AI code review tools compared: Bugbot, GitHub Copilot, CodeRabbit and Farol

Our hands-on test covers Farol only. We have not tested Cursor Bugbot, GitHub Copilot code review or CodeRabbit hands-on yet. The facts about those three tools come from official pages checked on Oct 27, 2026.

What does each AI code review tool do?

The four tools solve two different problems. Cursor Bugbot, GitHub Copilot code review and CodeRabbit are AI reviewers. An AI reviewer reads the changed lines and leaves comments about possible bugs. Farol is a risk triage tool. Farol tells the person who approves the merge how risky the change is and which files to read first.

How much does AI code review cost?

The four tools charge in four different ways. For that reason, a single price comparison is not possible from the official pages. Here is what each official page says.

• GitHub Copilot code review: Copilot Free does not include pull request reviews. Copilot Pro costs $10/mo, Copilot Pro+ costs $39/mo and Copilot Max costs $100/mo, and all three plans include pull request reviews in GitHub. For organizations, Copilot Business costs $19/user/mo and Copilot Enterprise costs $39/user/mo. Each review uses AI credits, and 1 AI credit costs $0.01. GitHub estimates that one review typically uses $0.05 to $1 of AI credits with the Lite effort level, and $0.25 to $5 with the Balanced effort level. These estimates do not include GitHub Actions minutes, and GitHub says that the ranges may change.
• Cursor Bugbot: Bugbot is part of Cursor Premium ($30/mo), Super ($100/mo), Ultra ($200/mo), Teams (from $30/user/mo) and Enterprise (custom price). Bugbot is not part of Cursor Free or Cursor Plus ($8/mo). Since the May 2026 pricing update, Bugbot uses usage-based billing. The Cursor pricing page does not publish a fixed price per review. In its May 11, 2026 blog post, Cursor says that the average Bugbot run costs $1.00 to $1.50, depending on the size and complexity of the pull request. That number is the company's own estimate. Before the update, Bugbot cost $40 per seat per month.
• CodeRabbit: The Essentials plan costs $30/user/mo on monthly billing, or $24/user/mo on annual billing. The Team plan costs $60/user/mo monthly, or $48/user/mo annually. The Advanced plan costs $90/user/mo monthly, or $72/user/mo annually. The Enterprise plan has no public price. CodeRabbit charges only for developers who create pull requests. After the included reviews per hour, extra reviews cost $0.25 per reviewed file. Reviews of public repositories are free.
• Farol: Farol is free. Farol needs no account, no API key and no hosted service. In our test, Farol also needed no AI model.
• Our review prompt: The review prompt template is free to copy. You pay only for the AI tool that you already use, such as Cursor or Claude Code.

We do not publish a monthly cost estimate for a solo developer or a team. Bugbot has no fixed price per review, so any estimate would be a guess.

Pricing as of Oct 27, 2026. Prices change often: always confirm on the official site.

Can you choose faster or deeper reviews?

Two of the tools let you trade cost for depth.

• Cursor Bugbot offers four effort levels: Low, Default, High and Smart. Cursor says that higher effort can find more bugs, but each review may take longer and use more of your Cursor usage. Effort levels are available only on usage-based Bugbot plans.
• GitHub Copilot code review offers two effort levels: Lite and Balanced. Balanced is the default. GitHub suggests Balanced for security-sensitive code and for pull requests that touch several services, and Lite for routine changes.
• Farol has no effort levels. Farol uses static analysis, so the same pull request gets the same report every time.
• We did not check whether CodeRabbit offers effort levels.

Can AI code review block a bad merge?

Not by default, so plan for a human approval step.

• Cursor Bugbot reports findings with a neutral status by default. If you require the Bugbot check in branch protection, the check still does not block a merge because of findings. An organization can turn on an option that fails the check when issues are not resolved.
• By default, approvals from Copilot do not count toward required approvals. Copilot approvals are in public preview, and an organization must turn them on.
• Farol never blocks a merge. Farol only informs the reviewer.
• GitHub says that Copilot is not guaranteed to spot all problems, and GitHub recommends a human review as well.

How do you teach the reviewer your project rules?

• Cursor Bugbot reads rules from .cursor/BUGBOT.md files and from a .cursor/config/bugbot.yaml file on the base branch. Bugbot also supports team rules and rules that Bugbot learns from merged or closed pull requests. Cursor project rules in .cursor/rules/ do not apply to Bugbot.
• GitHub Copilot code review reads .github/copilot-instructions.md, path-specific *.instructions.md files, AGENTS.md and agent skills from the head branch of the pull request.
• CodeRabbit stores learnings from earlier pull requests, issues and guidelines, and you can view and edit those learnings.
• Farol reads a farol.config.json file. In our test, a one-line file was enough to tell Farol the language and the type of the project.

If you do not have an AGENTS.md file yet, start with our free AGENTS.md starter template.

Our hands-on test of Farol (Oct 27, 2026)

This section is our own hands-on test. We ran Farol on Oct 27, 2026 on a small sample project that we wrote for the test. We spent no money, created no account and used no API key.

What we tested. We used Farol version 0.2.1 from npm, with Node.js 22.23.4 on Linux. We wrote a small Python web API with FastAPI. The API has three routes: a health check, an order lookup and a refund endpoint. Then we made a change that looks like a typical AI-written pull request. The change weakened the login token checks, let admin users refund any order for more than the order total, added a required reason field to the refund request and added a harmless formatting helper. As a control, we also made a second branch with only the harmless helper and a README edit.

How we ran the test. We added a one-line farol.config.json file and ran three commands.

npx -y @winninjs/[email protected] routes
npx -y @winninjs/[email protected] analyze --base main --head HEAD --out farol-plain.json
npx -y @winninjs/[email protected] report --in farol-plain.json > farol-plain.md

What Farol reported for the risky change. This is a real excerpt from the report.

### farol · merge risk 78/100 (high) · ⚠ careful review

Most of the risk comes from a breaking change to `POST /orders/{order_id}/refund` and `auth.py`, used by 2 of 3 existing operations. 4 code files changed; 2 of 3 existing operations run changed code.

<sub>farol only informs: it never approves or blocks.</sub>

**Must check** (by hand, before approving)
- [ ] Breaking API change: `POST /orders/{order_id}/refund` — **26**

**Files by risk** (points are each part's share of the 78)
- 🔴 `src/shop/auth.py` **25** · 2 of 3 operations
- 🔴 `src/shop/payments.py` **14** · 1 of 3 operations
- 🔴 `src/shop/main.py` **12** · 1 of 3 operations
- and 1 file to skim: 1 point together

What worked.

• The first download with npx took 1.6 seconds. Farol needed no account, no API key and no AI model.
• Farol found all three API routes without running the code.
• Farol put the login file auth.py first and the refund file payments.py second. Farol also showed that the login change reaches both routes that need a login.
• Farol flagged the new required reason field as a breaking API change.
• The harmless control branch scored 2 out of 100, with a quick review verdict. The risky branch scored 78 out of 100.
• Each analysis took about 0.7 seconds. A second run gave the same report.

What did not work.

• Farol did not say what was wrong inside auth.py. The change added a hard-coded fallback secret, replaced a constant-time signature check with a plain comparison and extended the token lifetime to 30 days. Farol only reported that these declarations changed.
• Farol did not flag the admin refund-limit bypass as a problem. Farol only reported that the refund function changed.
• Farol did not report the renamed field in the refund response. The handler returns a plain dictionary without a response model, and that may be the reason.
• When we added a test coverage report, the score of payments.py dropped from 14 to 4 points. The changed lines ran in tests, but no test covered the new admin path.
• When we followed the Python recipe in the README and added a security lint report from Ruff, Farol listed three S101 warnings about assert statements in a test file as items to check by hand. Those warnings were noise.
• One reason line in the Python report carried a "(Go)" label. That is a cosmetic bug.

Our verdict. Farol did what its README promises in this small test. Farol pointed the reviewer at the risky files and kept the harmless change at a low score. Farol is not a replacement for an AI reviewer or a human reviewer, because Farol does not explain the bug. Use Farol together with a line-by-line review, as the README recommends.

Limits of our test. We tested one small Python project with two branches that we wrote ourselves. We did not test the GitHub Action, TypeScript projects or Go projects. The Farol README reports that, on 662 past commits from four repositories, its fast track verdict had 0 problems in 56 commits. That is the project's own measurement, and one small test cannot confirm or refute that number.

Is there a free way to review AI code before you commit?

Yes. You can get a second opinion without a new tool. Run git diff, open a fresh chat or a second agent session, and paste our review prompt. The prompt checks scope, correctness, invented code, security, data changes, dependencies, tests, leftovers and readability. A fresh session matters, because a reviewer that wrote the code tends to defend that code. We have not measured the results of this prompt.

Farol is also free. You can run Farol on your own machine before you open a pull request. For more tools that fit an AI coding workflow, see Best AI for vibe coding.

Which AI code review tool should you pick?

Our current picks are based on price, free plans and our Farol test. We have not compared the review quality of these tools, so this list does not rank them by quality. Sponsorship never affects ranking (methodology).

• If you already pay for GitHub Copilot: Try Copilot code review first, because pull request reviews are included in Copilot Pro and higher plans.
• If you use Cursor on the Premium plan or higher: Cursor Bugbot is included in your plan and works with GitHub, GitLab, Bitbucket and Azure DevOps. Check your usage after the first reviews, because Bugbot reviews are billed by usage.
• If you maintain a public open-source repository: CodeRabbit reviews public repositories for free.
• If your team approves many pull requests from AI agents: Add Farol after your AI reviewer, so the approver knows which files to read line by line.
• If you want to spend nothing: Use Farol and our review prompt together.

FAQ

Related pages on this site

CursorGitHub CopilotClaude Code

Best AI for vibe codingFree templatesAll guides

Sources

• Cursor pricing — checked Oct 27, 2026
• Cursor docs: Models and pricing — checked Oct 27, 2026
• Cursor docs: Bugbot — checked Oct 27, 2026
• Cursor blog: Updates to Bugbot for Teams and Individuals (May 11, 2026) — checked Oct 27, 2026
• GitHub Copilot plans and pricing — checked Oct 27, 2026
• GitHub Docs: Plans for GitHub Copilot — checked Oct 27, 2026
• GitHub Docs: GitHub Copilot code review — checked Oct 27, 2026
• CodeRabbit pricing (annual and monthly views) — checked Oct 27, 2026
• CodeRabbit docs — checked Oct 27, 2026
• Farol README on GitHub — checked Oct 27, 2026
• Farol on npm (version 0.2.1 tested) — checked Oct 27, 2026
• Our own hands-on test of Farol on Oct 27, 2026. The results are in the Farol section above.

Updated Oct 27, 2026. Prices change often: always confirm on the official site. Sponsorship never affects ranking. Read our methodology. Found a mistake? Email [email protected].