Agentic AI code review with the LLM of your choice. Bubo reviews your GitLab MRs and GitHub PRs with the model you run, and posts only the findings worth acting on as inline threads — no chatbot noise, no praise, no summaries.
Self-hosted— code, diffs, and review data stay on your infrastructure** Bring-your-own-LLM**— Codex, Claude, or any model your CLI drives** SCM**— Currently supports Gitlab and Github** findings**— Inline or "all good" if clean** Governance, provenance & an auditable on-prem report**- cosign-signed releases with SBOMs** Metrics**— Opentelemetry
Full documentation → mountainowl.github.io/bubo
uv tool install bubo # or: pipx install bubo
bubo init # idempotent; seeds config + workspace + DB
bubo doctor # verify before the first poll
bubo-poller # one poll cycle — dry-run by default, posts nothing
Prefer a container? docker pull ghcr.io/mountainowl/bubo
(multi-arch; the review-agent CLI is BYO). Continue with the recipes and quickstart.
Everything lives on the docs site — this README is just the front door.
|
FeaturesConfigurationOperateTroubleshootingMetrics & telemetryllm_review.*
metrics and dashboards.GitLab & GitHub posting via polling— production path, at outcome-metric parity. Set[scm].provider = "github"
(orBUBO_PROVIDER=github
).MCP server (— read-only metrics + triggered reviews; stdio or HTTP.bubo-mcp
)Codex or Claude— Bubo runs the review through a wrapper around your agent CLI; Codex ships pre-wired.** Webhook-driven triggering**— not yet; polling is the only path.
Review execution sits outside CI/CD by design — run it as a poller beside your existing pipelines.
config/env.toml
is gitignored and holds tokens.Do not print or commit real values.- Review-agent stdout is redacted (
GITLAB_TOKEN=
,OPENAI_API_KEY=
,glpat-…
,sk-…
, credentialed Git URLs) before it touches reports, logs, or the database. - The reviewer subprocess runs under a strict env allowlist — host secrets aren't handed wholesale to the LLM agent.
- Releases are cosign-signed via Sigstore keyless OIDC, with an SBOM on every release.
- Report vulnerabilities per SECURITY.md.
Contributing · Security policy · Support · Code of conduct · License: MIT