Building an AI-Powered Git Diff Reviewer: Catch Bugs Before You Push

A developer built Git Diff Reviewer, an open-source CLI tool that installs as a Git pre-commit hook, extracts staged diffs, and sends them to a configurable LLM provider (Gemini, Groq, OpenRouter, or local Ollama) for a structured review of critical bugs, security vulnerabilities, anti-patterns, and performance issues before code is pushed. The tool filters files via a .reviewerignore file and flags issues such as SQL injection with CWE references, with a local Ollama option for fully private review.

Hey dev.to 👋 Have you ever pushed a commit in a hurry, only to realize later that you introduced a critical security flaw or a silly bug? We've all been there. The "oops, I'll fix it in the next commit" cycle is a rite of passage for developers. What if you had a senior developer looking over your shoulder before you even push? That's exactly why I built Git Diff Reviewer , a CLI tool that integrates directly into your Git workflow. When you commit, it automatically extracts your diff, sends it to an LLM Gemini, OpenRouter, Groq, or local Ollama , and gives you a structured review right in your terminal. Let's dive into how it works and how you can set it up Git Diff Reviewer is a pre-commit hook that acts as your personal AI code reviewer. Instead of waiting for CI/CD to fail or a teammate to catch a bug, you get instant feedback. git commit . Zero friction. .reviewerignore : .env files so you don't waste tokens. | Category | What it catches | |---|---| | Critical Bugs | Logic errors, infinite loops | | 🔒 Security Vulnerabilities | SQL injection, XSS, hardcoded secrets aligned with OWASP/CWE | | ⚠️ Anti-patterns | Code smells and bad practices | | ⚡ Performance Bottlenecks | N+1 queries, inefficient loops | ┌──────────────────────────────────────────┐ │ git commit -m "feat: update auth" │ └────────────────────┬─────────────────────┘ ▼ ┌──────────────────────────────────────────┐ │ Pre-commit hook │ │ python main.py --staged │ └────────────────────┬─────────────────────┘ ▼ ┌──────────────────────────────────────────┐ │ Extract staged diff │ │ + filter files via .reviewerignore │ └────────────────────┬─────────────────────┘ ▼ ┌──────────────────────────────────────────┐ │ LLM Provider │ │ Gemini │ Groq │ OpenRouter │ Ollama │ └────────────────────┬─────────────────────┘ ▼ ┌──────────────────────────────────────────┐ │ Structured review printed in terminal │ └──────────────────────────────────────────┘ Let's get this running on your machine. git clone https://github.com/humammoin09-blip/git-diff-reviewer.git cd git-diff-reviewer python -m venv .venv Windows: .\.venv\Scripts\Activate.ps1 Mac/Linux: source .venv/bin/activate pip install -r requirements.txt Copy the example file and add your API key: cp .env.example .env Open .env and configure your provider e.g., Gemini : LLM PROVIDER=gemini GEMINI API KEY=your api key here 💡 Pro tip: If you want 100% privacy, set LLM PROVIDER=ollama and run a local model python main.py --install-hook That's it Now, every time you commit, the AI will review your code. Imagine you write this code: python auth.py def get user user id : query = f"SELECT FROM users WHERE id = {user id}" return db.execute query When you commit, the AI immediately flags it: === AI CODE REVIEW === CRITICAL SQL Injection vulnerability detected File: auth.py, Line 42 Issue: User input directly interpolated into SQL query. Fix: Use parameterized queries. CWE-89: Improper Neutralization of Special Elements used in an SQL Command WARNING Hardcoded secret detected File: config.py, Line 15 Issue: API KEY = "sk-abc123..." Fix: Move to environment variable. This catches the bug before it ever reaches production. 🛑 Real security engineers respect honesty over hype, so here's what the tool cannot do: I'm just getting started with this. For v2, I'm planning: If you find this project useful, please give it a Star on GitHub ⭐ A modular, terminal-based CLI tool that inspects local git diffs and sends them to your choice of LLM provider for an automated, high-rigor security and code quality review. --staged , unstaged changes --unstaged , or diff against specific branches/commits --branch main . .md files for pull request comments… Break it, fuzz it, and if you find a bug, open an issue. I read every single one. Let me know in the comments what features you'd like to see in v2