Runtime code review that tests each GitHub pull request in a live, single-use copy of your app
Ito is an AI code review agent for GitHub teams that tests every pull request by running the app in a real browser.
AI Panel Score
6 AI reviews
Reviewed
Ito is an AI code review agent that tests GitHub pull requests by building the app in a single-use container and exercising the affected user flows in a real browser. It is built for engineering teams whose pull-request volume, much of it written by AI coding agents, has outgrown manual verification. A free trial covers the first 20 reviews, Pro starts at $40 per seat per month, including 50 reviews per seat, and Enterprise is quote-based. Each run plans tests from the diff, covers happy-path, edge-case and adversarial scenarios, and posts failures on the PR with severity ratings, video replays and reproduction steps. TopReviewed's six-seat AI review panel scored it 8.1/10, praising that only bugs a pull request introduced fail the run while noting that each review takes 30 minutes to two hours. It fits GitHub teams that want a runtime check alongside static code review; Ito publishes comparisons with CodeRabbit and Cursor Bugbot.
Ito installs as a GitHub App. Once an admin connects a repository, every eligible pull request opened or updated by a team member with an assigned seat starts a test run: Ito provisions an isolated, single-use container, builds the app from source, and reads the diff, the PR description and any linked ticket to work out which user journeys the change puts at risk. AI agents then open the app in a real browser and work through those flows as a user would, signing in, filling in forms, moving between pages and covering desktop and mobile viewports. Plans mix happy-path, edge-case, adversarial, logic, accessibility, mobile and UX cases, and nobody writes or maintains test scripts or selectors. A review typically takes between 30 minutes and two hours, and the container is destroyed when the run ends.
Results land in the pull request itself. A summary comment lists the test cases that ran, failures tied to changed code also get an inline comment on the relevant diff line, and each failure carries a severity rating of Critical, High, Medium or Minor, a video replay that jumps to the moment of failure, screenshots, numbered reproduction steps and a code analysis naming the files and line ranges at fault. Ito checks whether each problem was introduced by the PR or already existed in the base branch; only PR-attributable failures decide pass or fail. Pushing a fix triggers a re-run, and with incremental review enabled, later commits get a diff report that separates retested cases from ones carried forward. Teams steer coverage with plain-English Test Instructions scoped to repositories or PR authors, supply variables, browser-encrypted secrets and seed data such as test-account logins, and Ito weights future plans toward the bug classes a team actually fixes, while findings a reviewer dismisses are not reported again.
Ito is aimed at engineering teams whose pull-request volume, much of it now written by AI coding agents, has outgrown manual verification, and at QA teams that want regression runs handled so they can focus on exploratory testing. It tests web apps and APIs on any framework, including React, Vue, Next.js, Rails and Django; native mobile apps are on the roadmap rather than supported. Pricing is per seat: a free trial covers the first 20 reviews without a credit card, Pro costs $40 per seat per month with 50 reviews per seat included and $1 for each additional review, Enterprise is quoted for teams of 25 or more engineers, and qualifying non-commercial open-source projects under MIT or Apache licenses can apply to use it free. Ito publishes comparison pages against CodeRabbit, Cursor Bugbot, Greptile, Qodo, Claude Code Review and the testing platform Mabl, addresses script-based frameworks such as Playwright and Cypress in its FAQ, and positions itself as a runtime check that sits alongside static code review rather than replacing it.
Alongside per-PR review, Ito records a short happy-path demo video of user-visible changes and posts it with the results, runs smoke tests on a schedule, from a GitHub workflow or on demand, and full bug-bash sweeps before a release, and offers managed sandboxes that give coding and security agents a live copy of the app to build and test against; a self-healing mode that opens fix pull requests for small, well-scoped bugs is in private alpha for paying customers. Sign-in uses GitHub OAuth at app.ito.ai, and GitLab support is listed as coming soon. Per-repository settings mark a repository Active, Silent (results stay in the dashboard) or Paused and decide whether draft and bot-authored pull requests are reviewed, and the dashboard tracks PRs tested, bugs by severity and bug detection rate over time. Secret values are encrypted in the browser with a 4096-bit RSA-OAEP key before storage and redacted from uploaded logs, and Ito reports SOC 2 Type II compliance.
Builds a per-repository profile from resolved findings and reviewer feedback to steer coverage toward the bug classes a team fixes, and stops re-reporting findings a reviewer has dismissed.
A dedicated demo agent records a clean happy-path walkthrough of a pull request's user-visible changes, with chapters, and links it from the PR comment.
AI agents open the running app in a real browser and work through affected flows like a user, signing in, filling forms, navigating pages and triggering backend calls on desktop and mobile viewports.
For small, well-scoped bugs it finds, Ito opens a pull request with a proposed fix and re-runs the failing test to confirm it; currently in private alpha for paying customers.
Reads the diff, PR description and any linked ticket to map a change to the user journeys it puts at risk, then builds a plan of happy-path, edge, adversarial, logic, accessibility, mobile and UX cases with no scripts to write.
Shows PRs tested, bugs by severity and bug detection rate for the last 7, 30 or 90 days or all time, with filters by PR state, author and repository.
Rates every failure Critical, High, Medium or Minor and separates issues introduced by the PR from pre-existing ones, which are listed as additional findings without failing the run.
Re-tests the affected scenario after a fix is pushed and, with incremental review on, reports later commits as a diff that separates retested cases from ones carried forward.
Sets each repository to Active, Silent or Paused, toggles review of draft and bot-authored PRs, and lets engineers request a one-off draft review by commenting @itoqa.
Runs regression sweeps across a release nightly, from a GitHub workflow or on demand, and full bug-bash sweeps of a feature's critical flows in parallel before launch.
Mocks external dependencies such as payment processors, email and analytics by default so they do not cause flaky results, with the option to supply real sandbox credentials instead.
Builds a fresh, isolated copy of the application from source for every pull request, runs the tests against it and destroys the container when the run ends.
Plain-English guidance, scoped to repositories or PR authors, that tells Ito which flows to prioritise, treat as requirements or skip when it builds a test plan.
Deploys a managed, single-use, fully built copy of the app that coding and security agents can use to build, test or run pentests against real services.
Posts a summary comment on the GitHub pull request plus inline comments on the affected diff lines, each failure carrying a video replay, screenshots, reproduction steps and the implicated files and line ranges.
Per-repository environment variables, secrets encrypted in the browser with a 4096-bit RSA-OAEP key, and seed data such as test-account credentials so agents can test authenticated flows.
Self-serve plan for startups and small teams at $40 per seat per month; each seat includes 50 code reviews per billing period and additional reviews cost $1 each. Starts with a free trial of 20 reviews, no credit card required.
Quote-based plan for teams of 25 or more engineers; the pricing page lists Custom with a Talk to Sales button instead of a figure.
Free for qualified non-commercial open-source projects with MIT or Apache licenses, available to approved projects only.
Ito fails a pull request only for bugs that PR introduced, which makes it a gate worth keeping.
“Ito separates bugs a pull request introduced from ones already in the base branch, and only the new ones fail the run. It runs beside a code reviewer rather than replacing one, at $40 per seat with 50 reviews included.”
Ito won't fail a pull request for a bug that was already there. Pre-existing problems land as Additional Findings on the same severity scale, and only bugs the PR introduced decide pass or fail. That's what keeps a merge gate from turning into noise engineers click past.
Budget it beside your code reviewer, not instead of one. Ito's own Cursor Bugbot page calls them two layers, one reading code and one running the app. The board questions have answers too: SOC 2 Type II, browser-encrypted secrets, and a changelog running from v1.0.1 in May to v1.2.17 in August.
The catch is reach. It's GitHub-only, with GitLab listed as coming soon, and custom DPA terms wait for Enterprise at 25 engineers. Spend the 20 free reviews on one busy repo, then buy $40 seats only if findings get fixed rather than dismissed.
It builds and runs the app for every pull request, the layer Ito's own comparison says diff readers such as Cursor Bugbot don't cover.
Code isn't kept after the run, secrets are encrypted in the browser and SOC 2 Type II is reported, but custom DPA terms are Enterprise-only from 25 engineers.
The pricing page promises first results within about 60 minutes of install, though each later review takes 30 minutes to two hours.
It adds a runtime check for teams whose pull-request volume, much of it from coding agents, has outgrown manual verification.
The changelog runs from v1.0.1 on May 4 to v1.2.17 on August 27, 2026, beside a full docs site and a complete public pricing page.
Engineering leads who merge a heavy stream of agent-written pull requests.
Teams whose repositories live on GitLab.
Ito's PR reviews ride on a managed build of your app, which is the real three-year bet.
“Ito builds a single-use copy of the app from source for every pull request, and Agent Sandboxes offer the same kind of copy to coding and security agents. The coverage it accumulates lives in Test Instructions and a learned per-repository profile rather than in test code your repo owns.”
Strip out the PR comments and Ito is an environment service. For every pull request it builds a single-use copy of your app from source, and Agent Sandboxes offer the same kind of copy to coding and security agents. That second use is what I'd weigh over three years.
A faithful copy of the stack is the job platform teams never finish. Ito's sandbox page says it maintains the builds, integrations and services, and the first environment build takes roughly 60 minutes. If that holds, you get runtime checks beside static review without owning another staging fleet.
The catch is where test knowledge lives. A Playwright or Cypress suite sits in your repo; Ito's coverage sits in Test Instructions, which the docs call experimental, and a profile learned from your fixes. Pilot it, but plan the exit before it's your only end-to-end layer.
It executes the app where diff-reading reviewers only read code, and it drops the script upkeep that Playwright or Cypress suites carry.
Findings arrive as GitHub summary and inline diff comments naming files and line ranges, which is where engineering review already happens.
It hooks into GitHub pull requests and workflows and extends to coding agents through Agent Sandboxes, but I couldn't find a public API reference in the docs.
Coverage accumulates in Test Instructions and a learned per-repository profile inside Ito, so leaving means rebuilding that knowledge elsewhere.
It builds each pull request from source in a single-use container, plans cases from the diff and linked ticket, and mocks third-party services by default.
Engineering leaders who want runtime PR checks without maintaining test environments.
Teams who require their end-to-end tests to live as code in the repo.
$40 a seat covers 50 reviews, and new organizations review bot PRs by default.
“Twenty engineers on Pro cost $9,600 a year before overage, which runs $1 per review past each seat's 50. Per-engineer overage caps and monthly Stripe billing keep the downside bounded.”
Who pays for Dependabot's pull requests? The changelog shows new organizations review bot PRs by default. I couldn't find which seat those runs bill against. Check the Bot PRs toggle in Automation Settings first.
Pro is $40 per seat monthly, 50 reviews included. Twenty engineers: 20 × $40 × 12 = $9,600 a year. However, the changelog says successful re-runs count as reviews. At 70 runs per engineer, that's 400 extra. $400 a month at $1 each. Three years: $28,800 in seats plus $14,400 overage. $43,200.
Admins can cap overage per engineer. Presets are 10, 25 or 50. Contributors can get emails at 80% and 100% of included usage. The dashboard tracks bug detection rate. That's your ROI line. Billing is monthly through Stripe. Custom invoicing sits on Enterprise, quote-only from 25 engineers.
Self-serve Stripe billing with downloadable invoices, while custom invoicing and payment terms need an Enterprise quote.
Monthly subscriptions cancel from the web app effective the next cycle, but refunds are at the vendor's discretion.
The pricing page lists $40 per seat, 50 included reviews and $1 overage, but the Terms of Service still quote a $150 monthly plan.
The dashboard tracks PRs tested, bugs by severity and bug detection rate over 7, 30 or 90 days.
Twenty seats cost $28,800 over three years before overage, and successful re-runs count toward each seat's 50 reviews.
GitHub teams under 25 engineers who want runtime PR testing at a public price.
Finance teams who need a fixed monthly bill with no usage charges.
Ito's diff report ranks new failures and regressions above anything still broken from the last run.
“On follow-up commits, Ito posts a diff report that separates cases run on this commit from ones carried forward, and its Origin column puts new failures and regressions first. The catch is that carried-forward cases rest on Ito's reading of the diff, and a push mid-run cancels a run that can take two hours.”
"Ran this commit" heads Ito's diff report on a follow-up push, and the docs indicate that count covers only cases that actually executed. Cases Ito judged untouched by the diff sit on a second line, carried forward from the prior run. They don't pad the green.
Under that, the Origin column sorts failures by actionability: New, then Regression, then Still broken, verified before inherited. Bugs already on the base branch go to Additional Findings and don't fail the run. Good sign. CodeRabbit comments on what the diff says; this comments on what the running app did.
The catch is that carry-forward rests on Ito's reading of the diff, so a flow it wrongly skips stays listed as an inherited pass. Timing matters too: their pricing page puts a run at 30 minutes to two hours, and a push mid-run cancels it. Batch fixups.
Follow-up commits get a triage-ordered diff report, but each run still takes 30 minutes to two hours.
The PR Comments page explains the diff report's Origin column and its sort order the way a reviewer would triage it.
A push mid-run cancels a run that can take two hours, and successful re-runs count against the 50 reviews included per seat.
Test Instructions scoped by repository or PR author, seed data, and Active, Silent or Paused repository modes give real room to tune.
It lives inside GitHub review, with summary and inline comments, an eyes reaction while it runs and @itoqa for one-off draft runs.
Reviewers who triage several commits on the same pull request.
Teams who push fixups faster than a run can finish.
Ito films a chaptered demo of your PR, but signed-in flows want test accounts from you first.
“Ito records a chaptered demo video of a pull request's visible changes and pairs every failure with a replay and repro steps. Testing signed-in flows means supplying seed data and test-account credentials per repository.”
Chapters. Ito's Product Demo Videos come with chapters. A separate demo agent walks the happy path of whatever your PR changed, and the changelog says PR pages with one now open straight to it. That's a review your PM can do without pulling a branch.
Failures get the same care. Replays jump to the moment something broke, with numbered repro steps, the lines likely at fault, and a severity from Critical down to Low. Dismiss a finding and it doesn't come back. Month three, it's steering plans toward the bug classes your team actually fixes.
The catch is anything behind a login. No scripts doesn't mean no setup: signed-in flows want seed data like test-account credentials, plus variables and secrets, entered per repository. Spend a few of the 20 free reviews getting that right.
Demo videos come with chapters, replays jump to the moment of failure, and dismissed findings don't come back.
Day one needs no test scripts, and later test plans lean toward the bug classes your team actually fixes.
Results live in GitHub comments and a web dashboard, and I couldn't find a native app, which a PR tool rarely needs.
GitHub sign-in and 20 free reviews with no card are easy, but first results take about 60 minutes and logins need test accounts.
The docs say run status updates without a refresh and comments retry on network errors, but I can't judge day-to-day stability from outside.
Web teams who want to watch each PR work before merging.
Teams who can't share test-account credentials with an outside service.
Ito's homepage claims both 50% and 70% fewer regressions, so trust DoltHub's 43-PR write-up instead.
“Ito's marketing overreaches: it promises to catch all runtime bugs and puts a private-alpha Self-healing Codebase first in its features menu. The docs and a six-week DoltHub write-up are more candid, though 26 of 43 tested PRs there carried pre-existing findings someone had to triage.”
Ito's homepage talks louder than its docs. The headline promises to catch all runtime bugs. The stats banner says 50% fewer regressions; the FAQ below says 70%. Self-healing Codebase leads the features menu, yet it's a private alpha for paying customers, and its testimonials carry titles, not names.
The quieter pages are straighter. Exploratory testing still belongs with humans, the pricing page admits. Base-branch bugs land under Additional Findings instead of failing your PR. DoltHub's six-week customer write-up keeps the warts: a stale-binary false alarm, since fixed, and comments that didn't warrant action.
That candour beats any percentage. But 26 of DoltHub's 43 tested PRs surfaced pre-existing findings, and Ito's own recap concedes not all were confirmed bugs. Useful, maybe. Also triage. Budget reviewer hours next to the $40 seat. The product looks real. The homepage math doesn't.
Building and running the app on every PR separates it from diff-reading reviewers, though its own Mabl comparison concedes other QA platforms also drive a real browser.
Findings stay in GitHub as PR comments and monthly plans cancel from the web app, but no test scripts come with you when you leave.
Versioned changelog entries landed about twice a week from May to late August 2026, and support and security contacts are published.
The homepage promises all runtime bugs and quotes both 50% and 70% fewer regressions, while the pricing page and docs state their limits plainly.
DoltHub's own six-week write-up backs the core claim with runtime-found SQL bugs and more than twice as many confirmed findings as dismissed ones.
Teams who want a reproducible failure attached to every PR finding.
Teams who need native mobile app testing today.
Common questions answered by our AI research team
Ito Pro costs $40 per seat per month and includes 50 code reviews per seat, with each extra review billed at $1. The first 20 reviews are free with no credit card, and Enterprise pricing is custom for teams of 25 or more engineers.
No. Ito builds a test plan from the pull request diff, its description and any linked ticket, then runs it in a real browser. Plain-English Test Instructions can prioritise or skip scenarios, but there are no scripts or selectors to maintain.
Setup takes a few minutes: sign in at app.ito.ai with GitHub, install the Ito GitHub App and connect a repository. Ito then needs roughly 60 minutes to build the environment and post results on the first pull request.
No. Ito builds each pull request in a single-use container that is destroyed after the run, so code does not persist. Secret values are encrypted in the browser before storage, and Ito reports SOC 2 Type II compliance.
Not yet. Ito runs as a GitHub App, signs users in with GitHub OAuth and posts results as GitHub pull request comments. GitLab support is listed as coming soon in the setup documentation.
Who Ito competes with, and how each one differs
CodeRabbit reviews pull requests by reading the diff and posting context-aware line comments; Ito instead builds and runs the application in a sandbox to catch bugs that only appear at runtime.
Qodo generates and maintains test suites and reviews code changes with AI agents; Ito skips scripted tests, executing the actual application per PR to produce video and log evidence instead.
Greptile analyzes a team's full codebase to write context-aware PR review comments without executing the code; Ito complements that static read by building and running the app for each pull request.
Cursor's Bugbot flags likely bugs inside the Cursor editor by reasoning over the diff; Ito runs independently of any editor, building and executing the full application on every PR regardless of where the code was written.
Anthropic's Claude Code can review pull requests by reasoning over the diff and surrounding codebase; Ito instead builds and runs the application in an isolated environment, testing behavior rather than reading code.
Mabl is a low-code UI test automation platform where teams build and maintain their own regression test suites; Ito requires no test scripts, generating and executing tests automatically from the PR diff in a fresh environment on every pull request.
Company
Ito Inc.Pricing
From $40/moFree Trial
AvailableFree Plan
AvailableIto Inc. makes Ito, an AI code review tool that builds and runs a pull request's application in an isolated sandbox to catch runtime bugs static review misses.
