code review that shows its work
bduck is a github app that reviews pull requests with a fixed team of models: triage, scouts, two reviewers and a verifier. ask it questions in the thread, watch every run as it happens, and get fixes as draft prs.
01how it works19-4052 classic blue
how a review runs
every review runs the same pipeline, pinned to the head commit. triage reads the change and plans up to four scouts; scouts collect facts from the source around it; two reviewers propose findings; a verifier keeps or rejects each one before anything is posted.
models are set by the operator, not by comments. every result names the workflow that produced it.
- inline findings above your confidence bar
- a summary, with how the review ran
- an advisory checknever a merge gate
- 🚀 when it's donenot an approval
02commands18-3838 ultra violet
ask it in the thread
post /bduck and a question on any pull request. bduck routes it by intent and answers from the source, the conversation and its own run records. it only listens to people who can write to the repository.
- you/bduck is F2 real? the cache is cleared on logout.
- bduckreads session.ts and logout.ts
- bduckyes. logout clears the cache, but refresh() writes the old token back after it returns (session.ts:88).
- you/bduck fix F2 in a draft pr
/bduck review# review the full current diff/bduck <question or request># "is F2 real?", "why was a proposal dropped?"/bduck status# mode, last reviewed head, queue position/bduck help
03live runs15-0343 greenery
watch every run
every review, question and fix gets a page that streams while it runs: each stage's reasoning and answer, the files it reads (path and lines, never contents), and its time and tokens. finished stages fold into one line.
viewers sign in with github and need read access to the repository. transcripts are kept for 7 days.
- run #318 · review
- triageopus · 9s
- scouts3 × haiku · 41s
- src/session.tslines 60–140
- src/logout.tslines 1–48
- correctnessgpt-6.1-sol · 1m 52s
- securitygpt-6-astra · 1m 20s
- verifyopus · 38s
- summarygemini · 11s
- reasoning and answers as they stream
- files read: path and lines
- time and tokens per stage
- file contentsnever sent to the page
- promptsnever sent to the page
04fixes16-1546 living coral
fixes arrive as a draft pr
ask for a fix and bduck applies it in a disposable sandbox, runs checks there without network, and opens a draft pull request against your branch. when ci finishes on it, bduck reports the result back on your pr.
fixes are off until the operator turns them on, and each repository can turn them off again.
- never pushes to your branch
- never merges
- no credentials in the sandbox
- no network unless you allow itbase branch .bduck.yaml
05guardrails18-1750 viva magenta
the model is never the gate
everything in a pull request is untrusted, including what the models write about it. permissions, pins and limits live in code, never in a prompt.
- signed webhooks
- github's signature is checked over the raw bytes before anything is parsed or queued.
- write access, every time
- each command re-checks that the commenter can write to the repository. the model never decides who may ask.
- pinned to one commit
- reads use the reviewed head. if the branch moves mid-review, nothing stale gets posted.
- config from the base branch
- .bduck.yaml is read from the base branch only, so a pull request cannot loosen its own review.
- fixed models
- models, reasoning and limits come from the operator's workflow file. a comment cannot pick a model.
- one tool
- agents can only read the pinned source: no shell, no network, no file writes, no github api.
06join the list13-0647 illuminating
join the list
bduck runs only on github accounts and orgs we approve. tell us where you want it, and we'll email you when it's on.
one email when you're approved. nothing else, and no cookies on this site.