Guide

Setup

Everything starts with the GitHub App. Each installation becomes a workspace.

1. Install the app on your account or organization and pick the repositories. Installing on an organization needs an organization owner; members send an install request to an owner instead. Install on more repos
2. Reviews run only on repositories you have switched on. New repositories start switched off.
3. Open Repos and click a repository → Settings. Each head has its own tab there.
4. Use the workspace switcher at the top of the sidebar when you belong to several installations.

Review

AI code review on every pull request. One comprehensive comment with critical issues, suggestions, and a verdict (APPROVE / REQUEST_CHANGES / COMMENT).

Enable

1. Repos → repository → Settings → Review tab → turn on “Enable automatic reviews”.
2. Pick a review language, or leave it on the profile default.
3. Optionally write Team Conventions there, or scan the repo to draft them from CLAUDE.md / CONTRIBUTING.

What triggers a review

• A pull request is opened or gets new commits.
• Someone comments a command on the PR (see below).

PR thread commands

Where to look

Every run is listed under Review. Open one to see the findings, mark false positives, or hand an issue to the Agent with “Send to Agent”.

Code BETA

An autonomous coding agent. It takes a task, works in an isolated workspace, opens a PR, and asks you a question mid-run when it is unsure.

Enable

1. Repos → repository → Settings → Agent tab → enable the Agent.
2. Choose a model preset. OpenRouter presets are only available when the platform has an OpenRouter key configured.
3. Optional: “Auto-fix from Reviews” lets Review dispatch the Agent to fix its own findings on the PR branch. Auto-merge is off by default and merges without human approval — enable with care.

Ways to start a run

While it runs

• Watch progress under Code; the run page streams phases, logs and the resulting diff.
• If the status turns to waiting, the Agent has a question. Answer it on the run page (or from your Inbox) and it continues.
• Runs can be retried or cancelled from the run page.
• The Board shows queued tasks per repository; Schedules can trigger recurring runs.

Hacker EXPERIMENTAL

Dependency vulnerability monitoring. It reads the repo's lockfiles, matches them against the OSV database, and opens a GitHub security issue for every hit. It reports only — it never writes the fix itself.

Enable

1. Repos → repository → Settings → Security tab → enable security scans. The first scan runs immediately.
2. Optional: turn on “Dispatch to Agent” so each issue is labeled coder and the Agent opens the fix PR. Requires Code to be enabled on the same repo.

When it scans

• On enable.
• On a push that touches a lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, poetry.lock, Pipfile.lock, requirements.txt, Cargo.lock, go.mod / go.sum, composer.lock, Gemfile.lock).
• On a Dependabot alert or security advisory from GitHub.
• Continuously, via a background poll of the OSV feed for newly published advisories.

Where to look

The Hacker page lists monitored repos, tracked vulnerabilities and each run with its issue and PR links.

Config files

Two optional files at the repository root shape how Review reads your code.

Team Conventions in the repo settings do the same job from the dashboard and stop the reviewer from re-suggesting things your team already decided.