Skip to main content

Bubo 🦉

PyPI Python 3.14+ Docker: GHCR GitHub Action CI SCM adapters OpenTelemetry OpenSSF Scorecard Signed with cosign SLSA 3 Ruff Managed with uv Docs License: MIT

Bubo AI code review tone examples

This wise owl is Bubo, an agentic AI code reviewer that reviews your GitLab MRs and GitHub PRs with the LLM model of your choice, and posts only the findings worth acting on as inline threads — no chatbot noise, no praise, no summaries.

  • Signal over noise — evidence-backed inline findings, confidence gates, optional verification, and deduplication.
  • Your model, your infrastructure — OpenAI, Anthropic, or another CLI-backed reviewer with your own deployment.
  • Feedback-driven reviews — recorded outcomes help tune thresholds and suppress recurring unwanted findings.
  • Review evidence, in one place — local dashboards and reports for findings, usage, policy decisions, and outcomes.
  • Compliance - cosign-signed releases with SBOMs, auditable on-prem report
  • Metrics and RoI — Read about real world metrics and ROI

Run continuous reviews through polling, or trigger reviews through MCP. The experimental GitHub Action.

Bubo dashboard, review activity, and reports shown as layered interface previews

Install

uv tool install bubo     # or: pipx install bubo
bubo init                # idempotent; seeds config + workspace + DB
bubo doctor              # verify before the first poll
bubo-poller service start # start the review service (polling + outcome sync)

Container → docker pull ghcr.io/mountainowl/bubo - Bring your own LLM CLI, you can use multiple architectures.

Documentation

Everything lives on the docs site — this README is just the front door.

Recipes Copy-paste GitLab / GitHub / in-house-model setups.
Features The full capability list.
Configuration Every setting, per section, plus a quick-start config.
Operate Deploy, schedule, grade outcomes, governance report.
Troubleshooting Host / infra fixes (sandbox, AppArmor).
Metrics & telemetry Emitted llm_review.* metrics and dashboards.
Updates & recovery Automatic/manual updates, safe deferrals and issue-ready failure reports; platform acceptance status.

Community

Contributing · Security policy · Release verification · Support · Code of conduct · License: MIT

Metadata

Release files for bubo 0.29.2

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for bubo 0.29.2
File Size Uploaded Provenance Actions
bubo-0.29.2.tar.gz 594.1 kB With provenance Details for bubo-0.29.2.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for bubo 0.29.2
File Interpreter ABI Platform Actions
bubo-0.29.2-py3-none-any.whl Python 3 none any Details for bubo-0.29.2-py3-none-any.whl

Total release size: 983.0 kB

Release files / bubo-0.29.2.tar.gz

Download URL bubo-0.29.2.tar.gz
Size 594.1 kB
Tags Source
SHA-256 checksum
How to use checksums
433f50dd6f8c5a99baaecdf6203322af76182b180299900dd716ff0c5745d1c5
BLAKE2b-256 checksum
How to use checksums
bf689179e728349f59ff407690439c7b093fc02ac43b5ee3607581059b5c5f13
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.

Transparency log

Release files / bubo-0.29.2-py3-none-any.whl

Download URL bubo-0.29.2-py3-none-any.whl
Size 389.0 kB
Tags Python 3
SHA-256 checksum
How to use checksums
9aa7ba079ecc248b247cb56d54f5bdd94ce7f5a594ef10632ea4abb51e97d319
BLAKE2b-256 checksum
How to use checksums
e0ec493ae16b7f23bd86e765babfb03524f5676f8901e8d30e113c926a4754f0
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.

Transparency log

Security for bubo 0.29.2

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for bubo-0.29.2.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 18, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Release history Release notifications | RSS feed

This release

0.29.2 This release

2 release files Full provenance

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page