Bubo: AI code-reviewer that learns from review comments

Mountain Owl released Bubo, a self-hosted AI code-review tool that reviews GitLab MRs and GitHub PRs using a bring-your-own-LLM approach, posting only actionable findings as inline threads. The tool supports models like Codex and Claude, includes cosign-signed releases with SBOMs, and is installable via uv or pipx.

Agentic AI code review with the LLM of your choice. Bubo reviews your GitLab MRs and GitHub PRs with the model you run, and posts only the findings worth acting on as inline threads — no chatbot noise, no praise, no summaries. Self-hosted — code, diffs, and review data stay on your infrastructure Bring-your-own-LLM — Codex, Claude, or any model your CLI drives SCM — Currently supports Gitlab and Github findings — Inline or "all good" if clean Governance, provenance & an auditable on-prem report - cosign-signed releases with SBOMs Metrics — Opentelemetry Full documentation → mountainowl.github.io/bubo uv tool install bubo or: pipx install bubo bubo init idempotent; seeds config + workspace + DB bubo doctor verify before the first poll bubo-poller one poll cycle — dry-run by default, posts nothing Prefer a container? docker pull ghcr.io/mountainowl/bubo multi-arch; the review-agent CLI is BYO . Continue with the recipes and quickstart https://mountainowl.github.io/bubo/recipes/ . Everything lives on the docs site — this README is just the front door. | Features https://mountainowl.github.io/bubo/features/ Configuration https://mountainowl.github.io/bubo/configuration/ Operate https://mountainowl.github.io/bubo/operate/ Troubleshooting https://mountainowl.github.io/bubo/troubleshooting/ Metrics & telemetry https://mountainowl.github.io/bubo/telemetry/ llm review. metrics and dashboards. GitLab & GitHub posting via polling — production path, at outcome-metric parity. Set scm .provider = "github" or BUBO PROVIDER=github . MCP server — read-only metrics + triggered reviews; stdio or HTTP. bubo-mcp Codex or Claude — Bubo runs the review through a wrapper around your agent CLI; Codex ships pre-wired. Webhook-driven triggering — not yet; polling is the only path. Review execution sits outside CI/CD by design — run it as a poller beside your existing pipelines. config/env.toml is gitignored and holds tokens. Do not print or commit real values. - Review-agent stdout is redacted GITLAB TOKEN= , OPENAI API KEY= , glpat-… , sk-… , credentialed Git URLs before it touches reports, logs, or the database. - The reviewer subprocess runs under a strict env allowlist — host secrets aren't handed wholesale to the LLM agent. - Releases are cosign-signed via Sigstore keyless OIDC, with an SBOM on every release. - Report vulnerabilities per SECURITY.md /mountainowl/bubo/blob/main/SECURITY.md . Contributing /mountainowl/bubo/blob/main/CONTRIBUTING.md · Security policy /mountainowl/bubo/blob/main/SECURITY.md · Support /mountainowl/bubo/blob/main/SUPPORT.md · Code of conduct /mountainowl/bubo/blob/main/CODE OF CONDUCT.md · License: MIT /mountainowl/bubo/blob/main/LICENSE