Skip to content

PR Review Engine

Open a pull request, and this bot reviews it automatically — checking for security risks, performance issues, and code-quality problems — then posts the results as a single comment on the PR itself. Three specialists run in parallel, and later pushes edit that same comment in place rather than piling up new ones.

Needs: Python 3.12, uv, and a Postgres you can reach (local or a free Supabase project) — budget about 30 minutes for a first working review.

Pull request opened or updated
You push code or open a PR — that's the only step you take.
→
Webhook received
GitHub calls the bot automatically the moment your PR changes.
↓
Queued for review
The request is saved in line so nothing gets missed, even under heavy traffic.
↓
Security
Looks for risky code, like exposed secrets or unsafe input handling.
Performance
Flags code that could run slowly or waste resources.
Code Quality
Suggests cleaner, easier-to-maintain code.
↓
Findings combined
All three reports are merged into one clear summary.
↓
Posted as a PR comment
The summary appears directly on your pull request — no dashboard required.

What a review looks like

A real posted comment, condensed to one finding per specialist:

## 🤖 Automated Code Review — PR #42
_3 specialists · llama-3.3-70b-versatile (groq) · 4.2s · ~$0.0021_

### 🔒 Security — 1 finding
| Severity | Line | Issue | Suggested fix |
| --- | --- | --- | --- |
| 🔴 critical | `app/auth.py:88` | API key is logged in plaintext when the request fails | Log only the key's length/hash, never the raw value |

### ⚡ Performance — 1 finding
| Impact | Line | Issue | Suggestion |
| --- | --- | --- | --- |
| 🟡 medium | `app/api/users.py:145` | N+1 | Batch these lookups into a single query |

### 🧹 Code Quality — 1 finding
| Category | Line | Issue | Refactoring suggestion |
| --- | --- | --- | --- |
| duplication | `app/utils/format.py:22` | Date-formatting logic is duplicated across three modules | Extract a shared helper |

---
<sub>Runtime 4.2s · 1,842 tok in / 612 tok out · est. $0.0021 · provider: groq</sub>

If a specialist's own check fails outright, its section says so plainly instead of vanishing — partial failure is always visible, never silent.

Two tracks

  • Local — run the engine on your own machine against a webhook-forwarding tool, for development and debugging.
  • Hosted — deploy to Render with a real GitHub webhook, for a durable, always-on reviewer.

Both are covered by the same setup guide, which shares its first four steps regardless of which track you pick.

The one command to remember

uv run python -m bot.scripts.doctor

Run it any time, from a fresh clone or mid-setup. It answers three questions: where am I, what's missing, and what's next — without ever mutating anything.

Get started →