What is ReviewPilot AI?

A GitHub App that performs the first review pass on every pull request against a versioned rule set, then learns from senior reviewers’ overrides. It is fail-closed: if the AI is unavailable, the PR is flagged for human review rather than silently approved.

How does AI code review work?

On each PR, ReviewPilot fetches the diff, runs static checks (naming, formatting, complexity, security via Semgrep/Gitleaks), then an LLM semantic pass scoped to the changed lines, and posts a single summarized review with inline comments and a priority label.

Does ReviewPilot auto-merge?

No. It never merges and never approves. It posts findings; your team’s required reviewers remain the gate. This is by design — fail-closed, auditable.

How does the self-learning work?

When a senior reviewer overrides, dismisses, or edits a comment, ReviewPilot records the feedback (anonymized, diff-scoped) and calibrates future suggestions. Precision is tracked weekly; rules that drift are flagged for review.

Which languages and repos?

Any repo the GitHub App is installed on. Rule sets are language-aware where static analysis applies (JS/TS/Python/Go/Java and more via Semgrep registry); the LLM pass is language-agnostic on the diff.

Blog

Practical notes for engineering leads. Honesty first: we do not claim 100% defect detection.

Definitional · Article
What AI pull-request review is (and is not)
A practical definition of fail-closed AI code review: first pass against a versioned rule set, never sole approver, never silent LGTM when the model is down.
Read article →
Security · Article
OWASP LLM01 for AI code-review agents
How prompt injection shows up in PR diffs and commit messages, and how layered review should treat untrusted code as data — with honest limits.
Read article →

Blog

What AI pull-request review is (and is not)

OWASP LLM01 for AI code-review agents