cubic

You will like cubic for the CLI: it reviews the diff you have not committed yet, and it can be called from Cursor, Claude Code or Codex, so the agent that wrote the code hears what is wrong before you do, and the fix happens in the same session. That is the daily trait: review moves left of the commit. GitHub only for now, which is a hard wall for some teams.

Pick it if GitHub is your host and your code is written by agents you want checked before they push. Pick Bito if you are on GitLab or Bitbucket, where cubic simply is not.

The risk is the write path. Reviews are read-only, but background agents grant the app write access so Claude Code can push fix commits and open pull requests, and a reviewer that can write is a second author with your app's credentials. The privacy page limits that scope to fix branches and says main is never pushed directly, which is the right boundary and also a promise, not a permission you set.

Turn on background agents per repository, not per org, and read the branch protection rules first. What it does right: comments auto-resolve once the code addresses them, so the thread ends when the bug does.

1. The benchmark is Code Review Bench, maintained by Martian, a third party. 2. Reported figures are F1 61.8%, precision 56.3%, recall 68.6%. 3. The source is cubic's own post dated 25 March 2026, so vendor-reported on an external harness, which is credible about the harness and silent about the run. Precision of 56.3% means four comments in nine are not defects; recall of 68.6% means roughly three defects in ten go unremarked.

The consequence is that the tool is better as a net than as a filter. Publishing precision at all is creditable, and the ranking will last until the next vendor's post.

cubic runs the standard playbook: free on public repos so maintainers carry it into their day jobs, and a leaderboard win as the headline for the sales deck. Leaderboards rotate quarterly; distribution compounds annually, and only one of those is a moat. No proprietary data and no switching cost beyond the custom review agents a team has written, which is a small cost and the only one.

Likely acquirer: GitHub, which already owns the surface the comments land on and would rather buy the reviewer than watch it grow. Position: small, watch retention after the free tier ends, and keep the custom agents in your own repo.

The demo is a review comment on a pull request. Procurement: Team is $30 a developer on annual, $40 monthly, so sixty seats is $1,800 or $2,400 a month; Pro at $79 is $4,740, and no meter sits on top, which I appreciate. The security page states SOC 2 Type 1 and AES-256 at rest; Type 1 is a snapshot, not a year, and SSO and retention are not stated anywhere I can cite. Onboarding is a GitHub app install.

Approved with conditions: Type 2 and SSO in writing, and retention terms before any private repository is connected.

I cannot read it or run it at home, bring-your-own keys is gated to Enterprise, and there is no MCP client or server, so my tools cannot talk to it and it cannot talk to mine. What I get: curl -fsSL https://cubic.dev/install | bash or npx @cubic-dev-ai/cli install -g puts a reviewer in my terminal, and custom review agents are plain text that encode my rules instead of the vendor's, versioned with the code.

That is a rented reviewer with a decent command line and a rules file I own. Nothing forks, and the day the CLI changes its endpoint the binary is a paperweight.