I Built My Own AI Code Reviewer for GitHub Pull Requests

# I Built My Own AI Code Reviewer for GitHub Pull Requests

Code reviews are important.

But let's be honest — they can also become repetitive.

Someone opens a pull request.

A reviewer has to go through dozens of changed files.

Then comes the usual checklist:

• Is there an obvious bug?
• Is there a security issue?
• Is this database query going to cause a performance problem?
• Is there duplicated or unnecessary code?
• Is there a better way to implement this?
• Did we introduce something that will break later?

And when the PR is large, reviewing everything carefully becomes difficult.

So I decided to build something for this problem.

Meet CodeGuard AI — a self-hosted AI code reviewer for GitHub Pull Requests.

The idea is simple:

Give it a GitHub PR → let AI inspect the diff → get a structured code review directly on GitHub.

And because I wanted this to be a developer-owned tool, it is designed to run on your own infrastructure and use your own AI provider.

## What is CodeGuard AI?

CodeGuard AI is a Spring Boot application that automatically reviews GitHub Pull Requests using an AI model.

It can analyze a PR for things like:

• 🐛 Bugs
• 🔐 Security issues
• ⚡ Performance problems
• 📐 Best-practice violations
• 🗄️ Database-related issues
• 💡 Improvement suggestions

Instead of returning a huge block of AI-generated text, the review is structured around findings.

For example:

CRITICAL
SecurityConfig.java

Disabled CSRF on Session-Cookie Authentication

CSRF protection is disabled while the application
uses session cookies for authentication.

Suggested fix:
Enable CSRF protection using a CookieCsrfTokenRepository
or switch to stateless header-based authentication.
The goal isn't to replace human reviewers.

The goal is to give them a useful first pass before they spend time going through the PR themselves.

Why I built it

There are already many AI coding tools.

AI can write code.

AI can explain code.

AI can generate tests.

So I was interested in a slightly different question:

What happens if AI becomes the first reviewer instead of the programmer?

A pull request already contains something extremely valuable for an AI model:
the change itself.

You don't necessarily need to understand the entire application to start finding potential problems.

You can start with:
PR
↓
Changed files
↓
Diff
↓
AI analysis
↓
Structured findings
↓
Developer
That became the core idea behind CodeGuard AI.

How CodeGuard AI works
The architecture is intentionally simple.
GitHub
│
│ Pull Request
▼
┌─────────────────────┐
│ GitHub Webhook │
│ Receiver │
└──────────┬──────────┘
│
▼
┌─────────────────────┐
│ PR / Diff Fetcher │
│ GitHub API │
└──────────┬──────────┘
│
▼
┌─────────────────────┐
│ Code Review Service │
└──────────┬──────────┘
│
▼
┌─────────────────────────┐
│ AI Provider Abstraction │
└──────┬──────┬──────┬───┘
│ │ │
OpenAI Gemini Ollama
│ │ │
└──────┴──────┘
│
▼
┌─────────────────────┐
│ Structured Review │
│ Findings │
└──────────┬──────────┘
│
┌──────┴───────┐
▼ ▼
Dashboard GitHub PR

The application is built with:

Java 17
Spring Boot
Spring Security
GitHub REST API
REST APIs
HTML/CSS/Vanilla JavaScript
OpenAI / Gemini / Ollama integrations
Maven

Step 1: GitHub sends the Pull Request
CodeGuard AI exposes a GitHub webhook endpoint.
For example:
POST /webhook/github
When a pull request is opened, reopened, or updated, GitHub sends an event to CodeGuard AI.
The webhook signature is verified using HMAC-SHA256 before processing the request.
This is important because you don't want arbitrary requests triggering your review pipeline.
Step 2: Fetch the Pull Request
Once the webhook is verified, CodeGuard AI uses the GitHub API to retrieve information about the PR.

This includes things such as:

Repository
Pull request number
Author
Changed files
Diff
Added lines
Deleted lines

The important part is the diff.

Instead of blindly sending an entire repository to an AI model, the reviewer focuses on the code that actually changed.

Step 3: Send the changes to the AI
The diff is then passed to the configured AI provider with a structured review prompt.
CodeGuard AI supports multiple providers:
OpenAI
Google Gemini
Ollama

The provider can be selected through configuration.
For example
ai.provider=openai
or:
ai.provider=gemini
or:
ai.provider=ollama
This provider abstraction was an important design decision.
I didn't want the entire application tightly coupled to a single AI vendor.

Step 4: Generate structured findings
The AI isn't simply asked:
"Review this code."
Instead, the review is structured around useful information.
A finding contains concepts such as:
Severity
Category
File
Location
Problem
Suggested Fix

For example:
Severity: HIGH

Category: SECURITY

File:
src/main/java/com/example/config/SecurityConfig.java
Problem:
CSRF protection is disabled while session cookies
are used for authentication.
Suggested Fix:
Enable CSRF protection or switch to stateless
authentication.
This makes the result much easier to consume in a dashboard or GitHub comment.
Step 5: Post the review back to GitHub
One of the things I wanted from the beginning was:
Don't make developers open another dashboard just to read the review.
So CodeGuard AI can post the generated review directly to the Pull Request.
The result looks something like:
🤖 CodeGuard AI Review

✅ SAFE TO MERGE

Quality score: 9/10
Risk: Low
Confidence: 95%

No issues found.

What's good:

• Clean implementation
• Backward-compatible configuration
• Clear separation of concerns If problems are found, the review instead highlights them with severity and suggested fixes. The dashboard

The dashboard provides a second way to run and inspect reviews.

You can manually enter:

owner/repository
PR number

and run a review.

This is useful before setting up the webhook because you can test the entire pipeline manually:

GitHub
↓
Fetch PR
↓
Analyze diff
↓
AI
↓
Generate review
↓
Post comment

No webhook is required for the initial test.

Review history

I also wanted the application to remember previous reviews.

The dashboard therefore keeps review history containing information such as:

Repository
PR number
Review score
Risk
Number of findings
Files reviewed
Lines changed
Review timestamp

This makes it possible to see how a codebase is progressing over time.

For example:

Review #1 6/10 3 issues
Review #2 7/10 2 issues
Review #3 9/10 0 issues

The dashboard can also visualize review trends.

One interesting feature: merge recommendation

I added a simple high-level verdict to make the review easier to understand.

For example:

┌──────────────────────────────┐
│ ✅ SAFE TO MERGE │
└──────────────────────────────┘

Quality Score: 9/10
AI Confidence: 95%
Critical Issues: 0
Suggestions: 0

Or, when the PR has serious issues:

┌──────────────────────────────┐
│ ⚠️ REVIEW REQUIRED │
└──────────────────────────────┘

Quality Score: 6/10
Risk: Medium
Critical Issues: 1

This isn't intended to replace a team's merge policy.

It's simply a quick signal for the developer.

Why self-hosted?

This was probably the most important product decision.

There are already hosted AI code-review products.

So why build another one?

Because some developers and teams don't want their source code going through another hosted SaaS platform.

With a self-hosted architecture:

Your GitHub
↓
Your CodeGuard instance
↓
Your AI provider

You control the infrastructure and credentials.

You can use:

OpenAI
Google Gemini
Ollama

And with Ollama, you can even run a local model.

The application doesn't require a CodeGuard-managed AI subscription.

Private repositories

CodeGuard AI isn't limited to public repositories.

The GitHub Personal Access Token used by the application determines which repositories it can access.

For example, a fine-grained token can be configured with the required permissions for the repositories that need to be reviewed.

This makes the same architecture usable for private projects and internal repositories.

Handling large Pull Requests

There is an obvious problem with AI-based code review:

What happens when a PR contains hundreds of files?

Sending an enormous diff to an AI model isn't practical.

CodeGuard AI therefore truncates large per-file diffs to keep the review within a reasonable token budget.

That means extremely large PRs may receive a partial review rather than causing the entire review process to fail.

This is one area I want to improve further.

What I deliberately didn't build yet

One thing I intentionally kept out of the first version is inline GitHub review comments.

Currently, CodeGuard AI posts a structured summary comment to the Pull Request.

Inline comments are more complicated because GitHub's review API requires calculating the appropriate diff positions.

So a future version could potentially do this:

src/main/java/UserService.java:42

🔴 HIGH

Potential authorization bypass.

Suggested fix:
Verify that the authenticated user owns
the requested resource before updating it.

That would make the tool much closer to a traditional human code review.

What I learned building it

The interesting part of this project wasn't actually calling an AI API.

That part is relatively straightforward.

The harder part is building the system around it.

A useful AI developer tool needs:

1. Reliable input

The model is only as useful as the code context you provide.

1. Structured output

A giant paragraph isn't particularly useful during a code review.

1. Provider abstraction

AI providers change quickly, so coupling the application to one provider isn't ideal.

1. Security

GitHub tokens, webhook secrets and AI API keys need to be handled carefully.

1. Failure handling

GitHub API failures, AI timeouts, invalid model responses and huge diffs all need to be considered.

1. A useful UI

Developers shouldn't have to dig through logs to understand what happened.
**
Current feature set**

The current version includes:

✅ GitHub Pull Request integration
✅ GitHub webhook support
✅ HMAC webhook verification
✅ Manual PR review
✅ AI-powered bug detection
✅ Security analysis
✅ Performance analysis
✅ Best-practice analysis
✅ Risk assessment
✅ Quality scoring
✅ AI confidence score
✅ Structured findings
✅ Suggested fixes
✅ GitHub review comments
✅ Review history
✅ Review trend visualization
✅ Markdown export
✅ PDF export
✅ OpenAI support
✅ Google Gemini support
✅ Ollama support
✅ Light/dark mode
✅ Self-hosted deployment

What's next?
There are several things I want to explore next.

Inline review comments

Instead of one summary comment, report findings directly on changed lines.

GitHub App support

The current version uses a Personal Access Token because it keeps the self-hosted setup simple.

A GitHub App would be a better architecture for multi-repository and multi-organization deployments.

Better repository configuration

Allow teams to define their own review rules.

For example:

security:
enabled: true

performance:
enabled: true

tests:
required: true

style:
enabled: false
Custom review prompts

Different teams care about different things.

A Spring Boot backend team may care heavily about:

N+1 queries
transaction boundaries
authentication
authorization
database indexes
API design

A frontend team may care about completely different things.

CI/CD integration

Another direction is running CodeGuard AI directly inside CI pipelines.

Final thoughts

I started CodeGuard AI with a simple idea:

AI shouldn't only help us write code. It can also help us question the code we just wrote.

The goal isn't to replace experienced engineers.

A good human reviewer can understand business context, architecture and trade-offs that an AI model may completely miss.

But an AI reviewer can be a useful first layer.

It can catch obvious issues.

It can point out suspicious code.

It can identify things worth discussing.

And it can do that before the human reviewer spends 30 minutes reconstructing what changed.

That's what I'm trying to build with CodeGuard AI.

Try it / explore the project

CodeGuard AI is built as a self-hosted Spring Boot application with the complete source code included.

If you want to run your own instance, you can configure it with your own OpenAI, Gemini, or Ollama setup.

CodeGuard AI — Self-Hosted GitHub AI Code Reviewer

# CodeGuard AI### Self-hosted AI code review for GitHub Pull Requests — built with Spring Boot.CodeGuard AI automatically reviews your GitHub Pull Requests using AI and identifies potential bugs, security issues, performance problems, and best-practice violations.Instead of paying for another monthly SaaS subscription, run CodeGuard AI on your own infrastructure using your own AI provider credentials.## 🚀 What You Get- 🤖 AI-powered GitHub Pull Request reviews- 🐛 Bug and logic issue detection- 🔐 Security issue detection- ⚡ Performance analysis- ✅ Best-practice checks- 📊 Quality score and risk assessment- 🎯 AI confidence score- 💬 Automatic review comments posted directly to GitHub- 🔄 Automatic reviews through GitHub webhooks- 📝 Manual PR review from the dashboard- 📚 Review history- 📈 Review trend tracking- 📄 Export reviews to Markdown and PDF- 🌙 Light and dark mode- 🔌 Multiple AI providers## 🔌 Supported AI ProvidersChoose the provider that works best for you:- OpenAI- Google Gemini- Ollama (local AI)Your AI provider can be changed through configuration without changing the core review architecture.## 🛠️ Technology Stack- Java 17+- Spring Boot- Spring Security- GitHub REST API- AI provider integrations- REST APIs- HTML / CSS / Vanilla JavaScript- Maven## 🔐 Self-Hosted & PrivateCodeGuard AI is designed to run in your own environment.Your GitHub credentials and AI API keys stay under your control.It can be used with repositories your GitHub token has permission to access, including private repositories when the token has the required permissions.## 📦 What's IncludedThe download includes:- Complete Spring Boot source code- Installation Guide- User Manual- API Documentation- Architecture Diagram- Database Schema- SQL database script- Postman Collection- Environment Configuration Guide- Sample Repository Guide- Changelog- License## ⚡ How It WorksGitHub Pull Request↓GitHub Webhook↓CodeGuard AI↓Fetch PR Changes↓AI Analysis↓Security / Bug / Performance Review↓Quality & Risk Assessment↓GitHub Review Comment## 🎯 Who Is This For?CodeGuard AI is ideal for:- Java / Spring Boot developers- Backend developers- Solo developers- Small development teams- Freelancers- Developers building internal developer tools- Anyone who wants an AI-assisted code review system they can run themselves## 💡 Why Buy the Source Code?This isn't just a demo UI.You get the complete backend implementation and supporting documentation so you can:- Run it locally- Deploy it on your own server- Customize the review logic- Change the AI provider- Modify the dashboard- Extend the GitHub integration- Build additional features on top of it## ⚠️ Requirements- Java 17+- Maven 3.8+- GitHub Personal Access Token- OpenAI, Gemini, or Ollama- A GitHub repository/PR accessible by your configured tokenDetailed setup instructions are included in the download.---### Build on top of it. Customize it. Self-host it.One-time purchase. No CodeGuard AI subscription required.

    <div class="color-secondary fs-s flex items-center">
        <img
          alt="favicon"
          class="c-embed__favicon m-0 mr-2 radius-0"
          src="https://public-files.gumroad.com/v56byb8cpoecdju06otk8bb7y66g"
          loading="lazy" />
      swarnalata25.gumroad.com
    </div>
  </div>
</div>

I'd especially love feedback on:

What should an AI code reviewer detect?
Would you use a self-hosted reviewer?
Which AI provider would you prefer?
Are inline GitHub comments more useful than a single summary?
What would make this useful for your team?

Thanks for reading! 🚀