Devin Review: Cognition's AI code review tool, and how it works

What is Devin Review?

Devin Review is a review screen for pull requests, built into the Devin web app. Cognition introduced it in Devin Review: AI to Stop Slop, arguing that coding agents now open more pull requests than people can carefully read. It works on any pull request, whether a person or an agent wrote it.

It's one of four products under the Devin name, next to Devin Cloud, the Devin CLI and Devin Desktop. What is Devin AI? covers the whole family.

How do you open a pull request in Devin Review?

There are four ways in, according to the docs:

• The web app. app.devin.ai/review lists your open pull requests: assigned to you, written by you, or waiting on your review.
• The URL swap. Replace github.com with devinreview.com in any GitHub.com pull request link. Public pull requests don't need a Devin account. Private ones do.
• A PR comment. Comment /devin review on a pull request in a connected repo. On GitHub this needs write or admin access, and since October 16, 2026 it also works on GitLab merge requests.
• Pasting the link. For GitHub Enterprise and Azure DevOps, paste the full pull request URL into app.devin.ai/review.

The launch post also offered a command, npx devin-review. Cognition retired it on September 21, 2026, and installed copies "will no longer work". The Devin CLI is a different product, a coding agent for your terminal.

What does Devin Review do with a pull request?

It changes how the diff is laid out, then adds AI findings on top. The docs list these features:

• Diff grouping. Related changes are grouped and ordered by logic "instead of alphabetical order", which is how GitHub shows files.
• Copy and move detection. Code that was moved or copied shows as a move, not as a full delete in one file and a full insert in another.
• Bug Catcher. Findings are labelled by confidence. Bugs are Severe or Non-severe, and flags are Investigate or Informational.
• Security checks. Since September 16, 2026, every review checks for security bugs such as injection, auth flaws, exposed secrets and SSRF. Findings are Critical or Warning, with a CWE identifier where one applies.
• Chat. You can ask about the change with context from the rest of the codebase. Chat can also propose an edit, which you can commit to the pull request's branch.
• GitHub actions. Comments, approvals and change requests sync back to GitHub, and you can merge or close from Devin Review.

It also follows instruction files in your repo, such as REVIEW.md, AGENTS.md and CLAUDE.md.

How do Auto-Review and Auto-Fix work?

Auto-Review runs a review without anyone asking, and Auto-Fix sends the findings to a Devin session that changes the code.

Admins set Auto-Review rules in Settings › Review. A rule starts when a "PR is created" or a "PR is ready", and runs "Only once" or on "Every push". It can be narrowed by repo, author, label, branch, changed files or diff size. Developers can also turn it on for their own pull requests.

Auto-Fix arrived with Devin 2.2 on February 24, 2026. When Devin opened the pull request, findings go back to its session first, and since September 30, 2026 only what it couldn't fix gets posted as comments. On other pull requests, "Auto-fix with Devin" starts a session.

Devin Desktop has a lighter tool for the step before. Quick Review, added on May 6, 2026, checks your local working tree for likely bugs before you open a pull request.

Which Git hosts does Devin Review support?

All the main ones, with GitHub getting the most features. This is the support list in the docs:

How much does Devin Review cost?

At launch, Cognition said Devin Review was "currently free, while in early release". It's now billed through Devin's plans, as Cognition's self-serve billing docs describe:

• Public pull requests on devinreview.com need no account and use no credits.
• The Free plan lists "Access to Devin Review".
• Teams pays for reviews from the team's shared on-demand credits, not from anyone's seat quota. When the credits run out, Devin Review "switches to its smart diff viewer": the grouped diff stays, the AI findings stop.
• Enterprise pays in Agent Compute Units (ACUs), and the docs size a review from XS (up to 2.25 ACUs) to XL (over 18).

Ultra effort reviews are more thorough and cost more than Normal ones. Cognition's docs don't say how reviews count against the Pro and Max quotas. Devin pricing covers the plans themselves.

What are Devin Review's limits?

Cognition doesn't claim it catches everything. An earlier post on automated PR reviews, which now points readers to Devin Review, says "Devin isn't guaranteed to catch every bug" and recommends a human check before merging. The docs say of flags: "You should review the flagged code yourself."

The launch post gives no accuracy numbers. The May 2026 post says only that Devin Review "checks hundreds of thousands of PRs per day", which is a volume figure.

The docs list other limits:

• A diff-only analysis, such as one run after a spend limit pauses auto-review, "is not a completed security review".
• GitHub connections made with a personal access token are read-only. Commenting and merging need the GitHub App.
• Auto-Review doesn't run on public repos that aren't connected to your organization.

Is Devin any good? What reviews say

Many people who search "Devin review" want a verdict on Devin, the coding agent. The most concrete numbers come from Cognition itself. Its 2025 performance review, from November 14, 2025, says 67% of Devin's pull requests were merged, up from 34% a year earlier, and that Devin got "4x faster at problem solving".

The same post lists where it falls short. Devin can't take "an ambiguous coding project end-to-end like a senior engineer could", and it "usually performs worse when you keep telling it more after it starts the task". These are the vendor's own figures, not an independent test. What is Devin AI? explains how the agent works, and Devin alternatives compares it with other tools.

Where Buildful fits

Buildful isn't a code review tool. It's a background coding agent that writes the change itself. You describe a task in the browser, Slack or Linear, and it works in a private cloud sandbox on your GitHub repo, runs your checks, tests UI changes in a real browser with a recording, reviews its own diff, and opens a pull request for you to review. Devin Review is one place you could read that pull request.

Smart Mode picks the right open-weight model for each task, and on Pro and Team you can pick a frontier model like Claude or GPT yourself, with prepaid credit or your own API key. Buildful Pro is $10 a month for 1,000 tasks, or ₹750 in India, and Team is $40 a month for 3,000 tasks shared by unlimited members (₹3,500 in India). See Buildful vs Devin for the two side by side.

Frequently asked questions

Is Devin Review free?

Partly. Reviewing a public GitHub pull request on devinreview.com needs no account and uses no credits, and the Free plan includes access. On Teams, reviews use shared credits, and Enterprise pays in ACUs.

How do I use Devin Review on a GitHub pull request?

Replace github.com with devinreview.com in its URL, or comment /devin review on it in a connected repo. Private pull requests need a Devin account.

Does Devin Review work with GitLab?

Yes. Cognition added GitLab.com and Self-Managed GitLab merge requests on June 19, 2026, including auto-review. Some merge and draft actions are only partly supported.

Can Devin Review fix the bugs it finds?

Yes, with Auto-Fix. A Devin session works through the findings and commits fixes to the pull request's branch.

Is there a Devin Review CLI?

Not anymore. The npx devin-review command was retired on September 21, 2026. The Devin CLI is a separate coding agent for the terminal.

Does Devin Review replace human code review?

No. Cognition's docs tell you to check flagged code yourself, and an earlier Cognition post says a human should still check pull requests before merging.