Skip to content
Log inStart free trial

Self-hosted and on-premise

Self-hosted AI code review, inside your own network

Self-hosted MergeHarbor runs entirely in your environment: the console, the API, workers, the review agent and the database. Your code, reviews and audit log stay on your infrastructure, and reviews call only the model providers you configure.

Start free trialSelf-hosting guide

14 days of the Team plan, no card needed.

values.yaml (air-gapped)
image: registry: registry.internal:5000/mergeharborairGapped: trueconfig: MODEL_PROVIDERS: openai_compatibleembedder: enabled: trueagent: selfHostedLLM: { baseUrl: http://vllm.models.svc:8000/v1 } reviewModel: selfhosted/qwen-coder

What MergeHarbor does

Your models, your keys
Use the Anthropic API, Amazon Bedrock, or your own OpenAI-compatible server such as vLLM, Ollama or TGI. Only providers you configure are ever called.
Air-gapped networks
Every release has a checksummed air-gap bundle with all images, signed with Sigstore cosign and shipped with an SBOM. With AIR_GAPPED=true, every outbound connection is limited to private addresses.
An offline license
The license key is a signed file checked offline against public keys built into the release. MergeHarbor is never contacted, and it sends no telemetry and makes no update checks.
The same product
Reviews, the merge gate, triage, security scans, Insights and the agent work as they do in MergeHarbor Cloud, with SSO, SCIM, custom roles and the audit log.
Your code hosts, on your network
GitHub Enterprise Server, GitLab Self-Managed, Bitbucket Data Center, Azure DevOps Server, Gitea and Perforce, reached over private addresses.
Sized by one setting
A small, medium or large profile sizes the installation, from a single VM for about 50 developers to Kubernetes for thousands. Very large estates spread repositories across cells.

Three ways to install

  1. Kubernetes with Helm

    For production on EKS, GKE, AKS, OpenShift or any conformant Kubernetes 1.27+ cluster, with your own PostgreSQL 15+ and pgvector.

  2. Docker Compose on one VM

    For small teams, on-premises servers and evaluations. The bundle includes PostgreSQL, an embeddings server and Caddy for TLS.

  3. AWS with Terraform

    For a new AWS account: networking, EKS, Aurora PostgreSQL, S3 and KMS, then the Helm chart.

Read the full self-hosting guide

Sizing profiles

smallUp to about 50 developers. Docker Compose VM: 4 vCPU, 8 GB RAM, 50 GB disk.
mediumUp to about 500 developers. Docker Compose VM: 8 vCPU, 16 GB RAM, 200 GB disk, or two or more replicas with autoscaling.
largeThousands of developers. Kubernetes with three or more replicas and workers sized for large monorepos.
Data residencyCode, reviews, the audit log and embeddings stay in your infrastructure
PlanSelf-hosting is part of the Enterprise plan; evaluation licenses run for up to 45 days
Documentation:Self-hostingInstall with HelmInstall with Docker ComposeAir-gapped installSelf-hosted licensingSizing guide
Guide · 8 min readAI code review security and data privacyWhat an AI code reviewer sends to model providers, what it should never send, who keeps your code and for how long, and the questions to ask any vendor.Read the guide Guide · 8 min readAI code review for monorepos and large repositoriesHow AI code review handles monorepos and very large repositories: folder-level configuration, indexing at scale, large pull requests and the limits.Read the guide

Frequently asked questions

Which models can a self-hosted installation use?

The Anthropic API, Amazon Bedrock, or your own OpenAI-compatible server such as vLLM, Ollama or TGI. In an air-gapped network, open-weight models served by vLLM or Ollama are the tested setup; Claude through Amazon Bedrock in an air-gapped network is not confirmed yet.

Does a self-hosted installation send anything to MergeHarbor?

No. It sends no telemetry and makes no update checks, in any mode, and the license is checked offline. Traces are exported only when you set an OpenTelemetry endpoint.

What happens if the license expires?

Reviews pause; signing in, connecting code hosts and configuring organizations keep working. Paid licenses have a grace period of 14 days unless agreed otherwise. Installing a new key resumes reviews within a minute.

Can we evaluate it on our own infrastructure?

Yes. Ask for an evaluation license. It works like a paid license for up to 45 days, with no grace period. Our engineers can help you deploy and size the installation.

How do embeddings work without internet access?

The Compose bundle includes an embeddings server with its model inside the image. On Kubernetes, run the same server in the cluster or point MergeHarbor at your own OpenAI-compatible embeddings endpoint.

What do we need to back up?

Only PostgreSQL. Repository mirrors and search indexes can be rebuilt from your code hosts.

Have another question? Talk to our team

Plan a self-hosted evaluation

Ask for an evaluation license and access to the release images, or start a cloud trial to see the reviews first.

Contact salesStart free trial