The annoying thing about a code-review bot is that it can be completely correct and still make your day worse. It finds a bug, writes a paragraph, and leaves. You copy the suggestion, open the branch, make the edit, push again, and wait for the test suite to render judgment. The bot has contributed information. You have inherited a chore. Gitar, a San Mateo company founded by veterans of Uber's developer-platform organization, built its pitch around that handoff. Its agent reviews a pull request, diagnoses a failed build, makes or proposes the change, commits it, and sends the result back through continuous integration. The claim is not that artificial intelligence can write code. Plenty of companies sell that. Gitar sells the part where someone asks whether the code deserves to ship.
That distinction became unexpectedly valuable. Gitar launched in 2023 as a broader end-to-end development platform. By 2025, it was talking about Jimy, expert agents, program transformation, migrations, dependency work, and a persistent knowledge graph of the codebase. The ambition was expansive: a reusable team of specialists that could remember a company's conventions and maintain software across its life. Then generative coding accelerated. More pull requests arrived; review queues and CI failures became the tax on all that speed. The company sharpened its public product around a more immediate job: code review that fixes what it finds and validates the repair.
The bottleneck moved to the right
Founder and CEO Ali-Reza Adl-Tabatabai had spent decades in compilers, reliability, and developer infrastructure at Intel Labs, Google, Meta, and Uber. Co-founder and CTO Gautam Korlam was Uber's ninth mobile engineer, helped build its mobile platform, and later worked on developer productivity at monorepo scale. Raj Barik, named alongside them in the original launch announcement, was the third co-founder. Their founding observation was practical rather than mystical: good internal tools create leverage, but most businesses cannot dedicate an Uber-sized platform organization to assembling them.
AI changed the arithmetic. If producing a patch takes minutes, the scarce resource becomes senior attention - reading it, finding the buried assumption, understanding the failed test, and deciding whether a green build is meaningful. Adl-Tabatabai described the result neatly: generation produces code; validation makes it trustworthy. Gitar placed itself after the coding assistant and before the merge button.
The product loop
In practice, Gitar installs into GitHub or connects to GitLab. It watches pull-request activity, reviews for bugs, security problems, performance, edge cases, and maintainability, and maintains a dashboard comment inside the existing thread. If CI breaks, it reads the logs, groups duplicate failures, distinguishes likely flakiness from a change-induced problem, and can push a fix. Developers can ask questions or request changes in natural language. Repository rules turn instructions such as “add tests for new functions” or “link the relevant Jira ticket” into repeatable checks.
A bot with permission to be quiet
The obvious danger is comment confetti. Automated reviewers can be technically busy and socially useless, carpeting a pull request with generic suggestions until developers learn to ignore all of them. Gitar's response was a design constraint: one living dashboard comment, the most consequential information at the top, inline comments reserved for actionable lines, and stale findings resolved as the code changes. The agent can move its dashboard comment after important events so the current state remains visible. It can also say nothing.
“Silence is a feature. Every comment Gitar posts should earn its place.”Gitar engineering blog, March 2026
That principle produced the most instructive failure in Gitar's public engineering notes. Its first “Judge” guardrail used several specialist agents for duplicate detection, content filtering, and relevance. The architecture was tidy in a diagram. In use, coordination overhead piled up, and tracing why a comment disappeared meant investigating three decision-makers. The team collapsed the committee into one agent, one pass, and one explainable outcome. What changed their mind was not an abstract preference for simplicity. It was the inability to debug a missing comment quickly.
There is a stealable playbook here even for teams that never install Gitar: keep automation in the interface where the work already happens; consolidate status instead of appending updates; rank messages by consequence; remove output after it becomes stale; and force machine changes through an external check. Most AI products compete on how much they can produce. A trusted workplace tool is often defined by what it declines to produce.
What it costs - and who pays
Gitar's business is subscription software. Core includes customizable reviews, summaries, native GitHub Actions and GitLab Pipeline analysis, comment-requested fixes, and developer insights. Pro adds automatic fixing until a pull request is green, merge controls, natural-language checks, richer integrations, and CI support including CircleCI, Buildkite, and Bitrise. Enterprise contracts add unlimited users, SSO, audit logs, APIs, custom deployment, self-hosted code-hosting support, and the option to bring an LLM key. Qualifying open-source projects get Pro features free.
The natural buyer is an engineering, platform, DevOps, or application-security leader whose team already lives in pull requests and whose review load is growing. Public references include SoFi, Altruist, Shef, Revyl, Kumojin, Sphinx, Collate's OpenMetadata project, and Uber's Cadence project. Altruist's engineering manager described deployment across more than 130 engineers and 1,100 repositories; SoFi highlighted faster time to merge in mobile CI. These are customer statements, not controlled trials, but they show the market Gitar wants: teams large enough that a few saved interruptions multiply.
Gitar's own 1,000-PR intervals
The company also tested its thesis on itself. It reported that the time to merge successive blocks of 1,000 pull requests fell from 80 days before agents, to 44 with early agents, to 15 after a full Expert-agent rollout. That is the source of its 5x throughput claim. It is useful directional evidence and unusually concrete startup dogfooding data. It is not proof that another team will receive the same multiplier.
A crowded market, one extra step
CodeRabbit, Greptile, Cursor BugBot, Graphite, and Copilot compete for pull-request attention.
SonarQube and static-analysis systems find known classes of quality and security defects.
Platform teams stitch CI scripts, linters, retry logic, bots, and issue trackers together.
Contextual review plus diagnosis, write access, and another trip through CI.
The alternatives are plentiful. CodeRabbit and Greptile sell AI review; Cursor BugBot and GitHub Copilot bring review closer to code generation; Graphite combines review with a broader pull-request workflow. Static analyzers and homegrown scripts remain the sober incumbents. Gitar's difference is less a magical model than ownership of one additional step. It does not merely recommend a repair. It can make the repair and stay around for the build's response.
That also explains the acquirer. In April 2026, Gitar emerged from stealth with $9 million led by Venrock and joined by Sierra Ventures. Five weeks later, Sonar announced it had acquired the company. Terms were not disclosed. Sonar framed the combination as two forms of skepticism: SonarQube applies deterministic, auditable analysis against known patterns; Gitar reads the codebase and the intent of a particular change, then participates in the messy loop of discussion and repair. Gitar remained available as a standalone product, with the boundary between the services expected to blur over time.
Where the loop breaks
Auto-fix is only as convincing as the gate it reruns. Weak tests, flaky infrastructure, unclear policies, restricted repository access, or changes whose correctness depends on human product judgment can turn a green check into false comfort.
The condition hidden inside “until green”
Gitar is least persuasive where software work is not testable, builds are not reproducible, or an organization cannot give an outside agent read-and-write access. Its documentation says cloud jobs use ephemeral environments and enterprise customers can run the agent inside their CI infrastructure, but security review and governance still matter. The software also cannot manufacture a meaningful specification from silence. A test suite can certify that expected behavior still passes; it cannot prove that the expected behavior was wise.
The right operating condition is a repository with decent tests, observable CI, clear ownership, and engineers willing to supervise exceptions. Under those conditions, Gitar can remove the mechanical middle of code review: log archaeology, duplicate failure triage, branch switching, small repairs, and status narration. Under weaker conditions, it risks automating the appearance of certainty. The founders' own acquisition note makes the distinction: a passing build proves compilation and tests, not intent. Sonar's deterministic checks add another layer, but human judgment does not evaporate merely because the checks turn green.
Gitar's story is therefore less about replacing the reviewer than repricing attention. Code became cheaper to draft. Review, diagnosis, and trust became dearer. The company found a compact workflow where an agent could do more than talk, charged by the seat, measured the result on its own repository, and sold itself to a company whose entire business is asking code to show its work. The reusable insight is almost stubbornly plain: follow a new technology one step downstream. That is often where the bill lands.