Skillget

bubo

mcp
Guvenlik Denetimi
Uyari
Health Uyari
  • License — License: MIT
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Low visibility — Only 7 GitHub stars
Code Gecti
  • Code scan — Scanned 12 files during light audit, no dangerous patterns found
Permissions Gecti
  • Permissions — No dangerous permissions requested

Bu listing icin henuz AI raporu yok.

SUMMARY

Agentic AI code review for GitLab MRs and GitHub PRs, with the LLM of your choice. Posts only actionable findings as inline review threads.

README.md

Bubo 🦉

PyPI
Python 3.14+
Docker: GHCR
CI
OpenSSF Scorecard
Signed with cosign
SLSA 3
Ruff
Managed with uv
Docs
License: MIT

Bubo AI code review tone examples

Just facts • No noise • Always learning • Compliant • Auditable • Proven ROI

See metrics & ROI → · Install Bubo →

Install

uv tool install bubo     # or: pipx install bubo
bubo init                # idempotent; seeds config + workspace + DB
bubo doctor              # verify before the first poll
bubo-poller service start # start the review service (polling + outcome sync)

Prefer a container? docker pull ghcr.io/mountainowl/bubo (multi-arch; the
review-agent CLI is BYO). Continue with the
recipes and quickstart.

Documentation

Everything lives on the docs site — this README is just the front door.
Recipes Copy-paste GitLab / GitHub / in-house-model setups.
Features The full capability list.
Configuration Every setting, per section, plus a quick-start config.
GitHub Action Run one synchronous PR review in GitHub Actions.
Operate Deploy, run the review service, grade outcomes, governance report.
Troubleshooting Host / infra fixes (sandbox, AppArmor).
Metrics & telemetry Emitted llm_review.* metrics and dashboards.

Status

  • GitLab & GitHub posting via polling — production path, at outcome-metric
    parity. Set [scm].provider = "github" (or BUBO_PROVIDER=github).
  • GitHub Marketplace Action — experimental synchronous review for the PR
    that triggered a GitHub Actions workflow; start in dry-run mode.
  • MCP server (bubo-mcp) — read-only metrics + triggered reviews; stdio or HTTP.
  • Codex or Claude — Bubo runs the review through a wrapper around your agent
    CLI; Codex ships pre-wired.
  • Webhook service — not yet; long-running deployments use polling, while
    the GitHub Action can run one review from a pull_request workflow.

For continuous operation, run the service beside your pipelines. Use the
Marketplace Action only when a CI-scoped review is the intended deployment.

Security

  • config/env.toml is gitignored and holds tokens. Do not print or commit real values.
  • Review-agent stdout is redacted (GITLAB_TOKEN=, OPENAI_API_KEY=, glpat-…,
    sk-…, credentialed Git URLs) before it touches reports, logs, or the database.
  • The reviewer subprocess runs under a strict env allowlist — host secrets aren't
    handed wholesale to the LLM agent.
  • Releases are cosign-signed via Sigstore keyless OIDC, with an SBOM on every release.
  • Report vulnerabilities per SECURITY.md.

Community

Contributing · Security policy · Support · Code of conduct · License: MIT

Yorumlar (0)

Sonuc bulunamadi