Quoted $1M for AI code review. Built it for free.
I wanted an AI reviewer on our PRs at Postman. Catch the dumb stuff. Let humans do architecture.
Got quotes. ~$1,000,000 a year. Why? We need Soc2 or SSO support 🤷.
For software that takes a diff, puts it in a prompt, and posts a comment.
I built Nitpicker instead. Last month's bill: $300.
Open source.
Does it even work?
Yes. Not how the sales deck says.
It won't replace your staff engineer. It replaces the forty minutes before they open the tab. Your branch rots while someone's in a meeting three timezones away. The bot comments in ~30 seconds. You fix it while the code is still loaded in your head.
It's also better than you at dull failure modes. Swallowed exceptions. Off-by-ones in a 400-line diff. New endpoint with no auth because the file next to it didn't have one either. Line 340 of your eighth PR today, where your eyes stopped reading.
Models don't get bored. That's the whole product.
And every convention living in one senior's skull — no DB calls from handlers, every migration needs a rollback, no user IDs in logs — can be written down once and enforced on every PR forever. Including the ones at 2am. Institutional memory that doesn't take PTO.
Per-seat pricing is a scam
Every tool in this category charges per seat.
Per seat. For a thing whose actual cost is tokens.
Your bill scales with headcount. Their cost scales with diff volume. The gap between those two lines is the entire business model, and at a few hundred engineers that gap has six zeroes in it.
If your pricing is disconnected from your actual cost structure — especially seat-based billing for usage-based work — you are not building a moat. You are building a case study for the person who replaces you.
AI collapsed the cost of "take input, call a model, return output." Half of SaaS is exactly that product wearing a pricing page. The ones still charging like it's 2019 are one weekend project away from irrelevance. Customers can already smell it. The quotes make it obvious.
Own the model choice and the curve flips. Cheap model for the first pass, expensive one only when it earns it. Provider hikes prices, you change one line. Token prices fall every year — when you own the config, you keep that. When you signed a per-seat contract, your vendor keeps it.
Per-seat is a ratchet. Tokens are a commodity. Buy the commodity.
Send the diff. That's it.
Half this category wants to index your monorepo, babysit a vector store, and hurl 200k tokens at a typo fix. Demos beautifully. Slow, expensive, and unnecessary for ~95% of PRs.
Nitpicker's default: take the diff. One model call. Structured output. Post comments. Done.
Seconds. A few thousand tokens. Fractions of a cent.
Escalate only when it earns it — big diff, sensitive path, finding outside the window. Otherwise stay cheap. Long tail of cheap reviews subsidizing a handful of thorough ones. Exactly how human review already works.
We run ~100 repos. Busiest one: a few thousand PRs a day. Full-repo index on all of them and the bill looks like the quote I ran from.
Speed isn't optional. Four minutes gets muted. Beats your tab switch gets read.
The bill
| Monitored repos | ~100 |
| PRs/day (busiest) | a few thousand |
| Monthly cost | ~$300 |
| - model tokens | essentially all of it |
| - compute | a rounding error |
Runs on Lambda. Nothing to keep warm — no index, no vector DB, no control plane. Wake up, 300ms network call, die. Lambda prices that at approximately nothing.
Cost is tokens. Tokens are cheap because diffs are small. Every design decision exists to produce this table.
What's not on the pricing page
No seats. Hire fifty engineers. Bill doesn't notice.
No third party holding your source. Only thing leaving is the model call you configured, to a provider you already use.
No SOC 2 rodeo. Vendor approval to read your source tree: security questionnaire, DPA, legal, procurement, circus again at renewal. Weeks of somebody's life, annually, before a single line gets reviewed. Self-host it and that workstream vanishes.
No lock-in. Open source. Hate a decision? Fork it. Project dies? You still have a working reviewer.
Run it wherever
GitHub Action. Lambda. Cloudflare Workers. Any server, container, or sad VM you can point a webhook at.
Webhook handler + model call. It should run anywhere. It does.
Fight with it
A bot that never answers is a linter with worse aim.
Ask why. Tell it it's wrong. Ask for a fix. Tell it to drop the thread. It engages.
False positives get cheap — one reply instead of quiet resentment ending in a deleted workflow file. And every time you explain why it's wrong, you've articulated a rule you should write down. So write it down.
Teach it your religion
Generic prompts produce generic feedback.
Per-repo guidelines, checked into the repo. Your payments service and your marketing site should not share a rulebook.
The system prompt is a file. Not a "strictness" slider. Edit it.
Make it terse. Make it patient. Make it paranoid about security. Give it a voice — engineers read comments from something with a personality and ignore automated-review-bot[bot].
Ours is a nitpicker. On brand.
The catch
There isn't one. Free, open source. Pay your model provider for tokens. Nobody else for anything.
Want zero? Point it at Ollama on hardware you own. Quality drops, fine for internal first-pass, and your code never leaves.
Before you install anything: divide your quote by your actual monthly diff volume. You might not need me at all.