Home / Guides / CLI subscriptions

Automated PR review with a CLI subscription you already pay for

Updated July 11, 2026 · applies to pgup-ai/jbot-review-action v0

Yes — the coding-agent seat you already pay for can review your pull requests. If you subscribe to Codex (ChatGPT Plus/Pro), Cursor, Devin, Cline, Kilo, Command Code, Grok Build, or Qoder, J-Bot Review — an open-source (MIT) GitHub Action — runs that CLI inside your own GitHub Actions and posts diff-anchored, verified review comments on every PR. One workflow file, one repo secret, $0 added by J-Bot.

Hosted AI reviewers (CodeRabbit, Greptile, and similar) charge roughly $40 per seat per month and run your code through their own servers. None of them can reuse a CLI subscription; as far as we know, J-Bot Review is the only PR reviewer that can.

The base workflow (one file)

Commit this as .github/workflows/jbot-review.yml. The provider line and one secret change per CLI — the table below has every combination.

name: J-Bot Code Review
on:
  pull_request: { types: [opened, reopened, ready_for_review, synchronize] }

concurrency:
  group: jbot-review-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: write
  issues: write        # PR reactions use the issues API
  checks: read

jobs:
  review:
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with: { fetch-depth: 0 }
      - uses: pgup-ai/jbot-review-action@v0
        with:
          provider: codex                              # ← pick yours from the table
          codex-auth: ${{ secrets.CODEX_AUTH_JSON }}  # ← and its matching secret
          github-token: ${{ secrets.GITHUB_TOKEN }}

Per-CLI setup: provider, secret, and where the credential comes from

Each subscription maps to a provider value plus one action input, fed from a repository secret (Settings → Secrets and variables → Actions). Use the credential from the same account or local CLI setup you already use.

Notes that save you a debugging session

• Codex runs read-only (codex exec --sandbox read-only). The secret is the whole auth.json file content, not a key inside it. Full setup: Codex code review in GitHub Actions.
• Cursor authenticates straight from CURSOR_API_KEY and runs in read-only plan mode (cursor-agent --mode plan).
• Cline has two billing modes as separate providers sharing one secret. Pin models as cline/<type>/<model> or cline-pass/<model>, or omit model for each mode's default.
• Devin and Command Code want a key value copied out of the credential file — windsurf_api_key (devin-session-token$…) and apiKey (user_…) respectively — not the whole file, unlike Codex, Cline, Kilo, and Grok Build.
• Kilo defaults to its free gateway model — a $0 way to trial the whole pipeline.
• Grok Build prefers account auth: the xai-api-key fallback is used only when grok-auth is absent, so an expired login fails loudly instead of silently billing your API key. provider: grok is deliberately separate from provider: xai, which keeps calling the xAI API directly.
• Qoder uses a Personal Access Token from Qoder Integrations. Set provider: qoder and pass it through qoder-token.
• These are credentials on your account: store them as repo secrets (never variables), and check your plan's terms for CI/automation use.
• On pull_request events GitHub strips secrets from fork PRs, so outside contributors can't exfiltrate your seat.

What you get on every PR

• Diff-anchored findings across the full base…head diff, posted as normal review comments with a verdict.
• Verified before posting: a second session adversarially re-checks every blocking finding; refuted ones are dropped, uncertain ones demoted to advisory. Nits are demoted so the PR gets signal, not noise.
• Your house rules: it discovers AGENTS.md, REVIEW.md, .coderabbit.yaml, greptile.json, and Cursor rules, and reviews against them.
• Current-docs checks: when a PR touches an external API or SDK, Context7 verifies the change against live documentation.
• Read-only: the runner checkout is never written to; least-privilege permissions are the default.

Cost & privacy

• $0 added by J-Bot — MIT-licensed action, no reviewer SaaS account, no per-seat bill. You pay normal CI minutes.
• No new data recipient: the diff goes only to the CLI's own backend under your account — the same vendor your editor already sends code to.
• Tunable spend: defaults are one review pass with verification on; raise review-passes for recall or set min-severity to trim output. Doc-only PRs skip the model entirely.

FAQ

Related