version: 3 in its root .coderabbit.yaml or .coderabbit.yml. See Migrating to V3 for availability, setting changes, inheritance, and directory requirements. The reference does not describe the separate preferences managed in the web UI.
Download the V3 JSON Schema.
This reference is automatically generated from the CodeRabbit V3 configuration schema. Last updated: November 12, 2026
General settings
enum
required
Select the V3 schema with the number 3. A schema URL comment does not select a configuration version.One of the following:
3Learn more: Migrate configuration to V3.coderabbit.yaml
enum
default:"en-US"
Set the language used for human-readable review feedback with a supported language code.One of the following:
de, de-DE, de-AT, de-CH, en, en-US, en-AU, en-GB, en-CA, en-NZ, en-ZA, es, es-AR, fr, fr-CA, fr-CH, fr-BE, nl, nl-BE, pt-AO, pt, pt-BR, pt-MZ, pt-PT, ar, ast-ES, ast, be-BY, be, br-FR, br, ca-ES, ca, ca-ES-valencia, ca-ES-balear, da-DK, da, de-DE-x-simple-language, el-GR, el, eo, fa, ga-IE, ga, gl-ES, gl, it, ja-JP, ja, km-KH, km, ko-KR, ko, pl-PL, pl, ro-RO, ro, ru-RU, ru, sk-SK, sk, sl-SI, sl, sv, ta-IN, ta, tl-PH, tl, tr, uk-UA, uk, zh-CN, zh, zh-TW, crh-UA, crh, cs-CZ, cs, nb, no, nl-NL, de-DE-x-simple-language-DE, es-ES, it-IT, fa-IR, sv-SE, de-LU, fr-FR, bg-BG, bg, he-IL, he, hi-IN, hi, vi-VN, vi, th-TH, th, bn-BD, bnboolean
default:false
Allow applicable parent settings to fill values omitted here. Explicit scalar values take precedence; lists follow the inheritance merge rules. Organization and workspace overrides can force inheritance.Learn more: Migrate configuration to V3
Reviews
Behavior
reviews.behavior
enum
default:"chill"
Choose the amount of review feedback. Quiet prioritizes the most important feedback, chill provides balanced feedback, and assertive includes more suggestions that can feel nitpicky.One of the following:
quiet, chill, assertivearray of string
default:[]
Include or exclude files from review using repository-relative glob patterns. Prefix an exclusion with
!, and quote patterns starting with ! in YAML.object
string
Merge Risk Instructions: Describe what makes a pull request more or less risky to merge in this codebase. CodeRabbit uses this when rating merge risk, which
auto_approvals.max_merge_risk can limit for automatic approval. Up to 3000 characters. Example: Database migrations and billing changes are high risk. Docs-only and test-only changes are low risk.Max length: 3000
string
Security Risk Instructions: Describe facts about your system that affect security risk, such as which services are internet-facing, where tenant isolation is enforced, or which controls protect a path. CodeRabbit uses this when rating security architecture risk, which
auto_approvals.max_security_risk can limit for automatic approval. Security risk assessments require the Advanced plan or above. Unlike Security scan context, which guides security findings in reviews and scans, this only affects the risk rating. Up to 3000 characters. Example: The admin service is reachable only over the corporate VPN. Changes to tenant isolation in packages/tenancy are high risk.Max length: 3000
object
Defaults to
{"progress_updates":true,"legacy_commit_status":true,"fail_on_error":false}.Auto review
reviews.auto_review
boolean
default:true
Automatic Review: Review PRs automatically.
string
default:""
Keyword in the PR description that triggers a review when automatic reviews are disabled. If
enabled is false and this field is not empty, CodeRabbit reviews the PR only when this keyword is present in the description.boolean
default:true
Incremental Review: Re-run the review on each push.
integer
default:5
Auto Pause After Reviewed Commits: Pause automatic reviews after this many reviewed commits since the last pause. Set to 0 to disable.
Min: 0, Max: 9007199254740991
array of string
default:[]
Labels that control which PRs are reviewed. Labels starting with â!â are negative matches. Examples: [âbugâ, âfeatureâ] reviews PRs with either label. [â!wipâ] reviews all PRs except those labeled âwipâ when automatic reviews are enabled. [âbugâ, â!wipâ] reviews PRs labeled âbugâ but not âwipâ. When
enabled is false, a positive label match (for example [âreview-readyâ]) triggers a review; negative-only labels such as [â!wipâ] remain exclusion filters and do not opt PRs in by themselves.boolean
default:false
Include draft PRs.
array of string
default:[]
Base branches (other than the default branch) to review. Accepts regex patterns. Use â.*â to match all branches.
Output
reviews.output
object
Defaults to
{"placement":"description","placeholder":"@coderabbitai summary","instructions":""}.object
Defaults to
{"collapse":true,"review_status":true,"review_info":true,"review_details":false,"changed_files_summary":true,"related_issues":true,"related_prs":true}.object
default:{"allow_non_org_members":true}
object
Defaults to
{"labels":{"mode":"suggest","instructions":[],"mutually_exclusive_groups":{}},"reviewers":{"mode":"suggest","instructions":[]}}.Tools
reviews.tools
Tools that provide additional context to code reviews.
object
ast-grep is a code analysis tool that helps you to find patterns in your codebase using abstract syntax trees patterns.Version:
v0.51.1object
ShellCheck is a static analysis tool that finds bugs in your shell scripts.Version:
v0.11.0object
Ruff is a Python linter and code formatter.Version:
v0.17.3object
markdownlint-cli2 is a static analysis tool to enforce standards and consistency for Markdown files.Version:
v0.24.0object
GitHub Checks integration configuration.
object
LanguageTool is a style and grammar checker for 30+ languages.
object
Biome is a fast formatter, linter, and analyzer for web projects.Version:
v2.6.3object
Hadolint is a Dockerfile linter.Version:
v2.15.1object
SwiftLint integration configuration object.Version:
v0.65.1object
PHPStan is a tool to analyze PHP code.Version:
v2.3.3object
PHPMD is a tool to find potential problems in PHP code.Version:
v3.0.0object
PHP CodeSniffer is a PHP linter and coding standard checker.Version:
v3.13.6object
golangci-lint is a fast linters runner for Go.Version:
v2.15.0object
YAMLlint is a linter for YAML files.Version:
v1.37.1object
Betterleaks is a secret scanner (an improved version of Gitleaks).Version:
v1.9.0object
TruffleHog is a secret scanner with verification capabilities that can detect and verify secrets in code.Version:
v3.99.8object
Checkov is a static code analysis tool for infrastructure-as-code files.Version:
v3.3.30object
TFLint is a Terraform linter for finding potential errors and enforcing best practices.Version:
v0.66.0object
Detekt is a static code analysis tool for Kotlin files.Version:
v1.23.8object
ESLint is a static code analysis tool for JavaScript files.
object
Flake8 is a Python linter that wraps PyFlakes, pycodestyle and Ned Batchelderâs McCabe script.Version:
v7.4.1object
Configuration for Infer to find bugs in Java and C/C++ codeVersion:
v1.3.0object
Fortitude is a Fortran linter that checks for code quality and style issues.Version:
v0.10.0object
RuboCop is a Ruby static code analyzer (a.k.a. linter ) and code formatter.Version:
v1.92.1object
Buf offers linting for Protobuf files.Version:
v1.74.0object
Regal is a linter and language server for Rego.Version:
v0.43.0object
actionlint is a static checker for GitHub Actions workflow files.Version:
v1.7.12object
zizmor is a static security analyzer for GitHub Actions workflow files.Version:
v1.31.1object
PMD is an extensible multilanguage static code analyzer. Itâs mainly concerned with Java.Version:
v7.28.0object
Configuration for Clang to perform static analysis on C and C++ codeVersion:
v23.1.4object
Cppcheck is a static code analysis tool for the C and C++ programming languages.Version:
v2.22.0object
Vale lints prose using the repositoryâs checked-in style rules.Version:
v3.24.0object
Verilator statically analyzes Verilog and SystemVerilog source files.Version:
v5.052object
OpenGrep is a high-performance static code analysis engine, compatible with Semgrep configurations.Version:
v1.33.0object
Semgrep is a static analysis tool designed to scan code for security vulnerabilities and code quality issues.Version:
v1.183.0object
CircleCI tool is a static checker for CircleCI config files.Version:
v1.9.0object
Clippy is a collection of lints to catch common mistakes and improve your Rust code.
object
SQLFluff is an open source, dialect-flexible and configurable SQL linter.Version:
v4.4.0object
Configuration for Squawk to lint Postgres migrations and SQL for safe schema changesVersion:
v2.70.0object
Trivy is a comprehensive security scanner that detects misconfigurations and secrets in Infrastructure as Code filesVersion:
v0.76.2object
Configuration for Prisma Schema linting to ensure schema file qualityVersion:
v0.13.1object
Pylint is a Python static code analysis tool.Version:
v4.1.3object
Oxlint is a JavaScript/TypeScript linter for OXC written in Rust.Version:
v1.89.0object
Configuration for Shopify Theme Check to ensure theme quality and best practicesVersion:
cli 5.0.0, theme 3.58.2object
Configuration for Lua code linting to ensure code qualityVersion:
v1.2.0object
Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications.Version:
v8.1.0object
dotenv-linter is a tool for checking and fixing .env files for problems and best practicesVersion:
v4.0.0object
HTMLHint is a static code analysis tool for HTML files.Version:
v1.9.2object
Stylelint is a linter for stylesheets (CSS, SCSS, Sass, Less, SugarSS, Stylus) that helps avoid errors and enforce conventions.Version:
v17.14.0object
checkmake is a linter for Makefiles.Version:
v0.3.2object
OSV Scanner is a tool for vulnerability package scanning.Version:
v2.7.0object
oasdiff detects breaking changes between OpenAPI specifications.Version:
v1.34.0object
React Doctor scans React codebases for security, performance, correctness, and accessibility issues.Version:
v0.9.18object
Microsoft Presidio Analyzer 2.2.366 detects sensitive identifiers (including payment cards, US SSN, cryptocurrency wallets, and phone numbers) in changed files. Tune entities, thresholds, and languages in repository Presidio configuration (for example .presidiocli or AnalyzerEngineProvider YAML); the built-in scan uses fixed defaults and is skipped when that configuration is present.Version:
v2.2.366object
Blinter is a linter for Windows batch files that provides comprehensive static analysis to identify syntax errors, security vulnerabilities, performance issues, and style problems.Version:
v1.1.49object
smarty-lint is a linter for Smarty 3 template files that checks for common issues such as incorrect operator usage, naming conventions, empty blocks, and unquoted strings.Version:
v0.3.3object
ember-template-lint is a linter for Handlebars template files that checks for common issues such as accessibility violations, deprecated patterns, and template anti-patterns.Version:
v7.9.4object
SkillSpector is a security scanner for AI agent skills that detects vulnerabilities, malicious patterns, and security risksVersion:
v2.12.0object
PSScriptAnalyzer is a static code checker for PowerShell scripts and modules.Version:
v1.25.0Fun
string
default:""
Max length: 250
boolean
default:false
boolean
default:false
Related resources
Review commands
Learn about @coderabbitai commands
Migrating to V3
Check eligibility and prepare your configuration