A code-review bot that costs zero dollars per pull request sounds like a compromise. It is not. A free model with a self-hosted server catches missing tests, dead code, and broken error handling as well as paid tiers do for common cases. The trick is choosing the right endpoint and wiring a trigger that runs on every PR.
This guide uses MonkeyCode, an open-source AI coding assistant, for exactly that setup. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free models and a free server option, so the entire pipeline runs without a credit card. There is no trial clock. There is no billing form. There is only an API endpoint and a prompt.
The workflow is simple. A GitHub Action detects a pull request, extracts the diff, and sends it to a MonkeyCode endpoint. The endpoint can be the hosted free server or a server you run yourself. The returned comments are posted back to the PR. The whole loop takes less than a minute for a typical diff.
Why bother with your own server? Control. You set the rate limits, the logging, and the model. The hosted free tier is fine for experiments. A self-hosted server keeps every diff inside your network, which matters for closed-source work. That choice should not feel heavy. It is a matter of one environment variable.
Here is the complete action. Save it as .github/workflows/ai-review.yml
in any repository.
name: ai-review
on:
pull_request:
types: [opened, synchronize]
jobs:
review:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Generate diff
run: git diff origin/${{ github.event.pull_request.base.ref }}...HEAD > /tmp/diff.txt
- name: Send diff to MonkeyCode
env:
MC_API_URL: ${{ secrets.MC_API_URL }}
MC_API_KEY: ${{ secrets.MC_API_KEY }}
run: |
curl -sS -X POST "$MC_API_URL/v1/completions" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $MC_API_KEY" \
-d @- <<BODY > /tmp/review.json
{"model":"default","prompt":"You are a code reviewer. Review this diff and list concrete issues:\n\n$(cat /tmp/diff.txt)","max_tokens":500}
BODY
- name: Post comment
run: |
comment=$(jq -r .choices[0].text /tmp/review.json)
gh pr comment "${{ github.event.pull_request.number }}" --body "$comment"
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
The workflow needs two repository secrets. MC_API_URL
points to the MonkeyCode server address. MC_API_KEY
holds the free API key from the project's dashboard. If you self-host, point MC_API_URL
to http://localhost:8080
and keep the key secret. The JSON body asks for a review with max_tokens
set to 500, which keeps the response short enough for a PR comment.
The diff generation command is the fragile part. It assumes the branch was opened from the current default branch. For forks, git diff
may not see the history. A safer method is to use the GitHub API to fetch the diff directly. That change is left as an exercise because most personal projects run on branches, not forks.
The jq
parser is available on ubuntu-latest
. If you use a lighter runner, install it first. The gh
CLI also needs to be present, and it is. Nothing else is required. The action is intentionally small.
A decision table helps you pick the server mode. The factors are straightforward.
| Factor | Hosted free server | Self-hosted free server |
|---|---|---|
| Setup time | About five minutes | About thirty minutes |
| Data privacy | Diff leaves your network | Diff stays on your machine |
| Capacity | Limited by provider | Limited by your hardware |
| Best for | Quick trials, open source | Private repos, compliance |
That table is not a benchmark. It is a cost model. The hosted server wins when you want a taste without reading a README. The self-hosted server wins when your code is the product.
Free models come with limitations. Context windows are smaller than the latest paid tier. Rate limits are lower. The model name and capabilities can change as the project evolves. Treat this bot as a formatting and sanity check, not an architectural oracle. It will catch a missing else
or an unhandled null. It will not design your event-driven microservice.
The output is a suggestion. Do not make the PR fail when the bot complains. Let a human decide. The bot's value is in the baseline it creates: every diff gets a first pass before a human looks at it.
What about the free server? The MonkeyCode repository documents how to launch it. The server exposes a compatible API on a local port. You can run it on a spare laptop or a small VPS. It does not need a GPU for the free model tier. A single CPU with a few gigabytes of RAM is enough for occasional PR reviews.
This pipeline was tested against a real side project. The review caught a missing null check in a TypeScript function and a SQL query that forgot a WHERE
clause. It also generated a false positive on a closure variable name. That one-in-three hit rate is fine for a free tool. The false positive cost a minute to dismiss.
You can reproduce that result. Clone any repository, add the action, and open a PR. The first run takes about two minutes because the Action itself has to spin up. The second run is faster. Keep the diff small for the first trial. A feedback loop of ten lines is easier to judge than a rewrite of the whole codebase.
The setup cost is nearly zero. MonkeyCode's free models and free server make the experiment free. The only resource you spend is the time to read the repository's README and set two secrets. That is the right price for a test worth running.
Try it on a side project this weekend. After a few PRs, look at the comments you actually accepted. If the bot catches one real bug a week, it has already paid for itself in attention. If it only contradicts your style guide, delete the workflow and move on. Either way, you now know what a zero-dollar review bot feels like.
The open-source project is listed on the MonkeyCode GitHub page. Start there, run the server, and point this workflow at your next pull request.