README
¶
kritika
Repository-aware AI pull request review for GitHub, Forgejo, GitLab and Gitea.
kritika reviews pull requests on GitHub, Forgejo, GitLab and Gitea using the code around the change. It posts an updated summary, inline findings and suggested fixes. Mention the bot to ask a follow-up question or request another review.
[!WARNING] kritika is under active development. Check the changelog before upgrading; configuration and APIs can change between releases.
What it does
- Reviews new pull requests and updates its review after a push.
- Reads repository context and your review rules.
- Answers questions in pull request comments.
- Offers optional confidence scores and automatic approvals.
- Shows reviews, usage and costs in a web dashboard.
- Lets coding agents read reviews and findings through a read-only MCP endpoint.
What you need
- Kubernetes and Helm.
- Postgres with VectorChord and three database roles.
- A GitHub App, a Forgejo or Gitea bot account or a GitLab service account, and a model provider credential.
- An HTTPS address for the dashboard and the forge's webhooks.
The setup guide walks through installation and the first review. No repository configuration file is required.
Learn more
| I want to… | Read |
|---|---|
| Use the bot | Reviews and commands |
| Add review rules | Repository settings |
| Manage reviews and costs | Dashboard |
| Configure the service | Configuration reference |
| Secure a deployment | Security |
| Work on kritika | Development |
License
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
kritika
command
Command kritika reviews GitHub pull requests against an index of the repository.
|
Command kritika reviews GitHub pull requests against an index of the repository. |
|
kritika-runner
command
Command kritika-runner executes a runner Job: "kritika-runner run" carries out the one review, follow-up or index run its job document names, then exits.
|
Command kritika-runner executes a runner Job: "kritika-runner run" carries out the one review, follow-up or index run its job document names, then exits. |
|
internal
|
|
|
adapter
Package adapter resolves the configuration's providers to model adapters, built once for the life of the process, as the configuration is, and records what they are asked for the transcript view.
|
Package adapter resolves the configuration's providers to model adapters, built once for the life of the process, as the configuration is, and records what they are asked for the transcript view. |
|
agent
Package agent is a bounded tool loop over a git commit's tree: a Stepper reads it through read_file, grep and list_files, and through run executes allowlisted commands over a checkout of it when a repository allows them, then must call submit_review to end the run.
|
Package agent is a bounded tool loop over a git commit's tree: a Stepper reads it through read_file, grep and list_files, and through run executes allowlisted commands over a checkout of it when a repository allows them, then must call submit_review to end the run. |
|
aqua
Package aqua resolves packages of the aqua registry (github.com/aquaproj/aqua-registry), as aqua itself would for the platform the runner runs on, and installs them: it downloads a package, checks the download against a checksum published apart from it, and unpacks it, running nothing of aqua's or the package's.
|
Package aqua resolves packages of the aqua registry (github.com/aquaproj/aqua-registry), as aqua itself would for the platform the runner runs on, and installs them: it downloads a package, checks the download against a checksum published apart from it, and unpacks it, running nothing of aqua's or the package's. |
|
auth
Package auth signs humans in to the dashboard, as the local admin or through the file's OIDC, GitHub, Forgejo, Gitea and GitLab sign-ins, decides what each may do from the sign-in's role mapping and the forge, keeps their sessions, and guards the dashboard's routes.
|
Package auth signs humans in to the dashboard, as the local admin or through the file's OIDC, GitHub, Forgejo, Gitea and GitLab sign-ins, decides what each may do from the sign-in's role mapping and the forge, keeps their sessions, and guards the dashboard's routes. |
|
chatgpt
Package chatgpt implements Sign in with ChatGPT and token renewal for reviews that use a ChatGPT plan.
|
Package chatgpt implements Sign in with ChatGPT and token renewal for reviews that use a ChatGPT plan. |
|
chunk
Package chunk cuts source files into declarations.
|
Package chunk cuts source files into declarations. |
|
config
Package config loads process settings from the configuration file and environment.
|
Package config loads process settings from the configuration file and environment. |
|
configfile
Package configfile loads application policy and runtime settings from YAML.
|
Package configfile loads application policy and runtime settings from YAML. |
|
configfile/configfiletest
Package configfiletest builds configurations for tests from one YAML document, as the configuration file holds it.
|
Package configfiletest builds configurations for tests from one YAML document, as the configuration file holds it. |
|
contextpack
Package contextpack builds the review context the runner writes next to the diff: the PR-head overlay (whole declarations the diff touches), exact definitions of identifiers on changed lines, and callers of changed declarations.
|
Package contextpack builds the review context the runner writes next to the diff: the PR-head overlay (whole declarations the diff touches), exact definitions of identifiers on changed lines, and callers of changed declarations. |
|
egress
Package egress is the worker's forward proxy: the one route out of the cluster for runner pods, which reach it through HTTPS_PROXY and have no other egress.
|
Package egress is the worker's forward proxy: the one route out of the cluster for runner pods, which reach it through HTTPS_PROXY and have no other egress. |
|
egresspolicy
Package egresspolicy is what the gateway lets a runner reach: the hosts and addresses it allows and denies, the credentials it adds and the hosts its cache keeps nothing from.
|
Package egresspolicy is what the gateway lets a runner reach: the hosts and addresses it allows and denies, the credentials it adds and the hosts its cache keeps nothing from. |
|
executor
Package executor runs a runner for one review: as a Kubernetes Job in production, in-process for tests and local development.
|
Package executor runs a runner for one review: as a Kubernetes Job in production, in-process for tests and local development. |
|
forge
Package forge is the worker's view of a forge: the few calls a review needs before and after the runner does its work.
|
Package forge is the worker's view of a forge: the few calls a review needs before and after the runner does its work. |
|
forge/forgejo
Package forgejo implements forge.Client against a Forgejo or Gitea instance's REST API, https://<host>/api/v1, with the standard library's HTTP client: requests and responses are written out for the subset of the API kritika needs, which keeps a context on every call.
|
Package forgejo implements forge.Client against a Forgejo or Gitea instance's REST API, https://<host>/api/v1, with the standard library's HTTP client: requests and responses are written out for the subset of the API kritika needs, which keeps a context on every call. |
|
forge/github
Package github is kritika's forge: the App's credentials, a transport that signs requests as the App with a short-lived JWT and one that mints, caches and refreshes an installation token, the forge.Client over an installation, and the App manifest flow.
|
Package github is kritika's forge: the App's credentials, a transport that signs requests as the App with a short-lived JWT and one that mints, caches and refreshes an installation token, the forge.Client over an installation, and the App manifest flow. |
|
forge/gitlab
Package gitlab implements forge.Client against a GitLab instance's REST API, through gitlab.com/gitlab-org/api/client-go.
|
Package gitlab implements forge.Client against a GitLab instance's REST API, through gitlab.com/gitlab-org/api/client-go. |
|
gateway
Package gateway is the worker's listener for runner pods: the egress proxy they reach the outside through, each with its run token, and the model, similar-code and conversation endpoints a review's runner calls with the same token, and the aqua registry it resolves tools against.
|
Package gateway is the worker's listener for runner pods: the egress proxy they reach the outside through, each with its run token, and the model, similar-code and conversation endpoints a review's runner calls with the same token, and the aqua registry it resolves tools against. |
|
gitfetch
Package gitfetch fetches exactly the commits a review needs, the head and the merge-base and, for a re-review, the head and merge base of the last review, at depth one into a throwaway bare repository, and diffs their trees.
|
Package gitfetch fetches exactly the commits a review needs, the head and the merge-base and, for a re-review, the head and merge base of the last review, at depth one into a throwaway bare repository, and diffs their trees. |
|
gittest
Package gittest prepares go-git repositories for tests.
|
Package gittest prepares go-git repositories for tests. |
|
indexer
Package indexer cuts a repository tree into the chunks the embedding index stores.
|
Package indexer cuts a repository tree into the chunks the embedding index stores. |
|
ingest
Package ingest is the only surface a forge reaches.
|
Package ingest is the only surface a forge reaches. |
|
jobs
Package jobs defines the River job arguments that ingest, the leader and the dashboard enqueue and the worker consumes.
|
Package jobs defines the River job arguments that ingest, the leader and the dashboard enqueue and the worker consumes. |
|
jobtimeout
Package jobtimeout holds the River job timeout bounds shared between the worker, which computes each job's timeout, and configfile, which rejects admin settings that would make River's cap cut a job short.
|
Package jobtimeout holds the River job timeout bounds shared between the worker, which computes each job's timeout, and configfile, which rejects admin settings that would make River's cap cut a job short. |
|
metrics
Package metrics is every Prometheus series kritika exports beyond the Go runtime.
|
Package metrics is every Prometheus series kritika exports beyond the Go runtime. |
|
model
Package model is kritika's view of a language model and an embedder.
|
Package model is kritika's view of a language model and an embedder. |
|
poller
Package poller backstops missed webhooks: on the leader, every interval and per account, it lists the open pull requests, hands those updated since the last poll to the ingest dispatcher as if a webhook had delivered them, and closes the ones kritika holds open that the forge no longer lists.
|
Package poller backstops missed webhooks: on the leader, every interval and per account, it lists the open pull requests, hands those updated since the last poll to the ingest dispatcher as if a webhook had delivered them, and closes the ones kritika holds open that the forge no longer lists. |
|
prfilter
Package prfilter compiles and evaluates a CEL boolean expression that decides which pull requests kritika reviews (a condition of the configuration's trigger.include and trigger.exclude lists).
|
Package prfilter compiles and evaluates a CEL boolean expression that decides which pull requests kritika reviews (a condition of the configuration's trigger.include and trigger.exclude lists). |
|
repoconfig
Package repoconfig parses .kritika.yaml, the optional per-repository file that lets a repository narrow how kritika reviews it (a filter ANDed with the admin's own filter, path globs to ignore, which also skip a pull request that changes nothing else), add rules, context files and templates read from the repository itself, and choose its models among what its account may use.
|
Package repoconfig parses .kritika.yaml, the optional per-repository file that lets a repository narrow how kritika reviews it (a filter ANDed with the admin's own filter, path globs to ignore, which also skip a pull request that changes nothing else), add rules, context files and templates read from the repository itself, and choose its models among what its account may use. |
|
review
Package review turns a context pack into a prompt, a model answer into findings, and findings into the comments kritika posts.
|
Package review turns a context pack into a prompt, a model answer into findings, and findings into the comments kritika posts. |
|
rolemap
Package rolemap compiles and evaluates a sign-in's role mapping: a CEL expression over what the identity provider says about a person, whose value decides what that person may do in the dashboard.
|
Package rolemap compiles and evaluates a sign-in's role mapping: a CEL expression over what the identity provider says about a person, whose value decides what that person may do in the dashboard. |
|
runner
Package runner is what a runner pod does: fetch the head and merge-base (and the last reviewed head when there is one), diff them, compute the patch id, decide what the review builds on and whether it is skipped, write a context pack under its own run id, and run the review's agent over it.
|
Package runner is what a runner pod does: fetch the head and merge-base (and the last reviewed head when there is one), diff them, compute the patch id, decide what the review builds on and whether it is skipped, write a context pack under its own run id, and run the review's agent over it. |
|
runspec
Package runspec is what a worker and a runner agree on across images: the job document a worker hands a runner, the credentials delivered beside it, and the names a runner gives the gateway and its own variables.
|
Package runspec is what a worker and a runner agree on across images: the job document a worker hands a runner, the credentials delivered beside it, and the names a runner gives the gateway and its own variables. |
|
server
Package server holds kritika's HTTP listeners.
|
Package server holds kritika's HTTP listeners. |
|
store
Package store owns kritika's Postgres access: the two connection pools, the startup assertion that keeps row-level security honest, schema migrations, the leader lock, account-scoped transactions, and applying the running configuration, the file's and the dashboard's, to the rows it declares.
|
Package store owns kritika's Postgres access: the two connection pools, the startup assertion that keeps row-level security honest, schema migrations, the leader lock, account-scoped transactions, and applying the running configuration, the file's and the dashboard's, to the rows it declares. |
|
store/storetest
Package storetest opens the store on the integration tests' database, the one the test-integration task provisions.
|
Package storetest opens the store on the integration tests' database, the one the test-integration task provisions. |
|
textcut
Package textcut shortens text without splitting a UTF-8 sequence, so a cut string stays valid wherever valid UTF-8 is required, as it is in a Postgres text column.
|
Package textcut shortens text without splitting a UTF-8 sequence, so a cut string stays valid wherever valid UTF-8 is required, as it is in a Postgres text column. |
|
transcript
Package transcript records model calls for the dashboard's transcript view.
|
Package transcript records model calls for the dashboard's transcript view. |
|
udiff
Package udiff reads a unified diff, as git writes one, into its files, their hunks and their lines, and nothing else: what a caller makes of a diff, a prompt's file list, a finding's anchors, the hunks an incremental delta leaves out, stays with the caller.
|
Package udiff reads a unified diff, as git writes one, into its files, their hunks and their lines, and nothing else: what a caller makes of a diff, a prompt's file list, a finding's anchors, the hunks an incremental delta leaves out, stays with the caller. |
|
upstream
Package upstream fetches a repository other than the one under review, such as the upstream of a dependency the change bumps, at one ref into a throwaway bare repository, and writes its files to a directory the run tool's commands can search.
|
Package upstream fetches a repository other than the one under review, such as the upstream of a dependency the change bumps, at one ref into a throwaway bare repository, and writes its files to a directory the run tool's commands can search. |
|
web
Package web embeds the built kritika UI (see internal/web/src) so the kritika binary serves it without any external static-file dependency.
|
Package web embeds the built kritika UI (see internal/web/src) so the kritika binary serves it without any external static-file dependency. |
|
webapi
Package webapi is the dashboard's JSON API and static UI server: reads over each account's reviews, repositories, usage and queue, and over the running configuration, its setup and connections; re-runs, cancels, reindexes and turning repositories on or off, with their audit log; and the server-sent event stream that keeps the UI live.
|
Package webapi is the dashboard's JSON API and static UI server: reads over each account's reviews, repositories, usage and queue, and over the running configuration, its setup and connections; re-runs, cancels, reindexes and turning repositories on or off, with their audit log; and the server-sent event stream that keeps the UI live. |
|
webhook
Package webhook verifies and parses inbound forge webhook requests.
|
Package webhook verifies and parses inbound forge webhook requests. |
|
worker
Package worker consumes River jobs.
|
Package worker consumes River jobs. |
|
scripts
|
|
|
trustedroot
command
Command trustedroot writes Sigstore's public-good trusted root, the keys of its certificate authorities, transparency logs and timestamp authorities, to the file it is given, as Sigstore's TUF repository publishes it: fetched and checked from the root of trust sigstore-go carries, so the file is only ever what that repository signed.
|
Command trustedroot writes Sigstore's public-good trusted root, the keys of its certificate authorities, transparency logs and timestamp authorities, to the file it is given, as Sigstore's TUF repository publishes it: fetched and checked from the root of trust sigstore-go carries, so the file is only ever what that repository signed. |
Click to show internal directories.
Click to hide internal directories.