl`

## Configuration

You can enable or disable smarty-lint in your CodeRabbit configuration (see [Tools reference](/reference/tools-reference) and [Configuration reference](/reference/configuration)).

CodeRabbit supports `smartylint.json`. If no config file is present, CodeRabbit creates a temporary `smartylint.json` that scans `**/*.tpl`.

If `smartylint.js` is present, CodeRabbit skips smarty-lint rather than executing a JavaScript config file.

## When we skip smarty-lint

CodeRabbit will skip running smarty-lint when:

* No `.tpl` files are found in the pull request.
* smarty-lint is already running in GitHub workflows.
* `smartylint.js` is present in the repository.

## Links

* [smarty-lint on GitHub](https://github.com/modix/smarty-lint)


# SQLFluff
Source: https://docs.coderabbit.ai/tools/sqlfluff

How CodeRabbit runs SQLFluff to lint SQL files in pull requests.

[SQLFluff](https://github.com/sqlfluff/sqlfluff) is a dialect-flexible SQL linter for standardizing SQL code. CodeRabbit runs SQLFluff version 4.2.2 in a secure sandbox and reports lint findings on changed SQL files.

## Files

SQLFluff runs on files with the `.sql` extension.

## Configuration

To enable or disable SQLFluff, use your `.coderabbit.yaml` file or the CodeRabbit web UI:

<Tabs>
  <Tab title=".coderabbit.yaml">
    ```yaml .coderabbit.yaml theme={null}
    reviews:
      tools:
        sqlfluff:
          enabled: true
          config_file: "custom/.sqlfluff"
    ```
  </Tab>

  <Tab title="Web UI">
    Go to **Reviews > Tools > SQLFluff** in your organization or repository settings and toggle SQLFluff `on` or `off`.
  </Tab>
</Tabs>

SQLFluff supports the following configuration option:

* `config_file` (default: unset): Optional path to a SQLFluff configuration file relative to the repository. Use this when the config file is not named one of SQLFluff's default filenames.

When `config_file` is not set, CodeRabbit looks for these SQLFluff config files:

* `setup.cfg`
* `tox.ini`
* `pep8.ini`
* `.sqlfluff`
* `pyproject.toml`

CodeRabbit uses a SQLFluff config file only when it contains a `[sqlfluff]` or `[tool.sqlfluff]` section. If no valid SQLFluff config file is found, CodeRabbit writes a temporary config based on the selected review profile and detected SQL dialect.

## Profile behavior

When no valid SQLFluff config file is found, CodeRabbit generates a temporary config whose rule set depends on the active review profile:

* **Chill** uses a narrow default rule set focused on SQL issues that can cause incorrect results or runtime failures, including bare `UNION`, mismatched set-operation column counts, implicit cross joins, duplicate table aliases, and `NULL` comparisons with `=` or `!=`.
* **Assertive** uses a broader semantic and structural rule set, including checks for unused aliases or CTEs, duplicate aliases, identifier portability, unnecessary `CASE` expressions, misleading `DISTINCT` syntax, unreferenced joined tables, and T-SQL procedure issues. Layout, capitalization, style-preference, and high-noise reference rules remain excluded.

## dbt templater support

CodeRabbit includes `sqlfluff-templater-dbt` 4.2.2, `dbt-core` 1.10.22, and `dbt-duckdb` 1.10.1 with its SQLFluff installation. When your SQLFluff config sets `templater = dbt`, CodeRabbit can compile dbt-templated SQL for linting without requiring your repository to provide the Python templater package.

Before running the dbt templater, CodeRabbit runs a bounded `dbt deps` preflight when the project contains `packages.yml` or `dependencies.yml`. This installs dbt packages into the sandbox for the lint run only. Preflight failures are non-blocking: CodeRabbit still runs SQLFluff when possible, then cleans up `dbt_packages/` and any package lock file that CodeRabbit created.

CodeRabbit resolves dbt projects in repository subdirectories by passing the project directory through `DBT_PROJECT_DIR`. For profile selection, CodeRabbit uses the first available value in this order: the `profile` value in your SQLFluff configuration, the `DBT_PROFILE` environment variable, then the `profile` field in `dbt_project.yml`. Templated profile values in `dbt_project.yml` are ignored.

If the configured dbt profiles directory does not already contain a DuckDB profile, CodeRabbit writes a temporary `profiles.yml` that uses an in-memory DuckDB target for the lint run, then restores the previous profile file after SQLFluff finishes. The generated profile uses the resolved profile name and the `target` value from your SQLFluff config when present; otherwise it defaults to `dev`.

## Security policy and restrictions

SQLFluff runs in a secure sandbox using CodeRabbit's installed SQLFluff, dbt templater, and DuckDB adapter packages. CodeRabbit does not install repository-provided Python packages, custom SQLFluff plugins, third-party dbt adapters, or custom templaters for this integration.

<Info>
  Custom plugins, third-party dbt adapters, and custom templaters that require repository-provided Python packages are not supported.
</Info>

## When CodeRabbit skips SQLFluff

CodeRabbit skips SQLFluff when:

* SQLFluff is disabled in CodeRabbit settings.
* The pull request does not include changed `.sql` files.
* SQLFluff is already running in GitHub workflows.

## Ignored codes

The following SQLFluff codes are automatically ignored:

| Code   | Description                  |
| ------ | ---------------------------- |
| `LT01` | Trailing whitespace          |
| `LT02` | Indentation                  |
| `CP01` | Keyword capitalization       |
| `CP02` | Identifier capitalization    |
| `CP03` | Function name capitalization |
| `CV06` | Convention style checks      |
| `RF02` | Qualified reference style    |
| `RF06` | Reference style checks       |
| `LXR`  | Lexing stage failures        |
| `PRS`  | Parsing stage failures       |
| `TMP`  | Templating stage failures    |

## What's next

<CardGroup>
  <Card title="All supported tools" href="/tools/list" icon="list">
    Browse the complete list of linters, security analyzers, and CI/CD integrations available in CodeRabbit.
  </Card>

  <Card title="Tools reference" href="/reference/tools-reference" icon="wrench">
    Explore detailed specifications and capabilities of all available CodeRabbit tools.
  </Card>

  <Card title="Configuration reference" href="/reference/configuration" icon="settings">
    Full reference for all available options, including how to enable, disable, and tune individual tools.
  </Card>
</CardGroup>


# Squawk
Source: https://docs.coderabbit.ai/tools/squawk

How CodeRabbit runs Squawk to detect unsafe PostgreSQL schema changes in migration files.

[Squawk](https://squawkhq.com) is a linter for PostgreSQL migrations. CodeRabbit runs Squawk version 2.61.0 and reports schema changes that can cause downtime, blocking locks, or compatibility problems.

## Files

Squawk runs on changed SQL migration files that match these patterns:

* `**/migrations/*.sql`
* `**/migrations/**/*.sql`
* `**/migration/**/*.sql`
* `**/db/migrate/**/*.sql`
* `**/db/migration/**/*.sql`
* `**/db/migrations/**/*.sql`

SQL files outside migration directories are not included. Use [SQLFluff](/tools/sqlfluff) for general SQL linting.

## Configuration

Squawk is enabled by default. Enable or disable it with `.coderabbit.yaml` or the CodeRabbit web UI:

<Tabs>
  <Tab title=".coderabbit.yaml">
    ```yaml .coderabbit.yaml theme={null}
    reviews:
      tools:
        squawk:
          enabled: true
    ```
  </Tab>

  <Tab title="Web UI">
    Go to **Reviews > Tools > Squawk** in your organization or repository settings and toggle Squawk `on` or `off`.
  </Tab>
</Tabs>

CodeRabbit looks recursively for a `.squawk.toml` file and uses it when present. See the [Squawk CLI documentation](https://squawkhq.com/docs/cli/) for supported options, including rule inclusion and exclusion, PostgreSQL version selection, and path exclusions.

CodeRabbit assumes each migration file runs inside a transaction. Add `-- squawk-disable-assume-in-transaction` to a migration file when your migration runner does not wrap that file in a transaction.

## Profile behavior

When the repository does not contain a `.squawk.toml` file, CodeRabbit generates a temporary configuration for the active review profile:

* **Chill** focuses on unsafe migrations, blocking locks, and breaking schema changes while excluding schema-style preferences.
* **Assertive** also enables schema preference rules such as using identity columns and timestamp types with time zones.

CodeRabbit suppresses the `require-timeout-settings` and `syntax-error` rules from review comments to reduce low-signal findings. This filtering also applies when the repository provides a `.squawk.toml` file.

## When CodeRabbit skips Squawk

CodeRabbit skips Squawk when:

* Squawk is disabled in CodeRabbit settings.
* The pull request does not change a SQL migration file matching the supported paths.
* Squawk is already running in GitHub workflows.

## What's next

<CardGroup>
  <Card title="Tool catalog" href="/tools/list" icon="list">
    Browse all linters, security analyzers, and CI/CD integrations by category and technology.
  </Card>

  <Card title="Tools reference" href="/tools/reference" icon="wrench">
    Explore detailed specifications and configuration options for CodeRabbit tools.
  </Card>

  <Card title="SQLFluff" href="/tools/sqlfluff" icon="database">
    Lint general SQL files for correctness, structure, and style.
  </Card>
</CardGroup>


# Stylelint
Source: https://docs.coderabbit.ai/tools/stylelint

CodeRabbit's guide to Stylelint.

[Stylelint](https://stylelint.io/) is a linter for stylesheets that helps avoid errors and enforce conventions in CSS, SCSS, Sass, Less, SugarSS, and Stylus. CodeRabbit runs Stylelint version 17.14.1.

## Files

Stylelint runs on files with the following extensions:

* `.css`
* `.scss`
* `.sass`
* `.less`
* `.sss` (SugarSS)
* `.styl` (Stylus)

## Configuration

* **Allowed config files**: Only data-only config files are used. CodeRabbit looks for `.stylelintrc.json`, `.stylelintrc.yml`, or `.stylelintrc.yaml`. Executable configs (`.stylelintrc.js`, `stylelint.config.js`, `stylelint.config.mjs`) are **not** allowed.
* **No user config**: If no allowed config is found, CodeRabbit writes a default `.stylelintrc.json` that extends `stylelint-config-standard-scss` and disables some stylistic rules (e.g. `selector-class-pattern`, `color-hex-length`, `rule-empty-line-before`) to reduce noise. Plugin and `extends` resolution uses only packages we ship in the image.

## Links

* [Stylelint Documentation](https://stylelint.io/user-guide/get-started/)
* [Stylelint GitHub](https://github.com/stylelint/stylelint)


# SwiftLint
Source: https://docs.coderabbit.ai/tools/swiftlint

CodeRabbit's guide to SwiftLint.

[SwiftLint](https://realm.github.io/SwiftLint/) is a linter for Swift.

## Files

SwiftLint will run on files with the following extensions:

* `.swift`

## Configuration

SwiftLint supports the following config files:

* User-defined config file set at `reviews.tools.swiftlint.config_file` in your project's `.coderabbit.yaml` file or setting the "Reviews → Tools → SwiftLint → Config File" field in CodeRabbit's settings page.
* `.swiftlint.yaml`
* `.swiftlint.yml`

CodeRabbit will use the default settings if no config file is found.

## When we skip SwiftLint

CodeRabbit will skip running SwiftLint when:

* SwiftLint is already running in GitHub workflows.
* The config file specifies a SwiftLint version greater than the version used by CodeRabbit.

## Ignored rules

The following SwiftLint rules are automatically ignored (style rules with very low acceptance):

* `trailing_whitespace`
* `line_length`
* `comment_spacing`
* `vertical_whitespace`

## Links

* [SwiftLint Configuration](https://github.com/realm/SwiftLint?tab=readme-ov-file#configuration)


# TFLint
Source: https://docs.coderabbit.ai/tools/tflint

CodeRabbit's guide to TFLint.

[TFLint](https://github.com/terraform-linters/tflint) is a linter for Terraform configuration files. CodeRabbit runs TFLint version 0.64.0.

## Files

TFLint runs only on files with the following extension:

* `.tf`

## Configuration

* If the repository does not include `.tflint.hcl`, CodeRabbit runs TFLint with its safe defaults.
* If the repository does include `.tflint.hcl`, CodeRabbit writes and uses a safe override config that enables only the bundled `terraform` ruleset.
* A repository `.tflint.hcl` is not required.

## Security policy and restrictions

* CodeRabbit recognizes the following plugin names as approved when inspecting `.tflint.hcl`.
  * **terraform** — bundled with TFLint ([tflint-ruleset-terraform](https://github.com/terraform-linters/tflint-ruleset-terraform))
  * **aws** — [tflint-ruleset-aws](https://github.com/terraform-linters/tflint-ruleset-aws)
  * **google** — [tflint-ruleset-google](https://github.com/terraform-linters/tflint-ruleset-google)
  * **azurerm** — [tflint-ruleset-azurerm](https://github.com/terraform-linters/tflint-ruleset-azurerm)

## When we skip TFLint

CodeRabbit skips TFLint when:

* TFLint is disabled in your CodeRabbit configuration.
* No `.tf` files are in the pull request.
* TFLint is already running in GitHub workflows.

## Links

* [TFLint GitHub Repository](https://github.com/terraform-linters/tflint)
* [TFLint Documentation](https://github.com/terraform-linters/tflint/tree/master/docs)


# Trivy
Source: https://docs.coderabbit.ai/tools/trivy

CodeRabbit's guide to Trivy.

[Trivy](https://github.com/aquasecurity/trivy) is a security scanner that finds misconfigurations and exposed secrets in Infrastructure as Code (IaC) files. CodeRabbit runs Trivy version 0.72.0.

## Files

Trivy runs only on files matching these patterns:

* **Terraform**: `*.tf`, `*.tf.json`, `*.tofu`, `*.tofu.json`
* **Docker**: `Dockerfile`, `Dockerfile.*`, `*.dockerfile`
* **Kubernetes**: `k8s/**/*.yaml`, `k8s/**/*.yml`, `kubernetes/**/*.yaml`, `kubernetes/**/*.yml`, `manifests/**/*.yaml`, `manifests/**/*.yml`
* **Helm**: `helm/**/*.yaml`, `helm/**/*.yml`, `charts/**/*.yaml`, `charts/**/*.yml`, `Chart.yaml`, `values.yaml`, `values.yml`
* **CloudFormation**: `*.template.json`, `*.template.yaml`, `*.template.yml`, `cloudformation/**/*.json`, `cloudformation/**/*.yaml`, `cloudformation/**/*.yml`
* **Azure ARM**: `azuredeploy.json`, `azuredeploy.parameters.json`, `arm/**/*.json`
* **Docker Compose**: `docker-compose.yaml`, `docker-compose.yml`, `compose.yaml`, `compose.yml`

Non-IaC files (e.g. GitHub workflows, `package.json`) are excluded.

## Configuration

* CodeRabbit will read and use the repo's `trivy.yaml` config file.

## Profile behavior

* **Chill**: `--severity CRITICAL,HIGH`
* **Assertive**: `--severity CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN`

## Links

* [Trivy GitHub Repository](https://github.com/aquasecurity/trivy)
* [Trivy Documentation](https://trivy.dev)


# TruffleHog
Source: https://docs.coderabbit.ai/tools/trufflehog

CodeRabbit's guide to TruffleHog.

[TruffleHog](https://github.com/trufflesecurity/trufflehog) is a secret scanner with verification capabilities that can detect and verify secrets in code. CodeRabbit runs TruffleHog version 3.96.0 in **filesystem** mode with a repository-supplied config file.

## Files

TruffleHog scans changed pull request files when a supported TruffleHog config file is present. CodeRabbit does not restrict TruffleHog to specific file extensions.

## Configuration

TruffleHog **requires** a config file in the repository. CodeRabbit allows the following to be used:

* `trufflehog-config.yml`
* `trufflehog-config.yaml`
* `trufflehog.yml`
* `trufflehog.yaml`
* `.trufflehog.yml`
* `.trufflehog.yaml`

If none of these are found, TruffleHog is skipped for the run.

## Links

* [TruffleHog GitHub](https://github.com/trufflesecurity/trufflehog)
* [TruffleHog Documentation](https://docs.trufflesecurity.com/)


# YAMLlint
Source: https://docs.coderabbit.ai/tools/yamllint

YAMLlint is a linter for YAML files.

YAMLlint is a linter for YAML files that checks both for syntax validity and cosmetic problems like line length, trailing spaces, indentation, etc. CodeRabbit runs YAMLlint version 1.37.1.

## Files

YAMLlint will run on files with the following extensions:

* `.yaml`
* `.yml`

## Configuration

### Enable YAMLlint

<Tabs>
  <Tab title="Web UI">
    <table>
      <tbody>
        <tr>
          <td>
            <strong>Location</strong>
          </td>

          <td>Reviews → Tools → Enable YAMLlint</td>
        </tr>

        <tr>
          <td>
            <strong>Default</strong>
          </td>

          <td>true</td>
        </tr>
      </tbody>
    </table>
  </Tab>

  <Tab title=".coderabbit.yaml">
    <table>
      <tbody>
        <tr>
          <td>
            <strong>Field</strong>
          </td>

          <td>`reviews.tools.yamllint.enabled`</td>
        </tr>

        <tr>
          <td>
            <strong>Datatype</strong>
          </td>

          <td>boolean</td>
        </tr>

        <tr>
          <td>
            <strong>Default</strong>
          </td>

          <td>true</td>
        </tr>
      </tbody>
    </table>
  </Tab>
</Tabs>

YAMLlint is a linter for YAML files.

## Features

YAMLlint performs several checks:

### Syntax checks

* YAML validity
* Document structure

### Cosmetic checks

* Line length limits
* Trailing whitespace
* Indentation consistency
* Empty lines
* Comments formatting

## Configuration File

CodeRabbit loads repository `.yamllint.yml` or `.yamllint.yaml` files for this integration if they exist. If not, it passes inline configuration data to yamllint based on the selected review profile.

## When we skip YAMLlint

CodeRabbit will skip running YAMLlint when:

* YAMLlint is already running in GitHub workflows.

## Ignored rules

The following YAMLlint rules are automatically ignored (noisy whitespace/indentation-only rules):

* `trailing-spaces` - extra spaces at end of line
* `trailing spaces` - alternate spelling sometimes emitted by YAMLlint
* `indentation` - spaces don't line up
* `new-line-at-end-of-file` - new line at end of file
* `commas` - commas in lists
* `colons` - spacing around colons
* `comments` - comment formatting
* `line-length` - line length limits
* `document-start` - document start requirements
* `quoted-strings` - quoted strings
* `braces` - whitespace inside braces

## Profile behavior

CodeRabbit uses different YAMLlint rule sets based on the review profile:

* **Chill Mode**: Uses the `relaxed` rule set
* **Assertive Mode**: Uses the `default` rule set

## Links

* [YAMLlint Documentation](https://yamllint.readthedocs.io/)
* [Configuration Reference](https://yamllint.readthedocs.io/en/stable/configuration.html)


# zizmor
Source: https://docs.coderabbit.ai/tools/zizmor

CodeRabbit's guide to zizmor, a static security analyzer for GitHub Actions workflow files.

[zizmor](https://docs.zizmor.sh/) is a static analysis tool for GitHub Actions. It finds common security issues in GitHub Actions CI/CD setups, such as template injection, excessive permissions, unpinned actions, and dangerous use of untrusted input. CodeRabbit runs zizmor version 1.28.0.

## Files

zizmor will run on GitHub Actions definition files in the following locations:

* `.github/workflows/**/*.yml`
* `.github/workflows/**/*.yaml`
* `action.yml`
* `action.yaml`

## Configuration

zizmor supports the following config files:

* `zizmor.yml`
* `zizmor.yaml`
* `.github/zizmor.yml`
* `.github/zizmor.yaml`

CodeRabbit will use the default configuration if no config file is found.

To enable or disable zizmor, use your `.coderabbit.yaml` file or the CodeRabbit web UI:

<Tabs>
  <Tab title=".coderabbit.yaml">
    ```yaml .coderabbit.yaml theme={null}
    reviews:
      tools:
        zizmor:
          enabled: true
    ```
  </Tab>

  <Tab title="Web UI">
    Go to **Reviews → Tools → zizmor** in your organization or repository settings and toggle zizmor `on` or `off`.

    ***
  </Tab>
</Tabs>

## When we skip zizmor

CodeRabbit will skip running zizmor when:

* No GitHub Actions workflow or action files are found in the pull request.
* zizmor is already running in GitHub workflows.

## Links

* [zizmor Documentation](https://docs.zizmor.sh/)
* [zizmor Configuration](https://docs.zizmor.sh/configuration/)
* [zizmor Audit Rules](https://docs.zizmor.sh/audits/)
* [zizmor GitHub Repository](https://github.com/zizmorcore/zizmor)

## What's next

<CardGroup>
  <Card title="actionlint" href="/tools/actionlint" icon="github">
    Lint GitHub Actions workflow files for syntax errors and common misconfigurations.
  </Card>

  <Card title="All supported tools" href="/tools/list" icon="list">
    Browse the complete list of linters, security analyzers, and CI/CD integrations available in CodeRabbit.
  </Card>

  <Card title="Configuration reference" href="/reference/configuration" icon="settings">
    Full reference for all available options, including how to enable, disable, and tune individual tools.
  </Card>
</CardGroup>