On this page
For pull request risk assessment, CodeScene is the established paid choice, Sonar quality gates and Codecov cover rules and coverage, and CodeRabbit or Greptile add model-written review comments. For a deterministic risk score plus the files and tests a change should touch, repowise risk and its GitHub PR bot do that from git history with no LLM. Blast radius needs a dependency graph, and only some of these tools build one.
Vendor facts below are as of November 2026, from each vendor's own pages linked in the text.
| Tool | What it gives you on a PR | Risk score | Blast radius | Model in the loop |
|---|---|---|---|---|
| CodeScene | Code health review and quality gates | Code health gate, no numeric score shown | No | No |
| Sonar quality gate | Pass or fail on new code | No | No | No |
| Codecov | Patch and project coverage comment | No | No | No |
| CodeRabbit | Review comments, triage ranked by value and risk | Queue triage by value and risk | No | Yes |
| Greptile | Review comments from a repository graph | No | Graph context | Yes |
| repowise | Risk score, missing co-change files, reaching tests | Yes | Dependency and co-change | No |
Scroll the table sideways to see every column.
We build repowise, so weigh our entry accordingly. The measurements we publish about it, with their methods, are on the benchmarks page.
What a PR risk score and blast radius are
A PR risk score estimates how likely a change is to cause a defect, and blast radius lists what else the change can break. They answer different questions. Risk is about the change itself: its size, its spread across files and how its history looks. Blast radius is about the code that depends on it. See the glossary entries for change risk and blast radius.
CodeScene
CodeScene's pull request integration runs an automated code health review and acts as a quality gate. Its page says it auto-reviews PRs against Code Health standards and can block Code Health decline in hotspots (CodeScene). I could not confirm from the page when it comments or how it scores risk.
Pick CodeScene if you want a commercial product with behavioral analysis and support. It is the closest like-for-like for a PR risk signal. See repowise vs CodeScene for the detail.
Sonar quality gates
A Sonar quality gate is a set of conditions that code either passes or fails. The default "Sonar way" gate on new code requires no new issues, reviewed security hotspots, at least 80.0% coverage and at most 3.0% duplication (Sonar docs).
Pick Sonar if you want a hard pass or fail on rule violations. It does not score how risky a change is or what it affects.
Codecov
Codecov posts a pull request comment with patch coverage, the share of changed lines that tests cover. It also shows the project coverage change and impact per flag and component (Codecov docs).
Pick Codecov if your main question is whether a change shipped untested. Pair it with a risk tool, since coverage alone does not say how fragile the files are.
CodeRabbit and Greptile
CodeRabbit and Greptile review the diff with a model and comment on what they find. CodeRabbit supports GitHub, GitLab, Azure DevOps and Bitbucket and has a triage feature that prioritizes the PR queue by value and risk (CodeRabbit docs). Greptile reviews each pull request using a graph of the repository and supports GitHub, GitLab and Bitbucket among others (Greptile docs).
Pick them if you want written, model-driven review. Their output is findings, not a repeatable risk number or a list of dependents. Costs and the full field are in best GitHub PR review bots.
repowise change risk and the PR bot
repowise risk scores a commit, a base..head range or uncommitted work against the repository's own history. It also lists files that usually change together with the diff but are missing from it, and the tests that reach the changed code. The MCP tool get_change_risk returns defect, maintainability, performance and test-coverage signals for the changed lines, so a coding agent can check its own work before opening a PR. No LLM call is involved. Details are in the change risk docs and on the change risk feature page.
uv tool install repowise
repowise init
repowise risk HEAD~1..HEAD
The PR bot applies the same deterministic review on GitHub, stays silent on a clean pull request and reports its verdict as a check run on the pull request. The PR bot runs on GitHub; indexing and CI gates work on GitLab, Azure DevOps and Bitbucket. In a workspace of several repositories, blast radius is also computed across repo boundaries. The engine is open source under AGPL-3.0 and self-hostable, which suits air-gapped and many-repo setups. How the bot works without a model is in deterministic PR review bot, no LLM.
Pick repowise if you want a repeatable score from your own history, co-change and test gaps in one place, or one check that runs locally, in CI and in agents.
How to choose
- Individual developer: run
repowise riskbefore pushing; add Codecov if you publish coverage. - Team on GitHub: the repowise bot for a risk check, plus Sonar or CodeScene if you need a formal gate.
- Team on GitLab, Azure DevOps or Bitbucket: CodeScene or CodeRabbit for the PR surface; run repowise in CI.
- Enterprise: self-host the engine, add a gate on risk and patch coverage, and use workspace blast radius for contract changes across services.
- Hotspot background: the git hotspot guide explains why churn plus complexity predicts defects.
FAQ
- What is a pull request risk score?
- A pull request risk score is one number estimating how likely a change is to introduce a defect, usually from its size, spread and the history of the files it touches. repowise computes it against the repository's own commit history.
- What is the difference between blast radius and risk?
- Risk describes the change itself. Blast radius describes the code that depends on it and could break, found through the dependency graph and co-change history.
- Which tools show code change blast radius?
- Tools that build a dependency graph: repowise from its code graph and co-change data, and Greptile from a repository graph used as review context. Rule-based gates like Sonar and Codecov do not show dependents.
- Which git hosts does repowise support?
- The PR bot runs on GitHub; indexing and CI gates work on GitLab, Azure DevOps and Bitbucket. On those hosts, run
repowise riskand the CI gates in your pipeline. - Is the repowise risk score generated by an LLM?
- No. It is computed from git history, the code graph and test reach, with no model call.