reviewkit 0.1.0

AI-powered code review CLI tool for GitHub PRs

reviewkit

AI-powered code review CLI. Runs 100% locally — your code never leaves your machine.

Install

pip install reviewkit

Usage

Review a GitHub PR

reviewkit review https://github.com/owner/repo/pull/123

Review local changes

reviewkit review --path ./myproject

Scan entire directory

reviewkit scan ./src

Output formats

# JSON output
reviewkit review https://github.com/owner/repo/pull/123 --format json

# Markdown report
reviewkit scan . --format markdown --output report.md

Filter by severity

reviewkit scan . --severity high

What it checks

Security (SEC-*)

• Hardcoded secrets and API keys
• SQL injection vulnerabilities
• Command injection (os.system, shell=True)
• Dangerous eval()/exec() usage
• Insecure random for crypto
• Disabled SSL verification
• Insecure deserialization (pickle)
• XSS via innerHTML
• Weak hash algorithms (MD5/SHA1)

Performance (PERF-*)

• String concatenation in loops
• List membership testing (use sets)
• Nested loop detection
• len() in loop conditions

Code Quality (QUAL-*)

• TODO/FIXME/HACK comments
• Overly long functions (>50 lines)
• Bare except clauses
• Unused imports
• Magic numbers
• console.log in JS
• == instead of === in JS

General (GEN-*)

• Lines over 120 characters
• Trailing whitespace

Rules

reviewkit rules

Lists all available review rules with severity levels.

CI Integration

GitHub Actions

- name: Code Review
  run: |
    pip install reviewkit
    reviewkit review ${{ github.event.pull_request.html_url }} --severity high

Exit codes:

• 0 — No critical/high issues
• 1 — Critical issues found (blocks merge)

GitHub Token

For private repos, set GITHUB_TOKEN:

export GITHUB_TOKEN=ghp_xxxxxxxxxxxx

License

MIT