BugViper

AI PR Reviews with codebase-aware DeepAgents + ESLint, Ruff, golangci-lint and more. Install the GitHub App, open a PR, and BugViper clones the repo, builds a blast radius and call graph on the fly in an E2B sandbox, then posts a full review — inline comments, issue tracking, and a summary — with no friction.

Features


🤖 AI DeepAgents	Codebase-aware agents that understand cross-file function interactions, not just isolated snippets
🫡 Normal Mode	Single generalist agent — fast, efficient reviews for everyday PRs
🔬 Deep Mode	Three specialized sub-agents (correctness, security, performance) run in parallel for thorough analysis
🏝️ E2B Sandboxes	Secure isolated sandboxes to clone and review code — no access to your environment
🔍 Blast Radius + Call Graph	Builds call graph on the fly so agents see the real impact of every change
🔧 Third Party Static Analysis	ESLint, Ruff, golangci-lint — fast lint-only mode with support for Python, JS/TS, Go, and more
✅ Verifier Pass	Validates every finding against the actual diff — negates false positives and marks issues as: `nitpick` (low confidence), `valid` (high confidence), or `outside_diff` (not in the PR)
🔀 Dedup	Deduplicates findings across batches and agents — same issue reported twice gets merged once
🧠 Any LLM Model	Use any model — open source or closed source — via OpenRouter, Gemini, or MiniMax
💬 Inline Comments	Posts high-confidence issues directly on the relevant lines in the PR
📊 Analytics Dashboard	Tracks bugs caught, resolved, merge times, and PRs reviewed per day
🔁 Resolve Detection	Tracks whether previously reported issues were fixed in subsequent PRs — automatically marks issues as `fixed` when the same issue no longer appears
📈 Per-Repo Analytics	Stacked bar charts per repo for reviews per day, PRs reviewed, avg merge time, and addressed rate
🐛 Issue Lifecycle	Full issue tracking — open, resolved, fixed — with per-issue GitHub comment linkage
☁️ Cloud Run + Cloud Tasks	Production-ready deploy on GCP with async task dispatch

Coming Soon


🧠 Global Knowledgebase	Agents learn from review feedback across all repos — common issues and patterns get smarter over time
🌍 Repo Knowledgebase	Per-repo memory so agents remember past issues and don't re-report the same things
🛠️ More Static Analysis	Adding more third-party tools: Hadolint, ShellCheck, Terraform (HCL), and more

Full Review

Comment @bugviper full review on any PR and get a complete AI-powered code review — inline comments, issue tracking, and a summary posted back to GitHub.

Full.Review.mp4

How it works

Trigger — User comments @bugviper full review on a GitHub PR
Clone + Blast Radius — BugViper clones the repo at the PR head SHA into an E2B sandbox and generates a full call graph via tree-sitter to understand which files call which functions
Scoring + Batching — Every changed file is scored for its blast radius (how many downstream callers it affects). Files are then grouped into small batches using Louvain community detection so that tightly-connected files are reviewed together
Agent Review — In Normal mode, batches of 4 run sequentially through a single generalist agent. In Deep mode, batches of 2 run through 3 specialized sub-agents in parallel (Bug, Security, Performance), each in their own isolated E2B container
Verifier Pass — Every finding from the agents is validated against the actual diff by a verifier agent. It removes false positives and classifies each issue as valid, nitpick (low confidence), or outside_diff
Dedup + Normalize — Duplicate findings across batches and agents are merged into a single entry
Post to GitHub — High-confidence valid issues are posted as inline comments on the relevant lines; the full summary is posted as a PR review body

Real-world example: A large PR with 58 files was reviewed by splitting it into batches based on connected blast-radius components. In Deep mode, 3 agents (Bug, Security, Performance) ran in parallel across 2 batches at a time inside isolated E2B containers, with the verifier removing false positives before any comments were posted.

Run Lint

Comment @bugviper run lint on any PR for a fast static-analysis review using ESLint, Ruff, golangci-lint, and more — results posted back to GitHub in seconds.

How it works

Trigger — User comments @bugviper lint on a GitHub PR
Queue — The request is dispatched to the review service via Cloud Tasks (or direct HTTP in local dev with DEBUG=true)
Lint Execution — The configured linters (ESLint, Ruff, golangci-lint) run against the changed files in an isolated E2B sandbox
Parse + Filter — Lint results are parsed and filtered to only issues that fall within the actual PR diff
Post to GitHub — Findings are posted as inline comments on the relevant lines, with a summary comment on the PR

Note: Run Lint is designed for speed — no call graph, no AI agents, no batching. It's the fastest way to catch style violations, unused imports, and standard lint errors before merging.

Analytics

Track your team's code review activity across all repos — bugs caught, resolved, merge times, and PRs reviewed per day.

What it shows

The analytics dashboard aggregates data from all repos into a single view:

Stat Cards — At a glance: total repos, PRs reviewed, reviews run, bugs caught, addressed rate, PRs per week, and average merge time
Total Reviews per Day — Stacked bar chart with each repo as a colored segment, so you can see which repo generated the most review activity on any given day
PRs Reviewed per Day — Stacked bar chart showing how many unique PRs were reviewed per day, broken down by repo
Repository Comparison — Side-by-side bar charts comparing average merge time and addressed rate across all your repos
Per-Repo Detail — Click into any repo to see its full analytics: daily bug trends, issue lifecycle, and individual PR history with full review run details

Every chart is interactive — hover for breakdowns and click to drill down.

View and Manage Reviews

Browse all your repos, inspect individual PR reviews, and track what issues the agents found — right from the dashboard.

Repo.mp4

How it works

Repos list — The Repositories page shows every repo you've connected, with stats per repo: open issues, review count, fix rate percentage, and language badge
Repo detail sheet — Click any repo to open a side panel with:
- Stats bar — total issues raised, resolved, PR count, fix rate, addressed rate, avg merge time, PRs per week, total reviews
- PR list — every reviewed PR with merge status, review count, open issues, and last review timestamp
PR drill-down — Click a PR to expand its runs. Each run shows review type, duration, issue count, and a "View Details" button
Run detail view — Opens a full breakdown of a single review run:
- Walkthrough — which files were modified
- Issues — each issue shows: severity (color-coded), category badge, issue type, confidence score, file location, description, impact, suggestion, and code snippet
- Positive findings — what the agent liked about your code
- Resolve tracking — if an issue was fixed in a later run, it shows as "Resolved" with a checkmark

Static Analysis Tools

Configure which linters run on your PRs — enable or disable tools, set config files, and manage supported file extensions.

Tools.mp4

Supported tools

Tool	Languages	Config file
Ruff	Python (`.py`, `.ipynb`)	`pyproject.toml`, `ruff.toml`, `.ruff.toml`
ESLint	JS/TS (`.js`, `.ts`, `.jsx`, `.tsx`, and more)	`eslint.config.js`, `.eslintrc`, `.eslintrc.json`
golangci-lint	Go (`.go`, `.go.mod`)	`.golangci.yml`, `.golangci.yaml`, `.golangci.toml`

How it works

From the Dashboard → Tools page:

Toggle each tool on or off — disabled tools are skipped during lint and full review
Select config file — choose between auto-detected config files or a specific path
View extensions — see which file extensions each tool covers
Save — changes take effect on the next review immediately

More tools coming soon: Hadolint (Dockerfile), ShellCheck, Terraform (HCL).

What it does

Review any PR — Bot posts a structured review (inline comments + summary) on every pull request
Two review modes — lint (fast, static analysis via ESLint, Ruff, golangci-lint, and more) and full_review (deep AI analysis in an E2B sandbox)
Tracks progress — dashboards show bugs caught, resolved, merge times, and PRs reviewed per day across all repos
GitHub App + OAuth — App for webhook events, Firebase GitHub OAuth for the dashboard

Architecture

flowchart TD
    USER["👤 User comments @bugviper<br/>on a GitHub PR"]
    GH["GitHub<br/>Webhook Event"]
    API["API Service (FastAPI)<br/>Port 8000"]
    DECIDE{"DEBUG?"}
    CT["Cloud Tasks<br/>codeReview Queue"]
    DIRECT["Direct HTTP"]
    RS["Review Service (Cloud Run)<br/>Port 8100"]
    SANDBOX["E2B Sandbox<br/>Secure isolated environment"]
    CLONE["Clone Repo<br/>at PR head SHA"]
    CALLGRAPH["Call Graph<br/>via tree-sitter"]
    SCORE["Score Files<br/>by blast radius"]
    BATCH["Batch Files<br/>Louvain community detection"]
    AGENTS{"Review Mode?"}
    NORMAL["Normal Mode<br/>4 batches · 1 generalist agent"]
    DEEP["Deep Mode<br/>2 batches · 3 agents (Bug · Security · Performance)<br/>running in parallel"]
    LINT["Lint<br/>ESLint · Ruff · golangci-lint"]
    VERIFIER["Verifier Pass<br/>Validates findings vs diff<br/>→ valid · nitpick · outside_diff"]
    DEDUP["Dedup + Normalize<br/>Merges duplicates across batches"]
    GITHUB["GitHub PR<br/>Inline comments + review body"]
    FIRESTORE["Firestore<br/>Users · PRs · Reviews · Analytics"]
    DASHBOARD["Frontend (Next.js)<br/>Port 3000"]

    USER --> GH
    GH --> API
    API --> DECIDE
    DECIDE -->|"DEBUG=false"| CT
    DECIDE -->|"DEBUG=true"| DIRECT
    CT --> RS
    DIRECT --> RS
    RS --> SANDBOX
    SANDBOX --> CLONE
    CLONE --> CALLGRAPH
    CALLGRAPH --> SCORE
    SCORE --> BATCH
    BATCH --> AGENTS
    AGENTS -->|normal| NORMAL
    AGENTS -->|deep| DEEP
    NORMAL --> LINT
    DEEP --> LINT
    LINT --> VERIFIER
    VERIFIER --> DEDUP
    DEDUP --> GITHUB
    DEDUP --> FIRESTORE
    FIRESTORE --> DASHBOARD

Tech Stack

Backend: Python 3.13 · FastAPI · firebase-admin · google-cloud-tasks · langchain · openai · e2b

Frontend: Next.js 16 (App Router) · React 19 · TypeScript · Tailwind CSS v4 · Recharts · Firebase Auth (GitHub OAuth) · shadcn/ui

AI: DeepAgent with 3 specialized sub-agents (correctness, security, performance) running in E2B sandboxes; verifier pass validates findings; Louvain community detection for batch sizing

Deploy: Docker · Cloud Build · Cloud Run · Cloud Tasks

Project Structure

BugViper/
├── apps/frontend/               Next.js dashboard
│   ├── app/(protected)/         Auth-gated pages (dashboard, repos, tools)
│   ├── components/              Sidebar, Header, UI primitives
│   └── lib/                    API client, Firebase auth, utils
├── src/
│   ├── api/                    FastAPI backend
│   │   ├── routers/           webhook, repos, analytics, auth, tools
│   │   └── services/          Cloud Tasks, review orchestration
│   ├── ai_code_review/         Review worker service
│   │   ├── pipeline.py         Main review pipeline (normal mode)
│   │   ├── deep_pipeline.py    Deep mode (3 sub-agents)
│   │   ├── agent.py            Agent factory
│   │   ├── sandbox.py          E2B sandbox lifecycle
│   │   ├── batch.py            Louvain community batching
│   │   ├── prompts.py          All system/user prompts
│   │   ├── normalize.py        Finding validation
│   │   └── tracking.py         Firebase state updates
│   ├── common/                 Shared across all services
│   │   ├── firebase_service.py Firestore operations
│   │   └── github_client.py    GitHub API wrapper
├── infra/
│   ├── docker/                 Dockerfiles (api, review, frontend)
│   └── cloudbuild/             Cloud Build + Cloud Run deploy configs
├── scripts/
│   ├── seed_demo_data.py       Demo analytics data generator
│   └── migrate_analytics.py    Schema migration
├── tests/                      pytest unit tests
└── start.sh                    Local dev launcher

Quick Start

# Clone and install
git clone https://github.com/MabudAlam/BugViper.git
cd BugViper
uv sync
cd apps/frontend && npm install && cd ../..
cp .env.example .env

# Configure .env with your keys (see SETUP.md)
# Then launch everything:
./start.sh

This starts:

API on port 8000 (FastAPI — webhooks + REST)
Review Service on port 8100 (AI review pipeline)
Frontend on port 3000 (Next.js dashboard)
Ngrok tunnel (for local webhook testing)

Key API Endpoints

Endpoint	Description
`POST /api/v1/webhook`	GitHub webhook receiver (PR events, comments)
`GET /api/v1/repos/overview`	List repos with aggregated stats
`GET /api/v1/repos/{owner}/{repo}/analytics`	Per-repo analytics with daily breakdown
`GET /api/v1/repos/{owner}/{repo}/prs`	List PRs for a repo
`GET /api/v1/repos/{owner}/{repo}/prs/{pr}/reviews`	List review runs for a PR
`GET /api/v1/repos/{owner}/{repo}/prs/{pr}/reviews/{run}`	Full review run detail with issues
`PUT /api/v1/tools/config`	Save linter tool configuration
`POST /api/v1/auth/login`	Authenticate with GitHub OAuth token
`GET /api/v1/dashboard/analytics`	Aggregated dashboard analytics

Name		Name	Last commit message	Last commit date
Latest commit History 353 Commits
apps/frontend		apps/frontend
e2b-templates		e2b-templates
infra		infra
screenshots		screenshots
scripts		scripts
src		src
tests		tests
.dockerignore		.dockerignore
.env.example		.env.example
.gitignore		.gitignore
.python-version		.python-version
LICENSE		LICENSE
README.md		README.md
SETUP.md		SETUP.md
pyproject.toml		pyproject.toml
start.sh		start.sh
uv.lock		uv.lock

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

BugViper

Features

Coming Soon

Full Review

How it works

Run Lint

How it works

Analytics

What it shows

View and Manage Reviews

How it works

Static Analysis Tools

Supported tools

How it works

What it does

Architecture

Tech Stack

Project Structure

Quick Start

Key API Endpoints

About

Uh oh!

Contributors

Uh oh!

Languages

Folders and files

Latest commit

History

Repository files navigation

BugViper

Features

Coming Soon

Full Review

How it works

Run Lint

How it works

Analytics

What it shows

View and Manage Reviews

How it works

Static Analysis Tools

Supported tools

How it works

What it does

Architecture

Tech Stack

Project Structure

Quick Start

Key API Endpoints

About

Topics

Resources

License

Uh oh!

Stars

Watchers

Forks

Contributors

Uh oh!

Languages