Every tool here is good at what it's built for. This page is about one specific job: telling you what a pull request actually changes — reliably, and without a token bill.
The tools you'd reach for split cleanly in two. LLM reviewers read like a teammate but drift, hallucinate, and bill per PR. Static scanners are precise and free but report whole-file findings and can't tell a rename from a real change. Lenscheck takes the third path: deterministic like a scanner, behavior-aware like a reviewer.
Great prose and context, but the same PR can produce a different review twice, findings can be invented, and every run costs tokens. Nothing traces to a guaranteed file:line.
Deterministic and exact, but they flag rule matches across the whole file, not what a PR changed in behavior — and a pure refactor lights them up with noise.
Rows reflect each tool's default PR-review behavior — not everything it can be configured to do.
| CodeRabbit | Copilot review | SonarQube | Semgrep | Lenscheck | |
|---|---|---|---|---|---|
| Deterministic — same PR, same review | ✗ | ✗ | ✓ | ✓ | ✓ |
| No LLM — nothing to hallucinate | ✗ | ✗ | ✓ | ✓ | ✓ |
| No per-token LLM bill | ✗ | ✗ | ✓ | ✓ | ✓ |
| Reviews the behavior change, not whole files | ~ | ~ | ~ | ~ | ✓ |
| Endpoint lens — routes · auth · PII · db · calls | ~ | ~ | ✗ | ~ | ✓ |
| Refactor-stable (renames = no noise) | ✗ | ✗ | ✗ | ✗ | ✓ |
| Learns your repo's own rules | ✗ | ✗ | ✗ | ✗ | ✓ |
| Honest about the unknown — never "safe" when unseen | ✗ | ✗ | ~ | ~ | ✓ |
✓ yes · ~ partial / with setup · ✗ no.
It reads your code with Python's own parser and reports what's there — it never runs it, and never guesses. Every finding traces to a file:line, so there's nothing to fact-check.
A tool that wrongly says "all clear" ships the bug. Lenscheck fails toward look here — ✓ / ⚠ / ? — and never renders "didn't see it" as "it's safe."
Facts are matched on the URL route, not class names. Rename every class in the repo and a pure refactor produces zero noise — so the real change stands out.
It learns the promises your codebase already keeps and flags the PR that breaks one. That confirmed corpus is yours — the piece a competitor can't clone.
It doesn't replace your tests or type-checker — it sees a different layer: behavior at the endpoint, and whether a change broke a promise.
Deterministic and free in beta. Review a pull request in under a minute — your source never leaves your machine, only an abstract facts graph.