This is the follow-up for anyone already running CodeAnt AI on a real repo. The default config is tuned for a generic codebase; yours is not generic.

Why does CodeAnt AI comment on files you never touch by hand?

Because it scans every changed file, including bundled output. If a build artifact, lockfile or generated schema lands in a PR, CodeAnt treats it as source. That produces a wall of duplication warnings nobody can act on.

The fix lives in .codeant.yaml at the repo root:

ignore:
  - "dist/**"
  - "**/*.min.js"
  - "package-lock.json"
  - "migrations/**"
severity_threshold: medium

Commit that file and the next PR inherits the rules. Start by ignoring three directories — build output, vendored code, migrations — then add more only when a specific path proves noisy.

Which severity level should you set?

Set the threshold to medium on a codebase that already has a linter, and low only on legacy repos where you want the full sweep once. Here is the practical trade-off:

Most teams land on medium and stay there. High is tempting but lets duplication slide, and duplication is where the real decay starts.

How does CodeAnt AI remember dismissed findings?

When you dismiss a comment, CodeAnt records the finding fingerprint — rule plus code context — and stops reposting it on future runs. This matters because a reviewer who has to dismiss the same null-check warning five times will stop reading the bot.

Two caveats. First, the memory is per repo, so a monorepo with shared utilities may still repeat across packages. Second, if the code around a dismissed line changes materially, the fingerprint shifts and the finding returns. That is intentional, but it surprises people.

Should you let CodeAnt AI block merges?

Yes, but only for security findings. Wire the CodeAnt check into branch protection as a required status, then keep bugs and smells as advisory comments. Blocking on style kills velocity for no real gain.

The sequence that works: run advisory for two weeks, review every security finding by hand, then flip security to required once the false-positive rate on your code is clearly under ten percent.

Quick Summary

• Ignore build output, lockfiles and migrations via .codeant.yaml before anything else.
• Use medium severity for active repos; reserve low for one-off legacy cleanup.
• Dismissal memory suppresses repeat findings per repo, not per monorepo package.
• Only make the check blocking for security categories, never for style.
• Run advisory for two weeks before enforcing anything.

It is aimed at small teams that ship fast and cannot afford a senior reviewer on every commit. If you work solo, the value drops sharply — you can already see your own diff.

What does CodeAnt AI actually check?

CodeAnt runs static analysis plus LLM-based review on each changed file. In practice it posts line-level comments for four classes of problems:

• Bugs and anti-patterns — null dereferences, unhandled promise rejections, off-by-one loops.
• Security — hardcoded API keys, SQL string concatenation, weak hashing like MD5.
• Duplication — copy-pasted blocks over a threshold it configures per repo.
• Code smells — functions over 50 lines, deeply nested conditionals.

Each finding shows the rule, the line and a suggested fix you can accept or dismiss. The dismissal is remembered, so the same false positive stops nagging you.

How do you connect CodeAnt AI to GitHub?

Setup takes about four minutes. You do not write any config files.

1. Sign up at codeant.ai with your GitHub account.
2. Install the CodeAnt GitHub App and choose all repositories or a hand-picked list.
3. Turn on Auto Review in the dashboard so new PRs get analyzed without a manual trigger.
4. Optional: add a .codeant.yaml file to the repo root to ignore paths like migrations/**.

After that, every PR gets a summary comment plus inline notes. If a PR introduces a hardcoded secret, the check goes red and blocks merge when branch protection requires it.

Is CodeAnt AI free?

There is a free tier for open-source and public repos, and a paid plan for private repos that is billed per developer per month. Small teams usually start on the free plan, hit the repo limit, then upgrade. The exact trial length and seat pricing change often, so check the pricing page before you roll it out to twenty engineers.

One limitation worth knowing: the free tier only runs a subset of checks on private repos, so security scanning may be paywalled on the plan you first land on.

Where CodeAnt fits and where it does not

It works best as a first-pass filter on high-traffic repos where reviewers are the bottleneck. Teams merging ten or more PRs a day see the cleanest win.

It is a poor substitute for tests. CodeAnt will not tell you the feature is wrong, only that the code is risky. Treat its comments as a checklist, not a verdict. Also expect noise in the first week — review the dismissed findings once and tune the rules, or engineers will start ignoring the bot entirely.

Quick Summary

• CodeAnt AI plugs into GitHub, GitLab and Bitbucket and comments on pull requests automatically.
• It checks bugs, secrets, duplication and code smells at the line level.
• Setup is a GitHub App install plus one toggle — roughly four minutes, no config files required.
• Free for public repos; private-repo plans are per-seat and some checks are gated.
• Best for teams merging 10+ PRs a day; not a replacement for unit tests.

Related reading: pair it with Sweep AI if you want the bot to not just flag issues but open the fix PR itself.