Filtered view · Verified 2026-10-26
For teams in regulated industries, or with a security review that says source code does not leave the network, deployment is the first filter — not features. 6 of 27 tools here document full self-hosting; 13 more will sell it to you on an enterprise contract.
Watch the second half of the question too: self-hosting the reviewer does not move the model inside your boundary. Check the model-control row on each profile.
No enterprise contract required to run it yourself.
| # | Tool | Coverage | Self-hosting | Licence | Free tier | From |
|---|---|---|---|---|---|---|
| 1 | Kodus AI PR Review | 6.5/9 Coverage score 6.5 out of 9 | Self-hostable | Open source | Limited free tier | $10/dev/mo |
| 2 | Semgrep Security | 4.5/9 Coverage score 4.5 out of 9 | Self-hostable | Open source | Limited free tier | $30/contributor/mo |
| 3 | SonarQube Code Quality | 4/9 Coverage score 4 out of 9 | Self-hostable | Open source | Limited free tier | $34/mo |
| 4 | Qodana Static Analysis | 3.5/9 Coverage score 3.5 out of 9 | Self-hostable | Proprietary | Limited free tier | $5/contributor/mo |
| 5 | OpenReview AI PR Review | 3/9 Coverage score 3 out of 9 | Self-hostable | Proprietary | Free tier | Free (self-run) |
| 6 | PR-Agent AI PR Review | 2.5/9 Coverage score 2.5 out of 9 | Self-hostable | Open source | Free tier | Free (MIT) |
AI PR Review · AGPL-3.0
Open-source AI code review built to run where the organization controls: self-hosted or cloud, models under your keys, org-wide Kody Rules.
Security · LGPL-2.1
Open-source static analysis engine with a commercial AppSec Platform adding cross-file analysis and an AI assistant for triage.
Code Quality · LGPL-3.0
Deterministic static analysis platform (Server and Cloud) with PR decoration and LLM-generated AI CodeFix suggestions.
Static Analysis · Proprietary
JetBrains' static analysis for CI, running IDE inspections in pipelines with quality gates, baselines, and cloud reports.
AI PR Review · Proprietary
Vercel Labs' self-hosted GitHub review bot: mention @openreview for Claude-powered inline suggestions; dormant beta since March 2026.
AI PR Review · MIT
Community-maintained, MIT-licensed PR reviewer with /review, /describe, and /improve commands, self-hosted with your own model keys.
Available, but priced and gated — expect a sales cycle and, in some cases, a seat minimum.
Private Mode (data-plane pod in your AWS EKS) on Pro and Enterprise; full VPC deployment is an Enterprise capability.
6.5/9On-prem/VPC deployment on Enterprise; also connects to self-hosted SCMs (GHES, GitLab self-managed, Bitbucket DC).
6.5/9Self-hosting is listed as an Enterprise-plan inclusion on the pricing page (not available on Startup/Scale); deploy in your own cloud with your own provider keys.
6.5/9Self-hosted deployment on custom-priced Enterprise; docs cite availability for orgs with 500+ seats, connecting to your own LLM provider.
6/9Self-hosted deployment (Docker Compose or Kubernetes, license required) on custom-priced Enterprise tier, alongside SOC 2 Type II and SSO/SAML.
4.5/9Per Tabnine's product docs (docs.tabnine.com, still live separately from the marketing site): secure SaaS is available on Starter, Pro, and Enterprise tiers, while VPC, on-premises, and fully air-gapped private-installation deployments are Enterprise-tier only.
4.5/9Enterprise offers single-tenant SaaS, on-prem, and air-gapped deployment at custom pricing; On-Prem specifically excludes GitHub Cloud and Bitbucket Cloud as source platforms.
3.5/9SaaS platform; Snyk Broker (Enterprise-only) connects private SCMs, and Snyk Code Local Engine (Early Access, Enterprise-only) runs scans in your network, though results still sync to Snyk's hosted UI.
3/9SaaS-first; Pro adds on-premises/local scanning and Enterprise offers on-premises deployment options.
2.5/9bito.ai/pricing confirms self-hosted deployment of the review agent from the Professional tier (+$5/seat/mo, vs. Bito-hosted by default); Enterprise adds full on-prem/multi-org deployment. Docs also detail self-managed-git guides for GitHub Enterprise Server 3.0+, GitLab Self-Managed 15.5+, and Bitbucket self-managed.
2/9Enterprise adds self-hosted and air-gapped deployment plus BYOK (Anthropic, OpenAI, or Gemini keys).
1.5/96 of the 27 tools in this directory document self-hosting on a standard plan: Kodus, Semgrep, SonarQube, Qodana, OpenReview, PR-Agent. A further 13 offer it only on a custom enterprise contract.
No, and conflating them is the most common mistake in this evaluation. A proprietary tool can ship a self-hosted deployment you cannot read the source of, and an open-source tool can still route your code through a vendor API. Check the licence row and the deployment row separately.
Only if the model runs somewhere you control too. Self-hosting the reviewer moves the orchestration into your network, but the model call still goes wherever the tool points it. Look for BYOK plus support for a local or private endpoint if the requirement is that code never leaves your boundary.
Usually your own infrastructure plus your own model spend, which is why the total bill can be lower or much higher than a seat price depending on review volume. Tools that meter model usage separately are marked in the pricing column of each profile.
Open source matters to you too?
Different filter, different list — self-hostable and readable are not the same thing.