AI code review

Kodus and Aevral, at a glance

Kodus is an open source AI code reviewer (AGPL core): cross-repo context, team rules written in plain language, and checks against acceptance criteria pulled from a linked Jira, Linear, or Notion ticket, per Kodus's site.

Kodus is built as an open source AI code review platform: its review agent maps callers, callees, and tests across linked repositories, turns team rules into enforced checks, and pulls acceptance criteria from a linked ticket to check whether the pull request satisfies them, per Kodus's site. Aevral is built for a security reading of its own: its PR review, live on install, looks for access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration flaws on the diff, and its whole-repo scan reads who has access to what: authorization, IDOR, and business-logic access control.

Kodus focuses on

Pull-request review with cross-repo context: callers, callees, and tests around a change.
Team rules written in plain language, or imported from files like CLAUDE.md, enforced on every change.
Acceptance-criteria checks against a linked Jira, Linear, or Notion ticket, per Kodus's site.

Aevral adds alongside

The access reading of the same change: dropped ownership checks, caller-controlled object references, gates that went from a role to a login.
Live on install: up to five findings per review, grounded on the added lines, posted as a Check plus inline comments. It never blocks a merge.
A fix prompt you hand to the coding agent you already use, with a human reviewing before merge.

Run them together

Let Kodus check the change against your team's rules and the ticket it closes; let Aevral add its security reading of the same change, live on install.

Kodus and Aevral, in depth; Aevral whole-repo scan.

Also alongside

Security review, handled.

Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.

Install the GitHub App Log in Sign up

For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.