Free and open source AI code review tools for maintainers

Ten, as of September 2026, and I checked every one against the vendor's own page. CodeRabbit, Codacy, Greptile, Qodo, Sourcery, Korbit, DeepSource, Gitar, CodeAnt and our own PR Lens all give open source projects something for nothing, and three of them make you apply first. The one that surprises people: GitHub Copilot code review is not among them. GitHub's own documentation says users on the Copilot Free plan "do not have a monthly allowance of AI credits" for code review and that the plan "does not include Copilot code review". There is no public repository exemption, only a restricted Review selection inside VS Code.

Everything below comes from the vendor's own pricing or docs page, read on 7 September 2026. None of those pages carried a last-updated date, and terms in this category change every few months, so check before you commit a workflow file.

Free for public repositories, no application

CodeRabbit is the clearest. Its pricing FAQ says to "install CodeRabbit on a public repository, and receive free reviews forever for public repositories. No additional setup is required." Paid plans for private code start at $24 per developer per month on annual billing. The page lists CLI reviews under Essentials and says nothing about the CLI on the open source offer, so I would not assume it is covered.

Codacy advertises an Open Source plan that is "Free forever for open-source projects", described in its FAQ as being for "individuals and teams working exclusively on public projects". Its paid seats are defined per git contributor who commits to a private repository, so a public-only project pays nothing.

PR Lens is the third. It is MIT licensed at github.com/coldteadotai/pr-lens and free for open source, and the hosted GitHub App runs on Gemini with no key of yours anywhere in it. It does something different from the other two, which I will come back to.

Free for open source, with a gate in front

Four of them put something in front of the offer. Three want an application. Qodo wants 200 stars.

The Greptile and Gitar offers are generous on their face. The Qodo star threshold is worth reading closely if you maintain something small and load-bearing rather than something popular, which describes most of the dependencies I actually worry about.

Stated as a plan, with limits

Three more publish an open source tier without describing an approval step. I would still read the fine print, because in each case the free tier is narrower than the headline.

Sourcery says it "is fully free to use on open source projects" and lists Pro features for open source repos. The open source tier caps security scans at three repositories and runs them biweekly.

Korbit says "Korbit Max is free for all open source repositories" with no stated cap. Everything else on that page starts with a 14-day trial.

DeepSource says it "is free for open-source projects, and always will be", with unlimited public repositories and unlimited team members, capped at 1,000 pull requests reviewed per month. The catch is that AI Review and Autofix on that plan are pay as you go, so the static analysis is free and the AI part is metered.

The genuinely open source ones you run yourself

If free matters because you do not want a vendor in the loop at all, these are the ones with a licence file rather than a pricing page.

PR-Agent is MIT licensed and community maintained. It has moved out of the Qodo organisation to The-PR-Agent/pr-agent, and its README now says plainly that it "is not the Qodo offering for open-source projects". You bring your own model key, so the tool is free and the inference is not.

reviewdog is MIT and wraps linters you already run, posting their output as review comments. Danger is MIT in both its JavaScript and Ruby forms and enforces rules about the pull request itself: has it a changelog entry, is it too big, did it touch the migrations without touching the tests. Neither calls a model. A rule you wrote never hallucinates.

Semgrep's community edition is open source under LGPL-2.1. Its hosted Free Edition reads as a flat cap of 10 repositories and 10 contributors in the tier summary, and the comparison table under it says public repositories are unlimited and the 10 applies to private ones. For a public project the second reading is the one that matters, and it is worth confirming with them.

PR Lens is MIT too. The renderer has no dependencies beyond the schema it validates against, so if you only want the drawing part you can take @coldtea/pr-lens-renderer and feed it your own documents.

Which tools are not free for open source

Copilot code review, as covered above. GitHub does note that "verified teachers, and maintainers of popular open source projects may be eligible for free access to Copilot Pro", which does include code review, so the route exists through the account rather than the repository. One caution on numbers: GitHub now labels its premium-requests page legacy billing, so a per-review request figure lifted from an older round-up no longer describes how code review is charged.

Cursor Bugbot bills on usage, and neither the pricing page nor the Bugbot docs mention open source terms at all. Claude Code Review is a research preview for Team and Enterprise subscriptions, and Anthropic's docs put each review at an average of $15 to $25 in token cost. The claude-code-action GitHub Action is MIT and free to run, but you supply the key, so the same split applies as with PR-Agent.

That is fair enough. Reviewing a large pull request with a model costs real money, and a vendor that gives it away to every public repository is subsidising a lot of CI. It is just worth knowing which bill you are signing up for.

What a maintainer actually runs out of

Every tool on this list is free; the one you install still costs a maintainer's attention. A finder that posts eight comments on a drive-by contribution has not saved you anything, because you now have to judge eight findings on a change you have not read yet.

That is the gap PR Lens is built for, and it is why it sits oddly in a list like this one. It reports no findings. It reads the diff and the system around it, writes a typed JSON graph document, and a deterministic renderer turns that into animated architecture and data-flow diagrams posted as one comment on the pull request. Colour carries the delta: green new, amber changed, red gone, with retired components struck through and the untouched parts of the system left on the page. The comment links to a canvas where you can pan, zoom and press play to walk the change one step at a time.

For a maintainer, the useful property is that a first-time contributor's 400-line pull request arrives with a picture of what it does to your project, drawn from the branch rather than from the contributor's description of it. You still review it. You start from a different place.

Four ways to run it, all free for open source: the GitHub App, a GitHub Action with your own model key, a CLI on npm, and an agent skill that lets whatever coding agent you already have draw the change with no key at all. The details are in what is PR Lens.

What I would put on a public repository tomorrow

One finder and one explainer, and nothing else until they have earned their place.

For the finder, CodeRabbit if you want it working in five minutes, Greptile if your project qualifies and you would rather have whole-codebase context, or PR-Agent if you would rather host it. For the explainer, PR Lens. The category split behind that recommendation is in AI code review tools grouped by what they actually do, and the specific comparison with the most popular of the free-for-OSS bots is in PR Lens vs CodeRabbit.

Then turn off anything that has not changed a merge decision in a month. Free tools still cost review attention, and on an open source project that is the budget that runs out first.