---
name: CodeRabbit
description: Use when reviewing pull requests, analyzing code changes, running
  local CLI reviews, prioritizing PR queues, scanning for security
  vulnerabilities, generating code improvements, or integrating AI-powered code
  review into development workflows across GitHub, GitLab, Azure DevOps, and
  Bitbucket.
metadata:
  mintlify-proj: coderabbit
  version: "1.0"
---

# CodeRabbit Skill

## Product summary

CodeRabbit is an AI-powered code review platform that analyzes pull requests, local changes, and repositories for bugs, security issues, and code quality improvements. It integrates with GitHub, GitLab, Azure DevOps, and Bitbucket to provide automated reviews, one-click fixes, and contextual feedback. Agents use CodeRabbit to review code before merge, run local CLI reviews during development, prioritize PR queues with Triage, scan for security vulnerabilities, and generate improvements like unit tests and docstrings. Key files: `.coderabbit.yaml` (repository configuration), `.coderabbit.config.ts` (TypeScript config). CLI: `coderabbit review`, `cr review`, `cr config`. Primary docs: https://docs.coderabbit.ai

## When to use

Reach for this skill when:

- **Reviewing pull requests** — A PR is open and needs automated analysis for bugs, security issues, or code quality feedback
- **Running local reviews** — An agent is developing code locally and needs feedback before committing (use `cr review`)
- **Prioritizing work** — A team has many open PRs and needs to rank them by risk and value (use Triage)
- **Scanning for security** — A repository needs vulnerability scanning, secret detection, or security architecture review
- **Generating improvements** — A PR needs unit tests, docstrings, or code simplification
- **Configuring reviews** — A repository needs custom review rules, tool settings, or path-based instructions
- **Fixing issues** — CodeRabbit found problems and an agent needs to apply fixes or run follow-up actions
- **Integrating with workflows** — Code review needs to integrate with Slack, Discord, issue trackers, or CI/CD systems

## Quick reference

### CLI commands

| Command | Purpose |
|---------|---------|
| `cr review` | Review tracked Git changes (committed + staged + unstaged) |
| `cr review --uncommitted` | Review only staged and tracked local edits |
| `cr review --committed` | Review only committed changes |
| `cr review --include-untracked` | Review tracked changes plus untracked files |
| `cr review --agent` | Output NDJSON for agent integration |
| `cr review --deep` | Deeper review using GitHub PR review policy |
| `cr auth login` | Authenticate with CodeRabbit |
| `cr auth status` | Check authentication and region |
| `cr config` | Guided setup for `.coderabbit.yaml` |
| `cr doctor` | Diagnose CLI setup issues |
| `cr stats` | Show review statistics |
| `cr usage` | Check review allowance and quota |

### Configuration file structure

Create `.coderabbit.yaml` in repository root:

```yaml
reviews:
  profile: "chill"  # or "assertive"
  auto_review:
    enabled: true
    drafts: false
  tools:
    eslint:
      enabled: true
    ruff:
      enabled: true
      config_file: "pyproject.toml"
  path_instructions:
    - path: "**/*.sql"
      instructions: "Flag any DROP or TRUNCATE statements"

knowledge_base:
  learnings: true
  code_guidelines: true
  linked_repositories:
    - repository: "myorg/backend-api"
      instructions: "Contains REST API endpoints"

chat:
  auto_reply: true
```

### PR review commands

Post in pull request comments (start with `@coderabbitai`):

| Command | Effect |
|---------|--------|
| `@coderabbitai review` | Review commits since last review |
| `@coderabbitai full review` | Review entire PR from scratch |
| `@coderabbitai pause` | Stop automatic reviews |
| `@coderabbitai resume` | Restart automatic reviews |
| `@coderabbitai fix comments` | Apply CodeRabbit's suggested fixes |
| `@coderabbitai generate docstrings` | Add documentation to functions |
| `@coderabbitai generate unit tests` | Create unit tests for changes |
| `@coderabbitai simplify` | Suggest code simplifications |
| `@coderabbitai configuration` | Show resolved config with sources |
| `@coderabbitai help` | List available commands |

### Configuration priority (highest to lowest)

1. Workspace global overrides (Enterprise)
2. Organization global overrides
3. Repository `.coderabbit.yaml` or `.coderabbit.config.ts`
4. Central `coderabbit` repository config
5. Repository UI settings
6. Organization UI settings
7. Workspace settings (Enterprise)
8. CodeRabbit defaults

## Decision guidance

### When to use YAML vs TypeScript configuration

| Scenario | Use YAML | Use TypeScript |
|----------|----------|----------------|
| Version-controlled, simple config | ✓ | — |
| Shared across teams | ✓ | — |
| Programmatic, conditional logic | — | ✓ |
| Type checking and IDE autocomplete | — | ✓ |
| Adapts to PR or invocation context | — | ✓ |
| Most projects | ✓ | — |

**Note:** `.coderabbit.yaml` always takes precedence if both exist.

### When to use CLI review vs PR review

| Aspect | CLI Review | PR Review |
|--------|-----------|----------|
| Timing | During development, pre-commit | After PR creation |
| Scope | Local changes | Full PR context |
| Speed | Faster feedback | Comprehensive analysis |
| Context | Limited to local repo | Includes PR description, discussions |
| Best for | Catching issues early | Team collaboration, final check |

### When to use Triage

Use Triage when:
- Team has 10+ open PRs to manage
- Need to rank by risk and business value
- Want to automate PR merging or closure
- Need Slack integration for PR updates
- Requires Team plan or higher

## Workflow

### Typical PR review workflow

1. **Set up repository** — Connect repo to CodeRabbit via web app (GitHub, GitLab, Azure DevOps, Bitbucket)
2. **Configure (optional)** — Create `.coderabbit.yaml` in repo root with review rules, tools, path instructions
3. **Create PR** — Open pull request; CodeRabbit automatically starts review
4. **Review feedback** — Read CodeRabbit's summary, findings, and suggestions in PR comments
5. **Apply fixes** — Use `@coderabbitai fix comments` to apply suggested changes, or manually implement
6. **Chat for context** — Ask `@coderabbitai` questions about findings or code
7. **Merge** — Once satisfied, merge PR

### Local CLI review workflow

1. **Install CLI** — `brew install coderabbit` (macOS) or use installer for your OS
2. **Authenticate** — `cr auth login` (opens browser for sign-in)
3. **Make changes** — Edit code in your working tree
4. **Run review** — `cr review` (reviews tracked changes) or `cr review --uncommitted` (staged only)
5. **Read findings** — Review terminal output with issues and fix suggestions
6. **Apply fixes** — Implement suggested changes in editor or pass to AI agent with `cr review --agent`
7. **Verify** — Run `cr review` again to confirm fixes

### Security scanning workflow

1. **Open Security** — Navigate to Security section in CodeRabbit app
2. **Run Deep Scan** — Click "Run Deep Scan", select repository, choose full or delta scan
3. **Review findings** — Inspect vulnerabilities, secrets, and misconfigurations in Findings page
4. **Triage** — Filter by severity, category, status; dismiss or resolve findings
5. **Fix** — Use "Fix with AI" for eligible findings or create pull request with fixes
6. **Schedule** — Set recurring weekly scans for continuous monitoring

### Triage workflow (Team plan+)

1. **Open Triage** — Go to app.coderabbit.ai/triage
2. **View queue** — See all open PRs ranked by priority and next action
3. **Filter/group** — Arrange by priority, workflow state, repository, or focus lanes
4. **Take action** — Start review, fix CI, merge, or close from card
5. **Automate** — Set Triage rules to merge ready PRs, close stale ones, send Slack reminders
6. **Get updates** — Enable Slack digest for daily queue summary

## Common gotchas

- **Configuration not applied** — Check priority order. Repository `.coderabbit.yaml` overrides organization settings. Run `@coderabbitai configuration` on a PR to see resolved config with sources.
- **Tools not running** — Most tools are enabled by default but only run on relevant file types. Verify tool is enabled in `.coderabbit.yaml` and repository has matching files.
- **CLI review differs from PR review** — CLI optimizes for immediate feedback; PR reviews use broader repository context. Differences are expected.
- **Rate limit hit** — Free tier has daily limits. Check `cr usage` to see remaining reviews. Upgrade plan or enable usage-based reviews for overage.
- **Config file not found** — CLI looks for `.coderabbit.yaml`, `.coderabbit.yml`, then `.coderabbit.config.ts` in review directory, then repo root. Ensure file is in correct location.
- **Learnings not applied** — Learnings start from first `@coderabbitai` chat interaction. They take time to accumulate and apply to future reviews.
- **Global overrides silently winning** — Global overrides take precedence over repository config. Check organization settings if config changes have no effect.
- **Linked repositories not working** — Linked repos must be in same organization/owner. Verify CodeRabbit has access and repository is installed.
- **Security findings not appearing** — Deep Scan requires Advanced/Enterprise plan (or usage billing). PR security reviews are separate from Deep Scan findings.
- **TypeScript config ignored** — If `.coderabbit.yaml` exists, TypeScript config is ignored. Remove YAML file or use only one format.

## Verification checklist

Before submitting work with CodeRabbit:

- [ ] Repository is connected to CodeRabbit (check web app)
- [ ] `.coderabbit.yaml` is in repository root if custom config needed
- [ ] Configuration is valid (run `@coderabbitai configuration` on PR or use YAML validator)
- [ ] Review has completed (check PR comments or terminal output)
- [ ] All critical/major findings are addressed or tracked
- [ ] Path instructions are correct for sensitive files (SQL, auth, etc.)
- [ ] Tools are enabled for your language/framework
- [ ] Learnings are applied if team has established patterns
- [ ] Security scan passed if required (check Deep Scan findings)
- [ ] Triage priority is accurate if using Triage
- [ ] CLI review passed locally before pushing (`cr review --agent` for agent integration)

## Resources

- **Comprehensive navigation** — https://docs.coderabbit.ai/llms.txt (page-by-page index for all documentation)
- **Configuration reference** — https://docs.coderabbit.ai/reference/configuration (all YAML options)
- **CLI reference** — https://docs.coderabbit.ai/cli/reference (all commands and flags)
- **Review commands** — https://docs.coderabbit.ai/reference/review-commands (all @coderabbitai commands for PRs)

---

> For additional documentation and navigation, see: https://docs.coderabbit.ai/llms.txt