> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# React Doctor

> CodeRabbit runs React Doctor to find React security, performance, correctness, and accessibility issues.

[React Doctor](https://github.com/millionco/react-doctor) scans React codebases for security, performance, correctness, and accessibility issues. CodeRabbit runs React Doctor version 0.9.14 on relevant changed files in a secure sandbox.

## Files

React Doctor runs on changed files with these extensions:

* `.jsx`
* `.tsx`
* `.ts`
* `.js`

React Doctor always scans changed `.jsx` and `.tsx` files. It scans changed `.js` and `.ts` files only when the nearest `package.json` declares a React dependency such as `react`, `react-dom`, `react-native`, `preact`, or `@preact/compat`. React Doctor skips `.mjs` and `.cjs` files even when a nearby package declares a React dependency.

## Configuration

React Doctor is enabled by default. Enable or disable it with `.coderabbit.yaml` or the CodeRabbit web UI:

<Tabs>
  <Tab title=".coderabbit.yaml">
    ```yaml .coderabbit.yaml theme={null}
    reviews:
      tools:
        reactDoctor:
          enabled: true
    ```
  </Tab>

  <Tab title="Web UI">
    Go to **Reviews → Tools → React Doctor** in your organization or repository settings and toggle React Doctor `on` or `off`.
  </Tab>
</Tabs>

CodeRabbit supports these static React Doctor config files:

* `doctor.config.json`
* `doctor.config.jsonc`
* `react-doctor.config.json`

CodeRabbit also reads `reactDoctor` configuration from `package.json`. If a package uses `package.json` configuration without a supported static config file, CodeRabbit writes a temporary `doctor.config.json` beside that `package.json` using the selected review profile.

Although `doctor.config.jsonc` is a recognized filename, the security check requires strict JSON. Comments and trailing commas cause CodeRabbit to skip React Doctor.

## Profiles

These defaults apply when CodeRabbit generates a React Doctor config. Supported repository config files control their own rule settings.

* `Chill`: Reports security findings and definite bug findings. Performance, accessibility, maintainability, design-tagged, and test-noise-tagged rules are disabled.
* `Assertive`: Reports security findings as errors and bug findings at their React Doctor default severity. Performance and accessibility findings are errors when their default severity is error, and warnings otherwise. Maintainability and test-noise-tagged rules remain disabled.

CodeRabbit also disables these React Doctor rules in generated configs for both profiles:

* `react-doctor/no-vulnerable-react-server-components`
* `react-doctor/no-barrel-import`
* `react-doctor/nextjs-no-img-element`
* `react-doctor/js-combine-iterations`
* `react-doctor/prefer-module-scope-pure-function`
* `react-doctor/prefer-module-scope-static-value`
* `react-doctor/only-export-components`
* `react-doctor/no-giant-component`
* `react-doctor/no-multi-comp`

CodeRabbit also filters the `react-in-jsx-scope` rule from review comments after parsing React Doctor output.

## Security policy and restrictions

React Doctor runs inside the CodeRabbit sandbox with the sandbox-installed `react-doctor` package. CodeRabbit does not install project npm packages or run repository-supplied React Doctor plugins.

Executable React Doctor config files are not supported:

* `doctor.config.ts`
* `doctor.config.js`
* `doctor.config.mjs`
* `doctor.config.cjs`
* `doctor.config.mts`
* `doctor.config.cts`

CodeRabbit skips React Doctor if a supported static config file or `package.json` `reactDoctor` configuration declares a non-empty `plugins` array. React Doctor dead-code analysis is disabled in CodeRabbit runs.

## When we skip React Doctor

CodeRabbit skips React Doctor when:

* React Doctor is disabled in CodeRabbit settings.
* The pull request does not change a supported file type.
* The changed files do not include JSX and no nearby `package.json` declares a React project dependency.
* React Doctor is already running in GitHub Actions, GitLab CI, CircleCI, or Azure Pipelines.
* The repository contains an executable React Doctor config file.
* A React Doctor config declares non-empty plugins.

## What's next

<CardGroup cols={1}>
  <Card title="ESLint" href="/tools/eslint" icon="file-code" horizontal>
    Review how CodeRabbit runs ESLint for JavaScript, TypeScript, and framework files.
  </Card>

  <Card title="Oxlint" href="/tools/oxlint" icon="zap" horizontal>
    Learn how CodeRabbit runs Oxlint for JavaScript and TypeScript projects.
  </Card>

  <Card title="All supported tools" href="/tools/list" icon="list" horizontal>
    Browse the complete list of linters, security analyzers, and CI/CD integrations available in CodeRabbit.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.