CodePanel 开源多模型 PR 代码评审工具，支持自带 API key 与自托管

AI code review for GitHub pull requests, done by a panel of models instead of one. Several models review the change independently. An orchestrator model then merges their findings, drops duplicates and false positives, and posts a single review on the pull request.

Free with your own API keys. Use a key from Anthropic, OpenAI, Google, DeepSeek, Groq or any OpenAI-compatible provider. You pay the provider per token, and CodePanel charges nothing for reviews on your keys.
Hosted or self-hosted. Use it at codepanel.ai, or run your own copy. It is open source under Apache-2.0.
Lives in the pull request. Reviews are posted as a PR comment and updated as you push. Comment /review to run one by hand, or /feedback to rate a finding.
Scriptable. It also comes with a CLI, an MCP server for coding assistants, and a GitHub Actions merge gate.

Get started on codepanel.ai

Sign in at codepanel.ai with GitHub and choose the repositories to review.
Add a provider API key under Settings → Provider keys. CodePanel builds a low-cost starter panel from it.
Open a pull request, or comment /review on an existing one.

A review on the starter panel typically costs a few cents in provider fees. You need a developer API key: a Claude or ChatGPT subscription can't be used, because neither includes API access. The quickstart covers each step in detail.

How a review works

A panel is a few reviewers plus one orchestrator. Each reviewer reads the whole pull request with its own focus, called its role:

Role	Looks for
Bugs & Security	Logic errors, edge cases, error handling, security holes
Tests & Maintainability	Untested changes, dead or duplicated code, confusing names
Docs & Best Practices	The repository's own rules and docs, and framework guidance
Security	A deeper pass on auth, payments and secrets
Performance	Queries in loops, missing indexes, unbounded work
API & Migrations	Breaking changes, schema and data migrations

The model for each reviewer is chosen separately from its role, so you can mix providers or give one role a stronger model. Reviewers run in parallel, and a provider that fails costs only its own reviewer. The orchestrator reads the reviews, not the diff, and writes the comment that gets posted.

Read more in Reviewers and panels and Choosing models.

Run it yourself

CodePanel runs on a Convex backend and a React frontend deployed to Cloudflare Workers. For local development you need Bun, a free Convex account and a GitHub account.

Install dependencies and create your own Convex dev deployment:
```
bun install
bunx convex dev
```
convex dev writes VITE_CONVEX_URL to .env.local and keeps your functions in sync. Leave it running.
Create a GitHub OAuth app. Set its callback URL to https://<your-deployment>.convex.site/api/auth/callback/github.

Set the backend secrets on your deployment, then generate the session signing keys:

bunx convex env set AUTH_GITHUB_ID <client id>
bunx convex env set AUTH_GITHUB_SECRET <client secret>
bunx convex env set ENCRYPTION_KEY "$(openssl rand -hex 32)"
bunx convex env set SITE_URL http://localhost:3000
bunx @convex-dev/auth

Start the app at http://localhost:3000:
```
bun run dev
```

Provider API keys are added by each user in the app, not as server settings. Everything optional is listed in .env.example: the GitHub App, error tracking, and billing. Deploying to production is covered in Self-hosting.

Documentation

Using CodePanel (also at codepanel.ai/docs): Quickstart · Providers and keys · Triggering reviews · Budgets and limits · CLI · MCP server · Merge gate · Billing · Security · FAQ

The source for these pages is in src/content/docs/pages/.

Working on CodePanel:

Architecture: how a review runs, from webhook to comment
Reviewers: roles, presets, seeding and cost tiers
API and agents: tokens, /api/v1, the CLI and MCP server
Review quality: the eval harness and benchmark
Maintainers: CI, production deploys and secrets

Contributing

Contributions are welcome. Read CONTRIBUTING.md before opening a pull request. Report security issues privately as described in SECURITY.md, not in public issues. This project follows a Code of Conduct.

License

CodePanel is open source under the Apache License 2.0. You can use, modify, self-host and redistribute it, commercially or not. The license does not grant rights to the CodePanel name or logo, so a fork or hosted copy should use its own name.

Earlier versions were published under FSL-1.1-MIT. All of the code, including those versions, is now available under Apache-2.0.

The benchmark fixtures in tools/eval/fixtures/oss/ contain code copied from MIT, Apache-2.0, BSD and ISC projects, which stays under those licenses (see NOTICE and tools/eval/fixtures/oss/NOTICE.md).