Open-Source AI Code Review, When to Run Your Own

Most AI code review runs as a hosted service. You connect your repository, the tool sends your pull requests to someone else’s servers and a model you did not choose, and comments come back. For a lot of teams that is exactly right, and our main guide covers those tools. But a smaller, growing group do it the other way, open-source and self-hostable, running on infrastructure you own and pointed at whichever model you decide. A developer building one of these got in touch after reading our code review comparison, which sent me down the rabbit hole this article came out of. So here is the proper version, why you would own your review bot, what it actually takes, and the tools that let you.

Why self-host your code review at all

Handing your code and your model choice to a third party is convenient right up until one of these reasons makes it a problem. Each of these is a real reason teams give up the convenience of a hosted bot.

• Data control. Your source never leaves infrastructure you own, which matters if you work under compliance rules, handle regulated or client-confidential code, or simply do not want to depend on a vendor’s promise never to store or train on it.
• Model choice. You bring your own model and can pick the best one for the job, a strong model for a critical service, a cheaper one for routine repos, or a fully local model for air-gapped environments.
• Rules in your own words. You define your team’s conventions in plain language, so the bot enforces how you actually work rather than generic best practice.
• Cost that scales with use, not head count. The software is free, so a large team is not paying a per-seat fee for a bot that reviews the same number of pull requests either way.
• No lock-in. It is open-source. You can read it, fork it, audit exactly what it does with your code, and never be held hostage by a pricing change or a shutdown.

What "bring your own model" actually means

This is the part that trips people up, because it changes the whole cost and quality picture. With a hosted tool, the model is chosen for you and baked into the subscription. With these tools, you supply an API key and the review runs on your account with the provider. In practice that means a few concrete things.

• You pay the model provider directly, per token, with no vendor markup. A single review is roughly one model call, so the cost is usually cents rather than dollars, though a huge diff or a premium model pushes it up.
• You can match the model to the stakes. Route a payments service to a top-tier model and a low-risk internal tool to something cheaper, rather than paying one flat rate for everything.
• You are not tied to one vendor’s roadmap. When a better or cheaper model appears, you switch a config value, you do not migrate tools.
• You can go fully local. Point it at a self-hosted model through Ollama or similar, and no code or prompt ever leaves your network.

The catch is that quality now depends on the model you pick and the prompts the tool ships. A weak model gives weak reviews, so this is control you have to use well, not a free upgrade.

The licence matters more than you think

The two leading tools sit on opposite ends of the open-source spectrum, and the difference is not academic if a lawyer ever looks at your stack. It is worth understanding before you build anything on top of one.

PR-Agent is MIT-licensed, which is about as permissive as it gets. You can use it, modify it, and even fold it into a closed commercial product, as long as you keep the copyright notice. For most companies that is the lowest-friction option there is.

Kodus is AGPL-licensed, which is strong copyleft with a network clause. Run it internally for your own team and, in practice, it asks almost nothing of you. The obligation only bites if you modify it and then offer that modified version to others over a network, in other words if you try to build a product or a SaaS on top of it, at which point you must publish your source changes. That is a deliberate design to stop companies quietly commercialising the project without giving back. Fine for self-hosting internally, worth a legal read before you build a business on it.

What setup actually involves

"Self-hostable" covers a wide range, from dropping in a config file to standing up a small platform. The two tools here sit at different points on that scale.

PR-Agent is the lighter lift. The quickest path is a GitHub Action, you add a workflow file and your model key as a repository secret, and it starts reviewing. There is also a pip install for local and CLI use, and Docker images and webhooks for GitLab, Bitbucket, Azure DevOps and Gitea. You then drive it from a pull request comment with slash commands.

/review     full automated review of the PR
/describe    generate a structured PR description
/improve     concrete code-improvement suggestions
/ask         free-text questions about the changes

Kodus is more of a platform, so it is more to run. You self-host it with Docker Compose or Helm, connect your forge, add your model key, and write your rules. In return you get a dashboard, technical-debt tracking and ticket integrations rather than just review comments. Either way, remember that standing it up once is the easy part. You now own the updates, the uptime and the secrets, which is the real ongoing cost of self-hosting anything.

Kodus

Kodus is the tool whose maker got in touch, and a good example of the fuller, product-shaped end of open-source review. Under the AGPL, you self-host it via Docker or Helm with no per-seat minimums. You bring your own model, Claude, GPT, Gemini, Llama or a self-hosted one, and pay the provider directly with no markup. Its distinctive angle is rules and context, you write review rules in plain language, it can sync the rule files you already keep for Cursor or Copilot, and it can check a change against the requirements in a Jira, Linear or Notion ticket. It reviews pull requests across GitHub, GitLab, Bitbucket and Azure DevOps, says it never stores your source code or trains on it, and turns suggestions you do not action into tracked technical-debt issues, with a dashboard for the usual delivery metrics. There is a 14-day trial of up to 35 reviews before you pay for platform access, while token costs stay with your provider. It suits a team that wants a managed-feeling product and their own rules, but is willing to run the infrastructure to keep control.

PR-Agent

PR-Agent is the leaner, more developer-driven option, and the one with the longest track record. It is MIT-licensed and, since its original maintainer Qodo handed it to a community-owned organisation in April 2026, genuinely community-run rather than a single vendor’s loss-leader. It supports GitHub, GitLab, Bitbucket, Azure DevOps and Gitea, and through the LiteLLM layer it works with almost any model, OpenAI, Anthropic, Gemini, DeepSeek, Mistral, the big cloud model services, and local models via Ollama. It has a compression strategy for handling very large pull requests, uses roughly a single model call per command to keep cost and latency down, and lets you customise the review categories through config. Its commercial cousin, Qodo, is the hosted, fuller platform if you later decide you would rather someone else ran it. PR-Agent suits developers who want a small, scriptable reviewer they fully control and can drop into CI in an afternoon.

Others worth knowing

The field is bigger than two tools, though much of it blurs the line between review and assistance. Sweep AI is worth a look if you want the bot to go further than commenting and actually open pull requests that fix what it finds; it is self-hostable, on a source-available licence that is set to become fully open over time. It is also worth being clear about what is not a dedicated reviewer. Open-source assistants like Sourcegraph’s Cody and Continue have strong open cores and will review code inside your editor, but they are coding assistants first, not automated pull-request reviewers, so reach for them for a different job.

How they compare, and where hosted tools still win

Roughly, Kodus leans toward teams that want rules, dashboards and a managed-feeling product they happen to be able to self-host, while PR-Agent leans toward developers who want a small, scriptable reviewer they fully control. Both keep your code and your model choice in your own hands, which is the entire reason to be here. If you do not actually need that control, the polished hosted tools are simply less work, and our best AI code review tools guide covers CodeRabbit, GitHub Copilot, Graphite and Codacy for exactly that.

The rough cost picture

The money question is where most decisions actually land, so it is worth being concrete. A hosted tool bills per developer, from roughly $10 to $15 a month each, which for a ten-person team is a fixed hundred-odd dollars a month no matter how many pull requests you open. Self-hosting flips that. The software is free, you pay only for the model tokens each review consumes, typically cents per review, plus whatever the small server it runs on costs and, the part people forget, the engineering time to keep it healthy. For a small team doing modest volume, the hosted bill is trivial and the ops effort is not worth it. For a large team, a high-volume monorepo, or anyone under data rules that rule out sending code offsite, the maths and the requirements tip the other way. Work out your own crossover before you assume open-source is cheaper, because sometimes the cheapest thing is not running any servers at all.

For the hosted, less-setup alternatives, see our best AI code review tools guide. And for turning what a review finds into fixes, see the best AI tools for debugging code.