AI Code Review Tools: Inithouse Tests 10 on Vibecoded Apps

A small studio's test lands in a crowded, shifting market

Inithouse runs a portfolio of products built mostly with AI app builders. In June 2026 it published a ranking of ten AI code review tools, each run against five of its own production codebases: three React single-page apps generated in Lovable, one backend scaffolded in Cursor, and one project that mixed both11. The studio named CodeRabbit the leader for breadth and integrations, Greptile the best at catching bugs, and DeepSource the strongest at combining static analysis with AI. It also put forward its own product, Audit Vibe Coding, as an option for teams shipping AI-generated code without a conventional review process11.

Rankings like this appear every week, so the list itself is not what stands out. What stands out is the test set. Most comparisons run tools against human-written open-source pull requests. Inithouse used code that an AI wrote and an AI-native team shipped. That matches where the industry now is: one analyst guide sums up the market by saying AI now writes most PRs, which makes review the bottleneck15.

What the testing found

Inithouse scored each tool on setup time, the quality of its first-scan findings, its false-positive rate after tuning, and how it dealt with patterns typical of AI-generated code11. Three findings stand out.

The first is that most reviewers assume a human wrote the code. When a tool's suggestions refer to what "the developer" intended, they don't fit code whose intent lives in a prompt. The studio found that tools which index the whole codebase, Greptile and Bito, coped with this better than tools that only read the diff11.

The second is that false positives went up on AI-generated code across every tool. Lovable and Cursor follow conventions mechanically, and that triggered over-engineering warnings from tools tuned on human habits. The team spent its first week just adjusting sensitivity11.

The third is about security. Three of the five projects had at least one hardcoded API key or an overly permissive CORS configuration that the AI builder created without any warning. CodeRabbit, DeepSource and Inithouse's own auditor caught these issues consistently11. This is the most practical takeaway in the piece. Teams shipping fast with app builders are inheriting security debt they never chose to take on.

The studio's own workflow says the most. It does not rely on one reviewer. It runs SonarQube for deterministic rules, Greptile for deep bug detection, and Audit Vibe Coding for patterns specific to AI-built code11. Readers should note the conflict of interest, which Inithouse disclosed itself. It says it built Audit Vibe Coding for its own use, and admits the tool is narrower than CodeRabbit or Greptile and does not review at the pull-request level11.

The benchmark numbers deserve skepticism

The Inithouse piece repeats a widely cited result: Greptile caught 82% of bugs across 50 real-world PRs, close to double CodeRabbit's 44%11. Coverage elsewhere shows how fragile those numbers are. One ranking that tracks where each score came from says the 82% figure is Greptile's own July 2025 test. An independent 2026 evaluation by Tenki put Greptile at 36.1% and CodeRabbit at 28.7%16. The same comparison credits GitHub Copilot with 54% in the Greptile-run test but 24.6% in Tenki's16.

A third source muddies things further. Cubic's F1 leaderboard from October 10 placed Greptile, CodeRabbit, Claude, Copilot and Cursor Bugbot within about six points of each other, from 58.0 to 63.2. It also ranked cubic's own product first27. Another vendor's write-up describes CodeRabbit's 46% accuracy on runtime bugs as the highest published benchmark of any tool23.

My reading is that the gap between the leading AI reviewers is far smaller than vendor marketing implies. Almost every headline figure comes from a company with a product in the race. Inithouse, which tested on its own private, AI-generated code, is the closest thing here to a practitioner's view. Five codebases is still too small a sample to settle anything.

Claude Code moves into review

The Inithouse list leaves out Anthropic, a notable omission given how much the company has shipped this year. TechCrunch reported a March 2026 launch of Claude Code Review as a research preview for Teams and Enterprise customers, with reviews averaging an estimated $15 to $25 each24. On April 22, 2026, Anthropic added an /ultrareview command in Claude Code v2.1.8622. Claude Code also now runs automated security reviews through /security-review and GitHub Actions for paid users23.

The managed service sends a fleet of agents over each GitHub PR, checks their findings, and posts comments ranked by severity. A review takes roughly 20 minutes and never approves or blocks a merge27. Anthropic's own figures say 84% of PRs over 1,000 lines get findings, and fewer than 1% of findings are marked incorrect. One independent ranking used those numbers to put Claude Code Review in first place16. Cost is the main objection. One reviewer argues most teams should run the cheaper /code-review command on their branch instead of paying per managed review27. A vendor estimate puts 200 PRs a month at about $4,000 through Claude, against $800 for Bugbot under its old seat pricing7. The tool is also GitHub-only21.

GitHub Copilot and Cursor shift to metered billing

The biggest change this year is how review gets billed. Inithouse warns that from June 2026, each Copilot review uses both AI Credits and GitHub Actions minutes on private repositories, a cost it says adds up for busy teams11. Other reporting confirms GitHub started billing Copilot code review in AI credits on June 1. A review that teams thought of as included can therefore turn into metered spend24. Copilot's appeal hasn't changed: buyers need no new vendor, no new security assessment and no new integration. Coverage also notes it can hand its suggestions to the Copilot coding agent to apply fixes automatically23.

Cursor made a similar move with Bugbot. On May 11, 2026, it announced that Bugbot would drop its flat $40-per-seat price for usage-based billing. Existing subscribers switch at their first renewal after June 85. Cursor says an average run costs between $1.00 and $1.50 depending on the size and complexity of the PR1. On June 10, it said reviews had dropped from about five minutes to roughly 90 seconds, found around 10% more bugs, and cost about 22% less per run. It also added a /review command that runs before code is pushed17.

The catch is that Bugbot bills per run, not per PR, and by default it reviews on every PR update. A branch that goes through several rounds of changes gets billed each time, and Cursor has published no spend cap2. One analysis finds the new model cheaper for teams that open few PRs per developer but much more expensive for busy teams. For example, a ten-person team reviewing 2,000 PRs a month would go from $400 to between $2,000 and $3,0001. The same coverage reports that SpaceX acquired Cursor in August 2026 and that Bugbot is still on sale4.

The Inithouse list doesn't include Bugbot at all, even though a quarter of its test set was built in Cursor. It does include Sourcery, which reviews code inside VS Code, Cursor and JetBrains11. For teams that already live in Cursor, other coverage treats Bugbot as the default choice1517.

Why it matters

Put together, the coverage points one way. The flat-rate period of AI code review is ending, and the move to per-review and per-run pricing makes costs depend on how a team actually works. A team that pushes often, or that runs fleets of agents producing PRs, will pay much more under metered pricing than under seat licenses. One guide notes that per-PR pricing hurts active teams and agent fleets, while per-seat pricing stays predictable.

The Inithouse findings add a second point. The code these tools review increasingly isn't written by people, and the tools haven't fully adjusted. Higher false-positive rates and secrets slipping through in builder-generated apps are the failures that will matter as more AI-built MVPs reach production. The studio's three-tool setup reflects a broader consensus: deterministic rules as a baseline, an AI reviewer with full-codebase context for logic bugs, and humans keeping final approval. That is more convincing than any single ranking. Inithouse says it will retest every quarter11. With prices and models changing month to month, that pace looks like the minimum needed to keep a ranking accurate.