Bubo 🦉
This wise owl is Bubo, an agentic AI code reviewer that reviews your GitLab MRs and GitHub PRs with the LLM model of your choice, and posts only the findings worth acting on as inline threads — no chatbot noise, no praise, no summaries.
- Signal over noise — evidence-backed inline findings, confidence gates, optional verification, and deduplication.
- Your model, your infrastructure — OpenAI, Anthropic, or another CLI-backed reviewer with your own deployment.
- Feedback-driven reviews — recorded outcomes help tune thresholds and suppress recurring unwanted findings.
- Review evidence, in one place — local dashboards and reports for findings, usage, policy decisions, and outcomes.
- Compliance - cosign-signed releases with SBOMs, auditable on-prem report
- Metrics and RoI — Read about real world metrics and ROI
Run continuous reviews through polling, or trigger reviews through MCP. The experimental GitHub Action.
Install
uv tool install bubo # or: pipx install bubo
bubo init # idempotent; seeds config + workspace + DB
bubo doctor # verify before the first poll
bubo-poller service start # start the review service (polling + outcome sync)
Container → docker pull ghcr.io/mountainowl/bubo - Bring your own LLM CLI, you can use multiple architectures.
Documentation
Everything lives on the docs site — this README is just the front door.
| Recipes | Copy-paste GitLab / GitHub / in-house-model setups. |
| Features | The full capability list. |
| Configuration | Every setting, per section, plus a quick-start config. |
| Operate | Deploy, schedule, grade outcomes, governance report. |
| Troubleshooting | Host / infra fixes (sandbox, AppArmor). |
| Metrics & telemetry | Emitted llm_review.* metrics and dashboards. |
| Updates & recovery | Automatic/manual updates, safe deferrals and issue-ready failure reports; platform acceptance status. |
Community
Contributing · Security policy · Release verification · Support · Code of conduct · License: MIT
1 maintainer
Metadata
1 maintainer
Release files for bubo 0.31.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| bubo-0.31.0.tar.gz | 475.9 kB | With provenance | Details for bubo-0.31.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| bubo-0.31.0-py3-none-any.whl | Python 3 | none | any | Details for bubo-0.31.0-py3-none-any.whl |
Total release size: 891.6 kB
Release files / bubo-0.31.0.tar.gz
| Download URL | bubo-0.31.0.tar.gz |
|---|---|
| Size | 475.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
1926eaffc54d2b101aa8efd51fe80abb94499f79bca7b287a8afcd6c73178501
|
|
BLAKE2b-256 checksum How to use checksums |
b070bbb63f4672c56038a8871302957f2ef6271fce98345fbc580d70a31026ab
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 22, 2026.
Transparency logRelease files / bubo-0.31.0-py3-none-any.whl
| Download URL | bubo-0.31.0-py3-none-any.whl |
|---|---|
| Size | 415.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
34e4b69561de7fec1106f96238c0ab4e139d0cae4ec5fa9e7e2929365ba7cf28
|
|
BLAKE2b-256 checksum How to use checksums |
02492a78540544963376a734eb7495745ebc6c3ebcf3273e8bccaa9589f70225
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 22, 2026.
Transparency logSecurity for bubo 0.31.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for bubo-0.31.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 22, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
