How is MicroReview different from CodeRabbit?

MicroReview adds a 0-100 risk score per PR, merge blocking on critical findings, a dedicated GitHub Checks API integration with inline annotations, and hardcoded secret detection across 13 patterns. It also starts free and scales to $19/mo per repo vs CodeRabbit's higher per-seat pricing.

Does MicroReview work with private repositories?

Yes. MicroReview works with both public and private repositories on GitHub and GitLab. The GitHub App requests only the minimum permissions needed: read access to code for PR diffs and write access to post review comments and check runs.

What programming languages does MicroReview support?

AI bug detection and secret scanning work on any language. Deep static analysis rules including naming conventions, Spring Boot patterns, and validation checks are available for Java, TypeScript, and Python today with more language-specific rule sets coming soon.

Is my source code sent to AI?

Only the files your pull request touches are sent to the AI — the changed lines plus the surrounding file and the local files it imports, which is what makes the review accurate instead of guessing at missing context. Your wider repository is never uploaded. Code is sent over HTTPS, is not used to train models, and is retained by the AI provider for at most 30 days for abuse monitoring before deletion.

How much does MicroReview cost?

MicroReview starts free with 2 repos and 50 reviews per month. The Pro plan is $19/mo per repo with unlimited reviews and AI bug detection. The Team plan is $15/mo per repo for 5+ repos with analytics, SSO, and config inheritance.

Docs

Configuration — .microreview.yml

Drop a .microreview.ymlin your repo root to customize how MicroReview reviews your pull requests. Every field is optional — anything you omit uses the default shown below. You can also edit this file visually from your repo's Config page in the dashboard.

All options (with defaults)

# .microreview.yml — all options with their defaults
ai:
  enabled: true            # master switch for all AI features
  bugDetection: true       # AI logic-bug detection on changed files
  prWalkthrough: true      # AI "what does this PR do" summary
  maxFindingsPerPr: 5      # cap on AI-enriched findings per PR
  maxBugDetectionFiles: 15 # max files sent to AI bug detection
  instructions:            # optional — steer the AI reviewer
    focus:                 # extra things to look for
      - "concurrency issues in async handlers"
    ignore:                # things to never report
      - "TODO comments"
    customPrompt: "Our team prefers early returns over nested ifs."
    minSeverity: info      # only report >= this severity: info | warning | critical

languages:
  typescript: true         # TypeScript / JavaScript rules
  python: true             # Python rules
  java: true               # Java / Spring Boot rules

security:
  enabled: true            # SAST-lite scanner (SQLi, XSS, path traversal, …)
  secretDetection: true    # leaked keys/tokens/credentials (13+ patterns)

review:
  blockOnCritical: true    # REQUEST_CHANGES + failing check on critical issues
  githubChecks: true       # publish a GitHub check run with annotations

customRules:               # your own regex rules
  - id: NO_CONSOLE_LOG
    pattern: "console\\.log\\("
    message: "Remove console.log before merging."
    severity: warning      # info | warning | critical
    filePattern: "\\.(ts|tsx)$"   # optional — limit to matching paths

Sections explained

ai

Master controls for the AI reviewer. Turn off bugDetection to keep only rule-based checks. Use instructions.focus / instructions.ignore to steer what the AI reports, customPrompt for team conventions, and minSeverity to silence low-priority notes.

languages

Enable or disable rule packs per language. Secret detection runs on all file types regardless.

security

secretDetection scans diffs for leaked credentials (API keys, tokens, private keys). The wider scanner catches SQL injection, XSS, path traversal, and similar patterns.

review

blockOnCritical makes MicroReview request changes and fail its check when a critical issue is found — the merge gate. githubChecks publishes a check run with inline annotations.

customRules

Your own regex-based rules. Each needs an id, pattern (regex, escape backslashes), message, and severity. Add filePattern to limit which paths it applies to.

Monorepos & org-wide defaults

# Monorepos: place additional .microreview.yml files in
# subdirectories — each directory's config applies to files under it.
# Org-wide defaults: put .microreview.yml in a repo named ".github";
# repo-level values override org values.

PR commands

Comment on any pull request: /microreview recheck re-runs the review, /microreview ignore <rule> dismisses a finding, and /microreview help lists everything.

Questions or a missing option?

Reply to any MicroReview email or reach out — it goes to the founder.

Contact