Large-scale automated code review often fails because general-purpose agents either skip files, misplace comment positions, or produce noisy suggestions. This project moves the repeatable, correctness-critical parts of review out of the LLM and into deterministic engineering — then uses an agent only where dynamic reasoning and contextual retrieval matter. The result is faster, lower-token, and higher-precision reviews that remain practical in CI and large-monorepo workflows.
What Sets It Apart
- Deterministic + agent hybrid: engineering guarantees (exact file selection, smart bundling, template-driven rule matching) prevent position drift and missed files; the LLM is used for interpretation and deep reasoning only. This reduces unstable, prompt-sensitive behavior common in purely language-driven agents.
- Bundle-based review units: related files are grouped and reviewed as isolated sub-agents, which scales to large changesets and supports parallel review without losing context alignment.
- Built-in rules and security checks: ships with fine-tuned rulesets (NPEs, thread-safety, XSS, SQL injection) so many shallow, high-volume issues are caught deterministically before model costing.
- Engineering for cost and precision: benchmarked to consume ~1/9 of tokens versus general-purpose agents while improving precision and F1; recall is deliberately lower as a trade-off to reduce false positives and triage burden.
- Production pedigree: incubated from Alibaba Group's internal assistant, used at scale (tens of thousands of developers, millions of detected defects) and designed for CI integration and audit-style full-file scans.
Who It's For and Trade-offs
Great fit if you need automated code review that minimizes false positives in CI or large repositories, want reproducible positioning of comments, and are willing to configure an LLM provider or run in delegation mode. It is also appropriate for security-focused scanning where deterministic rules matter.
Look elsewhere if you require exhaustive recall (it favors precision over recall), if you need a purely GUI-first SaaS product (this is CLI-first with optional integrations), or if you cannot supply an LLM endpoint and cannot use the provided delegation modes. The project is Apache-2.0 licensed and optimized for predictable, auditable feedback rather than exploratory, noisy suggestions.
