Self-hosted GitHub App that reviews PRs like a senior who actually reads the diff.
Tier-1 detectors first · optional BYOK LLM · zero seat tax · run for $0
@codasaurus on any PR · Svelte dashboard · PostgreSQL only
Agents ship volume. Models invent packages, paste last year's APIs, and leave secrets in the hunk. SaaS reviewers charge per seat and still miss the boring breaks.
Codasaurus is one Rust binary you run yourself. On every PR it proves what it can (registry HEAD, manifests, secrets, OSV, IaC), then optionally asks your LLM. Never a silent cloud fallback.
| It catches | How |
|---|---|
| Hallucinated imports | npm / PyPI / crates.io / Go HEAD |
| Phantom deps | Import vs manifest |
| Lockfile drift | Manifest vs lockfile |
| License drift | Copyleft-style dep licenses |
| Secrets and vulns | Pattern + OSV |
| IaC footguns | Open CIDR, privileged pods |
| Agent-shaped PRs | Tier-1 first, LLM nits capped |
| Blast radius / dep delta | Walkthrough + @impact |
Fail-closed offline mode. Finding provenance. Learning from dismissals. Air-gap honest.
git clone https://github.com/lohitkolluri/codasaurus.git
cd codasaurus
cp .env.example .env # optional
docker compose upOpen http://localhost:3000, finish the onboarding wizard (~5 min), install the GitHub App.
Want $0 forever (no trials)? Run on always-free infra: Render free web + Aiven Free Postgres (or Neon). LLM optional / off.
# From source (Postgres must be reachable)
cargo build --release
export DATABASE_URL="postgres://codasaurus:codasaurus@127.0.0.1:5432/codasaurus"
./target/release/codasaurus serve --port 3000Prebuilt Linux binary: GitHub Releases (codasaurus-v*-x86_64-unknown-linux-gnu.tar.gz).
codasaurus serve | health | version | reset-password
| Guide | Topic |
|---|---|
| Onboarding | First-run wizard |
| GitHub App | Permissions, manifest, manual keys |
| Run for free | Always-free host + Postgres |
| Database | PostgreSQL, pool, schema |
| Configuration | Env vars, TOML, offline, OIDC |
.codasaurus.toml schema |
In-repo config reference |
| Commands | @codasaurus on PRs |
| Backup and restore | Postgres backup, HA, health |
Full index: docs/README.md.
@codasaurus review @codasaurus describe @codasaurus improve
@codasaurus security @codasaurus impact @codasaurus similar
@codasaurus ask … @codasaurus fix [fp] @codasaurus ignore <fp>
@codasaurus digest @codasaurus help
Also: summarize, labels, changelog, add_docs. React 👎 on a finding comment to dismiss. Full table in docs/commands.md.
| Hosted SaaS | Typical OSS bots | Codasaurus | |
|---|---|---|---|
| Cost | Per seat | OSS / commercial | Self-host, free |
| Deploy | Their cloud | Your infra | One Docker binary |
| Hallucinated imports | Rare | Rare | Tier-1 |
| LLM | Bundled | BYOK / vendor | BYOK, fail-closed offline |
| Trust | Opaque | Varies | Provenance + dismiss learning |
export OPENROUTER_API_KEY="sk-or-..."
# or Ollama / any OpenAI-compatible endpoint
export CODASAURUS_BASE_URL="http://localhost:11434/v1"
export CODASAURUS_MODEL="qwen2.5-coder:7b"Toggle per repo in the dashboard. offline_mode / CODASAURUS_OFFLINE=1 never opens an LLM socket. Details: configuration.md.
[checks]
hallucinated_imports = true
phantom_deps = true
vulnerabilities = true
secrets = true
iac = trueRepo overlays live in the dashboard (config_json). OIDC: OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, PUBLIC_URL.
See CONTRIBUTING.md for setup and PR checks.
cargo fmt --check
cargo clippy -- -D warnings
CODASAURUS_SKIP_FRONTEND_BUILD=1 cargo test
cargo build --releaseSecurity reports: SECURITY.md. Release history: CHANGELOG.md.
AGPL-3.0-or-later · free forever · keep credit · Copyright (C) 2026 Lohit Kolluri