Tools configuration reference

Complete reference for all CodeRabbit supported tools and their configuration options.

This reference is generated automatically. Last updated: October 15, 2026

CodeRabbit supports integration with 59 static analysis tools, linters, and security scanners. You can configure each tool individually via the web interface or your .coderabbit.yaml file, see the configuration overview for details.

All tools

actionlint

actionlint is a static checker for GitHub Actions workflow files.

Version: v1.7.12

• actionlint web page
• actionlint in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.actionlint.enabled · boolean · default: true

Enable actionlint

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    actionlint:
      enabled: true

ast-grep

ast-grep is a code analysis tool that helps you to find patterns in your codebase using abstract syntax trees patterns.

Version: v0.45.3

• ast-grep web page
• ast-grep in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.ast-grep.enabled · boolean · default: true

Enable ast-grep

reviews.tools.ast-grep.rule_dirs · array of string · default: []

List of rules directories.

reviews.tools.ast-grep.util_dirs · array of string · default: []

List of utils directories.

reviews.tools.ast-grep.essential_rules · boolean · default: true

Use ast-grep essentials package.

reviews.tools.ast-grep.packages · array of string · default: []

Predefined packages to be used.

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    ast-grep:
      enabled: true
      rule_dirs: []
      util_dirs: []
      essential_rules: true
      packages: []

Betterleaks (Gitleaks)

Betterleaks is a secret scanner (an improved version of Gitleaks).

Version: v1.9.0

• Betterleaks web page
• Betterleaks in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.gitleaks.enabled · boolean · default: true

Enable Betterleaks

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    gitleaks:
      enabled: true

Biome

Biome is a fast formatter, linter, and analyzer for web projects.

Version: v2.5.14

• Biome web page
• Biome in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.biome.enabled · boolean · default: true

Enable Biome

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    biome:
      enabled: true

Blinter

Blinter is a linter for Windows batch files that provides comprehensive static analysis to identify syntax errors, security vulnerabilities, performance issues, and style problems.

Version: v1.1.31

• Blinter web page
• Blinter in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.blinter.enabled · boolean · default: true

Enable Blinter

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    blinter:
      enabled: true

Brakeman

Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications.

Version: v8.0.6

• Brakeman web page
• Brakeman in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.brakeman.enabled · boolean · default: true

Enable Brakeman

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    brakeman:
      enabled: true

Buf

Buf offers linting for Protobuf files.

Version: v1.73.0

• Buf web page
• Buf in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.buf.enabled · boolean · default: true

Enable Buf

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    buf:
      enabled: true

checkmake

checkmake is a linter for Makefiles.

Version: v0.3.2

• checkmake web page
• checkmake in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.checkmake.enabled · boolean · default: true

Enable checkmake

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    checkmake:
      enabled: true

Checkov

Checkov is a static code analysis tool for infrastructure-as-code files.

Version: v3.3.20

• Checkov web page
• Checkov in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.checkov.enabled · boolean · default: true

Enable Checkov

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    checkov:
      enabled: true

CircleCI

CircleCI tool is a static checker for CircleCI config files.

Version: v1.0.51648

• CircleCI web page
• CircleCI in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.circleci.enabled · boolean · default: true

Enable CircleCI

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    circleci:
      enabled: true

Clang

Configuration for Clang to perform static analysis on C and C++ code

Version: v14.0.6

• Clang web page
• Clang in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.clang.enabled · boolean · default: true

Enable Clang for C/C++ static analysis and code quality checks

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    clang:
      enabled: true

Clippy

Clippy is a collection of lints to catch common mistakes and improve your Rust code.

• Clippy web page
• Clippy in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.clippy.enabled · boolean · default: true

Enable Clippy

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    clippy:
      enabled: true

Cppcheck

Cppcheck is a static code analysis tool for the C and C++ programming languages.

Version: v2.22.0

• Cppcheck web page
• Cppcheck in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.cppcheck.enabled · boolean · default: true

Enable Cppcheck

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    cppcheck:
      enabled: true

detekt

Detekt is a static code analysis tool for Kotlin files.

Version: v1.23.8

• detekt web page
• detekt in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.detekt.enabled · boolean · default: true

Enable detekt: detekt is a static code analysis tool for Kotlin files.

reviews.tools.detekt.config_file · string

Optional path to the detekt configuration file relative to the repository.

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    detekt:
      enabled: true
      config_file: "detekt.yml"

Dotenv Lint

dotenv-linter is a tool for checking and fixing .env files for problems and best practices

Version: v4.0.0

• Dotenv Lint web page
• Dotenv Lint in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.dotenvLint.enabled · boolean · default: true

Enable dotenv-linter

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    dotenvLint:
      enabled: true

Ember Template Lint

ember-template-lint is a linter for Handlebars template files that checks for common issues such as accessibility violations, deprecated patterns, and template anti-patterns.

Version: v7.9.3

• Ember Template Lint web page
• Ember Template Lint in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.emberTemplateLint.enabled · boolean · default: true

Enable ember-template-lint

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    emberTemplateLint:
      enabled: true

ESLint

ESLint is a static code analysis tool for JavaScript files.

• ESLint web page
• ESLint in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.eslint.enabled · boolean · default: true

Enable ESLint

reviews.tools.eslint.config_file · string

Optional path to an ESLint configuration file relative to the repository. When set, this configuration is used for every file instead of discovering ESLint configurations recursively.

reviews.tools.eslint.e18e · object

@e18e/eslint-plugin modernization, performance, and dependency replacement checks.

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    eslint:
      enabled: true
      config_file: "eslint.config.js"
      e18e:
        enabled: true

Flake8

Flake8 is a Python linter that wraps PyFlakes, pycodestyle and Ned Batchelder’s McCabe script.

Version: v7.4.1

• Flake8 web page
• Flake8 in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.flake8.enabled · boolean · default: true

Enable Flake8

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    flake8:
      enabled: true

Fortitude

Fortitude is a Fortran linter that checks for code quality and style issues.

Version: v0.9.2

• Fortitude web page
• Fortitude in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.fortitudeLint.enabled · boolean · default: true

Enable Fortitude: Fortitude is a Fortran linter that checks for code quality and style issues

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    fortitudeLint:
      enabled: true

GitHub Checks

GitHub Checks integration configuration.

• GitHub Checks in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.github-checks.enabled · boolean · default: true

Enable GitHub Checks: Enable integration, defaults to true

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    github-checks:
      enabled: true

golangci-lint

golangci-lint is a fast linters runner for Go.

Version: v2.14.0

• golangci-lint web page
• golangci-lint in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.golangci-lint.enabled · boolean · default: true

Enable golangci-lint

reviews.tools.golangci-lint.config_file · string

Optional path to the golangci-lint configuration file relative to the repository. Useful when the configuration file is named differently than the default ‘.golangci.yml’, ‘.golangci.yaml’, ‘.golangci.toml’, ‘.golangci.json’.

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    golangci-lint:
      enabled: true
      config_file: ".golangci.yml"

Hadolint

Hadolint is a Dockerfile linter.

Version: v2.15.1

• Hadolint web page
• Hadolint in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.hadolint.enabled · boolean · default: true

Enable Hadolint

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    hadolint:
      enabled: true

HTMLHint

HTMLHint is a static code analysis tool for HTML files.

Version: v1.9.2

• HTMLHint web page
• HTMLHint in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.htmlhint.enabled · boolean · default: true

Enable HTMLHint

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    htmlhint:
      enabled: true

Infer

Configuration for Infer to find bugs in Java and C/C++ code

Version: v1.3.0

• Infer web page
• Infer in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.fbinfer.enabled · boolean · default: true

Enable Infer for static bug analysis in Java and C/C++ code

reviews.tools.fbinfer.enable_java · boolean · default: false

Enable Java analysis: Disabled by default because Java analysis may require compiling more than the changed files.

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    fbinfer:
      enabled: true
      enable_java: false

LanguageTool

LanguageTool is a style and grammar checker for 30+ languages.

• LanguageTool web page
• LanguageTool in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.languagetool.enabled · boolean · default: true

Enable LanguageTool: Enable LanguageTool integration.

reviews.tools.languagetool.enabled_rules · array of string · default: []

IDs of rules to be enabled. The rule won’t run unless ‘level’ is set to a level that activates the rule.

reviews.tools.languagetool.disabled_rules · array of string · default: []

IDs of rules to be disabled. Note: EN_UNPAIRED_BRACKETS, and EN_UNPAIRED_QUOTES are always disabled.

reviews.tools.languagetool.enabled_categories · array of string · default: []

IDs of categories to be enabled.

reviews.tools.languagetool.disabled_categories · array of string · default: []

IDs of categories to be disabled. Note: TYPOS, TYPOGRAPHY, and CASING are always disabled.

reviews.tools.languagetool.enabled_only · boolean · default: false

Run only the rules and categories listed in enabled_rules or enabled_categories, instead of the default set.

With enabled_only: true, at least one rule or category is required. If both lists are empty, CodeRabbit skips LanguageTool and reports an error.

reviews.tools.languagetool.level · enum · default: "default"

If set to ‘picky’, additional rules will be activated, i.e. rules that you might only find useful when checking formal text.

One of: default, picky

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    languagetool:
      enabled: true
      enabled_rules: []
      disabled_rules: []
      enabled_categories: []
      disabled_categories: []
      enabled_only: false
      level: "default"

Luacheck

Configuration for Lua code linting to ensure code quality

Version: v1.2.0

• Luacheck web page
• Luacheck in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.luacheck.enabled · boolean · default: true

Enable Lua code linting: Luacheck helps maintain consistent and error-free Lua code

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    luacheck:
      enabled: true

markdownlint

markdownlint-cli2 is a static analysis tool to enforce standards and consistency for Markdown files.

Version: v0.23.3

• markdownlint web page
• markdownlint in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.markdownlint.enabled · boolean · default: true

Enable markdownlint

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    markdownlint:
      enabled: true

oasdiff

oasdiff detects breaking changes between OpenAPI specifications.

Version: v1.32.1

• oasdiff web page
• oasdiff in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.oasdiff.enabled · boolean · default: true

Enable oasdiff

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    oasdiff:
      enabled: true

OpenGrep

OpenGrep is a high-performance static code analysis engine, compatible with Semgrep configurations.

Version: v1.30.1

• OpenGrep web page
• OpenGrep in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.opengrep.enabled · boolean · default: true

Enable OpenGrep: OpenGrep is a high-performance static code analysis engine for finding security vulnerabilities and bugs across 17+ languages.

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    opengrep:
      enabled: true

OSV Scanner

OSV Scanner is a tool for vulnerability package scanning.

Version: v2.6.0

• OSV Scanner web page
• OSV Scanner in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.osvScanner.enabled · boolean · default: true

Enable OSV Scanner: OSV Scanner is a tool for vulnerability package scanning

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    osvScanner:
      enabled: true

Oxlint

Oxlint is a JavaScript/TypeScript linter for OXC written in Rust.

Version: v1.86.0

• Oxlint web page
• Oxlint in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.oxc.enabled · boolean · default: true

Enable Oxlint

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    oxc:
      enabled: true

PHP CodeSniffer

PHP CodeSniffer is a PHP linter and coding standard checker.

Version: v3.13.6

• PHP CodeSniffer web page
• PHP CodeSniffer in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.phpcs.enabled · boolean · default: true

Enable PHP CodeSniffer

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    phpcs:
      enabled: true

PHPMD

PHPMD is a tool to find potential problems in PHP code.

Version: v2.15.0

• PHPMD web page
• PHPMD in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.phpmd.enabled · boolean · default: true

Enable PHPMD

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    phpmd:
      enabled: true

PHPStan

PHPStan is a tool to analyze PHP code.

Version: v2.2.16

• PHPStan web page
• PHPStan in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.phpstan.enabled · boolean · default: true

Enable PHPStan: PHPStan requires config file in your repository root. Please ensure that this file contains the paths: parameter.

reviews.tools.phpstan.level · enum · default: "default"

Level: Specify the rule level to run. When set to default, the level is determined by the review profile: chill uses level 3 (real bugs only — return/property type mismatches, array offset errors) and assertive uses level 8 (adds dead code detection, argument type checking, null safety, and typehint checks). This setting is ignored if your configuration file already has a level: parameter.

One of: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, default, max

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    phpstan:
      enabled: true
      level: "default"

PMD

PMD is an extensible multilanguage static code analyzer. It’s mainly concerned with Java.

Version: v7.28.0

• PMD web page
• PMD in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.pmd.enabled · boolean · default: true

Enable PMD

reviews.tools.pmd.config_file · string

Optional path to the PMD configuration file relative to the repository.

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    pmd:
      enabled: true
      config_file: "ruleset.xml"

Presidio

Microsoft Presidio Analyzer 2.2.364 detects sensitive identifiers (including payment cards, US SSN, cryptocurrency wallets, and phone numbers) in changed files. Tune entities, thresholds, and languages in repository Presidio configuration (for example .presidiocli or AnalyzerEngineProvider YAML); the built-in scan uses fixed defaults and is skipped when that configuration is present.

Version: v2.2.364

• Presidio web page
• Presidio in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.presidio.enabled · boolean · default: true

Enable Microsoft Presidio Analyzer for high-signal PII in changed files

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    presidio:
      enabled: true

Prisma Lint

Configuration for Prisma Schema linting to ensure schema file quality

Version: v0.13.1

• Prisma Lint web page
• Prisma Lint in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.prismaLint.enabled · boolean · default: true

Enable Prisma Schema linting: Prisma Schema linting helps maintain consistent and error-free schema files

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    prismaLint:
      enabled: true

PSScriptAnalyzer

PSScriptAnalyzer is a static code checker for PowerShell scripts and modules.

Version: v1.25.0

• PSScriptAnalyzer web page
• PSScriptAnalyzer in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.psscriptanalyzer.enabled · boolean · default: true

Enable PSScriptAnalyzer

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    psscriptanalyzer:
      enabled: true

Pylint

Pylint is a Python static code analysis tool.

Version: v4.1.1

• Pylint web page
• Pylint in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.pylint.enabled · boolean · default: true

Enable Pylint

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    pylint:
      enabled: true

React Doctor

React Doctor scans React codebases for security, performance, correctness, and accessibility issues.

Version: v0.9.14

• React Doctor web page
• React Doctor in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.reactDoctor.enabled · boolean · default: true

Enable React Doctor

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    reactDoctor:
      enabled: true

Regal

Regal is a linter and language server for Rego.

Version: v0.43.0

• Regal web page
• Regal in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.regal.enabled · boolean · default: true

Enable Regal

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    regal:
      enabled: true

RuboCop

RuboCop is a Ruby static code analyzer (a.k.a. linter) and code formatter.

Version: v1.91.0

• RuboCop web page
• RuboCop in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.rubocop.enabled · boolean · default: true

Enable RuboCop

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    rubocop:
      enabled: true

Ruff

Ruff is a Python linter and code formatter.

Version: v0.16.9

• Ruff web page
• Ruff in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.ruff.enabled · boolean · default: true

Enable Ruff

reviews.tools.ruff.config_file · string

Optional path to a Ruff configuration file relative to the repository. When set, this configuration is used for every reviewed file instead of Ruff’s closest-config discovery.

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    ruff:
      enabled: true
      config_file: "ruff.toml"

Semgrep

Semgrep is a static analysis tool designed to scan code for security vulnerabilities and code quality issues.

Version: v1.179.0

• Semgrep web page
• Semgrep in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.semgrep.enabled · boolean · default: true

Enable Semgrep

reviews.tools.semgrep.config_file · string

Optional path to the Semgrep configuration file relative to the repository.

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    semgrep:
      enabled: true
      config_file: "semgrep.yml"

ShellCheck

ShellCheck is a static analysis tool that finds bugs in your shell scripts.

Version: v0.11.0

• ShellCheck web page
• ShellCheck in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.shellcheck.enabled · boolean · default: true

Enable ShellCheck: ShellCheck is a static analysis tool that finds bugs in your shell.

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    shellcheck:
      enabled: true

Shopify Theme Check

Configuration for Shopify Theme Check to ensure theme quality and best practices

Version: cli 4.8.3, theme 3.58.2

• Shopify Theme Check web page
• Shopify Theme Check in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.shopifyThemeCheck.enabled · boolean · default: true

Enable Shopify Theme Check: A linter for Shopify themes that helps you follow Shopify theme & Liquid best practices

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    shopifyThemeCheck:
      enabled: true

SkillSpector

SkillSpector is a security scanner for AI agent skills that detects vulnerabilities, malicious patterns, and security risks

Version: v2.12.0

• SkillSpector web page
• SkillSpector in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.skillspector.enabled · boolean · default: true

Enable SkillSpector: SkillSpector is a security scanner for AI agent skills. It detects vulnerabilities, malicious patterns, and security risks in SKILL.md manifests and MCP configurations.

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    skillspector:
      enabled: true

Smarty Lint

smarty-lint is a linter for Smarty 3 template files that checks for common issues such as incorrect operator usage, naming conventions, empty blocks, and unquoted strings.

Version: v0.3.3

• Smarty Lint web page
• Smarty Lint in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.smartyLint.enabled · boolean · default: true

Enable smarty-lint

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    smartyLint:
      enabled: true

SQLFluff

SQLFluff is an open source, dialect-flexible and configurable SQL linter.

Version: v4.3.0

• SQLFluff web page
• SQLFluff in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.sqlfluff.enabled · boolean · default: true

Enable SQLFluff

reviews.tools.sqlfluff.config_file · string

Optional path to the SQLFluff configuration file relative to the repository. Use this when the config file is not named one of SQLFluff’s default filenames.

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    sqlfluff:
      enabled: true
      config_file: "custom/.sqlfluff"

Squawk

Configuration for Squawk to lint Postgres migrations and SQL for safe schema changes

Version: v2.66.0

• Squawk web page
• Squawk in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.squawk.enabled · boolean · default: true

Enable Squawk for Postgres migration linting: Detects unsafe schema changes that can cause downtime or blocking locks

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    squawk:
      enabled: true

Stylelint

Stylelint is a linter for stylesheets (CSS, SCSS, Sass, Less, SugarSS, Stylus) that helps avoid errors and enforce conventions.

Version: v17.14.0

• Stylelint web page
• Stylelint in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.stylelint.enabled · boolean · default: true

Enable Stylelint

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    stylelint:
      enabled: true

SwiftLint

SwiftLint integration configuration object.

Version: v0.65.1

• SwiftLint web page
• SwiftLint in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.swiftlint.enabled · boolean · default: true

Enable SwiftLint: SwiftLint is a Swift linter.

reviews.tools.swiftlint.config_file · string

Optional path to the SwiftLint configuration file relative to the repository. This is useful when the configuration file is named differently than the default ‘.swiftlint.yml’ or ‘.swiftlint.yaml’.

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    swiftlint:
      enabled: true
      config_file: ".swiftlint.yml"

TFLint

TFLint is a Terraform linter for finding potential errors and enforcing best practices.

Version: v0.64.0

• TFLint web page
• TFLint in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.tflint.enabled · boolean · default: true

Enable TFLint: TFLint is a Terraform linter for finding potential errors.

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    tflint:
      enabled: true

Trivy

Trivy is a comprehensive security scanner that detects misconfigurations and secrets in Infrastructure as Code files

Version: v0.74.0

• Trivy web page
• Trivy in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.trivy.enabled · boolean · default: true

Enable Trivy for security scanning of IaC files (Terraform, Kubernetes, Docker, etc.)

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    trivy:
      enabled: true

TruffleHog

TruffleHog is a secret scanner with verification capabilities that can detect and verify secrets in code.

Version: v3.96.0

• TruffleHog web page
• TruffleHog in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.trufflehog.enabled · boolean · default: true

Enable TruffleHog: TruffleHog is a secret scanner with verification capabilities.

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    trufflehog:
      enabled: true

Vale

Vale lints prose using the repository’s checked-in style rules.

Version: v3.23.0

• Vale web page
• Vale in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.vale.enabled · boolean · default: true

Enable Vale: Vale checks prose against repository-defined editorial style rules. It runs only when a supported root Vale configuration is present.

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    vale:
      enabled: true

Verilator

Verilator statically analyzes Verilog and SystemVerilog source files.

Version: v5.052

• Verilator web page
• Verilator in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.verilator.enabled · boolean · default: true

Enable Verilator: Verilator lints Verilog and SystemVerilog for syntax, width, connectivity, and behavioral correctness issues.

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    verilator:
      enabled: true

YAMLlint

YAMLlint is a linter for YAML files.

Version: v1.37.1

• YAMLlint web page
• YAMLlint in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.yamllint.enabled · boolean · default: true

Enable YAMLlint

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    yamllint:
      enabled: true

zizmor

zizmor is a static security analyzer for GitHub Actions workflow files.

Version: v1.30.1

• zizmor web page
• zizmor in CodeRabbit: supported files, config file discovery, profile behavior, and when it’s skipped.

Configuration options:

reviews.tools.zizmor.enabled · boolean · default: true

Enable zizmor

Example configuration:

.coderabbit.yaml

reviews:
  tools:
    zizmor:
      enabled: true

What’s next

Configuration reference

View the complete reference for all CodeRabbit configuration options and settings.

Review commands

Learn how to control and customize code reviews using @coderabbitai commands.