code-review

code-review is a local, human-in-the-loop code-review workspace. It runs as a single Go binary with an embedded Svelte client and can also serve MCP over stdio. It is loopback-only and does not send repository data to a hosted service.

Install

The easiest way to use code-review on a new machine is to download the ZIP for your operating system and CPU from the repository's GitHub Releases page. Unzip it, put codereview on your PATH, and run:

codereview --version

Release archives are available for Linux (amd64 and arm64), macOS (amd64 and arm64), and Windows (amd64).

Build from source

For development, install mise and Git. Then trust the checked-out configuration once and install its pinned tools:

mise trust
mise install
mise run build-all

The pinned toolchain includes Go, Node.js, Playwright, and UPX. mise run build-all builds the frontend, embeds it in the Go binary, and writes dist/codereview.

Quick start

Review the current repository against main:

codereview --base main

Or review a different repository:

codereview --path /path/to/repository --base main

The browser opens automatically. Pass --no-open to suppress it. The positional path and --path are both supported; with neither, the current directory is used.

Common commands

Command	Purpose
mise run dev	Start the Go server and Vite development server.
mise run build-all	Build the embedded production binary.
mise run test	Run Go tests.
mise run verify	Run the complete Go, frontend, and browser verification suite.
mise run release	Build and smoke-test all release ZIPs locally.
mise run clean	Remove dist/ build output.

Useful CLI options include --port, --state-dir, --depth, --submodule-depth, --max-discovery-contexts, --repository-key, --output, --request-timeout, and --max-git-output. Run codereview --help for the full list, including worktree management commands.

MCP

Register the executable with an MCP client:

{
  "mcpServers": {
    "code-review": {
      "command": "/absolute/path/to/codereview",
      "args": ["--mcp"]
    }
  }
}

The MCP server identifies itself as code-review. Its tool names currently keep the established hitl_* compatibility prefix: hitl_discover_contexts, hitl_review, hitl_review_start, hitl_review_status, hitl_review_resume, and hitl_review_cancel.

Start with hitl_discover_contexts for a multi-repository workspace, then pass the returned repositoryKey to a review tool. Tool selection is fail-closed and does not silently switch to another repository.

Configuration and limits

Nested submodule discovery defaults to depth 8 and up to 4096 discovered contexts. Override them with --submodule-depth and --max-discovery-contexts, or CODEREVIEW_SUBMODULE_DEPTH and CODEREVIEW_MAX_DISCOVERY_CONTEXTS.

Submodule depth is capped at 32; context discovery is capped at 10000. Truncated discovery is reported in the workspace UI instead of being silently treated as complete.

Git and API operations default to a five-minute timeout. Override it with --request-timeout or CODEREVIEW_REQUEST_TIMEOUT; accepted values range from 1s to 30m.

Git command output defaults to 32MiB. Override it with --max-git-output or CODEREVIEW_MAX_GIT_OUTPUT; accepted values range from 1B to 1GiB.

Releases

Pushing a stable semantic-version tag, such as v1.2.3, validates the tagged commit, builds all platform archives, creates a GitHub Release, and attaches the ZIPs. The tag must point to a commit on main.

git tag -a v1.2.3 -m "Release v1.2.3"
git push origin v1.2.3

GitHub tag rules restrict release-tag creation to the repository owner. The release workflow is intentionally the publisher; normal CI never publishes a release.

Diagnostics and safety

Enable structured terminal diagnostics with CODEREVIEW_LOG_LEVEL=debug or --log-level debug. Logs go to stderr; the browser receives generic operational errors so local paths, Git stderr, and review data are not exposed over HTTP.

Review state is scoped to its repository, worktree or submodule, and base ref. The embedded server binds to loopback, protects mutations with a per-process CSRF token, and serves the UI with a strict content-security policy.