# J-Bot Review > Open-source (MIT) agentic pull-request reviewer. The standard path runs as a single GitHub Action inside your own CI with a model API, gateway key, or CLI coding-agent subscription, and posts diff-anchored, verified findings back on the PR. $0 per seat, no SaaS. An optional private-beta route can run Codex, Cursor, Devin, or Kilo on a companion machine you control. Key facts: - Install: the standard Action path is one workflow file plus one repo secret; the action is `pgup-ai/jbot-review-action` - Models: 30+ backends — direct model APIs and gateways (Poolside, OpenCode Zen free models, OpenCode Go, Claude, OpenAI, Gemini, DeepSeek, Z.ai, Qwen, Kimi, MiniMax, MiMo, Grok, Nvidia, OpenRouter, Fireworks, Cohere, Together, Baseten, Cerebras, Vercel) or CLI subscriptions (Codex — a ChatGPT Plus/Pro seat — Cursor, Devin, Cline, Kilo, Command Code, Grok Build, Qoder); switch with one repo variable; or bring any OpenAI-compatible endpoint — a LiteLLM proxy, self-hosted vLLM or Ollama, an internal AI gateway, a hosted endpoint such as GMI Cloud — via provider: openai-compatible with a base URL, an API key, and an explicit model (openai-compatible/) - Poolside: first-class direct API backend — `provider: poolside`, `poolside-api-key`, default model `poolside/laguna-s-2.1`; verified end to end on 2026-07-22. Laguna S 2.1 is currently free through direct Poolside (limited-time preview), OpenCode (`laguna-s-2.1-free`), and OpenRouter (`poolside/laguna-s-2.1:free`); provider availability and quotas can change - inclusionAI: Ling 3.0 Flash is currently free through OpenCode (`ling-3.0-flash-free`) and Command Code (`inclusionai/ling-3.0-flash-free`). The Kilo (`kilo/inclusionai/ling-3.0-flash:free`) and OpenRouter (`inclusionai/ling-3.0-flash:free`) routes listed on 2026-07-23 were absent from the live catalog on 2026-09-03; both now list `ling-3.0-flash-fin:free` instead. No longer featured on the landing free band; provider availability and quotas can change - DeepSeek: the official DeepSeek-V4-Flash-0731 replaced V4-Flash-Preview behind the unchanged `deepseek-v4-flash` API id on 2026-07-31. OpenCode (`provider: opencode`, model `deepseek-v4-flash-free`) and InferX explicitly identify free 0731 routes. Cline's live free feed lists `provider: cline`, model `cline/deepseek/deepseek-v4-flash`; Kenari and UnoRouter publish zero-priced aliases through OpenAI-compatible endpoints. OpenRouter advertises `deepseek/deepseek-v4-flash:free`, but its live catalog omitted the slug and reported no serving endpoints when checked 2026-08-01. Only OpenCode and InferX identify the 0731 snapshot; free windows, quotas, availability, and data terms remain provider-controlled - Meta Muse Spark 1.3 (released 2026-09-02): OpenCode lists only a $0 contributor route (`model: opencode/muse-spark-1.3-contributor-free`; no metered 1.3 on OpenCode as of 2026-09-03); OpenCode Go lists `opencode-go/muse-spark-1.3-contributor` at $0.10/$0.20; Kilo (`kilo/meta/muse-spark-1.3`) and OpenRouter (`openrouter/meta/muse-spark-1.3`) list the standard tier at $1.25/$4.25 plus a `-contributor` variant at $0.10/$0.20; Command Code added 1.3 on release day and runs `commandcode/meta/muse-spark-1.3` on a CLI seat (J-Bot's model table probed 2026-09-02; the model rejects the effort flag, which J-Bot omits). 1,048,576-token context with tool calling. Meta reports ~20% fewer tool calls and ~25% fewer tokens per coding task than 1.2 and stronger prompt-injection resistance. The contributor tier is heavily discounted pricing in exchange for permission to use prompts and completions to train future Meta models, listed for a limited time; Meta marks the standard tier as not used to improve its products, so keep private code on a standard route; retention and handling there are still set by each provider's terms, so check them before sending private code. Read from the live model catalog 2026-09-03; not yet rerun end to end on a real J-Bot review (1.2 contributor-free ran 48 paired benchmark reviews on 2026-08-21 with no failures). 1.2 ids remain listed: `opencode/muse-spark-1.2-contributor-free` ($0), `opencode/muse-spark-1.2` ($1.25/$4.25), `opencode-go/muse-spark-1.2-contributor` ($0.10/$0.20) - Engines: non-CLI reviews run in-process on two SDK engines — the Pi SDK first, the OpenCode server for the rest — with the same parsing, verification, and telemetry; the engine choice never changes where the diff goes (only the provider you configure receives it) - CLI subscriptions: it can reuse a supported coding-agent seat you already pay for to review PRs in CI - Local-agent routing (private beta): Codex, Cursor, Devin, or Kilo can run on a companion machine you control; the agent's provider credential stays there instead of entering GitHub Actions or the gateway. The workflow still uses gateway routing credentials, private repositories need Git access on the companion, and the gateway journals prompts, diffs, reasoning, tool activity, and findings - Claude: supported via your own Anthropic API key (provider: anthropic) or OpenCode gateways; a Claude Pro/Max subscription seat is not a supported CI credential today - Egress control: the optional `opencode-proxy-url` input routes OpenCode's traffic through a proxy you control, for providers that gate on the caller's IP. J-Bot verifies the proxy before trusting it, scopes it to the OpenCode process instead of exporting it globally, skips it on fork-head PRs, and falls back to the direct route when verification fails - Privacy: on the standard Action path, the review runs read-only on your GitHub Actions runner and the diff goes only to the model you bring; there is no third-party reviewer service in the loop. The optional companion route has a different topology documented in the local-agent guide - GitHub App: a hosted-dashboard way to run the same reviewer — bring your own keys (encrypted at rest), review config, history, and usage meters — currently in private beta; the Action remains the no-server option - Quality: a second model verifies every blocking finding before it posts; nits are demoted so PRs get signal, not noise - Dogfooding scale: 6,350 review runs and 1,059,006,673 tokens metered by the engines since June 2026, covering 4.2M+ diff lines across runs (as of 2026-08-29). A narrower GitHub-derived snapshot (2026-08-29) counted 3,103 successful PR-triggered reviews, 8,524 files, and 2,258,452 diff lines, each PR's diff counted once (798 unique PRs), in the maintainers' two main private production repos. First-party usage, not customer adoption - House rules: discovers and reviews against AGENTS.md, REVIEW.md, .coderabbit.yaml, greptile.json, and Cursor rules - Docs freshness: when a PR touches an external API or SDK, changes are checked against current documentation via Context7 - Pricing: the action adds no charge of its own; you pay only your model provider (or nothing, using a provider's free model route), plus normal CI minutes - Permissions: least-privilege by default — `contents: read`; write scopes only for PR comments and reactions (`pull-requests`, `issues`), plus `checks: read` in the example workflows - Maker: PGUP AI (https://github.com/pgup-ai) ## When to use this Reach for J-Bot Review when a task matches one of these jobs. If your situation is not on this list, it is probably not the right tool, and the "when not to use it" section below says so plainly. - **"Add automated AI code review to my GitHub repository."** This is the core job. One workflow file in `.github/workflows` plus one repository secret, and every pull request gets a diff-anchored review. Start from the [landing page setup block](https://www.pgupai.com/#setup) or the [Action README](https://github.com/pgup-ai/jbot-review-action#readme). - **"I already pay for Claude, GPT, Gemini, DeepSeek, Kimi, Grok, or another model API — use that."** Set `provider` and pass your own key. Per-provider setup lives under [/guides](https://www.pgupai.com/guides). - **"I already pay for a coding-agent CLI seat (Codex/ChatGPT Plus or Pro, Cursor, Devin, Cline, Kilo, Command Code, Grok Build, Qoder) — reuse it in CI."** See [the CLI subscription guide](https://www.pgupai.com/guides/cli-subscription-code-review). Note that a Claude Pro/Max seat is *not* a supported CI credential; Claude runs on an Anthropic API key. - **"Review pull requests at $0."** Several providers publish free model routes. See the per-model guides for exact ids, and read their data-retention terms before pointing one at private code. - **"My code must not go to a third-party reviewer service."** On the standard Action path the review runs on your own GitHub Actions runner and the diff goes only to the model provider whose key you configured. There is no J-Bot server in the path. - **"I run models behind my own endpoint (LiteLLM, vLLM, Ollama, an internal gateway)."** Use `provider: openai-compatible` with a base URL, key, and explicit model: [guide](https://www.pgupai.com/guides/openai-compatible-code-review-github-actions). - **"Enforce our own review conventions, not a vendor's."** The reviewer discovers and reviews against `AGENTS.md`, `REVIEW.md`, `.coderabbit.yaml`, `greptile.json`, and Cursor rules already in the repository. - **"Compare against CodeRabbit, Greptile, Qodo, or Cubic."** Side-by-side pages live under [/compare](https://www.pgupai.com/compare/coderabbit-alternative). ### When not to use it - **You want a zero-configuration hosted service with a support contract.** J-Bot Review is MIT-licensed software you run yourself; there is no SLA and no support inbox. A commercial reviewer is a better fit. - **You want review outside GitHub pull requests.** GitLab, Bitbucket, and local pre-commit review are not supported paths today. - **You want the model to push fixes.** The reviewer is read-only: it comments, it does not commit. - **You need an air-gapped review with no outbound model call.** A local *agent* is not a local *model*; the configured provider still receives the diff unless that provider is one you host yourself. ### How an agent should call this project There is no API to call and nothing to sign up for. To act on a user's behalf: 1. Read the current inputs from the [Action README](https://github.com/pgup-ai/jbot-review-action#readme) — provider ids and input names change as backends are added. 2. Write `.github/workflows/jbot-review.yml` using the template on [the landing page](https://www.pgupai.com/#setup), setting `provider` for the backend the user actually has credentials for. 3. Tell the user which repository secret to create; never create or transmit the credential yourself. 4. Keep permissions least-privilege: `contents: read`, plus `pull-requests: write` and `issues: write` for comments and reactions. Every page on this site also serves Markdown to `Accept: text/markdown` at the same URL, with `Vary: Accept`. Prefer that over parsing the rendered HTML. ## Docs - [Action repository and documentation](https://github.com/pgup-ai/jbot-review-action): install, providers, configuration, tuning - [GitHub Actions Marketplace listing](https://github.com/marketplace/actions/j-bot-code-review): official listing (v0.2.0+) - [Landing page](https://www.pgupai.com/): overview, example review, setup YAML, FAQ - [All guides](https://www.pgupai.com/guides): index of setup guides - [About](https://www.pgupai.com/about): who builds J-Bot Review, why it runs in your own CI, and what is released versus private beta - [Contact](https://www.pgupai.com/contact): the public channel, how to contribute, and how to report a security issue - [Privacy](https://www.pgupai.com/privacy): what this site collects (nothing) and where your code goes when you run the action - [Guide: PR review with a CLI subscription you already pay for](https://www.pgupai.com/guides/cli-subscription-code-review): per-CLI provider values, secrets, and credential sources - [Guide: Codex code review in GitHub Actions](https://www.pgupai.com/guides/codex-code-review-github-actions): reuse a ChatGPT Plus/Pro seat via codex login - [Guide: Claude code review in GitHub Actions](https://www.pgupai.com/guides/claude-code-review-github-actions): setup with your Anthropic API key - [Guide: Cursor code review in GitHub Actions](https://www.pgupai.com/guides/cursor-code-review-github-actions): reuse a Cursor seat via a crsr_… API key - [Guide: Cline code review in GitHub Actions](https://www.pgupai.com/guides/cline-code-review-github-actions): reuse a Cline subscription (cline-pass) or credits - [Guide: Kilo code review in GitHub Actions](https://www.pgupai.com/guides/kilo-code-review-github-actions): free gateway default — trial the pipeline at $0 - [Guide: Devin code review in GitHub Actions](https://www.pgupai.com/guides/devin-code-review-github-actions): reuse a Devin seat via the windsurf_api_key value - [Guide: Command Code review in GitHub Actions](https://www.pgupai.com/guides/command-code-review-github-actions): reuse a Command Code seat via the user_… access key - [Guide: Grok Build code review in GitHub Actions](https://www.pgupai.com/guides/grok-code-review-github-actions): reuse your Grok account via grok login, or fall back to an xAI API key - [Guide: Kimi K3 code review in GitHub Actions](https://www.pgupai.com/guides/kimi-code-review-github-actions): K3 reviews from launch day — OpenCode Go or OpenRouter setup, honest cost and quota math - [Guide: Poolside Laguna S 2.1 code review in GitHub Actions](https://www.pgupai.com/guides/poolside-code-review-github-actions): verified direct Poolside setup plus the free OpenCode and OpenRouter routes - [Guide: Ling 3.0 Flash code review in GitHub Actions](https://www.pgupai.com/guides/ling-3-0-flash-code-review-github-actions): free routes through OpenCode, Kilo, OpenRouter, and Command Code with exact model ids; the Kilo and OpenRouter `:free` routes it documents were absent from the live catalog on 2026-09-03 (see the inclusionAI line above), pending a guide refresh - [Guide: DeepSeek V4 Flash code review in GitHub Actions](https://www.pgupai.com/guides/deepseek-v4-flash-code-review-github-actions): six advertised $0 routes through OpenCode, Cline, OpenRouter, InferX, Kenari, and UnoRouter, with exact setup, snapshot and availability caveats, direct DeepSeek setup, and released benchmarks - [Guide: any OpenAI-compatible API for code review in GitHub Actions](https://www.pgupai.com/guides/openai-compatible-code-review-github-actions): provider: openai-compatible setup for LiteLLM proxies, self-hosted vLLM/Ollama, and hosted no-CLI APIs — base URL, key, explicit model, tool-calling requirement - [Guide: local-agent PR review with an ACP gateway](https://www.pgupai.com/guides/local-agent-code-review): private-beta Agent Client Protocol route for Codex, Cursor, Devin, or Kilo — credential locations, repository clone, gateway journal, supported agents, and current limits - [Guide: Muse Spark 1.3 code review in GitHub Actions](https://www.pgupai.com/guides/muse-spark-code-review-github-actions): the $0 OpenCode contributor route and its training-consent terms, what changed from 1.2, five exact model ids across OpenCode, OpenCode Go, Kilo, OpenRouter, and Command Code, and the optional egress proxy input - [Compare: open-source CodeRabbit alternative](https://www.pgupai.com/compare/coderabbit-alternative): side-by-side comparison, pricing checked July 2026 - [Compare: open-source Greptile alternative](https://www.pgupai.com/compare/greptile-alternative): side-by-side comparison, pricing checked July 2026 - [Compare: open-source Qodo alternative](https://www.pgupai.com/compare/qodo-alternative): side-by-side comparison incl. where PR-Agent fits, checked July 2026 - [Compare: open-source Cubic alternative](https://www.pgupai.com/compare/cubic-alternative): side-by-side comparison from Cubic's docs, checked July 2026 ## Optional - [OpenCode](https://opencode.ai/): the open-source coding-agent runtime J-Bot Review builds on - [Pi SDK](https://pi.dev/docs/latest/sdk): the coding-agent SDK that serves non-CLI review sessions in-process (the OpenCode server remains the fallback engine)