Sourcery Review 2026: AI Code Review Pricing & Limits

Disclosure: CodeToolPilot may earn a commission if you buy through links on this page, at no extra cost to you. How we make money.

Last verified: October 13, 2026. This is an editorial research review — how we review. Prices and plans change often; confirm on the vendor’s site.

Sourcery started out as a Python refactoring tool. It is now an AI code reviewer and security scanner for GitHub and GitLab. Install it on a repository and it reviews every pull request. Each review adds a summary to the PR description, a reviewer’s guide that walks through the changes file by file, inline comments with suggested fixes and, on GitHub, a status check. On the Team plan it also scans your repositories for secrets, code vulnerabilities, infrastructure misconfigurations and risky dependencies.

Sourcery is aimed at small and mid-sized teams that want an automated first-pass review without a large contract. Its per-seat prices are modest, and public repositories are reviewed free.

This is an editorial research review based on Sourcery’s website, pricing page and documentation. We did not run our own benchmarks or timed tests.

Quick verdict

Sourcery is a straightforward, reasonably priced PR reviewer with a useful security add-on. Plain-language review rules, adjustable comment volume and clear rate limits make it easy to tune. Its privacy story is simple: no code retention and no training on your code. Its limits are narrower platform support (GitHub and GitLab only), security scanning that is fully available only on Team, and enterprise features such as SSO and self-hosting that require a sales agreement.

Pro: Every review includes a PR summary, a reviewer’s guide with optional sequence diagrams, and inline comments with one-click suggestions.
Pro: Review rules written in plain English and scoped by file path, available on every plan.
Pro: The Team plan bundles secrets, SAST, IaC, dependency and license scanning.
Pro: Low per-seat prices, free reviews for public repositories, and a 14-day Team trial with no credit card.
Con: Works with GitHub and GitLab only. Bitbucket and Azure DevOps are not listed.
Con: Pro includes only a limited preview of security scanning.
Con: SSO, GitHub Enterprise Server, self-hosting and bring-your-own-LLM are Enterprise-only.
Con: Very large pull requests can exceed per-PR limits, and Sourcery then skips the review.

Visit Sourcery

What is Sourcery?

Sourcery connects to GitHub.com, GitLab.com and self-hosted GitLab, and to GitHub Enterprise Server on the Enterprise plan. It reviews a pull request when it opens and again when new commits arrive. It covers any language GitHub recognizes and skips lockfiles and generated files. By default it also skips draft PRs, dependency-bot PRs and oversized diffs. Reviews are generated by models from OpenAI and Anthropic, and you can drive Sourcery from PR comments with @sourcery-ai commands.

Sourcery also has an extension for VS Code, Cursor, Windsurf and JetBrains IDEs. The extension runs the same review engine on your local changes before you push. The original refactoring tool, with 212 built-in rules, is still available.

Key features

Pull request reviews

Each review writes a “Summary by Sourcery” into the PR description and posts a reviewer’s guide comment. It also adds inline comments labelled by type, such as issue (bug_risk) or nitpick (performance). Where Sourcery can propose a concrete fix, you can commit its suggestion directly. It also checks whether a PR addresses the issues linked in its description. A review profile (Quiet, Balanced or Verbose) controls how many comments appear, and reviews can be written in languages other than English.

Status checks and auto-approval

On GitHub, Sourcery reports a single “Sourcery review” status check that branch protection can require. Blocking security findings fail the check, but a skipped review never blocks a merge. Sourcery can also approve pull requests that contain nothing worth blocking on. Admins can turn this off.

Review rules

Teams write conventions in plain language, up to 3,000 characters each, and scope them with path globs. Examples include “flag any new code that imports requests” or “endpoints must validate input”. Sourcery then flags violations on changed lines. Review rules apply to code review only, not to the security scanners.

Security scanning

Sourcery runs established open-source scanners on your default branch: BetterLeaks (a Gitleaks fork) for secrets, OpenGrep for SAST, Checkov for infrastructure as code and Trivy for dependencies and licenses. Findings appear in one dashboard where you can snooze, ignore or override them. Each finding can generate a ready-made prompt for a coding agent or open the fix in Cursor. On Team, findings can also create Jira tasks automatically or be pulled through a REST API.

IDE reviews

From the editor panel you can review the current file, your branch against HEAD, or another branch, and apply fixes inline. Recipes generate diagrams, tests and docstrings or explain code, and a chat view handles free-form questions. Security scanning and linked-issue checks run only on pull requests.

Analytics

On Team, an analytics dashboard tracks PR cycle time, time to first review, how often developers act on Sourcery’s comments, and per-developer and per-repository trends.

Who should use Sourcery

Sourcery suits GitHub or GitLab teams that want an affordable AI first-pass reviewer they can steer with plain-language rules. It also suits open-source maintainers who want free reviews on public repositories, and small teams that want basic security scanning bundled with code review.

Who should skip it

Skip Sourcery if you use Bitbucket or Azure DevOps or need SSO without an enterprise contract. Teams that want a reviewer built on deep whole-codebase indexing, or one with a choice of models, may also prefer other tools.

Strengths and limitations

Strengths

Easy to adopt. Install a GitHub app or connect GitLab, and reviews start on the next pull request. Settings can be set org-wide and overridden per repository.
Tunable noise. Review profiles, title and label filters, base-branch filters and path exclusions help teams cut unwanted comments.
Clear data handling. Sourcery says it retains none of your code after a review and that none of it trains any model. It also says Anthropic retains nothing under a zero-day agreement and OpenAI retains data for no more than 30 days. It reports SOC 2 Type 2 certification.
Security in the same tool. Team-plan buyers get secrets, SAST, IaC and dependency scanning without a separate product.

Limitations

Platform coverage. Only GitHub and GitLab are documented. GitLab merge requests also get no status check.
Scanning depth by plan. Scans run on the default branch only, and the full scanner experience requires Team.
Fixed model providers. You cannot choose models from the dashboard. Using your own LLM deployment needs an Enterprise agreement.
Rate limits. Big diffs can hit the per-PR cap, and automatic re-reviews stop after five per PR unless someone asks for a fresh review.
Some documentation inconsistencies. In one or two places Sourcery’s own pages disagree on which plan includes a feature, such as bring-your-own-LLM. Confirm details with sales before buying.

Pricing (as of October 2026)

Plan	Price	What you get
Open Source	Free	AI reviews on public repositories, summaries and diagrams, one-click fixes, review rules and auto-approval. Security scanning preview on up to 3 repos.
Pro	$12/seat/month billed annually ($15 monthly)	Everything above for private repositories, higher review limits and Jira integration. Security scanning preview on up to 10 repos, twice weekly, with up to 10 findings visible.
Team	$24/seat/month billed annually ($30 monthly)	Full security scanning (50 repos, nightly and on demand, unlimited findings), Jira autocreate, the security API, team analytics and higher limits.
Enterprise	Custom	Self-hosting, GitHub Enterprise Server, SSO, bring your own LLM keys, a dedicated success manager and invoice billing.

New installs get 14 days of Team with no card required. You pay only for developers you assign a seat, and usage is measured in diff characters, with a per-PR cap and a rolling seven-day budget per seat. Confirm current prices and limits on Sourcery’s pricing page. See Sourcery pricing

Prices verified on October 13, 2026 against the official Sourcery pricing page. Plans change often — confirm on the vendor’s page before you buy.

Use cases

Sourcery is built for automated review of pull requests and, on the Team plan, repository security scanning. These scenarios are based on Sourcery’s documentation and the research behind our review, not on hands-on testing.

A first-pass reviewer for a small product team

A five-person team on GitHub wants every pull request checked before a human looks at it. Sourcery posts a summary, a reviewer’s guide and inline comments, and branch protection can require its status check. The caveat is that GitLab merge requests get no status check.

Encoding team conventions and migrations

A tech lead keeps repeating the same review comments, or is in the middle of moving from one library to another. Review rules let the team describe the convention in plain language and scope it to paths. Sourcery then flags violations on changed lines in every pull request. This is a reasonable fit when conventions are clear enough to write down.

Free reviews for an open-source project

A maintainer of a public repository wants help triaging outside contributions. The Open Source plan reviews public repositories for free and includes summaries, review rules and auto-approval of low-risk pull requests. Usage limits apply per developer.

Lightweight security scanning without another vendor

A startup needs secrets, dependency and infrastructure checks but has no budget for a separate security platform. The Team plan scans up to 50 repositories nightly with established open-source scanners and can create Jira tasks automatically. In our assessment, dedicated security teams may still want deeper tooling, since scans cover the default branch only.

Alternatives

CodeRabbit: a configurable AI reviewer that also supports Bitbucket and Azure DevOps.
Greptile: reviews that use a graph of your whole codebase, with self-hosted options.
Qodo: a review and governance platform for enforcing standards across many repositories.
Graphite: stacked PRs, a merge queue and AI review for GitHub teams.

Final verdict

Sourcery is a sensible, low-cost way to put an AI reviewer on every GitHub or GitLab pull request. Its plain-language rules and clear data-handling commitments are real advantages, and the Team plan adds credible security scanning. Teams on other Git platforms, or those needing SSO without an enterprise deal, should look elsewhere. Everyone else can try it free for 14 days.

Try Sourcery

FAQ

Is Sourcery free?

Yes, for public repositories. The Open Source plan reviews public repos at no cost. Private repositories need Pro or Team, which are billed per assigned seat, and new installs get a 14-day Team trial with no credit card required. Check Sourcery’s pricing page for current terms.

Does Sourcery support Bitbucket or Azure DevOps?

Sourcery’s documentation lists GitHub.com, GitHub Enterprise Server (Enterprise plan), GitLab.com and self-hosted GitLab. Bitbucket and Azure DevOps are not listed. If you need those platforms, CodeRabbit supports both.

Is my code used to train AI models?

Sourcery says none of your code is used by OpenAI, Anthropic or Sourcery to train any model, and that it retains none of your code after a review. It says Anthropic retains nothing under a zero-day agreement and OpenAI retains data for no more than 30 days. Sourcery reports SOC 2 Type 2 certification, and the report is available through its trust center.

Does Sourcery work in VS Code and JetBrains IDEs?

Yes. The extension runs in VS Code, Cursor, Windsurf and JetBrains IDEs. It reviews your current file or working changes and lets you apply fixes inline. Security scanning and linked-issue checks run only on pull requests.

Sourcery vs CodeRabbit: which is better?

Both review pull requests automatically and support custom rules. CodeRabbit covers more Git platforms. Sourcery bundles repository security scanning on its Team plan and has simple per-seat pricing. In our assessment, Sourcery suits GitHub or GitLab teams that want review and basic security scanning in one tool, while CodeRabbit suits teams on mixed platforms.

Sourcery Review (2026): Affordable AI Code Review With Security Scanning