- Home
- AI Code Review Tools
- Merlin AI Code Review
Merlin AI Code Review
What it is
Merlin AI Code Review is a self-hosted tool for reviewing pull request changes and posting inline comments without sending code to a third-party SaaS. Comments identify bugs, security concerns, style issues, and performance problems at file and line level, arranged by severity. Its security checks include OWASP Top 10 analysis, secret detection, and Snyk dependency scanning. Merlin works with GitHub, GitLab, Bitbucket, Azure DevOps, and Gitea, and supports AI backends including Claude, GPT-4o, Gemini, Bedrock, Ollama, and Claude Code CLI. It can index a codebase and prior review comments to retrieve relevant snippets, with embeddings running locally through Ollama. The maker presents it as a Rust single binary for CI pipelines, without a Merlin server or account. Merlin is MIT-licensed and free, but users must provide their own AI API key and pay the provider for token usage. The maker says code remains on the user's servers and describes an Ollama and local Qdrant configuration for offline use with no external calls.
For and against
For
- Posts comments at file and line level.
- Supports five listed code-hosting services.
- Includes OWASP analysis, secret detection, and dependency scanning.
- Can run offline with Ollama and local Qdrant.
- MIT-licensed with no per-seat fee.
Against
- Users supply an AI API key.
- AI provider token charges still apply.
The verdict
Merlin offers self-hosted pull request review with integrations for multiple code hosts and AI backends. Its free license does not cover provider token usage, which users pay separately.
Who it suits
Merlin suits developers and teams that want pull request reviews within their own environment. The listed audiences include solo developers, startups, open-source teams, regulated banks, and air-gapped defence labs.
Plans and prices
Free forever
MIT license · No per-seat fee · Bring your own AI API key; provider token charges apply
Read 3 Oct 2026 · merlin-review.com
On the record
- AI providers
- The site lists Claude, GPT-4o, Gemini, Bedrock, Ollama, and Claude Code CLI as supported AI backends.merlin-review.com · read 3 Oct 2026
- Audit logs
- The maker says every AI call can be logged locally and describes this as HIPAA/SOC2 friendly.merlin-review.com · read 3 Oct 2026
- Autonomous agent
- Its ReAct-loop agent can plan multi-step tasks and use the slash commands, RAG search, comment posting, and PR information tools.merlin-review.com · read 3 Oct 2026
- Context-aware reviews
- Merlin can index a codebase and past review comments, then retrieve relevant snippets before AI calls; embeddings run locally via Ollama.merlin-review.com · read 3 Oct 2026
- Deployment
- The product is presented as a Rust single binary that runs in a CI pipeline, with no Merlin server or account required.merlin-review.com · read 3 Oct 2026
- Git integrations
- The site says Merlin works with GitHub, GitLab (cloud and self-hosted), Bitbucket, Azure DevOps, and Gitea.merlin-review.com · read 3 Oct 2026
- Intended users
- The maker describes it for solo developers, startups, open-source teams, regulated banks, and air-gapped defence labs.merlin-review.com · read 3 Oct 2026
- License and cost
- Merlin is MIT-licensed and free forever; users supply their own API key and pay their AI provider for token usage.merlin-review.com · read 3 Oct 2026
- Maker
- The site credits Arunachalam Kalimuthu as the maker.merlin-review.com · read 3 Oct 2026
- Purpose
- Merlin reviews pull request diffs with configurable AI and posts inline comments without sending code to a third-party SaaS.merlin-review.com · read 3 Oct 2026
- Review comments
- It posts file- and line-level comments about bugs, security, style, and performance, sorted by severity.merlin-review.com · read 3 Oct 2026
- Security and privacy
- The maker says source code stays on the user's servers and describes an Ollama plus local Qdrant configuration for offline use with zero external calls.merlin-review.com · read 3 Oct 2026
- Security features
- Security scanning includes OWASP Top 10 analysis, secret detection, and Snyk dependency scanning.merlin-review.com · read 3 Oct 2026
- Support
- The maker directs users to open an issue, start a discussion, or contact the team directly for feedback.merlin-review.com · read 3 Oct 2026
