# Self-hosted AI code review, inside your own network Self-hosted MergeHarbor runs entirely in your environment: the console, the API, workers, the review agent and the database. Your code, reviews and audit log stay on your infrastructure, and reviews call only the model providers you configure. [Start free trial](https://app.mergeharbor.com/signup) [Self-hosting guide](https://mergeharbor.com/docs/self-hosting) 14 days of the Team plan, no card needed. values.yaml (air-gapped) ``` image: registry: registry.internal:5000/mergeharbor airGapped: true config: MODEL_PROVIDERS: openai_compatible embedder: enabled: true agent: selfHostedLLM: { baseUrl: http://vllm.models.svc:8000/v1 } reviewModel: selfhosted/qwen-coder ``` ## What MergeHarbor does Your models, your keys Use the Anthropic API, Amazon Bedrock, or your own OpenAI-compatible server such as vLLM, Ollama or TGI. Only providers you configure are ever called. Air-gapped networks Every release has a checksummed air-gap bundle with all images, signed with Sigstore cosign and shipped with an SBOM. With AIR\_GAPPED=true, every outbound connection is limited to private addresses. An offline license The license key is a signed file checked offline against public keys built into the release. MergeHarbor is never contacted, and it sends no telemetry and makes no update checks. The same product Reviews, the merge gate, triage, security scans, Insights and the agent work as they do in MergeHarbor Cloud, with SSO, SCIM, custom roles and the audit log. Your code hosts, on your network GitHub Enterprise Server, GitLab Self-Managed, Bitbucket Data Center, Azure DevOps Server, Gitea and Perforce, reached over private addresses. Sized by one setting A small, medium or large profile sizes the installation, from a single VM for about 50 developers to Kubernetes for thousands. Very large estates spread repositories across cells. ## Three ways to install 1. ### Kubernetes with Helm For production on EKS, GKE, AKS, OpenShift or any conformant Kubernetes 1.27+ cluster, with your own PostgreSQL 15+ and pgvector. 2. ### Docker Compose on one VM For small teams, on-premises servers and evaluations. The bundle includes PostgreSQL, an embeddings server and Caddy for TLS. 3. ### AWS with Terraform For a new AWS account: networking, EKS, Aurora PostgreSQL, S3 and KMS, then the Helm chart. [Read the full self-hosting guide](https://mergeharbor.com/docs/self-hosting) ## Sizing profiles

small	Up to about 50 developers. Docker Compose VM: 4 vCPU, 8 GB RAM, 50 GB disk.
medium	Up to about 500 developers. Docker Compose VM: 8 vCPU, 16 GB RAM, 200 GB disk, or two or more replicas with autoscaling.
large	Thousands of developers. Kubernetes with three or more replicas and workers sized for large monorepos.
Data residency	Code, reviews, the audit log and embeddings stay in your infrastructure
Plan	Self-hosting is part of the Enterprise plan; evaluation licenses run for up to 45 days

Documentation: [Self-hosting](https://mergeharbor.com/docs/self-hosting) [Install with Helm](https://mergeharbor.com/docs/self-hosting-helm) [Install with Docker Compose](https://mergeharbor.com/docs/self-hosting-docker-compose) [Air-gapped install](https://mergeharbor.com/docs/self-hosting-air-gapped) [Self-hosted licensing](https://mergeharbor.com/docs/self-hosting-licensing) [Sizing guide](https://mergeharbor.com/docs/self-hosting-sizing) ## Further reading [Guide · 8 min read AI code review security and data privacy What an AI code reviewer sends to model providers, what it should never send, who keeps your code and for how long, and the questions to ask any vendor. Read the guide](https://mergeharbor.com/guides/security-and-data-privacy) [Guide · 8 min read AI code review for monorepos and large repositories How AI code review handles monorepos and very large repositories: folder-level configuration, indexing at scale, large pull requests and the limits. Read the guide](https://mergeharbor.com/guides/monorepos-and-large-repositories) ## Frequently asked questions Which models can a self-hosted installation use? The Anthropic API, Amazon Bedrock, or your own OpenAI-compatible server such as vLLM, Ollama or TGI. In an air-gapped network, open-weight models served by vLLM or Ollama are the tested setup; Claude through Amazon Bedrock in an air-gapped network is not confirmed yet. Does a self-hosted installation send anything to MergeHarbor? No. It sends no telemetry and makes no update checks, in any mode, and the license is checked offline. Traces are exported only when you set an OpenTelemetry endpoint. What happens if the license expires? Reviews pause; signing in, connecting code hosts and configuring organizations keep working. Paid licenses have a grace period of 14 days unless agreed otherwise. Installing a new key resumes reviews within a minute. Can we evaluate it on our own infrastructure? Yes. Ask for an evaluation license. It works like a paid license for up to 45 days, with no grace period. Our engineers can help you deploy and size the installation. How do embeddings work without internet access? The Compose bundle includes an embeddings server with its model inside the image. On Kubernetes, run the same server in the cluster or point MergeHarbor at your own OpenAI-compatible embeddings endpoint. What do we need to back up? Only PostgreSQL. Repository mirrors and search indexes can be rebuilt from your code hosts. Have another question? [Talk to our team](https://mergeharbor.com/contact) ## Plan a self-hosted evaluation Ask for an evaluation license and access to the release images, or start a cloud trial to see the reviews first. [Contact sales](https://mergeharbor.com/contact?source=self-hosted) [Start free trial](https://app.mergeharbor.com/signup)