PR-Agent: open-source AI code review, donated by Qodo to the community

PR-Agent is an open-source AI code reviewer. On a pull request on GitHub, GitLab, Bitbucket or Azure DevOps, a comment with /review, /describe or /improve returns a review, a generated description or code suggestions. Qodo released the project first, and the repository was created in July 2023. The README now says Qodo has donated it to the open-source community, that it lives under The-PR-Agent organization on GitHub, and that it is “not the Qodo offering for open-source projects.” As of October 20, 2026 the repository had 13,480 stars and an MIT license, and its latest release was v0.48.0 from October 16, 2026.

That is the /review output from the README: an effort score from 1 to 5, whether the change includes relevant tests, possible issues, and any security concerns.

Core features

• Pull request comments are the interface: After setup, a comment with /review produces a review table with an effort estimate, a check for relevant tests, possible issues and security concerns. /describe writes the description with a per-file walkthrough, /improve posts categorized code suggestions, and /ask "…" answers questions about the change. The README also shows /similar_issue, which runs on an issue and finds similar ones in the repository.
• Several git hosts: The README lists GitHub, GitLab, Bitbucket, Azure DevOps and Gitea, each with its own installation guide, so a team does not have to move its repositories to use it.
• Bring your own model: The README lists OpenAI GPT, Anthropic Claude, Google Gemini, DeepSeek and Mistral, plus any model reachable through LiteLLM, including Azure OpenAI, AWS Bedrock, Vertex AI, OpenRouter and Ollama.
• Command line as well: pip install "pr-agent[github]" installs the CLI, which can run review against a single pull request URL without wiring up CI.
• Suggestions grouped by category: The README’s sample /improve output sorts suggestions into enhancement, maintainability, security and best practice. One security suggestion asks for HTML special characters in a function to be escaped to prevent XSS.
• Configurable behavior: Review categories and tool behavior are adjusted through configuration files. The README links configuration.toml.

Typical use cases

• Small teams without a dedicated reviewer: Run /review as soon as a pull request opens, read the flagged issues first, then decide which files need a close read.
• Teams whose pull request descriptions are often empty: /describe drafts one, and the author only adds context and reasons.
• Teams on GitLab, Bitbucket or Azure DevOps: They can add AI review by installing the integration for their platform, without switching hosts.
• Teams that want a local model: Ollama is reachable through LiteLLM. Whether code leaves your own infrastructure depends on the model service you choose, so verify that yourself.

Quick start

The README recommends a GitHub Action. Put this file at .github/workflows/pr-agent.yml:

name: PR Agent
on:
  pull_request:
    types: [opened, synchronize]
jobs:
  pr_agent_job:
    runs-on: ubuntu-latest
    steps:
      - name: PR Agent action step
        uses: the-pr-agent/pr-agent@main
        env:
          OPENAI_KEY: ${{ secrets.OPENAI_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

The workflow reads OPENAI_KEY from a repository secret, so add that secret first. The example uses @main. For a fixed version, swap in a release tag; the latest is v0.48.0.

For a local run, use the command line:

pip install "pr-agent[github]"
export OPENAI_KEY=your_key_here
pr-agent --pr_url https://github.com/owner/repo/pull/123 review

The README also lists Docker as a deployment option, and the image namespace changed. Releases 0.34.2 and later are published as pragent/pr-agent. Versions up to v0.31 remain in the legacy codiumai/pr-agent namespace as a frozen archive with no new images, so update any pinned image references when you upgrade.

Summary

It suits teams that already work on GitHub, GitLab, Bitbucket, Azure DevOps or Gitea, want an AI review on every pull request, and are prepared to pay for their own model API calls or run a local model. It does not suit anyone who wants a vendor-run hosted service with someone to call when something breaks. This is a community-maintained project, and the README says plainly that it is not Qodo’s free offering for open-source projects. That offering is a separate product.

Three things to know first. The code diff goes to the model service you configure. The README’s data privacy section notes that with a self-hosted setup, the data handling sits between you and the model provider. The README also says /help_docs has been disabled since v0.36.1 because of a credential-exposure security issue (#2445). That issue closed on June 19, 2026, but the README still carries the note, and we did not verify whether the command is back. Finally, we checked the documentation and screenshots only: we did not run the action or the Docker image on a real pull request. The code is almost entirely Python, the license is MIT, and the repository was pushed on October 20, 2026.

The independent analysis firm The Futurum Group published an article in April 2026 under the headline “Qodo Hands PR-Agent to the Community”, about the same donation. For the Claude Code side of this, read the Claude Code best-practices breakdown. Its Writer/Reviewer pattern, where one session writes and a fresh session reviews, follows the same idea.