Coding
pr review
code review ai

Code Review

Reviewing PRs/MRs for bugs, style, security. Tool-use + repo-context awareness drive quality.

Capability notes

AI-assisted code review in 2026 operates on two axes: **diff-level review** (flagging bugs in a PR's changed lines) and **repository-level review** (architectural analysis, security audit, style consistency across the codebase). [Llama 3.3 70B](/models/llama-3-3-70b) and [DeepSeek Coder V3](/models/deepseek-coder-v3) achieve 65-75% bug detection rate on real-world Python/JavaScript diffs — competitive with mid-senior human reviewers who average 70-85% on the same diffs. The gap sits in false positives: LLMs flag 15-30% of correct code as suspicious (false-positive rate) vs 3-8% for humans. Dedicated review models outperform general models. [DeepSeek Coder V3](/models/deepseek-coder-v3) fine-tuned for review outperforms the same model used for generation by 8-12 percentage points on bug detection. The model's training distribution matters — code-review corpora contain buggy/patched pairs where generation corpora contain correct code only. [Qwen 3 235B-A22B](/models/qwen-3-235b-a22b) MoE leads on architectural review (multi-file dependency analysis) but its serving complexity makes it impractical for per-PR review. Review scope affects accuracy: diff-only review (changed lines + 20 lines context) catches 60-70% of introduced bugs but misses bugs where the diff is correct in isolation but breaks integration (import changes, API contract violations, state machine transitions). Repository-level review (full file + dependency graph) catches 80-90% but costs 5-10× more tokens. A two-pass strategy — diff review on every PR, repo review on merge to main — balances accuracy and cost. [Continue.dev](/tools/continue) supports inline review comments. [Cline](/tools/cline) can be prompted for architectural review. [Aider](/tools/aider)'s diff format is review-friendly — every edit is a git commit amenable to per-commit review.

If you just want to try this

Lowest-friction path to a working setup.

Start with [Ollama](/tools/ollama) running [DeepSeek Coder V3](/models/deepseek-coder-v3) at Q4. Paste the git diff into the chat with: "Review this code change for bugs, security issues, and style violations. For each issue found, cite the specific line and explain the risk." The model returns a structured review. ```bash ollama pull deepseek-coder-v3:latest # Then in any terminal: git diff main...feature-branch | ollama run deepseek-coder-v3 "Review this code diff for bugs, security issues, and style violations. For each issue found, cite the specific line and explain the risk." ``` For inline IDE review, install [Continue.dev](/tools/continue) VS Code extension, configure it to use [DeepSeek Coder V3](/models/deepseek-coder-v3) via Ollama (`http://localhost:11434`). Highlight code → Ctrl+Shift+L → "Review this code." The response appears inline in your editor. Hardware: 16 GB+ VRAM for [DeepSeek Coder V3](/models/deepseek-coder-v3) Q4 on [RTX 4060 Ti 16GB](/hardware/rtx-4060-ti-16gb) or [RTX 4090](/hardware/rtx-4090). On Mac: [MacBook Pro 16" M4 Max](/hardware/macbook-pro-16-m4-max) runs it on SoC via [MLX LM](/tools/mlx-lm). Don't treat AI review as a replacement for human review. It's a pre-review filter that catches the bottom 60% of bugs — the cheap, pattern-matchable ones (null pointer dereferences, missing error handling, SQL injection patterns, forgotten input validation) — freeing humans to focus on architectural correctness, design coherence, and business logic which LLMs still miss.

For production deployment

Operator-grade recommendation.

Production AI code review integrates into the CI/CD pipeline as a pre-merge gate with configurable strictness per repo. **Architecture.** A webhook on PR creation/update triggers: (1) fetch diff + full files for changed paths, (2) build review prompt with PR description, commit messages, and code context, (3) send to model API, (4) parse review into structured JSON (file, line, severity, category, explanation), (5) post as inline PR review comments via GitHub/GitLab API. Severity: `blocker` (must fix), `warning` (should fix), `info` (consider). Blockers gate merge — PR cannot merge with unresolved blocker comments. **Model selection.** Diff review: [DeepSeek Coder V3](/models/deepseek-coder-v3) via [vLLM](/tools/vllm) on [RTX 4090](/hardware/rtx-4090) — 3-8 seconds per diff, 300-500 diffs/day on a single card. Architectural review: [Qwen 3 235B-A22B](/models/qwen-3-235b-a22b) or [DeepSeek V4](/models/deepseek-v4) on [NVIDIA L40S](/hardware/nvidia-l40s) — 15-30 seconds per full-file analysis, runs on merge-to-main only, not every PR. 7B models ([DeepSeek R1 Distill Llama 8B](/models/deepseek-r1-distill-llama-8b)) catch 45-55% of bugs — functional for teams with budget constraints but false-positive rate climbs to 35-45%. **False-positive management.** Track per-model false-positive rate via reviewer dismissals. If >25% of AI comments are dismissed, the model erodes trust and reviewers stop reading. Implement: (1) user feedback loop — "Was this helpful?" on each comment, (2) auto-silence categories with >40% dismissal rate, (3) model rotation — if [DeepSeek Coder V3](/models/deepseek-coder-v3) degrades on a codebase, swap to [Llama 3.3 70B](/models/llama-3-3-70b), (4) ensemble: two models agree on a bug → flag as blocker; one model flags → flag as warning. **Token efficiency.** Average PR diff is 500-3000 tokens. With context (PR description, 20-line surrounding code per hunk): 2000-8000 tokens per review. At 50 PRs/day with 1 review iteration each: 100K-400K tokens/day. Self-hosted on [NVIDIA L40S](/hardware/nvidia-l40s) handles this with 20-30% utilization.

What breaks

Failure modes operators see in the wild.

- **Output quality degradation under load.** Symptom: response quality drops under high concurrency — outputs become shorter and less detailed. Cause: [vLLM](/tools/vllm) under GPU memory pressure reduces effective context or switches generation parameters. Mitigation: monitor per-request quality scores, set max concurrency based on memory headroom, scale horizontally when metrics degrade. - **Confidence hallucination.** Symptom: outputs are confident and well-structured but factually wrong. Cause: LLMs generate by probability not factual verification. Confident-sounding outputs are harder to detect as errors. Mitigation: implement deterministic validation on outputs (numeric bounds, schema checks). Flag for human review when validation fails. Never trust LLM self-reported confidence. - **Edge case collapse.** Symptom: model performs well on common Code Review tasks (90%+) but fails catastrophically on rare edge cases. Cause: training distribution under-represents edge cases; model defaults to nearest common pattern. Mitigation: build regression test suite of edge cases, run before every model update, track edge case pass rate separately from general accuracy. - **Context pollution in long sessions.** Symptom: after 20-30 exchanges the model mixes information from earlier conversation parts, producing contradictions. Cause: long contexts dilute attention — relevant context competes with noise. Mitigation: periodically summarize and reset context every 15-20 exchanges, store key findings externally, trigger summarization at 80% context window capacity. For models see [Llama 3.3 70B](/models/llama-3-3-70b).

Hardware guidance

**Hobbyist ($300-$1,500).** [RTX 3060 12GB](/hardware/rtx-3060-12gb) or [Intel Arc B580](/hardware/intel-arc-b580) runs [DeepSeek R1 Distill Llama 8B](/models/deepseek-r1-distill-llama-8b) for basic diff review at 5-10 seconds per review. Quality is 45-55% bug detection — functional as a first-pass filter but expect high false positives. [RTX 4060 Ti 16GB](/hardware/rtx-4060-ti-16gb) runs [DeepSeek Coder V3](/models/deepseek-coder-v3) Q4 at 20-30 tok/s — the minimum for production-quality review. On Apple Silicon, [MacBook Pro 16" M4 Max](/hardware/macbook-pro-16-m4-max) 64GB runs 70B Q4 via [MLX LM](/tools/mlx-lm) at 25-35 tok/s — capable of diff review with reasonable latency. **SMB ($2,000-$4,000).** [RTX 4090](/hardware/rtx-4090) 24GB runs [DeepSeek Coder V3](/models/deepseek-coder-v3) Q4 comfortably — 30-45 tok/s, 3-8 seconds per PR. Handles 100-300 PRs/day for a team of 10-30 developers. [RTX 5090](/hardware/rtx-5090) 32GB adds headroom for 70B Q8 or [Llama 3.3 70B](/models/llama-3-3-70b) Q4 with 32K context — supports repository-level review on merge-to-main. **Team serving ($6,000-$15,000).** [NVIDIA L40S](/hardware/nvidia-l40s) 48GB or [RTX 6000 Ada](/hardware/rtx-6000-ada) 48GB for 25-100 developer teams. Runs 70B FP8 at 80-100 tok/s with [vLLM](/tools/vllm) continuous batching — handles 5-10 concurrent review requests. 48GB supports per-file review with 32K context. At 50+ concurrent developers, add a second card for review queue. **Enterprise ($25,000+).** [NVIDIA H100 PCIe](/hardware/nvidia-h100-pcie) 80GB for architectural review at scale — 70B FP8 with 64K context, 140-170 tok/s. Supports ensemble review (two models simultaneously) for critical code paths. [NVIDIA H200](/hardware/nvidia-h200) 141GB fits [DeepSeek V4](/models/deepseek-v4) for ultra-large-diff review on monorepo merges. Code review is bursty (peaks around PR creation, idle otherwise). GPU utilization averages 10-25% — consider sharing the card with CI test-parallelization or build-cache inference to amortize cost.

Runtime guidance

**If doing ad-hoc PR review on your own code** → [Ollama](/tools/ollama) with [DeepSeek Coder V3](/models/deepseek-coder-v3). Pipe `git diff` into the model. Simplest path. No CI integration needed. **If integrating into CI/CD pipeline** → [vLLM](/tools/vllm) with OpenAI-compatible API. CI runner sends HTTP POST to vLLM endpoint, receives structured review JSON. Set `--max-model-len 32768` for standard PRs, `131072` for full-file review. Configure `--gpu-memory-utilization 0.90` to maximize context window. Continuous batching handles multiple concurrent PR reviews without queuing. **If using Continue.dev for inline IDE review** → [Continue.dev](/tools/continue) with [Ollama](/tools/ollama) backend. Highlight code, Ctrl+Shift+L, "review this code." Review appears inline. This is per-developer, not CI-integrated — good for pre-PR self-review. **If using Cline for architectural review** → [Cline](/tools/cline) with [Qwen 3 32B](/models/qwen-3-32b) or [DeepSeek V4](/models/deepseek-v4). Prompt: "Review the file structure and dependency graph of this repository for architectural issues." Cline reads file tree and key files, produces architectural report. Not per-PR — use for sprint planning or major refactors. **If using Aider for review-before-commit** → [Aider](/tools/aider) with `--edit-format diff`. Each commit is a reviewable unit. Pair with git hooks: pre-commit runs `aider --message "review this change for bugs"` and blocks commit if blockers found. **If running ensemble review (two-model agreement)** → [vLLM](/tools/vllm) serving [DeepSeek Coder V3](/models/deepseek-coder-v3) on GPU 0 and [Llama 3.3 70B](/models/llama-3-3-70b) on GPU 1 via [TensorRT-LLM](/tools/tensorrt-llm). Send diff to both; flag as blocker only when both agree. Reduces false-positive rate 40-60% at 2× compute cost. **If on Apple Silicon** → [MLX LM](/tools/mlx-lm) or [LM Studio](/tools/lm-studio) running [DeepSeek Coder V3](/models/deepseek-coder-v3) GGUF. Metal backend delivers 25-35 tok/s. Review latency is 5-12 seconds — acceptable for ad-hoc review, borderline for CI where PRs queue.

Setup walkthrough

  1. Install Ollama → ollama pull qwen2.5-coder:14b (~9 GB).
  2. For reviewing a PR/MR locally: use a git diff → feed to the model:
git diff main...feature-branch > diff.txt
cat diff.txt | ollama run qwen2.5-coder:14b "Review this code diff for bugs, security issues, style violations, and architectural concerns. For each issue, specify the file and line number."
  1. First review in 5-15 seconds for a typical PR (200-500 lines changed).
  2. For VS Code integration: install Continue extension → select files → right-click → "Continue: Review Selection" → model reviews for bugs, style, and suggestions.
  3. For automated PR review in CI/CD: set up a GitHub Action that runs on PR open → git diff → Ollama API → post review comments.
  4. For security-focused review: use a prompt emphasizing OWASP Top 10, SQL injection, XSS, hardcoded secrets. The model catches ~70-80% of security issues that a human reviewer would catch.
  5. Best models: Qwen 2.5 Coder 32B > DeepSeek Coder V3 > Qwen 2.5 Coder 14B. The 32B model catches subtle logic errors the 14B misses.

The cheap setup

Used RTX 3060 12 GB (~$200-250, see /hardware/rtx-3060-12gb). Runs Qwen 2.5 Coder 14B at 25-35 tok/s — reviews a 500-line diff in 10-20 seconds. The 14B model catches obvious bugs, style issues, and well-known security patterns. Pair with Ryzen 5 5600 + 16 GB DDR4 + 512 GB NVMe. Total: ~$360-405. For small-to-medium teams (1-10 devs, PRs under 500 lines): $400 handles daily code review. The 14B model is surprisingly good at flagging missing error handling, race conditions, and SQL injection — things juniors miss frequently.

The serious setup

Used RTX 3090 24 GB (~$700-900, see /hardware/rtx-3090). Runs Qwen 2.5 Coder 32B at 35-50 tok/s or DeepSeek Coder V3 at 15-20 tok/s — reviews a 2,000-line PR in 30-60 seconds with architectural-level understanding. For enterprise teams (50+ devs, CI/CD integration): the 32B model acts as a first-pass reviewer that catches 80%+ of bugs before human review. Total: ~$1,800-2,200. Code review quality jumps significantly at 32B — the model can reason about data flow across files and spot architectural anti-patterns.

Common beginner mistake

The mistake: Running an AI code review, seeing "no issues found," and merging without a human glance. Why it fails: AI reviewers have false negatives — they miss novel vulnerability patterns, business logic errors, and context-dependent bugs. A model trained on open-source code won't flag proprietary business logic violations (e.g., "this discount calculation allows negative prices if the user is a premium member from a specific region"). The fix: Use AI review as a first pass (catch the obvious), then human review for domain knowledge and security. AI catches syntax errors, common bug patterns, and style violations. Humans catch business logic errors, novel exploits, and architectural decisions. AI-first, human-verified. Never AI-only for production code review. The model is a very thorough junior reviewer, not a senior architect.

Recommended setup for code review

Recommended runtimes

Browse all tools for runtimes that fit this workload.

Budget build
AI PC under $1,000 →
Best GPU for this task
Best GPU for Ollama (coding workflows) →

Reality check

Code models are LLM workloads — same VRAM math applies. 16 GB runs 13-32B Q4 (Qwen 2.5 Coder, DeepSeek Coder); 24 GB unlocks 70B-class code models. The killer detail is context window — code review wants 32K+, which pushes KV cache beyond 16 GB on 70B.

Common mistakes

  • Skipping context-window math (KV cache eats VRAM at scale)
  • Using base instruct models for code (specialized code models 30-50% better)
  • Running coding agent loops on 8 GB (works for 7B but agent loops compound)
  • Forgetting flash-attention impacts code workflows more than chat

What breaks first

The errors most operators hit when running code review locally. Each links to a diagnose+fix walkthrough.

Before you buy

Verify your specific hardware can handle code review before committing money.

Hardware buying guidance for Code Review

Local coding workflows live or die on time-to-first-token and 32K+ context. The guides below cover the developer-specific hardware decision.

Buyer guides
Compare hardware
Troubleshooting
Specialized buyer guides
Updated 2026 roundup