Skip to content
MicroReview
Start free

AI code review · GitHub & GitLab

Every pull request gets a number.

MicroReview scores every PR 0–100 for risk. Clean diffs auto-approve. Leaked secrets and logic bugs get flagged inline. Critical findings block the merge button until they’re fixed.

Start free — 2 repos foreverPaste code → get a review

$19

per repo / mo

30+

static rules

13

secret patterns

30s

setup, zero config

Works withGitHub·GitLab·Slack·VS Code

PR #128 · feat: checkout flowlive
72risk / 100
Request changes — merge blocked
Critical findings must be resolved before this PR can merge.
1 issue found
src/service/PaymentService.java
15 public class PaymentService {
16+  String apiKey = "sk_live_ABCDef1234";
19+  public void charge(PaymentRequest req) {
21+    .mapToDouble(i -> i.getPrice()).sum()
22+    / req.getItems().size();
Findings — toggle to see the score moveinteractive

A critical finding can never score low — that’s the floor. Thresholds are yours: auto_approve_below: 30, block_above: 70.

The problem

Review is the first thing that gets rushed

Not because anyone is careless — because it’s the step that compresses when a deadline is close. AI assistants have made it worse: more pull requests than any lead can read closely.

4.5 hrs

per week

Reviews take forever

Senior devs spend hours reviewing PRs instead of building. Junior devs wait days for feedback. Velocity drops, frustration rises.

25–60%

of defects caught

Human review misses bugs

That's the range studies put on manual code review — so up to three quarters of defects survive it. Logic errors, edge cases and race conditions slip through tired eyes.

13

secret patterns

Secrets leak into repos

API keys, database passwords and tokens get committed every day. One live credential in a merged PR means rotation, an incident, and an awkward customer email.

10×

costlier in prod

Late bugs cost more

A bug caught in review is cheap. The same bug in production costs an order of magnitude more — plus downtime, hotfixes and a 3 AM page.

Merge gates

Comments get ignored. Required checks don’t.

MicroReview posts a required status check through the GitHub Checks API. A pull request carrying a leaked credential or a critical vulnerability cannot be merged until it’s resolved — no reviewer discipline required.

  • 01Per-repo thresholds in .microreview.yml
  • 02Clean PRs auto-approve, so low-risk work never waits
  • 03Every finding names the rule, the line, and the reason — auditable, dismissible
Some checks were not successful
microreview / risk-gateFailing — risk 72 exceeds block threshold 70Details
ci / buildSuccessful in 1m 12s
Merge pull request

Blocked by 1 required check

# .microreview.yml
risk:
  auto_approve_below: 30
  block_above: 70
  secrets: block_always

Live sandbox

Paste your own code. Get a real review.

Same engine that runs on your pull requests — findings, severities and a 0–100 score. No signup, nothing stored.

Tab indents · Shift+Tab outdents · Esc then Tab to leave the editor

no signup · nothing stored · 5 reviews / hour · any language works
Review outputidle

Paste code and hit Review this code to see a real MicroReview review.

Demo limits apply: snippets are capped and rate-limited. Connect a repo for full-file reviews on every PR, inline comments and merge blocking.

Six layers, one pass

Everything runs in parallel on every diff

Reviews are incremental: only what changed since the last commit gets re-analysed, so a force-push doesn’t reopen noise you already resolved.

01

Secret detection

API keys, tokens, passwords and private keys caught before they leave the branch. AWS, Stripe, GitHub and 10 more patterns, across every file type.

13 patternsall files

02

AI bug detection

Off-by-ones, null dereferences, inverted operators, race conditions and silent data corruption — the class of bug no regex will ever match.

cross-file contextany language

03

SAST security

SQL injection, XSS, command injection, path traversal, weak crypto and insecure deserialization, mapped to the OWASP Top 10.

OWASP top 10

04

Risk scoring

One composite 0–100 number per PR from finding count and severity. A decision framework, not another wall of comments.

merge gatesper-repo thresholds

05

PR walkthrough

A plain-English summary of what changed, which critical paths it touches and what deserves a careful human look — posted as the first comment.

PR chat

06

Auto-fix suggestions

Exact code replacements delivered as native GitHub suggestions. One click to commit the fix — not vague advice to “consider refactoring”.

one-click apply

Deep static rules · Java · TypeScript · PythonAI analysis · Go · Rust · C# · Ruby · PHP · Kotlin · Swift · any language

Language support

Deep where it counts, broad everywhere else

Deep static rules

30+ hand-written rules covering naming, error handling, request validation, Spring Boot patterns and the anti-patterns that reliably become incidents.

JavaTypeScriptJavaScriptPython

AI review — any language

Bug detection, PR walkthroughs and risk scoring read your code directly, so they work on anything you commit — including languages we ship no static rules for.

GoRustC#RubyPHPKotlinSwift…

Secrets — every file type

13 credential patterns run on every file in the diff regardless of language — config, YAML, env samples, notebooks, plain text. A leaked key doesn’t care what language it’s in.

all files

Go and C# rule packs are next. We’ll say so on the changelog when they land rather than listing them early.

Real findings

Two things it actually caught

No customer logos to show you yet — MicroReview is new. Here are real findings from real pull requests instead, which tells you more than a logo wall would.

CriticalSECRET_DETECTION

Live Stripe key committed in a pull request

Caught and flagged before it reached main. The PR was blocked until the key was removed and rotated.

HighAI_BUG_DETECTION

Total divided by item count — undercharging every customer

A one-character mistake in a payment path. Static rules can't see it; the model reads the intent and flags the arithmetic.

Want to see it on your own code? Paste something into the sandbox — no signup, nothing stored.

Watch it work

Two minutes, one real pull request

How it catches bugs and secrets, scores the PR, and blocks a risky merge.

microreview — real pull request, start to finish2 min

Pricing

Priced per repo, so hiring doesn’t raise your bill

Unlimited developers on every repo you connect. No seats to reconcile, no procurement call, no 14-day trial that expires into an email sequence.

Cost model — drag to fit your team
Per-seat tool ($24/seat)$240
MicroReview ($19/repo)$57

You keep $183 per month — $2,196 a year back in the budget.

Free

forever

$02 repos · 50 reviews / month

  • All 30+ static rules
  • Secret detection, 13 patterns
  • SAST security checks
  • Risk scoring & merge blocking
  • No credit card, no expiry
Start free
Most teams

Pro

per repo

$19/mo

  • Unlimited devs — 2 or 200, same price
  • Everything in Free, unlimited reviews
  • AI bug detection
  • AI PR walkthrough + PR chat
  • Auto-fix suggestions
  • Slack & Teams notifications
  • Config editor, priority support
Connect a repo

Team

5+ repos

$15/mo

  • Per repo — 21% below Pro
  • Everything in Pro
  • Org-wide rule policies
  • Config inheritance
  • Analytics dashboard
  • SSO / SAML on the roadmap
Talk to us

Per-seat comparison uses CodeRabbit’s published $24/seat list price. Per-repo pricing wins when you have more developers than repositories — if you run many small services with a small team, run your own numbers above.

Honest comparison

Feature for feature, at a fraction of the cost

 MicroReviewCodeRabbitCodacySonarQube
Pricing modelPer repoPer seatPer seatPer LOC
Starting price$19/repo$24/seatCustom$32/mo
Team of 10, 3 repos$57/mo$720/moquote$96+/mo
Risk score per PR (0–100)yes———
Merge blocking via Checks APIyes———
AI bug detectionyesyes—limited
Secret detection13 patternsvia lintersyesyes
Setup time30 sec5 min30+ minhours
Free tier2 repos forever14-day trial14-day triallimited

Detailed breakdowns:vs CodeRabbitvs SonarQubevs Codacyvs DeepSource

Competitor figures are published list prices at the time of writing — check their sites for current pricing.

Security & trust

Your code stays yours

You’re granting access to source. Here is exactly what happens to it — in specifics, not adjectives.

No code storageNo training on your dataSOC 2 on roadmap

Scoped to your pull request

We read the files your PR touches — the changed lines, the surrounding file, and the local files they import, which is what makes the review accurate instead of guessing. Not your history, not your other branches, not the rest of the repo.

Never training data

Only that context reaches the model provider. Retained at most 30 days for abuse monitoring, then deleted. Never used for training.

Encrypted in transit

TLS on every hop. Code, tokens and review payloads never travel in plaintext.

Minimal permissions

Read for pull request contents, write for comments and check runs. The GitHub App asks for nothing else.

Full detail on the security page.

STEP 01

Install the GitHub App

One click from the Marketplace, pick your repos. No YAML to write, no server to provision, no onboarding call to book.

STEP 02

Open a pull request

Static rules, secret patterns and AI analysis all run in parallel on the diff the moment the PR opens.

STEP 03

Read the score, not the noise

Risk score, inline comments, suggested fixes and a walkthrough — in seconds. Clean PRs approve themselves.

Pankaj Kumar
“AI assistants mean more code and more pull requests than any lead can review in depth. MicroReview is the second pair of eyes that never gets rushed — and it gives you one honest number: how risky is this PR?”

Pankaj Kumar · Founder, MicroReview · Read the story

FAQ

Straight answers

Two things. Pricing: we charge per repository, so a team of ten costs the same as a team of two. And output: instead of a thread of comments, every PR gets one 0–100 risk score wired into a required GitHub check, so critical findings physically block the merge.

Yes, on every plan including Free. The GitHub App reads only the pull request it was invited to — never your history or your other branches.

AI bug detection and secret scanning work on any language. Deep static rule packs currently cover Java, TypeScript and Python, with Go and C# next.

No. We send the files your PR touches — the changed lines plus the surrounding file and the local files they import, which is what stops the reviewer guessing at missing context. Your wider repository is never uploaded. That context is retained by the model provider at most 30 days for abuse monitoring and is never used for training. Nothing is stored on our side after the review is posted.

Per repo, in .microreview.yml — auto-approve below, block above, plus per-rule severity overrides and file ignore patterns. Sensible defaults ship out of the box so you can skip this entirely.

Not yet — it is on the roadmap and we will notify you when it lands. Today MicroReview runs as a managed GitHub and GitLab App.

Stop paying per seat. Start scoring every PR.

Free forever on 2 repos. Thirty-second setup. No credit card, no trial clock.

Get started freeTry the sandbox