Qodex’s PR review is designed for high-signal feedback on normal pull requests. These limits explain what it reviews today, what it skips, and how to work around common boundaries.
The PR review settings (the Settings tab on Code > PR review, or Settings > PR review) show the effective allowance for the project: how many reviewed pull requests the plan includes a month, how many reviews each pull request can have, and how many pull requests the project has used this month. The Pull requests tab shows the same monthly count in its toolbar.Monthly allowances count distinct pull requests per calendar month in UTC. The whole allowance comes back at 00:00 UTC on the 1st. On the Free PR-review tier, a project can have 20 pull requests reviewed a month and up to two reviews of each pull request.The per-pull-request limit counts every review, whoever started it: a push, a @qodex-ai review comment, or the Run review button. When a pull request has used every review its plan includes, @qodex-ai review answers “Review limit reached” and the Run review button is disabled. On a plan with a hard monthly limit, once the month’s pull requests are used, new reviews are skipped with a neutral “Qodex review skipped: plan limit” Check Run and a comment that says when reviews resume.When the plan includes a set number of pull requests, project members are emailed once when 80% of the month’s included pull requests are used and once when they are all used.Paid or custom plans can have different limits. Use the project’s PR review settings rather than a plan name as the source of truth for the active allowance, and see the pricing page for plan details.
After a review finishes, the Run review button in Qodex waits two minutes before it runs another review on the same pull request. The button counts down the time left. This guards against duplicate clicks and is not a plan limit.
The unified diff is capped at 200 KB before it is sent to the model. A PR that touches a large generated file, a vendored library, or a refactor across hundreds of files will be truncated. The agent is told the diff is truncated and is instructed to focus on what it can see. The walkthrough footer shows diff truncated at 200KB when this fires.What to do: split large PRs when possible. Qodex reviews each PR independently, so two 100 KB PRs get full review coverage where one 400 KB PR loses part of the diff.
Every finding has a confidence score between 0.7 and 1.0. Anything below 0.7 is dropped before it ever reaches your PR. The floor is not tunable per project today.What to know: this is intentional. Qodex optimizes for precision over recall so the PR thread stays useful.
Every review starts with a high-precision pass across correctness, security, performance, maintainability, style, and conventions. On a non-trivial diff that appears clean, Qodex can run a deeper follow-up pass before reporting a clean result. The walkthrough’s What Qodex checked block records the passes and filters that actually ran.What to know: no review is a proof that a change has no defects. Findings are still limited by the available diff, repository context, and configured exclusions.
A review fires on a pull request event or a request, not on a timer. If you change .qodex.yaml and want the new policy applied to an open PR, push a new commit or run @qodex-ai review. The updated policy does not retroactively re-score past findings.
A draft PR is skipped with a neutral Check Run and the reason “PR is a draft; Qodex will review on ready_for_review.” Marking the PR ready for review starts a review.
GitHub rejects inline comments on lines that are not part of the PR diff. Findings that reference a line the PR did not touch move into the walkthrough body under “Findings outside the diff” and are tagged advisory. The author still sees them.
When a finding is anchored on a comment, blank line, import, or brace-only line, Qodex strips the suggestion block and adds an Anchor uncertain badge. The check is conservative because a wrong suggestion can replace the wrong line. The description always still posts.
.qodex.yaml ships with pr_review.block_pr_merge: false. The Check Run conclusion is always neutral until the repo opts in. Even when opted in, only verified findings at or above block_on_severity flip to failure; unverified findings never block.What to know: a fresh repo with no .qodex.yaml will never gate a merge. This is the safe default.
The config file is fetched from the PR head SHA and rejected if larger than 16 KB. A larger file falls back to defaults silently with a logged warning.
A repo over 500 MB cannot be linked. The link POST returns 413 with the message “Repo is MB, exceeds 500MB cap. Subdirectory selection for monorepos is planned for v2.”
A Qodex project can link at most 10 GitHub repos. Hitting the cap returns 409 with “Project already has 10 linked repos (max). Unlink one before adding another.” This cap is per project, not per install.
Verification probes are GET-only today. Every other verb is rejected before any request is made. Non-idempotent probes are gated behind an explicit .qodex.yaml opt-in (probes.allow_non_get: true) and are on the roadmap.
A probe is one GET. There is no multi-step probe, no login-then-probe flow, no probe chaining, and no probe retries. A flaky preview environment marks probes as failed. The finding still posts, just without the verification badge.
Preview deployment must come from GitHub Deployments
Qodex discovers the preview URL through the GitHub Deployments API. Vercel, Netlify, Cloudflare Pages, Render, and Railway all set Deployments by default. Custom CI that does not write to the Deployments API will not be discovered, and probes land as skipped.
Non-GET probes (POST, PUT, PATCH, and DELETE) remain unavailable. They are reserved for preview environments where mutation can be explicitly controlled.
