Codra

Codra is an open-source, self-hosted AI pull request reviewer built by Devarshi Shimpi. It listens to GitHub pull request events, runs model-based review jobs, and posts inline findings, a summary review and a check run back to GitHub. The README marks it as beta: the Cloudflare Worker deployment is described as stable for self-hosted use, while Node.js/Docker standalone is newer and still being hardened.

What It Is

Codra is pull request review infrastructure that you run in your own account. You operate the GitHub App, the runtime (Cloudflare Workers, Node.js 24 or Docker), a PostgreSQL database, a queue (Cloudflare Queues or BullMQ + Redis) and the dashboard. It reviews diffs for correctness, security, performance, maintainability and repository-specific patterns. Findings are attached to changed lines with a severity and a confidence score.

How a Review Runs

GitHub sends a webhook, Codra verifies the signature and loads the repository's settings, stores a job and queues it. The worker fetches the diff, reviews each file separately, and runs evidence, refutation and claim-type gates that filter candidate findings. Surviving findings are deduplicated against earlier runs, ranked, capped at a comment budget and posted. A confidence floor and severity gate keep low-certainty comments from being posted. Findings use a neutral check conclusion, and Codra does not push commits or open pull requests.

Configuration and Models

Settings can be tuned per repository from the dashboard, including triggers, skipped paths, draft handling, mention-triggered reviews, labels, custom rules and review budgets. Model routing supports global defaults, per-repository chains, fallbacks and size-based overrides. The homepage lists built-in providers (Workers AI, OpenAI, Anthropic, Gemini, OpenRouter and xAI) plus custom compatible endpoints, and the README also mentions NVIDIA. Provider keys are encrypted before database storage.

Operations and Licensing

PostgreSQL stores jobs, file reviews, inline comments and webhook deliveries so runs can be inspected, retried or rerun from the dashboard. The core is licensed under AGPL-3.0.