Guard your pull requests
with an AI that sees everything

Heimdall is an AI code review bot for GitHub. Model-agnostic, self-hostable, and always on call β€” it reviews every PR with severity grading, inline comments, and executable diff suggestions.

Get started in 2 minutes Read the docs
# add an AI reviewer to any repo β€” copy 2 files
cp template/heimdall-review.yml .github/workflows/
cp scripts/heimdall-review.js scripts/
# then in any PR: comment @CoderHeimdall

Everything Copilot Review should be

Model freedom, private deployment, and reports you can actually act on.

🧠

Model freedom

Claude, GPT, Gemini, or a local Ollama/vLLM β€” you pick. One unified AI_API_KEY + AI_BASE_URL.

🎯

Inline comments + diff

Every issue pinned to its code line, with an actionable title, a fix suggestion, and an executable diff (even 1-Click Suggestions).

πŸ›‘οΈ

On-demand review

PRs stay quiet until you say the word β€” comment @CoderHeimdall. Or set auto_review: true.

πŸ”

Deep checks

Trust-boundary, sensitive-field leakage, fake implementations, N+1, swallowed exceptions β€” caught and graded.

🌐

Bilingual reports

REVIEW_LANGUAGE = en (default), zh, or bilingual. One bot, every team.

🧩

Configurable

.github/heimdall.yml β€” include/exclude files, min severity, custom instructions, whitelist, block-on-critical.

πŸš€

Three deployment modes

GitHub Actions (per-repo), Cloudflare Workers (installable App), or Probot self-hosted β€” code stays on your infra.

πŸ”

No spam

Triple dedup means one review per commit. No duplicate review dumps.

A review report you can act on

Change summary, severity table, focus areas, verification steps β€” then pinned inline comments with diffs.

## πŸ›‘οΈ Heimdall Β· Code Review Report
Change Summary: 2 files, +214 / -58
β”‚ src/auth.ts    +120 / -30
β”‚ src/api.ts     +94 / -28

### πŸ“– Overview
Refactors auth to JWT. Risk: token expiry not verified, no tests yet. Suggest adding expiry + a rejection test.

πŸ” 3 issues (critical 1 Β· important 1 Β· normal 1)
β–Έ πŸ€– Review Comments
  πŸ”΄ src/auth.ts:45 β€” Trust boundary: reload authoritative data server-side
  πŸŸ‘ src/api.ts:88 β€” Use Promise.all β€” current N+1 query
  πŸŸ’ src/utils.ts:12 β€” Immutable data structure, nice
β–Έ ℹ️ Review Info
  Files reviewed: 2 Β· Change size: +214 / -58

πŸ₯² Why does Heimdall exist?

A story of one too many "unilateral contract changes"

One fine morning, Copilot arbitrarily revised its subscription deal: models quietly downgraded, token limits shrank, choices vanished overnight. And that $10/month fee? Collected right on schedule β€” yet your Code Review quota reliably ran out by mid-month, greeting you with "Quota limit reached. Please upgrade."

By month's end: paid full price, ran out of tokens halfway through, zero Code Review when PRs hit β€” and helped another earnings report.

🧠 Total model freedom β€” Claude, GPT, Gemini, or self-hosted. 100% your call.
πŸ’³ Pay for what you use β€” your own key or gateway. No $10 all-you-can-eat that starves you.
πŸŒ‰ Unshakeable bridge β€” the Bifrost Guardian never changes terms mid-flight.

Get started in 2 minutes

Pick a mode β€” Actions for a single repo, Workers for a team-wide installable bot.

# Mode A β€” add an AI reviewer to any repo
$ mkdir -p .github/workflows scripts
$ cp template/heimdall-review.yml .github/workflows/
$ cp scripts/heimdall-review.js scripts/
$ # add AI_API_KEY (or ANTHROPIC_API_KEY) as a repo secret

# in any PR, comment:
@CoderHeimdall

# want auto-review? add .github/heimdall.yml with:
auto_review: true
Read the full setup guide