AI code review tools: what a team pays per month and where your code goes (October 2026)

Entry price for 5 and 25 developers

The table lists what the entry team tier of each tool costs at list price on October 25, 2026, with the unit each vendor bills in. Read the unit column before the price columns: four tools bill per seat, SonarQube bills by lines of code, and Qodo bills credits for the whole team.

Sources: [1][2][3][4][5][6]

A shortlist from four questions

What this means for you: if self-hosting is a hard requirement, only the sales-call tiers apply, and if it is not, the billing unit matters more than the seat price.

Sources: [7][8][9]

Seats, lines of code and credits bill the same team three ways

CodeRabbit, Codacy, Copilot and Cursor charge per seat, so 25 developers cost 5 times what 5 developers cost. CodeRabbit adds a limit per seat: 5 pull request reviews per developer per hour on Essentials, 8 on Team, 10 on Advanced and 12 on Enterprise. Codacy's Team plan stops at 30 developers and 100 private repositories.

SonarQube does not care how many developers you have. The Team plan starts at $34 a month for up to 100k lines of code in private projects, for organizations under 50 developers, and Sonar's docs count the largest long-lived branch of each project. That makes it the cheapest line in the table and also the least comparable one, because it is a static analysis product with AI CodeFix on Team and Enterprise. The review product named in the Team column is Gitar AI Code Review at $20 per user a month, billed annually.

Qodo and Cursor meter the review itself. Qodo sells credits at $0.012 each, pooled across the team: 2,500 credits for $30 buy about 18 reviews a month, 5,000 buy about 36, 20,000 buy about 144. Cursor says Bugbot is usage based and the average review costs $1.00 to $1.50. As a constructed example, a team that opens 100 pull requests a month would pay about $100 to $150 for Bugbot reviews on top of its seats.

Copilot sits between the two. The seat includes AI credits, and each review consumes some. GitHub's docs estimate $0.05 to $1 per review at Lite effort and $0.25 to $5 at Balanced effort, and a review on larger GitHub-hosted runners adds Actions minutes. What this means for you: before you compare seat prices, count your pull requests per month, because that number decides the bill for three of the six.

Sources: [1][10][5][11][9]

Three entries in our directory did not match the vendor pages

Our own entry for Cursor lists Teams at $40 per user a month. The pricing page I opened shows Teams at $30 or more per seat, and the account docs list $30, $100 or $200 per seat by tier. I corrected it. Our SonarQube entry says the $34 Team price is a promotion from a regular $68, but the current page shows only "Starts at $34", so I removed the $68.

Our Codacy entry says the data is hosted in the EU. None of the 3 Codacy pages I read says so, and a search for a region statement found only that Codacy runs on AWS. I could not confirm the claim and kept it out of the table, which marks the field "Not published". On Qodo's pricing page I found two statements that cannot both hold for a small team: Pro Team lists "Unlimited reviews" and also sells credit packs that cover about 18 to 144 reviews a month. I priced Qodo by the credit packs, because those carry a price.

Sources: [3][12][6][4][5]

Training with your code: all six say no, with conditions

Every vendor says in writing that it does not train on code from a paid team, but the sentences differ in what they cover. Cursor's promise holds with Privacy Mode on, which is the default for teams, and its privacy page adds that zero retention does not apply when you bring your own API keys. Sonar's sentence names the LLMs behind AI CodeFix, not Sonar itself. GitHub changed its rules for individuals: since April 24, 2026, interaction data from Copilot Free, Pro and Pro+ trains models unless the user opts out, and Business and Enterprise are not affected.

Qodo has the thinnest evidence. The only paid-plan statement I found is a blog post from September 5, 2023: data of paid subscribers and trial users is never used to train, while free-tier data is. I found no current page that repeats it, so I mark it as old rather than drop it. Qodo's pricing page promises "strict data retention" without defining it.

What this means for you: ask each vendor for the sentence in your contract, not on its website, and for Qodo and Sonar ask which model providers sit behind the review.

Sources: [13][14][15][16][17][18][19]

Retention, hosting and self-hosting

CodeRabbit's sources disagree with each other. Its FAQ says it "does not retain your source code after a review completes" and its security page says nothing is stored after the review. Its terms, though, let customers opt out of data storage, and its configuration docs describe a knowledge base that keeps data until you set the opt-out. I read this as two kinds of data, code and learnings, but no page says so. Its DPA names GCP as the data center and allows transfers to the United States, and a customer-chosen SaaS region is listed only for Enterprise.

SonarQube is the most specific about where data sits. Sonar's trust center puts EU hosting in Frankfurt (the default) and US hosting in Northern Virginia, stores only the source from your most recent scans, and may hold data in snapshots for up to one year. It holds ISO 27001:2022 and SOC 2 Type II. Codacy's AI docs say that for AI Reviewer "no data is stored on our side", but no region is published.

For Copilot, Cursor and Qodo I found no retention period on the pages I could read. Cursor names ISO 27001:2022, ISO 42001:2023 and SOC 2 Type II and says it publishes its subprocessors on its trust portal. Qodo's DPA lists Google Cloud, AWS, Slack and Google Workspace as subprocessors.

Self-hosting is the most restricted option. CodeRabbit's docs say it is available exclusively on Enterprise for customers with 500 or more seats, set up with the CodeRabbit team, and you must bring your own LLM provider. Qodo lists on-prem for Enterprise only, and SonarQube Server editions are priced on request. Bugbot supports GitHub Enterprise Server, GitLab Self-Hosted and Bitbucket Data Center, but the review still runs on Cursor's systems. What this means for you: if your source code may not leave your network, none of the six has a self-serve answer.

Sources: [20][21][22][23][24][17][25][26]

Who each tool is not for

For each tool I picked the limit that matters most on the pages I read. This is a list of limits, not a ranking.

Sources: [4][12][9]

How I counted

On October 25, 2026 I opened 34 vendor pages: pricing and plan pages, documentation, 3 data processing addenda (CodeRabbit, Sonar, Qodo), terms of service, trust and security pages, and 2 vendor blog posts. I did not run any of the tools. I did not create accounts, and I did not get around any block. The CodeRabbit and GitHub trust portals and the EUR-Lex page for the GDPR returned no readable text, so I went by the vendors' own documents instead.

Prices are list prices for the entry team tier, with the annual rate where the vendor shows one, and the 5 and 25 developer columns are the seat price times the headcount. Where a vendor bills differently, the unit column says how. I did not use comparison blogs for any number, and I dropped every claim about one tool finding more bugs than another, because I found no vendor benchmark or study that I could verify. Prices change, so treat the table as a snapshot of October 25, 2026.