Skip to main content
| This reference describes the V3 repository file schema. Use it only after CodeRabbit confirms that your organization is eligible for the preview. Existing V2 configurations continue to use the V2 configuration reference. An eligible repository selects V3 with the numeric field version: 3 in its root .coderabbit.yaml or .coderabbit.yml. See Migrating to V3 for availability, setting changes, inheritance, and directory requirements. The reference does not describe the separate preferences managed in the web UI. Download the V3 JSON Schema.
This reference is automatically generated from the CodeRabbit V3 configuration schema. Last updated: November 12, 2026

General settings

enum
required
Select the V3 schema with the number 3. A schema URL comment does not select a configuration version.One of the following: 3Learn more: Migrate configuration to V3
.coderabbit.yaml
enum
default:"en-US"
Set the language used for human-readable review feedback with a supported language code.One of the following: de, de-DE, de-AT, de-CH, en, en-US, en-AU, en-GB, en-CA, en-NZ, en-ZA, es, es-AR, fr, fr-CA, fr-CH, fr-BE, nl, nl-BE, pt-AO, pt, pt-BR, pt-MZ, pt-PT, ar, ast-ES, ast, be-BY, be, br-FR, br, ca-ES, ca, ca-ES-valencia, ca-ES-balear, da-DK, da, de-DE-x-simple-language, el-GR, el, eo, fa, ga-IE, ga, gl-ES, gl, it, ja-JP, ja, km-KH, km, ko-KR, ko, pl-PL, pl, ro-RO, ro, ru-RU, ru, sk-SK, sk, sl-SI, sl, sv, ta-IN, ta, tl-PH, tl, tr, uk-UA, uk, zh-CN, zh, zh-TW, crh-UA, crh, cs-CZ, cs, nb, no, nl-NL, de-DE-x-simple-language-DE, es-ES, it-IT, fa-IR, sv-SE, de-LU, fr-FR, bg-BG, bg, he-IL, he, hi-IN, hi, vi-VN, vi, th-TH, th, bn-BD, bn
boolean
default:false
Allow applicable parent settings to fill values omitted here. Explicit scalar values take precedence; lists follow the inheritance merge rules. Organization and workspace overrides can force inheritance.Learn more: Migrate configuration to V3

Reviews

Behavior

reviews.behavior
enum
default:"chill"
Choose the amount of review feedback. Quiet prioritizes the most important feedback, chill provides balanced feedback, and assertive includes more suggestions that can feel nitpicky.One of the following: quiet, chill, assertive
array of string
default:[]
Include or exclude files from review using repository-relative glob patterns. Prefix an exclusion with !, and quote patterns starting with ! in YAML.
object
string
Merge Risk Instructions: Describe what makes a pull request more or less risky to merge in this codebase. CodeRabbit uses this when rating merge risk, which auto_approvals.max_merge_risk can limit for automatic approval. Up to 3000 characters. Example: Database migrations and billing changes are high risk. Docs-only and test-only changes are low risk.
Max length: 3000
string
Security Risk Instructions: Describe facts about your system that affect security risk, such as which services are internet-facing, where tenant isolation is enforced, or which controls protect a path. CodeRabbit uses this when rating security architecture risk, which auto_approvals.max_security_risk can limit for automatic approval. Security risk assessments require the Advanced plan or above. Unlike Security scan context, which guides security findings in reviews and scans, this only affects the risk rating. Up to 3000 characters. Example: The admin service is reachable only over the corporate VPN. Changes to tenant isolation in packages/tenancy are high risk.
Max length: 3000
object
Defaults to {"progress_updates":true,"legacy_commit_status":true,"fail_on_error":false}.

Auto review

reviews.auto_review
boolean
default:true
Automatic Review: Review PRs automatically.
string
default:""
Keyword in the PR description that triggers a review when automatic reviews are disabled. If enabled is false and this field is not empty, CodeRabbit reviews the PR only when this keyword is present in the description.
boolean
default:true
Incremental Review: Re-run the review on each push.
integer
default:5
Auto Pause After Reviewed Commits: Pause automatic reviews after this many reviewed commits since the last pause. Set to 0 to disable.
Min: 0, Max: 9007199254740991
array of string
default:[]
Labels that control which PRs are reviewed. Labels starting with ’!’ are negative matches. Examples: [‘bug’, ‘feature’] reviews PRs with either label. [‘!wip’] reviews all PRs except those labeled ‘wip’ when automatic reviews are enabled. [‘bug’, ‘!wip’] reviews PRs labeled ‘bug’ but not ‘wip’. When enabled is false, a positive label match (for example [‘review-ready’]) triggers a review; negative-only labels such as [‘!wip’] remain exclusion filters and do not opt PRs in by themselves.
boolean
default:false
Include draft PRs.
array of string
default:[]
Base branches (other than the default branch) to review. Accepts regex patterns. Use ’.*’ to match all branches.

Output

reviews.output
object
Defaults to {"placement":"description","placeholder":"@coderabbitai summary","instructions":""}.
object
Defaults to {"collapse":true,"review_status":true,"review_info":true,"review_details":false,"changed_files_summary":true,"related_issues":true,"related_prs":true}.
object
default:{"allow_non_org_members":true}
object
Defaults to {"labels":{"mode":"suggest","instructions":[],"mutually_exclusive_groups":{}},"reviewers":{"mode":"suggest","instructions":[]}}.

Tools

reviews.tools Tools that provide additional context to code reviews.
object
ast-grep is a code analysis tool that helps you to find patterns in your codebase using abstract syntax trees patterns.Version: v0.51.1
object
ShellCheck is a static analysis tool that finds bugs in your shell scripts.Version: v0.11.0
object
Ruff is a Python linter and code formatter.Version: v0.17.3
object
markdownlint-cli2 is a static analysis tool to enforce standards and consistency for Markdown files.Version: v0.24.0
object
GitHub Checks integration configuration.
object
LanguageTool is a style and grammar checker for 30+ languages.
object
Biome is a fast formatter, linter, and analyzer for web projects.Version: v2.6.3
object
Hadolint is a Dockerfile linter.Version: v2.15.1
object
SwiftLint integration configuration object.Version: v0.65.1
object
PHPStan is a tool to analyze PHP code.Version: v2.3.3
object
PHPMD is a tool to find potential problems in PHP code.Version: v3.0.0
object
PHP CodeSniffer is a PHP linter and coding standard checker.Version: v3.13.6
object
golangci-lint is a fast linters runner for Go.Version: v2.15.0
object
YAMLlint is a linter for YAML files.Version: v1.37.1
object
Betterleaks is a secret scanner (an improved version of Gitleaks).Version: v1.9.0
object
TruffleHog is a secret scanner with verification capabilities that can detect and verify secrets in code.Version: v3.99.8
object
Checkov is a static code analysis tool for infrastructure-as-code files.Version: v3.3.30
object
TFLint is a Terraform linter for finding potential errors and enforcing best practices.Version: v0.66.0
object
Detekt is a static code analysis tool for Kotlin files.Version: v1.23.8
object
ESLint is a static code analysis tool for JavaScript files.
object
Flake8 is a Python linter that wraps PyFlakes, pycodestyle and Ned Batchelder’s McCabe script.Version: v7.4.1
object
Configuration for Infer to find bugs in Java and C/C++ codeVersion: v1.3.0
object
Fortitude is a Fortran linter that checks for code quality and style issues.Version: v0.10.0
object
RuboCop is a Ruby static code analyzer (a.k.a. linter ) and code formatter.Version: v1.92.1
object
Buf offers linting for Protobuf files.Version: v1.74.0
object
Regal is a linter and language server for Rego.Version: v0.43.0
object
actionlint is a static checker for GitHub Actions workflow files.Version: v1.7.12
object
zizmor is a static security analyzer for GitHub Actions workflow files.Version: v1.31.1
object
PMD is an extensible multilanguage static code analyzer. It’s mainly concerned with Java.Version: v7.28.0
object
Configuration for Clang to perform static analysis on C and C++ codeVersion: v23.1.4
object
Cppcheck is a static code analysis tool for the C and C++ programming languages.Version: v2.22.0
object
Vale lints prose using the repository’s checked-in style rules.Version: v3.24.0
object
Verilator statically analyzes Verilog and SystemVerilog source files.Version: v5.052
object
OpenGrep is a high-performance static code analysis engine, compatible with Semgrep configurations.Version: v1.33.0
object
Semgrep is a static analysis tool designed to scan code for security vulnerabilities and code quality issues.Version: v1.183.0
object
CircleCI tool is a static checker for CircleCI config files.Version: v1.9.0
object
Clippy is a collection of lints to catch common mistakes and improve your Rust code.
object
SQLFluff is an open source, dialect-flexible and configurable SQL linter.Version: v4.4.0
object
Configuration for Squawk to lint Postgres migrations and SQL for safe schema changesVersion: v2.70.0
object
Trivy is a comprehensive security scanner that detects misconfigurations and secrets in Infrastructure as Code filesVersion: v0.76.2
object
Configuration for Prisma Schema linting to ensure schema file qualityVersion: v0.13.1
object
Pylint is a Python static code analysis tool.Version: v4.1.3
object
Oxlint is a JavaScript/TypeScript linter for OXC written in Rust.Version: v1.89.0
object
Configuration for Shopify Theme Check to ensure theme quality and best practicesVersion: cli 5.0.0, theme 3.58.2
object
Configuration for Lua code linting to ensure code qualityVersion: v1.2.0
object
Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications.Version: v8.1.0
object
dotenv-linter is a tool for checking and fixing .env files for problems and best practicesVersion: v4.0.0
object
HTMLHint is a static code analysis tool for HTML files.Version: v1.9.2
object
Stylelint is a linter for stylesheets (CSS, SCSS, Sass, Less, SugarSS, Stylus) that helps avoid errors and enforce conventions.Version: v17.14.0
object
checkmake is a linter for Makefiles.Version: v0.3.2
object
OSV Scanner is a tool for vulnerability package scanning.Version: v2.7.0
object
oasdiff detects breaking changes between OpenAPI specifications.Version: v1.34.0
object
React Doctor scans React codebases for security, performance, correctness, and accessibility issues.Version: v0.9.18
object
Microsoft Presidio Analyzer 2.2.366 detects sensitive identifiers (including payment cards, US SSN, cryptocurrency wallets, and phone numbers) in changed files. Tune entities, thresholds, and languages in repository Presidio configuration (for example .presidiocli or AnalyzerEngineProvider YAML); the built-in scan uses fixed defaults and is skipped when that configuration is present.Version: v2.2.366
object
Blinter is a linter for Windows batch files that provides comprehensive static analysis to identify syntax errors, security vulnerabilities, performance issues, and style problems.Version: v1.1.49
object
smarty-lint is a linter for Smarty 3 template files that checks for common issues such as incorrect operator usage, naming conventions, empty blocks, and unquoted strings.Version: v0.3.3
object
ember-template-lint is a linter for Handlebars template files that checks for common issues such as accessibility violations, deprecated patterns, and template anti-patterns.Version: v7.9.4
object
SkillSpector is a security scanner for AI agent skills that detects vulnerabilities, malicious patterns, and security risksVersion: v2.12.0
object
PSScriptAnalyzer is a static code checker for PowerShell scripts and modules.Version: v1.25.0

Fun

string
default:""
Max length: 250
boolean
default:false
boolean
default:false

Review commands

Learn about @coderabbitai commands

Migrating to V3

Check eligibility and prepare your configuration