{"slug": "quoted-1m-for-ai-code-review-built-it-for-free", "title": "Quoted $1M for AI code review. Built it for free", "summary": "Postman engineer built Nitpicker, an open-source AI code review tool, after receiving quotes of approximately $1 million per year for commercial alternatives due to SOC 2 and SSO requirements. The tool, which runs on Lambda and costs about $300 per month, processes diffs with a single model call and has been deployed across roughly 100 repositories, handling a few thousand PRs per day on the busiest one. The author argues that per-seat pricing is disconnected from actual token costs and that owning model choice keeps costs low.", "body_md": "# Quoted $1M for AI code review. Built it for free.\n\nI wanted an AI reviewer on our PRs at [Postman](https://www.postman.com). Catch the dumb stuff. Let humans do architecture.\n\nGot quotes. **~$1,000,000 a year.** Why? We need Soc2 or SSO support 🤷.\n\nFor software that takes a diff, puts it in a prompt, and posts a comment.\n\nI built [Nitpicker](https://nitpicker.dev) instead. Last month's bill: $300.\n\nOpen source.\n\n## Does it even work?\n\nYes. Not how the sales deck says.\n\nIt won't replace your staff engineer. It replaces the **forty minutes before they open the tab.** Your branch rots while someone's in a meeting three timezones away. The bot comments in ~30 seconds. You fix it while the code is still loaded in your head.\n\nIt's also better than you at dull failure modes. Swallowed exceptions. Off-by-ones in a 400-line diff. New endpoint with no auth because the file next to it didn't have one either. Line 340 of your eighth PR today, where your eyes stopped reading.\n\nModels don't get bored. That's the whole product.\n\nAnd every convention living in one senior's skull — *no DB calls from handlers, every migration needs a rollback, no user IDs in logs* — can be written down once and enforced on every PR forever. Including the ones at 2am. Institutional memory that doesn't take PTO.\n\n## Per-seat pricing is a scam\n\nEvery tool in this category charges per seat.\n\nPer seat. For a thing whose actual cost is tokens.\n\nYour bill scales with headcount. Their cost scales with diff volume. The gap between those two lines is the entire business model, and at a few hundred engineers that gap has six zeroes in it.\n\nIf your pricing is disconnected from your actual cost structure — especially seat-based billing for usage-based work — you are not building a moat. You are building a case study for the person who replaces you.\n\nAI collapsed the cost of \"take input, call a model, return output.\" Half of SaaS is exactly that product wearing a pricing page. The ones still charging like it's 2019 are one weekend project away from irrelevance. Customers can already smell it. The quotes make it obvious.\n\nOwn the model choice and the curve flips. Cheap model for the first pass, expensive one only when it earns it. Provider hikes prices, you change one line. Token prices fall every year — when you own the config, you keep that. When you signed a per-seat contract, your vendor keeps it.\n\nPer-seat is a ratchet. Tokens are a commodity. Buy the commodity.\n\n## Send the diff. That's it.\n\nHalf this category wants to index your monorepo, babysit a vector store, and hurl 200k tokens at a typo fix. Demos beautifully. Slow, expensive, and unnecessary for ~95% of PRs.\n\nNitpicker's default: take the diff. One model call. Structured output. Post comments. Done.\n\nSeconds. A few thousand tokens. Fractions of a cent.\n\nEscalate only when it earns it — big diff, sensitive path, finding outside the window. Otherwise stay cheap. Long tail of cheap reviews subsidizing a handful of thorough ones. Exactly how human review already works.\n\nWe run ~100 repos. Busiest one: a few thousand PRs a day. Full-repo index on all of them and the bill looks like the quote I ran from.\n\nSpeed isn't optional. Four minutes gets muted. Beats your tab switch gets read.\n\n## The bill\n\n| Monitored repos | ~100 |\n| PRs/day (busiest) | a few thousand |\n| Monthly cost | ~$300 |\n| - model tokens | essentially all of it |\n| - compute | a rounding error |\n\nRuns on Lambda. Nothing to keep warm — no index, no vector DB, no control plane. Wake up, 300ms network call, die. Lambda prices that at approximately nothing.\n\nCost is tokens. Tokens are cheap because diffs are small. Every design decision exists to produce this table.\n\n## What's not on the pricing page\n\n**No seats.** Hire fifty engineers. Bill doesn't notice.\n\n**No third party holding your source.** Only thing leaving is the model call you configured, to a provider you already use.\n\n**No SOC 2 rodeo.** Vendor approval to read your source tree: security questionnaire, DPA, legal, procurement, circus again at renewal. Weeks of somebody's life, annually, before a single line gets reviewed. Self-host it and that workstream vanishes.\n\n**No lock-in.** Open source. Hate a decision? Fork it. Project dies? You still have a working reviewer.\n\n## Run it wherever\n\nGitHub Action. Lambda. Cloudflare Workers. Any server, container, or sad VM you can point a webhook at.\n\nWebhook handler + model call. It should run anywhere. It does.\n\n## Fight with it\n\nA bot that never answers is a linter with worse aim.\n\nAsk why. Tell it it's wrong. Ask for a fix. Tell it to drop the thread. It engages.\n\nFalse positives get cheap — one reply instead of quiet resentment ending in a deleted workflow file. And every time you explain why it's wrong, you've articulated a rule you should write down. So write it down.\n\n## Teach it your religion\n\nGeneric prompts produce generic feedback.\n\nPer-repo guidelines, checked into the repo. Your payments service and your marketing site should not share a rulebook.\n\nThe system prompt is a file. Not a \"strictness\" slider. Edit it.\n\nMake it terse. Make it patient. Make it paranoid about security. Give it a voice — engineers read comments from something with a personality and ignore `automated-review-bot[bot]`\n\n.\n\nOurs is a nitpicker. On brand.\n\n## The catch\n\nThere isn't one. Free, open source. Pay your model provider for tokens. Nobody else for anything.\n\nWant zero? Point it at Ollama on hardware you own. Quality drops, fine for internal first-pass, and your code never leaves.\n\nBefore you install anything: divide your quote by your actual monthly diff volume. You might not need me at all.", "url": "https://wpnews.pro/news/quoted-1m-for-ai-code-review-built-it-for-free", "canonical_source": "https://sagivo.com/blog/i-was-quoted-1m-to-get-ai-diff-review-tool", "published_at": "2026-08-09 22:07:22+00:00", "updated_at": "2026-08-09 22:34:56.508237+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "generative-ai", "ai-products"], "entities": ["Postman", "Nitpicker", "Lambda"], "alternates": {"html": "https://wpnews.pro/news/quoted-1m-for-ai-code-review-built-it-for-free", "markdown": "https://wpnews.pro/news/quoted-1m-for-ai-code-review-built-it-for-free.md", "text": "https://wpnews.pro/news/quoted-1m-for-ai-code-review-built-it-for-free.txt", "jsonld": "https://wpnews.pro/news/quoted-1m-for-ai-code-review-built-it-for-free.jsonld"}}