CodeRabbit

Recently shipped Security Agent, a Discord Agent, and Post-Merge Actions.

Security Agent extends scans beyond PRs. Run it on demand or on schedule against existing repositories to find code vulnerabilities, leaked secrets, and vulnerable dependencies. The opt-in Scan Git History setting finds credentials still present in repository history. Finding drawers now offer a share option that copies agent-ready Markdown, so you can hand off findings to a coding agent without requiring access to the CodeRabbit app.

Discord Agent brings CodeRabbit to open-source communities. Public Discord channels can now query CodeRabbit to investigate repository context, discuss implementation work, and open pull requests directly from the conversation. Available for repos with at least 1,000 stars; usage is unpaid but capped.

Post-Merge Actions automate follow-up work. Define natural-language instructions — append a changelog entry, file a Linear or Jira ticket, open a GitHub issue, or post a Slack summary — and CodeRabbit executes them agentically after merging. Each action is previewed as a checkbox in the PR walkthrough; up to five actions per organization.

CodeRabbit Review expanded platform reach.

• CodeRabbit Review is now available on Azure DevOps in early access, with the same Change Stack navigation and per-range summaries.
• Review conversations can now be opened in-app on GitHub and GitLab, letting you read, reply, and resolve threads without leaving the review interface.
• Automatic PR review file limits now apply by plan: 150 files for Pro, 300 for Pro+. Non-Enterprise users can use usage-based pricing to continue a review that exceeds its tier limit.

New review profiles and policy controls.

• The Quiet review profile posts only critical and major high-impact comments inline, grouping everything else into collapsed sections. The three profiles now range from quiet (least feedback) to assertive (most).
• Administrators can enforce configuration inheritance org-wide with inheritance: true in a global override, overriding per-repo settings.
• The focus setting controls review verbosity (casual, balanced, high).
• Knowledge base approval delay lets administrators require approval before AI-sourced learnings are adopted.

Bitbucket and Azure DevOps workflow improvements.

• Bitbucket Cloud now supports committable suggestion blocks that apply directly from the UI.
• Webhook secret management is available for Bitbucket Cloud and Bitbucket Data Center, with automatic refresh for CodeRabbit-managed webhooks.
• Azure DevOps Boards work items can trigger CodeRabbit Plan with @coderabbit plan, generating linked plans that can be refined and handed off to a coding agent.

Tooling and analysis updates.

• ast-grep 0.43.0 supports Bicep, Dart, Glimmer JavaScript/TypeScript, Markdown, and TOML.
• Facebook's Infer, zizmor, oasdiff, and Nvidia's SkillSpector run automatically on applicable files.
• Reviewer suggestions on GitHub and Bitbucket Cloud now factor in people who recently changed the same files.
• Multi-repo analysis lets you control which ref of a linked repository to review against, including branch name matching.

CLI, API, and configuration.

• CLI v0.6.4 streamlines SSO and self-hosted sign-in, and improves repository detection for SSH aliases, self-hosted hosts, and Bitbucket slugs.
• The Learnings API (GET /v1/learnings) allows programmatic export, audit, and integration with filtering and CSV download.
• The Role Management API supports org_id: "ALL" for self-hosted instances to apply role changes across every active organization.
• Automatically linked repositories can be disabled individually, freeing a slot for another discovered repository.
• Workspace-level settings and Custom Roles API with org_id improve Enterprise configuration.
• CodeRabbit Plan is available in the VS Code extension, and the Devin IDE handoff works from the extension.
• Customer.io connections enable Agent work with lifecycle marketing context.