AI Pull Request Reviewer · Developer
A careful first-pass review on every pull request
It reviews each PR's diff for bugs, security issues and missing tests, posts one structured comment on GitHub and alerts Slack on serious findings. Merging stays your call.
Free account to start. Buying and running live need a paid plan.
- Starts when your form or app sends it something
- 1 AI step
- About 25 min to set up
Sound familiar?
The job, before and after this agent.
What it feels like today
- “PRs wait a day for review because the senior dev is buried.”
- “Reviews catch style nits but miss the missing auth check.”
- “Junior developers get slow, inconsistent feedback.”
What you get with the agent
- Each new or updated pull request's changed lines reviewed for bugs, edge cases, error handling and your conventions.
- Security checks for injection, missing auth or tenant checks and leaked secrets, which it never repeats back.
- One structured comment on the PR: verdict and up to 10 findings with file, line, severity and a suggested fix.
- Critical or high findings also posted to your engineering channel in Slack.
- Every review kept in the run history.
Before
A new export endpoint sits in review for a day. When someone finally looks, they skim it, approve, and nobody notices it never checks which workspace the invoices belong to.
After
Minutes after the PR opens, a comment flags the missing tenant check as high severity with the line and a suggested fix, and Slack pings the team. The human reviewer starts from there.
How it works
The whole workflow, step by step.
A short GitHub Actions step (provided) or any CI job sends each new or updated pull request's diff to the agent. AI reviews only the changed lines like a senior engineer: bugs, security issues (injection, missing auth or tenant checks, leaked secrets, which it never repeats), missing tests and the conventions you paste in. It posts one structured comment on the pull request through the GitHub API with your token (verdict, up to 10 findings with file, line, severity and a suggested fix), and alerts your engineering channel in Slack on critical or high findings. It never approves, blocks or merges, doesn't read the rest of the repository or scan dependencies, and works through your CI and token rather than a built-in GitHub app.
- TriggerPull request opened or updated
- AI stepReview the diff
- LogicCritical or high findings?
- Critical or high:Post the review on the pull request
- Critical or high:Alert the team in Slack
- Other:Post the review on the pull request
- App callPost the review on the pull request
- OutputReview posted
- App callAlert the team in Slack
- OutputTeam alerted
- App callPost the review on the pull request
- OutputReview posted
This is the workflow that opens in your workspace when you set the agent up. Every step can be edited.
- Step 1Pull request opened or updatedA short GitHub Actions step (or any CI job) posts each pull request's title, description and diff to the workflow's webhook URL.
- Step 2Review the diffAI reviews the diff like a senior engineer: bugs, security issues (injection, auth, leaked secrets), missing tests, your conventions, and writes a structured review comment with severities.
- Step 3Critical or high findings?Reviews with a critical or high finding also alert your team in Slack; every review is posted on the pull request.
- Step 4Post the review on the pull requestPosts the review as a comment on the pull request through the GitHub API, with your token.
- Step 5Review postedThe run history keeps the review and GitHub's response.
- Step 6Alert the team in SlackPosts the pull request, the verdict and the blocking findings to your engineering channel.
- Step 7Team alertedThe run history keeps the alert.
- Step 8Post the review on the pull requestPosts the review as a comment on the pull request through the GitHub API, with your token.
- Step 9Review postedThe run history keeps the review and GitHub's response.
Example run
What goes in, and what comes out.
Example with fictional data
Comes in
Fictional PR #214 “Add CSV export for invoices” on a sample web app: a new route that queries invoices without filtering by workspace.
The agent produces
Verdict: changes requested. High: missing workspace filter lets users export other tenants' invoices (file, line, suggested fix). Medium: no test for empty export. Slack alert sent for the high finding.
What you need
Everything it takes to run it.
About 25 minutes from purchase to live. A checklist above the canvas takes you through each step.
Plan
Included in Enterprise; on other paid plans it's $89 once. Agents run live on paid plans, from Basic ($39/mo).
Your AI key
Connect any of 14 AI providers on your own key. Your provider bills usage directly, at cost; we add no markup.
Apps
- HTTP / Custom APILive
- SlackLive
Checklist
- A paid plan (agents run live on paid plans).
- An AI provider key (Settings → AI Providers).
- An HTTP / Custom API connection to https://api.github.com with a token that can comment on pull requests, and Slack.
- A GitHub Actions step (provided in the FAQ) or another CI job that sends each pull request's diff to the webhook.
Setup, about 25 minutes
- Connect your AI provider. The AI steps run on your own key (OpenAI, Anthropic, Google and more). Add one in Settings → AI Providers.
- Connect GitHub (HTTP / Custom API). In Settings → Integrations, add an HTTP / Custom API connection: base URL https://api.github.com, Authentication “Bearer token”, and a fine-grained personal access token for your repositories with “Pull requests: Read and write”.
- Connect Slack. Connect the Slack workspace your engineers use (Settings → Integrations → Slack).
- Paste your conventions. Open “Review the diff” and replace the placeholder with your stack and the conventions reviews should enforce.
- Pick the GitHub connection. Open the two “Post the review on the pull request” steps and pick your GitHub connection in each.
- Pick the Slack account and channel. Open “Alert the team in Slack” and pick your account and channel. Invite the app to private channels first (/invite @Fluxo Flow).
- Test it with Dry Run. Press Dry Run: the agent runs on sample data with no messages sent and nothing written to your apps.
- Switch the trigger on. Switch the webhook on, copy its URL and secret into your repository secrets FLUXO_REVIEW_URL and FLUXO_REVIEW_SECRET, and add the GitHub Actions step from the agent's FAQ (.github/workflows/ai-review.yml).
Is it a fit?
Who it's for, and what it won't do.
Built for
- Small engineering teams without a dedicated reviewer
- Startups shipping fast
- Tech leads mentoring junior developers
- Agencies maintaining client codebases
What it doesn't do
- It doesn't approve, block, merge or push code, and doesn't run your code or tests.
- It only sees the diff your CI sends (the provided step sends the first 60 KB); it doesn't read the rest of the repository or check dependencies for CVEs.
- It doesn't learn from accepted or rejected suggestions; update your conventions to tune it.
- There is no built-in GitHub or GitLab app: it works through your CI and your API token.
We list the limits up front so you can decide before you buy.
Price
$89 one-time
Per workspace. It never renews.
- Included at no extra cost on Enterprise.
- Buying and running it live need a paid plan, from Basic ($39/mo).
- Dry Run costs nothing: simulated AI and app calls, nothing sent.
- AI usage is billed by your own provider, at cost. No AI credits to buy from us.
One-time agent purchases aren't covered by the 30-day money-back guarantee. Refund policy
FAQ
Questions about AI Pull Request Reviewer.
Will it approve or merge code?
Never. It doesn't approve, block, merge or push code, and doesn't run your tests. It's a first pass that makes your human review faster and sharper.
How much of my code does it see?
Only the diff your CI sends (the provided GitHub Actions step sends up to the first 60 KB). It doesn't read the rest of the repository or scan dependencies for vulnerabilities.
How do I set it up?
About 25 minutes: add the provided GitHub Actions step, create a GitHub token that can comment on PRs, connect Slack and paste in your conventions. It works through your CI and token, not a GitHub app. To run it live you need a paid plan and your own AI provider key (OpenAI, Anthropic, Google and others), added in Settings. Dry Run on sample data is free, so you can see real output before you commit.
Is it worth the price?
It's a one-time purchase that never renews. One security bug caught before production is worth far more.
How do pull requests reach the agent?
Add this workflow to your repository as .github/workflows/ai-review.yml and save the webhook URL and secret as the repository secrets FLUXO_REVIEW_URL and FLUXO_REVIEW_SECRET: name: AI code review on: pull_request: types: [opened, synchronize, ready_for_review] jobs: review: if: github.event.pull_request.draft == false runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: { fetch-depth: 0 } - env: URL: ${{ secrets.FLUXO_REVIEW_URL }} SECRET: ${{ secrets.FLUXO_REVIEW_SECRET }} TITLE: ${{ github.event.pull_request.title }} BODY: ${{ github.event.pull_request.body }} AUTHOR: ${{ github.event.pull_request.user.login }} PR_URL: ${{ github.event.pull_request.html_url }} PR: ${{ github.event.pull_request.number }} BASE: ${{ github.base_ref }} run: | git diff "origin/$BASE...HEAD" | head -c 60000 > pr.diff jq -n --rawfile diff pr.diff --arg repo "$GITHUB_REPOSITORY" --argjson pr "$PR" \ --arg title "$TITLE" --arg body "$BODY" --arg author "$AUTHOR" --arg url "$PR_URL" --arg base "$BASE" \ '{repository:$repo, pr_number:$pr, title:$title, description:$body, author:$author, url:$url, base_branch:$base, diff:$diff}' \ | curl -sf -X POST "$URL" -H "Content-Type: application/json" -H "x-fluxo-secret: $SECRET" --data @- GitHub doesn't share secrets with pull requests from forks, so forks aren't reviewed.
Does it work with GitLab?
Yes, with two changes: send the same JSON from a GitLab CI job, and in the two comment steps use a GitLab connection (base URL https://gitlab.com/api/v4, API key header PRIVATE-TOKEN) with the path /projects/<project id>/merge_requests/{{input.json.pr_number}}/notes.
Can it approve or merge?
No. It only comments. Your reviewers and branch protection rules decide.
Is this a subscription?
No. AI Pull Request Reviewer is a one-time purchase of $89 per workspace and never renews. The Enterprise plan includes it at no extra cost. Running it live needs a paid plan (from Basic ($39/mo)), and your AI provider bills you directly for usage.
Can I test it before it touches real data?
Yes. Once it's set up in your workspace, Dry Run plays every step on sample data with simulated AI and app calls: nothing is sent and nothing in your apps changes. Switch the trigger on only when you're happy.
Put AI Pull Request Reviewer to work.
Free account, no credit card. Your Agents page opens with AI Pull Request Reviewer ready to buy and set up, then Dry Run it before it goes live.