Coderabbit

CodeRabbit

AI-powered code review for pull requests and local changes.

Quick Navigation

Prerequisites Check (MUST RUN BEFORE REVIEW)

Before running CodeRabbit CLI, verify ALL of the following:

# 1. CLI installed?
which coderabbit || echo "MISSING: install with: curl -fsSL https://cli.coderabbit.ai/install.sh | sh"

# 2. Authenticated?
coderabbit auth status 2>&1 | grep -q "Logged in" || echo "MISSING: run coderabbit auth login"

# 3. Git repo has at least one commit? (CRITICAL — CLI crashes with GitError on empty repos)
git rev-parse HEAD >/dev/null 2>&1 || echo "MISSING: repo has no commits — make at least one commit first"

# 4. Base branch exists? (CLI defaults to 'main')
git rev-parse main >/dev/null 2>&1 || echo "WARNING: 'main' branch not found — use --base <branch>"

If any check fails, fix it before running the review. Do NOT proceed with a broken state.

Authentication failure rule: If authentication check fails (step 2), the agent MUST:

1. Stop immediately — do not attempt to run the review 2. Notify the user that CodeRabbit CLI is not authenticated 3. Show the user the exact command to authenticate: coderabbit auth login 4. Wait for the user to complete authentication before retrying 5. Do NOT attempt to run coderabbit auth login on behalf of the user — it requires interactive browser redirect

Quick Start

Run Review

# AI agent workflow (most common) — note: 'review' subcommand is optional
coderabbit review --prompt-only --type uncommitted --no-color

# If base branch is not 'main' (e.g., master, develop):
coderabbit review --prompt-only --type uncommitted --base master --no-color

# Plain text output (human-readable)
coderabbit review --plain --type uncommitted --no-color

Local Capture Script

Persist output to a file for later analysis:

# IMPORTANT: use absolute path to the skill's script directory
python3 ~/.claude/skills/coderabbit/scripts/run_coderabbit.py --output coderabbit-report.txt

Options:

• --output to choose a different file name (saved to .code-review/ in repo root)
• --timeout to adjust the timeout in seconds (default: 1800)
• --base to specify base branch (default: auto-detect from git)

PR Commands

@coderabbitai review          # Incremental review
@coderabbitai full review     # Complete review
@coderabbitai simplify        # Apply targeted simplifications to changed files
@coderabbitai fix merge conflict  # Attempt automatic merge-conflict resolution
@coderabbitai pause           # Stop auto-reviews
@coderabbitai resume          # Resume auto-reviews
@coderabbitai resolve         # Mark comments resolved

Severity Matrix

AI Agent Workflow Pattern

Implement [feature] and then run CodeRabbit CLI in a background terminal.
Wait for it to complete, then read the report. Fix CRITICAL/HIGH issues. Ignore nits.

Step-by-step:

1. Run prerequisites check (see above) — fix any issues before proceeding 2. Detect base branch: git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null or fall back to main/master 3. Run CLI in background: coderabbit review --prompt-only --type uncommitted --base <branch> --no-color 4. Reviews take 7-30+ minutes — run in background (run_in_background=true) 5. Read output when process completes 6. Fix CRITICAL/HIGH findings, skip LOW 7. Limit to 2-3 review iterations maximum

Troubleshooting

[error] stopping cli with no details

Run with DEBUG=* to see the actual error:

DEBUG=* coderabbit review --prompt-only --type uncommitted 2>&1 | grep -E "(ERROR|error|GitError)"

Check the log file:

ls -t ~/.coderabbit/logs/ | head -1 | xargs -I{} cat ~/.coderabbit/logs/{}

Common errors

Check auth status

coderabbit auth status

Linked Repositories (2026-02-18)

CodeRabbit can analyze linked repositories during PR review to catch cross-repo breakages (API/type/dependency drift).

• Configure linked repositories in Knowledge Base settings.
• As of 2026-03-11, Pro plans can link up to 2 repositories for Multi-Repo Analysis.
• Use this when changes in one repo affect contracts in another.
• Treat cross-repo findings as HIGH/CRITICAL when they indicate runtime incompatibility.

Dashboard and Reporting (2026-03-12)

• Dashboard metrics are now split between Git platform reviews and IDE/CLI reviews.
• Reporting surfaces now include Git-platform pages like Knowledge Base, Pre-merge Checks, and Reporting, plus IDE/CLI pages like Summary, Organization Trends, and Data Metrics.
• Team filters are available across dashboards; use them when review volume or findings need to be separated by team rather than repository alone.

Simplify Code (Open Beta, Pro) (2026-03-13)

• @coderabbitai simplify runs an agentic cleanup pass over the files changed in the PR.
• It focuses on extracting reusable helpers, simplifying conditionals, and removing redundancy while preserving behavior.
• CodeRabbit validates the result with the repository's existing test suite and can either open a follow-up PR or commit directly to the branch.
• Not available for fork PR direct-commit mode.

Chat Access Control (GitHub Orgs) (2026-03-16)

• Use chat.allow_non_org_members: false in .coderabbit.yaml when PR comment chat must stay limited to organization members.
• This affects comment-thread interaction only; automatic PR review behavior is unchanged.
• Default remains true, so public-repo chat stays open unless you opt out.

Resolve Merge Conflicts (Open Beta, Pro) (2026-03-17)

• CodeRabbit can detect merge conflicts during PR review and offer one-click or comment-triggered resolution.
• Trigger with @coderabbitai fix merge conflict or the Walkthrough checkbox on GitHub.
• It commits a proper merge commit when successful, but declines if the resolution is ambiguous or touches security-critical logic such as auth, encryption, secrets, or access control.
• If any conflicted file is declined, the whole auto-resolution attempt is aborted and no partial commit is created.

Betterleaks (replaces Gitleaks) (2026-03-19)

• Secret scanning now uses Betterleaks (improved detection over Gitleaks).
• The gitleaks config key in .coderabbit.yaml now controls Betterleaks.
• Default remains enabled; existing secret scanning continues without changes.

Slop Detection (2026-03-24)

• Automatically detects low-quality AI-generated PRs on public GitHub repositories.
• Flagged in the PR Walkthrough comment.
• Opt-in label tagging:

reviews:
  slop_detection:
    enabled: true # default
    label: "slop" # optional label

Bitbucket Data Center (2026-03-24)

• Full support for Bitbucket Data Center as a Git platform.
• OAuth 2.0, automated webhook configuration, and full PR review capabilities.

Audit Logs (2026-03-25)

• Tamper-resistant audit log for every administrative action across the workspace.
• Covers seat assignments/removals, role changes, org/repo changes, subscription events, config updates, and API key operations.
• Accessible in Settings UI or via REST API for automated export.

CLI Agent Mode (2026-03-31)

• coderabbit review --agent outputs results in structured JSON format for Skills and agent integrations.

CLI 0.4.x (2026-04-01 to 2026-04-06)

• coderabbit auth login completes fully in the browser.
• --agent now covers auth-related workflows better for agent environments.
• --dir replaces --cwd for subdirectory-scoped reviews.
• coderabbit stats is available for local review telemetry.

GitLab SSH Access (2026-04-02)

• Self-managed GitLab can use SSH clone credentials instead of HTTPS.
• This is useful when GitLab instances do not expose HTTPS cloning or enforce SSH-only repository access.

Codex Plugin (2026-04-14)

• CodeRabbit is available as a dedicated Codex plugin in addition to the standalone CLI.
• The plugin verifies CLI install/auth, triggers reviews from natural language or @coderabbit, and keeps findings inside the agent loop for follow-up fixes.

Global Overrides (2026-04-16)

• Organization admins can enforce top-priority configuration overrides across every repository.
• Nested objects merge with lower layers; arrays and scalar values replace them.

Custom Finishing Touch Recipes (Early Access) (2026-02-23)

Define reusable, named "finishing touch" recipes that apply agentic code changes to your PR.

See configuration.md for a minimal example.

Minimal Configuration

# .coderabbit.yaml
language: en-US
reviews:
  profile: chill
  high_level_summary: true
  tools:
    gitleaks:
      enabled: true
    ruff:
      enabled: true

Critical Prohibitions

• Do not introduce fallbacks, mocks, or stubs in production code
• Do not broaden scope beyond what CodeRabbit flagged
• Do not "fix" style nits handled by formatters/linters
• Do not ignore CRITICAL findings; escalate if unclear
• Stop and resolve CLI errors (auth/network) before fixing code
• Do not run CLI on a repo with no commits — it will silently crash

Links

• Documentation
• Changelog
• GitHub
• Schema

Templates

• coderabbit.minimal.yaml — Minimal configuration
• coderabbit.full.yaml — Full example with all options
• agent-prompts.md — Ready-to-use AI agent prompts

CodeRabbit AI Agent Prompts

Ready-to-use prompts for integrating CodeRabbit with AI coding agents.

Basic Review Prompt

Run coderabbit --prompt-only --type uncommitted and fix any critical issues.

Full Implementation + Review

Implement [FEATURE DESCRIPTION] and then run coderabbit --prompt-only -t uncommitted,
let it run as long as it needs (run it in the background) and fix any critical issues.
Ignore style nits.

Review with Severity Filter

Run coderabbit --prompt-only and evaluate the findings:
- Fix all CRITICAL and HIGH severity issues
- Defer MEDIUM issues if not quick wins
- Skip LOW severity (style/formatting)

Provide a summary of what was fixed and what was deferred.

Loop-Limited Review

Run coderabbit --prompt-only --type uncommitted. Fix critical issues only.
Then run CodeRabbit again to verify.

Only run the loop twice. If on the second run you don't find any critical issues,
ignore remaining nits and report completion with a summary.

Feature Branch Review

I'm working on [FEATURE]. Run coderabbit --prompt-only --base develop
to compare against the develop branch. Focus on:
- Security vulnerabilities
- Breaking changes
- Performance regressions

Fix critical issues and document any architectural concerns.

Cursor Rules Addition

Add to .cursorrules:

# CodeRabbit Integration

CodeRabbit CLI is installed. Use it to review code changes.

Commands:
- `cr -h` for help
- `coderabbit --prompt-only -t uncommitted` for AI-optimized review

Rules:
- Run CodeRabbit with --prompt-only flag
- Don't run more than 3 times per change set
- Fix CRITICAL issues immediately
- Document MEDIUM issues if deferring
- Skip LOW (style) issues

Claude.md Addition

Add to claude.md (Pro feature - CodeRabbit reads this):

## Code Review Standards

When CodeRabbit reviews my code, apply these preferences:

### Focus Areas

- Security vulnerabilities (SQL injection, XSS, auth bypass)
- Data integrity (race conditions, transaction handling)
- Error handling (uncaught exceptions, missing validations)
- Performance (N+1 queries, memory leaks)

### Ignore

- Formatting (handled by Prettier/Black)
- Import ordering (handled by isort/eslint)
- Line length warnings

### Style Preferences

- Prefer explicit error handling over silent failures
- Use typed parameters and return values
- Keep functions under 50 lines

AI Agent Integration

CodeRabbit CLI integrates with AI coding agents (Claude Code, Cursor, Codex) for autonomous review-fix workflows.

Core Workflow

1. Implement feature 2. Run prerequisites check (see below) 3. Run coderabbit review --prompt-only in background 4. AI agent evaluates findings 5. Fix critical issues 6. Re-run CodeRabbit to verify (max 2-3 iterations)

Prerequisites (MUST CHECK BEFORE EVERY REVIEW)

# All of these must pass:
which coderabbit                           # CLI installed
coderabbit auth status 2>&1 | grep -q "Logged in"  # Authenticated
git rev-parse HEAD >/dev/null 2>&1         # Has at least one commit
git rev-parse main >/dev/null 2>&1         # Base branch exists (or use --base)

Critical: CodeRabbit CLI silently crashes with [error] stopping cli if:

• The repo has no commits (GitError)
• The base branch doesn't exist (defaults to main)

Claude Code Integration

Prerequisites

# Install CodeRabbit CLI
curl -fsSL https://cli.coderabbit.ai/install.sh | sh
source ~/.zshrc

# Authenticate
coderabbit auth login

Running Reviews

# Auto-detect base branch and run review
python3 ~/.claude/skills/coderabbit/scripts/run_coderabbit.py

# Or run CLI directly (specify base branch if not 'main'):
coderabbit review --prompt-only --type uncommitted --base master --no-color

Key Components

• review — subcommand (optional, it's the default)
• --prompt-only — AI-optimized output format (implies --plain)
• --no-color — strip ANSI codes for clean parsing
• --base <branch> — specify base branch (default: main)
• --type uncommitted — only review working directory changes
• Background execution — reviews take 7-30+ minutes

Configuration

CodeRabbit reads claude.md for coding standards (Pro feature).

Cursor Integration

Setup

Let's verify you can run the CodeRabbit CLI.
Run the terminal command: coderabbit auth status and tell me the output.

Usage Prompt

Implement phase 7.3 - adding Withings smart scale integration.
Then run coderabbit review --prompt-only --type uncommitted --no-color.
Once it completes, fix any critical issues.

Cursor Rules File

Add to .cursorrules:

# Running the CodeRabbit CLI

CodeRabbit is already installed in the terminal. Run it as a way to review your code.
Run the command: cr review -h for details on commands available.
In general, I want you to run coderabbit with the `--prompt-only` flag.
To review uncommitted changes run:
`coderabbit review --prompt-only -t uncommitted --no-color`.

IMPORTANT: Before running CodeRabbit, verify the repo has at least one commit
(git rev-parse HEAD) and that the base branch exists.
Don't run CodeRabbit more than 3 times in a given set of changes.

Codex Integration

CodeRabbit now has a dedicated Codex plugin in addition to the standalone CLI.

Setup flow:

1. Install Codex. 2. Install/authenticate CodeRabbit CLI. 3. Install the coderabbit plugin from the Codex plugin marketplace. 4. Trigger reviews with natural language or @coderabbit mentions.

Examples:

Review my current changes with CodeRabbit
@coderabbit Review my current changes

Operational notes:

• The plugin verifies CLI installation and authentication before running.
• It summarizes the diff first, then reports findings with severity, file path, impact, and fix direction.
• Keep direct CLI usage for debugging/manual control; let the plugin drive normal Codex review loops.

Structured agent output

• Prefer coderabbit review --agent when another agent needs machine-readable findings.
• Consume the output line by line and branch on event type; findings include severity, file path, and codegen guidance.

Recommended Commands

# Review uncommitted changes (most common)
coderabbit review --prompt-only -t uncommitted --no-color

# Specify base branch (if not 'main')
coderabbit review --prompt-only --base master --no-color

# Review all changes
coderabbit review --prompt-only --type all --no-color

Loop Limit Pattern

Prevent infinite iteration:

Only run the loop twice. If on the second run you don't find any critical issues,
ignore the nits and you're complete. Give me a summary of everything that was
completed and why.

Severity Prioritization

Instruct agent to prioritize:

Evaluate the fixes and considerations. Fix major issues only, or fix any critical
issues and ignore the nits.

Troubleshooting

[error] stopping cli with no details

1. Check git rev-parse HEAD — repo must have at least one commit 2. Check git rev-parse main — base branch must exist (use --base to override) 3. Check coderabbit auth status — must be authenticated 4. Run with debug: DEBUG=* coderabbit review --prompt-only 2>&1 | grep ERROR 5. Check logs: ls -t ~/.coderabbit/logs/ | head -1 | xargs -I{} cat ~/.coderabbit/logs/{}

Review Not Finding Issues

1. Check coderabbit auth status 2. Verify git status shows tracked changes 3. Use --type uncommitted for working directory 4. Specify --base develop if main branch differs

Agent Not Applying Fixes

1. Ensure background execution in prompt 2. Use --prompt-only mode 3. Explicitly say "fix the issues found by CodeRabbit" 4. Check if review finished: "Is CodeRabbit finished running?"

Managing Duration

• Use --type uncommitted for faster reviews
• Work on smaller feature branches
• Break large features into reviewable chunks

CodeRabbit CLI Usage

Installation

curl -fsSL https://cli.coderabbit.ai/install.sh | sh

Restart shell after installation:

source ~/.zshrc  # or source ~/.bashrc

Authentication

coderabbit auth login
# Short alias
cr auth login

Authentication completes in the browser; no token copy-paste step is required in current CLI builds.

Check status:

coderabbit auth status

Prerequisites

CodeRabbit CLI requires:

1. Initialized git repo — must be run from within a git repository 2. At least one commit — the CLI uses git diff internally and will crash with GitError on repos with no commits 3. Valid base branch — defaults to main; use --base if your branch is named differently (e.g., master, develop)

Review Commands

The review subcommand is the default — coderabbit --plain and coderabbit review --plain are equivalent.

Output Modes

--agent writes JSON objects to stdout (one per line). Expect event types such as review_context, status, finding, complete, and error.

Review Types

Base Branch

# Default assumes 'main' branch — override if needed
coderabbit review --base master
coderabbit review --base develop

Combined Examples

# AI agent workflow: uncommitted changes, non-interactive
coderabbit review --prompt-only --type uncommitted --base master --no-color

# Compare feature branch against develop
coderabbit review --prompt-only --base develop --no-color

# Human-readable review
coderabbit review --plain --type uncommitted --no-color

Command Reference

Additional Options

Timing Notes

• Reviews take 7-30+ minutes depending on scope
• Use --type uncommitted for faster feedback
• Background execution recommended for AI agent workflows
• Use --no-color when capturing output programmatically

Troubleshooting

Debug mode: DEBUG=* coderabbit review --prompt-only 2>&1 Logs: ~/.coderabbit/logs/

Uninstall

# If installed via script
rm $(which coderabbit)

# If installed via Homebrew
brew remove coderabbit

CodeRabbit Configuration

CodeRabbit can be configured via .coderabbit.yaml in repository root.

Configuration Priority (highest to lowest)

0. Global overrides — Organization Settings → Global Overrides 1. Local .coderabbit.yaml — repository root 2. Central configuration — dedicated coderabbit repository 3. Repository settings — Web UI per-repository 4. Organization settings — Web UI organization-wide 5. Schema defaults

Configuration is resolved through the precedence chain above, and Global overrides are applied last as the authoritative enforcement layer.

Global Overrides (2026-04-16)

• Use Global overrides when organization admins need settings that repositories cannot bypass.
• Nested objects merge with the effective lower-priority configuration.
• Arrays and scalar values replace the lower-priority value entirely.
• The PR comment shows the winning configuration source, which is useful during rollout/debugging.

Central configuration notes

• The central coderabbit repository must itself be installed in CodeRabbit so the config file can be read.
• On GitLab, CodeRabbit can resolve the nearest coderabbit repository in the nested group hierarchy, which enables team-specific central configs with fallback to parent groups.

Minimal Example

# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
language: en-US
tone_instructions: "Be concise and focus on critical issues only"

reviews:
  profile: chill
  high_level_summary: true

Key Settings

Knowledge Base: Linked Repositories (2026-02-18)

CodeRabbit can traverse linked repositories during PR review to detect cross-repo issues:

• Breaking API contract changes
• Type mismatches across repos
• Dependency drift between connected services/libraries

Operational guidance:

• Configure linked repositories in CodeRabbit Knowledge Base settings.
• Use linked repos for multi-repo systems where PRs frequently impact shared contracts.
• Keep links minimal and relevant to reduce noisy findings.

General

Chat

GitHub organization repositories can restrict PR comment chat to org members only:

chat:
  allow_non_org_members: false

• Default: true
• Effect: limits comment-thread interaction to organization members
• Does not affect automatic PR review eligibility or background review execution

Reviews

Auto Review

reviews:
  auto_review:
    enabled: true
    auto_incremental_review: true
    drafts: false
    ignore_title_keywords: ["WIP", "DO NOT MERGE"]
    labels: ["!wip"] # Skip PRs with 'wip' label
    base_branches: ["develop", "main"]

Path Instructions

reviews:
  path_instructions:
    - path: "**/*.ts"
      instructions: "Focus on type safety and null checks"
    - path: "src/api/**"
      instructions: "Verify authentication and authorization"

Tools Configuration

reviews:
  tools:
    eslint:
      enabled: true
    gitleaks:
      enabled: true
    ruff:
      enabled: true
    golangci-lint:
      enabled: true
      config_file: ".golangci.yml"

Pre-merge Checks

Override restrictions (2026-02-25):

reviews:
  pre_merge_checks:
    override_requested_reviewers_only: true

When enabled, pre-merge check overrides can be restricted to requested reviewers (excluding the PR author). Overrides include an audit trail in the Pre-Merge Checks section.

reviews:
  pre_merge_checks:
    title:
      mode: warning # off, warning, error
    description:
      mode: warning
    docstrings:
      mode: warning
      threshold: 80

Finishing Touches

reviews:
  finishing_touches:
    docstrings:
      enabled: true
    unit_tests:
      enabled: true

Custom Recipes (early access)

Create up to 5 named recipes under reviews.finishing_touches.custom. Each recipe has a name and freeform instructions.

Requirements:

• Set early_access: true in .coderabbit.yaml.
• GitHub only (GitLab support is not available yet).

Trigger a recipe via PR comment:

@coderabbitai run <recipe name>

Minimal example:

early_access: true

reviews:
  finishing_touches:
    custom:
      - name: "Harden error handling"
        instructions: "Replace silent fallbacks with explicit errors; add typed exceptions."
      - name: "Add missing tests"
        instructions: "Add unit tests for edge cases; avoid snapshot-only coverage."

Labeling Configuration

reviews:
  suggested_labels: true
  auto_apply_labels: false
  labeling_instructions:
    - label: "frontend"
      instructions: "Apply when PR contains React component changes"
    - label: "security"
      instructions: "Apply for auth, encryption, or sensitive data handling"

Complete Example

# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
language: en-US
tone_instructions: "Be direct. Focus on bugs and security issues."
chat:
  allow_non_org_members: false

reviews:
  profile: chill
  high_level_summary: true
  sequence_diagrams: true
  poem: false

  auto_review:
    enabled: true
    drafts: false
    ignore_title_keywords: ["WIP"]

  path_filters:
    - "!dist/**"
    - "!node_modules/**"
    - "!*.min.js"

  path_instructions:
    - path: "**/*.py"
      instructions: "Check for type hints and proper exception handling"

  tools:
    ruff:
      enabled: true
    gitleaks:
      enabled: true
    eslint:
      enabled: true

CodeRabbit End-to-End Workflow

Complete workflow from running a review to implementing fixes.

When to use

• You want a structured, pre-PR review to catch correctness/security issues early.
• You want to use CodeRabbit output as an input for a focused, minimal-fix workflow.

Inputs

• Target scope: repo root or a subfolder (e.g. src/).
• CodeRabbit output (prompt-only) for triage.

If the team is close to PR review limits, confirm whether the Usage-based add-on is enabled before assuming PR/CLI reviews will continue past the plan cap.

Process

1. Run CodeRabbit (prompt-only) for the relevant scope. 2. If the review fails (rate limit/auth/network), stop and resolve the failure first. 3. Triage findings with triage.md. 4. If the PR needs agentic cleanup, optionally trigger @coderabbitai simplify and review the produced branch/commit before touching code manually. 5. If the PR is blocked by merge conflicts, use the merge-conflict path below instead of manual triage. 6. Implement fixes with fix.md (one issue at a time). 7. Verify quality gates (project checks, tests).

Merge Conflict Resolution Path (2026-03-17)

Use this when CodeRabbit detects merge conflicts in a PR or merge request.

Trigger options:

• @coderabbitai fix merge conflict
• Resolve merge conflicts checkbox in the GitHub Walkthrough

Operational behavior:

• CodeRabbit simulates the merge in a sandbox, analyzes the intent of both sides, edits the repo, and validates the result.
• On success it creates a proper merge commit with two parents.
• If the branch changes during processing, the run is aborted and must be retried.
• If any file is ambiguous or security-sensitive, the entire attempt is declined and no partial commit is created.

Treat these conflict classes as manual-review territory even if CodeRabbit offers the action:

• authentication or authorization logic
• encryption, secrets handling, or access control
• mutually exclusive architectural decisions that need product judgment

Critical prohibitions

• Do not introduce fallbacks, mocks, or stubs in production code.
• Do not "fix" style nits if tooling already covers them.
• Do not broaden the scope beyond the reviewed findings.

Reporting & Metrics

Usage-based review continuity (2026-04-08)

• PR reviews and CLI-triggered reviews follow the same usage-based add-on behavior when a plan limit is exceeded.
• When enabled, only the overflow is billed; the normal usage remains on-plan.
• Treat sudden review stoppage after plan exhaustion as an account/billing configuration issue before debugging the CLI.

Dashboard Structure (2026-03-12)

CodeRabbit dashboards are now split into two top-level review surfaces:

• Git platform reviews for GitHub/GitLab/Azure DevOps/Bitbucket pull-request review metrics.
• IDE/CLI reviews for local or editor-driven reviews through extensions and the CLI.

Use the dashboard split to avoid mixing PR review trends with IDE/CLI review adoption data.

Team filters are available across the dashboards, which is useful when adoption or findings need to be compared across teams instead of across the entire organization.

Data Export (Dashboard)

Use Data Export to download per‑PR review metrics as CSV for a selected date range (last 7/30/90 days or a custom range within the last year). The export includes fields like complexity scores, review times, and comment breakdowns by severity/category.

Dashboard drill-down (2026-02-24):

• You can drill into severity/category metrics to open a Comment Details view (useful for audits and debugging false positives).

Additional Git-platform dashboard pages (2026-03-12):

• Knowledge Base: review how Learnings and MCP integrations affect review outcomes.
• Pre-merge Checks: monitor pass/fail results for built-in and custom gates.
• Reporting: track report delivery volume and channel distribution.

Additional IDE/CLI dashboard pages (2026-03-12):

• Summary: overall IDE/CLI review activity and findings.
• Organization Trends: week-over-week adoption and findings by tool/severity.
• Data Metrics: per-user IDE/CLI review breakdown.

Review Metrics API

REST API for programmatic access to review metrics. Query by date range, filter by repository or user, and retrieve results in JSON or CSV.

Related references

• CLI usage: cli-usage.md
• Triage workflow: triage.md
• Single issue fix: fix.md

CodeRabbit Fix (Single Issue)

Implement a single CodeRabbit issue fix with minimal scope, root-cause focus, and mandatory verification.

When to use

• You have one triaged issue and you want to implement a focused fix.
• You want to avoid scope creep and keep diffs minimal.

Inputs

• One issue from triage: file, line (optional), issue, suggestion, severity, constraints.

Process

1. Read the relevant code section (include a small context window before/after). 2. Confirm the root cause (do not blindly apply the suggestion). 3. Implement the smallest correct fix that addresses the cause. 4. Preserve existing patterns and public APIs unless the issue requires a change. 5. Add or update verification:

• Run the narrowest checks/tests first.
• Then run broader checks if needed.

Verification (minimum)

• Run the workspace checker (code_checker) after edits.
• Run the most relevant tests for the changed area (follow repo test instructions).

Fixing guidelines

• Security/correctness: prefer explicit validation and clear error handling.
• Multi-tenant systems: ensure tenant context/isolation rules are respected (if applicable).
• Async code: avoid blocking I/O and ensure timeouts for network calls.
• Types: add precise type hints when it reduces risk; avoid "Any" unless justified.

Report format

Issue: <summary>
Severity: <CRITICAL|HIGH|MEDIUM|LOW>
Decision: FIXED
Files:
- path/to/file.py
Verification:
- code_checker: PASS
- tests: <what ran>
Notes: <trade-offs, if any>

Critical prohibitions

• Do not introduce silent fallbacks for required identifiers.
• Do not add mocks/stubs/fake implementations to production code.
• Do not refactor unrelated code while fixing a single issue.

Git Platform Integration

CodeRabbit integrates with major Git platforms for PR-based code reviews.

Supported Platforms

Integration Process

1. Authenticate — Log in to CodeRabbit with Git platform credentials 2. Add organizations — Connect organizations/groups/workspaces 3. Configure service account — Create dedicated CodeRabbit account (auto on GitHub.com) 4. Grant permissions — Authorize specific repositories

Platform Terminology

Permission Requirements

GitHub

• Ownership-level permissions for organizations
• Repository read/write access

GitLab

• Developer role in primary group to view repositories
• Maintainer role in primary group to enable toggle
• Self-managed GitLab works best on 16.x+.

Self-managed GitLab SSH cloning (2026-04-02)

• CodeRabbit can use SSH clone credentials instead of HTTPS for self-managed GitLab.
• SSH keys must be passphrase-free, and the public key must be registered on the GitLab account used by CodeRabbit.
• Optional known_hosts content helps avoid first-connect trust issues.
• If SSH credentials are invalid or cannot be decrypted, CodeRabbit falls back to HTTPS.

Azure DevOps

• Project-level permissions

Bitbucket

• Workspace admin for organization setup
• Repository write access

Enterprise / Self-Hosted

For organizations with 500+ users:

• Self-hosted CodeRabbit deployment available
• Contact CodeRabbit Sales for enterprise options

Enterprise roles and permissions (2026-02-24):

• Enterprise orgs can define custom roles with per-resource access levels (No access / Read only / Read+Write) for org/repo settings, reports, team management, billing, and API access.

Issue Tracker Integration

CodeRabbit connects with issue management for ticket creation:

GitHub PR Commands (@coderabbitai)

All commands use @coderabbitai mention in PR comments.

Review Control

Information Commands

Code Generation

Finishing Touches

Chat Interaction

Ask questions about code changes:

@coderabbitai Why did you suggest using a factory pattern here?

@coderabbitai Can you explain the security implications of this change?

Usage Notes

• @coderabbitai ignore must be in PR description (not comments)
• @coderabbitai resolve marks ALL comments as resolved
• CodeRabbit learns from your feedback over time
• Chat responses consider full repository context
• @coderabbitai simplify is an Open Beta Pro feature and may take up to 20 minutes on large PRs
• @coderabbitai fix merge conflict aborts without a commit when any conflicted file is too ambiguous or security-sensitive for safe automation

Supported Tools Reference

CodeRabbit integrates with 40+ static analysis tools, linters, and security scanners.

Configuration

Enable/disable tools in .coderabbit.yaml:

reviews:
  tools:
    eslint:
      enabled: true
    gitleaks:
      enabled: true

Tools by Category

JavaScript/TypeScript

Stylesheets

PowerShell

Python

Go

Ruby

PHP

Rust

Kotlin/Java

C/C++

Swift

Shell

SQL

Infrastructure

Security

Documentation

Other

Tools with Config File Support

Some tools accept custom configuration paths:

reviews:
  tools:
    golangci-lint:
      enabled: true
      config_file: ".golangci.yml"
    detekt:
      enabled: true
      config_file: "detekt.yml"
    semgrep:
      enabled: true
      config_file: ".semgrep.yml"
    swiftlint:
      enabled: true
      config_file: ".swiftlint.yml"
    pmd:
      enabled: true
      config_file: "ruleset.xml"

PHPStan Level Configuration

reviews:
  tools:
    phpstan:
      enabled: true
      level: "max" # 0-9 or "max"

LanguageTool Configuration

reviews:
  tools:
    languagetool:
      enabled: true
      level: "picky" # default or picky
      enabled_rules: []
      disabled_rules: []

GitHub Checks Integration

reviews:
  tools:
    github-checks:
      enabled: true
      timeout_ms: 90000 # Max 900000 (15 min)

CodeRabbit Triage Workflow

Turn CodeRabbit output into a severity-ranked plan: fix/defer/skip with clear rationale.

When to use

• You have CodeRabbit output (preferably --prompt-only) and need a structured fix plan.
• You want to balance pragmatism (minimal diffs) with safety (security/correctness first).

Inputs

• Full CodeRabbit output (do not paraphrase; keep exact wording where possible).
• Repository context: applicable instructions and skills (e.g., architecture, multi-tenancy, async rules).

Process

1. Extract issues into a list with: file, line (if provided), issue, suggestion. 2. Classify severity:

• CRITICAL: security, data loss/corruption, tenant isolation violations, broken error handling, missing timeouts.
• HIGH: reliability/performance regressions, transaction/session misuse, architectural violations.
• MEDIUM: type safety, refactors, maintainability improvements.
• LOW: formatting, naming preferences, pure style nits.

Cross-repo note:

• If linked-repository analysis flags contract drift across repos, default to HIGH.
• Multi-Repo Analysis can now span up to 2 linked repositories on supported plans, so check both linked repos before downgrading a cross-repo warning.
• Escalate to CRITICAL if breakage can cause production runtime failures.

3. Decide per issue:

• FIX if it materially improves safety/correctness or is a clear quick win.
• DEFER if valuable but not appropriate now (add an explicit TODO with reason).
• SKIP if subjective/outdated or handled by tooling.

4. Produce a triage report and a task plan (one task per issue).

Documentation for deferred issues

When deferring HIGH/MEDIUM issues, add a focused TODO that includes:

• Issue summary
• Reason for deferral
• Suggested follow-up

Expected output (template)

CRITICAL: N
HIGH: N
MEDIUM: N
LOW: N

Issue 1
- Severity: CRITICAL
- Decision: FIX
- Location: path/to/file.py:123
- Reason: ...
- Verification: ...

Issue 2
- Severity: MEDIUM
- Decision: DEFER
- Location: ...
- Reason: ...
- Follow-up: TODO(...)

Critical prohibitions

• Do not invent issues.
• Do not broaden scope beyond what CodeRabbit flagged.
• Do not recommend adding fallbacks/mocks/stubs to production code.

Windows / WSL notes (manual)

CodeRabbit CLI may be more practical to run inside WSL on Windows.

Install WSL + Ubuntu

wsl --install -d Ubuntu

Install CodeRabbit CLI in WSL

wsl -d Ubuntu -e bash -c "curl -fsSL https://cli.coderabbit.ai/install.sh | sh"

Authenticate

wsl -d Ubuntu -e bash -c "~/.local/bin/coderabbit auth login"

Line endings issue (CRLF vs LF)

When accessing Windows files via /mnt/..., tools can detect massive line-ending changes. A common workaround is to copy the repo into a native WSL folder and run CodeRabbit there.

Important: any commands that reset working tree state (e.g., git checkout .) must be run intentionally by a human and only on a disposable copy.

Troubleshooting

• "command not found": use ~/.local/bin/coderabbit or add $HOME/.local/bin to PATH.
• Slow performance on /mnt/...: prefer working inside WSL home (e.g. ~/projects).