Introduction

What is CroCode?

CroCode reviews GitHub pull requests with Claude Code, Codex, or OpenCode. You run the API, workers, database, and dashboard on your own servers.

Use your Claude Code or Codex subscription. You do not need an API key or a per-token bill. Reviews count against your plan usage limits. See subscription setup.

Each agent gets a read-only checkout. CroCode checks the findings against the diff, removes duplicates, and posts inline comments with severity levels and suggested fixes.

Run your first review

1. Start the stack with Docker Compose.
2. Create a GitHub App through the setup page. Install it on selected repositories.
3. Add your agent credentials to the worker environment.
4. Open a small pull request. Follow the review in the dashboard.

Set your review policy

Add .crocode.yml to the default branch. CroCode reads this file from the pull request base commit. A pull request cannot change its own review policy.

agent: claude
min_severity: low
max_comments: 20
review_drafts: false
ignore:
  - "docs/**"
instructions: |
  Focus on authentication and data loss.

All fields are optional. See repository config for defaults and selection rules.

What to expect

A new push cancels the previous review. CroCode does not queue the same repository, pull request, and head commit twice, including when the previous review was skipped.

The bot posts a COMMENT review. It never approves a pull request or requests changes. A person must check each suggestion before applying it.

Before the agent runs, OpenGrep scans the changed files in an offline sandbox. The agent receives the results on added lines as hints and reports only the ones it confirms. The review page lists them in the Static analysis tab. The bundled opengrep-rules use LGPL-2.1 with the Commons Clause, which does not grant the right to sell a service built mainly on them. See the image notes.

Use the REST API to read installations and findings. Use the development guide to build and test CroCode.