# Bubo: AI code-reviewer that learns from review comments

> Source: <https://github.com/mountainowl/bubo>
> Published: 2026-08-04 06:12:11+00:00

**Agentic AI code review with the LLM of your choice.** Bubo reviews your GitLab
MRs and GitHub PRs with the model *you* run, and posts only the findings worth
acting on as inline threads — no chatbot noise, no praise, no summaries.

**Self-hosted**— code, diffs, and review data stay on your infrastructure** Bring-your-own-LLM**— Codex, Claude, or any model your CLI drives** SCM**— Currently supports Gitlab and Github** findings**— Inline or "all good" if clean** Governance, provenance & an auditable on-prem report**- cosign-signed releases with SBOMs** Metrics**— Opentelemetry

**Full documentation → mountainowl.github.io/bubo**

```
uv tool install bubo     # or: pipx install bubo
bubo init                # idempotent; seeds config + workspace + DB
bubo doctor              # verify before the first poll
bubo-poller              # one poll cycle — dry-run by default, posts nothing
```

Prefer a container? `docker pull ghcr.io/mountainowl/bubo`

(multi-arch; the
review-agent CLI is BYO). Continue with the
[recipes and quickstart](https://mountainowl.github.io/bubo/recipes/).

Everything lives on the docs site — this README is just the front door.

|

[Features](https://mountainowl.github.io/bubo/features/)[Configuration](https://mountainowl.github.io/bubo/configuration/)[Operate](https://mountainowl.github.io/bubo/operate/)[Troubleshooting](https://mountainowl.github.io/bubo/troubleshooting/)[Metrics & telemetry](https://mountainowl.github.io/bubo/telemetry/)`llm_review.*`

metrics and dashboards.**GitLab & GitHub posting via polling**— production path, at outcome-metric parity. Set`[scm].provider = "github"`

(or`BUBO_PROVIDER=github`

).**MCP server (**— read-only metrics + triggered reviews; stdio or HTTP.`bubo-mcp`

)**Codex or Claude**— Bubo runs the review through a wrapper around your agent CLI; Codex ships pre-wired.** Webhook-driven triggering**— not yet; polling is the only path.

Review execution sits outside CI/CD by design — run it as a poller beside your existing pipelines.

`config/env.toml`

is gitignored and holds tokens.**Do not print or commit real values.**- Review-agent stdout is redacted (
`GITLAB_TOKEN=`

,`OPENAI_API_KEY=`

,`glpat-…`

,`sk-…`

, credentialed Git URLs) before it touches reports, logs, or the database. - The reviewer subprocess runs under a strict env allowlist — host secrets aren't handed wholesale to the LLM agent.
- Releases are cosign-signed via Sigstore keyless OIDC, with an SBOM on every release.
- Report vulnerabilities per
[SECURITY.md](/mountainowl/bubo/blob/main/SECURITY.md).

[Contributing](/mountainowl/bubo/blob/main/CONTRIBUTING.md) · [Security policy](/mountainowl/bubo/blob/main/SECURITY.md) · [Support](/mountainowl/bubo/blob/main/SUPPORT.md) · [Code of conduct](/mountainowl/bubo/blob/main/CODE_OF_CONDUCT.md) · [License: MIT](/mountainowl/bubo/blob/main/LICENSE)