Set up CodeRabbit with an AI agent

name: CodeRabbit
description: Use when reviewing pull requests, analyzing code changes, running
  local CLI reviews, prioritizing PR queues, scanning for security
  vulnerabilities, generating code improvements, or integrating AI-powered code
  review into development workflows across GitHub, GitLab, Azure DevOps, and
  Bitbucket.
metadata:
  mintlify-proj: coderabbit
  version: "1.0"

CodeRabbit Skill

Product summary

CodeRabbit is an AI-powered code review platform that analyzes pull requests, local changes, and repositories for bugs, security issues, and code quality improvements. It integrates with GitHub, GitLab, Azure DevOps, and Bitbucket to provide automated reviews, one-click fixes, and contextual feedback. Agents use CodeRabbit to review code before merge, run local CLI reviews during development, prioritize PR queues with Triage, scan for security vulnerabilities, and generate improvements like unit tests and docstrings. Key files: .coderabbit.yaml (repository configuration), .coderabbit.config.ts (TypeScript config). CLI: coderabbit review, cr review, cr config. Primary docs: https://docs.coderabbit.ai

When to use

Reach for this skill when:

• Reviewing pull requests — A PR is open and needs automated analysis for bugs, security issues, or code quality feedback
• Running local reviews — An agent is developing code locally and needs feedback before committing (use cr review)
• Prioritizing work — A team has many open PRs and needs to rank them by risk and value (use Triage)
• Scanning for security — A repository needs vulnerability scanning, secret detection, or security architecture review
• Generating improvements — A PR needs unit tests, docstrings, or code simplification
• Configuring reviews — A repository needs custom review rules, tool settings, or path-based instructions
• Fixing issues — CodeRabbit found problems and an agent needs to apply fixes or run follow-up actions
• Integrating with workflows — Code review needs to integrate with Slack, Discord, issue trackers, or CI/CD systems

Quick reference

CLI commands

Command	Purpose
cr review	Review tracked Git changes (committed + staged + unstaged)
cr review --uncommitted	Review only staged and tracked local edits
cr review --committed	Review only committed changes
cr review --include-untracked	Review tracked changes plus untracked files
cr review --agent	Output NDJSON for agent integration
cr review --deep	Deeper review using GitHub PR review policy
cr auth login	Authenticate with CodeRabbit
cr auth status	Check authentication and region
cr config	Guided setup for .coderabbit.yaml
cr doctor	Diagnose CLI setup issues
cr stats	Show review statistics
cr usage	Check review allowance and quota

Configuration file structure

Create .coderabbit.yaml in repository root:

reviews:
  profile: "chill"  # or "assertive"
  auto_review:
    enabled: true
    drafts: false
  tools:
    eslint:
      enabled: true
    ruff:
      enabled: true
      config_file: "pyproject.toml"
  path_instructions:
    - path: "**/*.sql"
      instructions: "Flag any DROP or TRUNCATE statements"

knowledge_base:
  learnings: true
  code_guidelines: true
  linked_repositories:
    - repository: "myorg/backend-api"
      instructions: "Contains REST API endpoints"

chat:
  auto_reply: true

PR review commands

Post in pull request comments (start with @coderabbitai):

Command	Effect
@coderabbitai review	Review commits since last review
@coderabbitai full review	Review entire PR from scratch
@coderabbitai pause	Stop automatic reviews
@coderabbitai resume	Restart automatic reviews
@coderabbitai fix comments	Apply CodeRabbit's suggested fixes
@coderabbitai generate docstrings	Add documentation to functions
@coderabbitai generate unit tests	Create unit tests for changes
@coderabbitai simplify	Suggest code simplifications
@coderabbitai configuration	Show resolved config with sources
@coderabbitai help	List available commands

Configuration priority (highest to lowest)

1. Workspace global overrides (Enterprise)
2. Organization global overrides
3. Repository .coderabbit.yaml or .coderabbit.config.ts
4. Central coderabbit repository config
5. Repository UI settings
6. Organization UI settings
7. Workspace settings (Enterprise)
8. CodeRabbit defaults

Decision guidance

When to use YAML vs TypeScript configuration

Scenario	Use YAML	Use TypeScript
Version-controlled, simple config	✓	—
Shared across teams	✓	—
Programmatic, conditional logic	—	✓
Type checking and IDE autocomplete	—	✓
Adapts to PR or invocation context	—	✓
Most projects	✓	—

Note: .coderabbit.yaml always takes precedence if both exist.

When to use CLI review vs PR review

Aspect	CLI Review	PR Review
Timing	During development, pre-commit	After PR creation
Scope	Local changes	Full PR context
Speed	Faster feedback	Comprehensive analysis
Context	Limited to local repo	Includes PR description, discussions
Best for	Catching issues early	Team collaboration, final check

When to use Triage

Use Triage when:

• Team has 10+ open PRs to manage
• Need to rank by risk and business value
• Want to automate PR merging or closure
• Need Slack integration for PR updates
• Requires Team plan or higher

Workflow

Typical PR review workflow

1. Set up repository — Connect repo to CodeRabbit via web app (GitHub, GitLab, Azure DevOps, Bitbucket)
2. Configure (optional) — Create .coderabbit.yaml in repo root with review rules, tools, path instructions
3. Create PR — Open pull request; CodeRabbit automatically starts review
4. Review feedback — Read CodeRabbit's summary, findings, and suggestions in PR comments
5. Apply fixes — Use @coderabbitai fix comments to apply suggested changes, or manually implement
6. Chat for context — Ask @coderabbitai questions about findings or code
7. Merge — Once satisfied, merge PR

Local CLI review workflow

1. Install CLI — brew install coderabbit (macOS) or use installer for your OS
2. Authenticate — cr auth login (opens browser for sign-in)
3. Make changes — Edit code in your working tree
4. Run review — cr review (reviews tracked changes) or cr review --uncommitted (staged only)
5. Read findings — Review terminal output with issues and fix suggestions
6. Apply fixes — Implement suggested changes in editor or pass to AI agent with cr review --agent
7. Verify — Run cr review again to confirm fixes

Security scanning workflow

1. Open Security — Navigate to Security section in CodeRabbit app
2. Run Deep Scan — Click "Run Deep Scan", select repository, choose full or delta scan
3. Review findings — Inspect vulnerabilities, secrets, and misconfigurations in Findings page
4. Triage — Filter by severity, category, status; dismiss or resolve findings
5. Fix — Use "Fix with AI" for eligible findings or create pull request with fixes
6. Schedule — Set recurring weekly scans for continuous monitoring

Triage workflow (Team plan+)

1. Open Triage — Go to app.coderabbit.ai/triage
2. View queue — See all open PRs ranked by priority and next action
3. Filter/group — Arrange by priority, workflow state, repository, or focus lanes
4. Take action — Start review, fix CI, merge, or close from card
5. Automate — Set Triage rules to merge ready PRs, close stale ones, send Slack reminders
6. Get updates — Enable Slack digest for daily queue summary

Common gotchas

• Configuration not applied — Check priority order. Repository .coderabbit.yaml overrides organization settings. Run @coderabbitai configuration on a PR to see resolved config with sources.
• Tools not running — Most tools are enabled by default but only run on relevant file types. Verify tool is enabled in .coderabbit.yaml and repository has matching files.
• CLI review differs from PR review — CLI optimizes for immediate feedback; PR reviews use broader repository context. Differences are expected.
• Rate limit hit — Free tier has daily limits. Check cr usage to see remaining reviews. Upgrade plan or enable usage-based reviews for overage.
• Config file not found — CLI looks for .coderabbit.yaml, .coderabbit.yml, then .coderabbit.config.ts in review directory, then repo root. Ensure file is in correct location.
• Learnings not applied — Learnings start from first @coderabbitai chat interaction. They take time to accumulate and apply to future reviews.
• Global overrides silently winning — Global overrides take precedence over repository config. Check organization settings if config changes have no effect.
• Linked repositories not working — Linked repos must be in same organization/owner. Verify CodeRabbit has access and repository is installed.
• Security findings not appearing — Deep Scan requires Advanced/Enterprise plan (or usage billing). PR security reviews are separate from Deep Scan findings.
• TypeScript config ignored — If .coderabbit.yaml exists, TypeScript config is ignored. Remove YAML file or use only one format.

Verification checklist

Before submitting work with CodeRabbit:

• Repository is connected to CodeRabbit (check web app)
• .coderabbit.yaml is in repository root if custom config needed
• Configuration is valid (run @coderabbitai configuration on PR or use YAML validator)
• Review has completed (check PR comments or terminal output)
• All critical/major findings are addressed or tracked
• Path instructions are correct for sensitive files (SQL, auth, etc.)
• Tools are enabled for your language/framework
• Learnings are applied if team has established patterns
• Security scan passed if required (check Deep Scan findings)
• Triage priority is accurate if using Triage
• CLI review passed locally before pushing (cr review --agent for agent integration)

Resources

• Comprehensive navigation — https://docs.coderabbit.ai/llms.txt (page-by-page index for all documentation)
• Configuration reference — https://docs.coderabbit.ai/reference/configuration (all YAML options)
• CLI reference — https://docs.coderabbit.ai/cli/reference (all commands and flags)
• Review commands — https://docs.coderabbit.ai/reference/review-commands (all @coderabbitai commands for PRs)

---

For additional documentation and navigation, see: https://docs.coderabbit.ai/llms.txt