# Building an AI-Powered Git Diff Reviewer: Catch Bugs Before You Push

> Source: <https://dev.to/humam_moin/building-an-ai-powered-git-diff-reviewer-catch-bugs-before-you-push-3mab>
> Published: 2026-10-12 14:08:18+00:00

Hey dev.to! 👋

Have you ever pushed a commit in a hurry, only to realize later that you introduced a critical security flaw or a silly bug? We've all been there. The "oops, I'll fix it in the next commit" cycle is a rite of passage for developers.

**What if you had a senior developer looking over your shoulder before you even push?**

That's exactly why I built **Git Diff Reviewer**, a CLI tool that integrates directly into your Git workflow. When you commit, it automatically extracts your diff, sends it to an LLM (Gemini, OpenRouter, Groq, or local Ollama), and gives you a structured review right in your terminal.

Let's dive into how it works and how you can set it up!

Git Diff Reviewer is a pre-commit hook that acts as your personal AI code reviewer. Instead of waiting for CI/CD to fail or a teammate to catch a bug, you get instant feedback.

`git commit`. Zero friction.`.reviewerignore`:`.env` files so you don't waste tokens.
| Category | What it catches | 
|---|---|
| Critical Bugs | Logic errors, infinite loops | 
| 🔒 Security Vulnerabilities | SQL injection, XSS, hardcoded secrets (aligned with OWASP/CWE) | 
| ⚠️ Anti-patterns | Code smells and bad practices | 
| ⚡ Performance Bottlenecks | N+1 queries, inefficient loops | 

```
┌──────────────────────────────────────────┐
│   git commit -m "feat: update auth"      │
└────────────────────┬─────────────────────┘
                     ▼
┌──────────────────────────────────────────┐
│   Pre-commit hook                        │
│   python main.py --staged                │
└────────────────────┬─────────────────────┘
                     ▼
┌──────────────────────────────────────────┐
│   Extract staged diff                    │
│   + filter files via .reviewerignore     │
└────────────────────┬─────────────────────┘
                     ▼
┌──────────────────────────────────────────┐
│   LLM Provider                           │
│   Gemini │ Groq │ OpenRouter │ Ollama    │
└────────────────────┬─────────────────────┘
                     ▼
┌──────────────────────────────────────────┐
│   Structured review printed in terminal  │
└──────────────────────────────────────────┘
```

Let's get this running on your machine.

```
git clone https://github.com/humammoin09-blip/git-diff-reviewer.git
cd git-diff-reviewer
python -m venv .venv

# Windows:
.\.venv\Scripts\Activate.ps1

# Mac/Linux:
source .venv/bin/activate
pip install -r requirements.txt
```

Copy the example file and add your API key:

```
cp .env.example .env
```

Open `.env` and configure your provider (e.g., Gemini):

```
LLM_PROVIDER=gemini
GEMINI_API_KEY=your_api_key_here
```

💡 **Pro tip:** If you want 100% privacy, set `LLM_PROVIDER=ollama` and run a local model!

```
python main.py --install-hook
```

That's it! Now, every time you commit, the AI will review your code.

Imagine you write this code:

``` python
# auth.py
def get_user(user_id):
    query = f"SELECT * FROM users WHERE id = {user_id}"
    return db.execute(query)
```

When you commit, the AI immediately flags it:

```
=== AI CODE REVIEW ===

[CRITICAL] SQL Injection vulnerability detected
File: auth.py, Line 42
Issue: User input directly interpolated into SQL query.
Fix: Use parameterized queries.
CWE-89: Improper Neutralization of Special Elements used in an SQL Command

[WARNING] Hardcoded secret detected
File: config.py, Line 15
Issue: API_KEY = "sk-abc123..."
Fix: Move to environment variable.
```

This catches the bug before it ever reaches production. 🛑

Real security engineers respect honesty over hype, so here's what the tool cannot do:

I'm just getting started with this. For v2, I'm planning:

If you find this project useful, please give it a Star on GitHub! ⭐

A modular, terminal-based CLI tool that inspects local git diffs and sends them to your choice of LLM provider for an automated, high-rigor security and code quality review.

`--staged`), unstaged changes (`--unstaged`), or diff against specific branches/commits (`--branch main`).`.md` files for pull request comments…
Break it, fuzz it, and if you find a bug, open an issue. I read every single one.

Let me know in the comments what features you'd like to see in v2!