Code quality

35 services

Many code quality services are free for public repositories and charge for private ones, so the first thing to check is the repository limit. SonarCloud, Coveralls, Scrutinizer, Coverity Scan, DeepScan and Hound are free for open source only. For private code, Codecov and CodeFactor each cover 1 private repository, semgrep allows 10 private repositories and 10 contributors, and Codacy lists unlimited public and private repositories.

AI pull request reviewers are usually rate-limited rather than capped by repository. CodeRabbit allows 3 reviews an hour, HeyDeer gives 300 credits a month including private repositories without a card, prquorum.com 50 reviews a month across 2 repositories, and What The Diff about 10 pull requests a month. Zenable allows 25 pull request reviews a day.

Dependency tooling sits here too. Dependabot opens pull requests to keep dependencies current across many package ecosystems, FOSSA checks licenses and known vulnerabilities, and Libraries.io alerts you when open-source dependencies publish new releases. Datree validates Kubernetes manifests and Helm charts before they reach a cluster.

35 services

Codacy

Automatic code review and static analysis covering Python, Java, PHP, Ruby, JavaScript, Scala and more.

Unlimited public and private repos

Visit
Codecov

Hosted code coverage reports and pull request coverage comments.

1 private repo

Unlimited open-source repos

Visit
CodeFactor

Automatic code review that grades Git repositories and flags issues on each commit.

1 private repo

Unlimited users, Unlimited public repos

Visit
CodeRabbit

AI reviewer that comments on pull requests in GitHub and GitLab.

  • Open source

3 reviews/hr

200 files/hr, 50 conversations/hr

Visit
GitDailies

Daily digests of a team's GitHub commits and PRs, with kudos and custom alerts.

3 repos

3 alerts, Unlimited users

Visit
HeyDeer

AI reviewer for GitHub pull requests, covering both public and private repositories.

  • No card

300 credits/mo

1,000 credits in month one, Private repos included

Visit
inspect.software

Published audits of open-source repos grading security, maintainability, dependencies and malicious packages.

100 starting credits

5 inspections, All published reports

Visit
MergeMe

Mirrors GitHub/GitLab pull requests into Slack as one live card with CI status and comments.

5 developers

1 channel mapping

Visit
prquorum.com

GitHub app that uses AI to review incoming pull requests.

50 reviews/mo

2 repos

Visit
Reviewable

Code review tool for GitHub pull requests with per-file discussion tracking.

Public and personal repos

Visit
semanticdiff.com

Diff viewer for GitHub commits and pull requests that understands language syntax and hides noise.

Public repos

Visit
semgrep

Static analysis and dependency scanning for security bugs in code.

10 contributors

10 private repos, Unlimited public repos

Visit
tomosu.ai

Reliability scoring for repos and pull requests, giving a 0-100 index, fixes and a merge recommendation.

1 repository

Visit
What The Diff

AI assistant that reviews pull requests and writes summaries of code changes.

25,000 tokens/mo

About 10 PRs/mo

Visit
Zenable

Policy-as-code guardrails that fix AI assistant output and review pull requests.

100 MCP tool calls/day

25 PR reviews/day

Visit
Codeac.io

Code review bot for GitHub, Bitbucket and GitLab that also checks Terraform, Ansible and Kubernetes files.

  • For open source

Limits not listed

Visit
codiga.io

IDE plugin for searching, saving and inserting reusable code snippets while you work.

Limits not listed

Visit
CodSpeed

Benchmark tracking in CI that reports performance regressions on pull requests.

  • For open source

Limits not listed

Visit
Coveralls

Hosted test coverage history and badges for repositories.

  • For open source

Limits not listed

Visit
Coverity Scan

Static analysis service for C, C++, Java, C# and JavaScript codebases.

  • For open source

Limits not listed

Visit
Datree

CLI that validates Kubernetes manifests and Helm charts against policies to stop misconfigurations.

  • Open source

Limits not listed

Visit
DeepScan

JavaScript static analyzer focused on detecting likely runtime errors and code defects.

  • For open source

Limits not listed

Visit
DeepSource

Continuous static analysis with autofix for GitHub, GitLab and Bitbucket repos, covering bugs, security and style.

Limits not listed

Visit
Dependabot

Bot that opens pull requests to keep dependencies current across many package ecosystems.

Limits not listed

Visit
EverSQL

SQL query and database performance analysis with automatic tuning recommendations.

Limits not listed

Visit
FOSSA

Open-source dependency management covering license compliance and vulnerability scanning.

Limits not listed

Visit
g
gerrithub.io

Hosted Gerrit instance for reviewing changes to GitHub repositories.

Limits not listed

Visit
Go Report Card

Report card that grades Go repositories using gofmt, vet, lint and similar checks.

  • For open source

Limits not listed

Visit
holistic.dev

Static analyzer for PostgreSQL schemas and queries that flags performance and security problems.

Limits not listed

Visit
Hound

Style-checking bot that leaves review comments on GitHub commits and pull requests.

  • For open source

Limits not listed

Visit
Libraries.io

Package discovery across 32 package managers with alerts when your dependencies get new releases.

  • For open source

Limits not listed

Visit
Pullflow

Code review coordination spanning GitHub, Slack and VS Code, with AI assistance.

Limits not listed

Visit
Scrutinizer

Continuous code inspection that tracks quality metrics and issues across builds.

  • For open source

Limits not listed

Visit
SonarCloud

Hosted SonarQube analysis for bugs, code smells and vulnerabilities across 25+ languages.

  • For open source

Limits not listed

Visit
t
tickgit.com

Scanner that lists TODO, FIXME and similar comments found in a repository.

Limits not listed

Visit
About this site
Esc

Type to search every entry. ↑↓ to move, Enter to open.