GitHub

Open source · Apache-2.0 · Written in Rust

AI code review that closes the bug loop.

Fixloop reviews every pull request, comments on the lines that changed and suggests the fix. It runs on your infrastructure, with the model you choose. Issue filing and test-gated fix pull requests come next.

Get startedStar on GitHub
cargo install --locked --git https://github.com/bwalia/fixloop fixloop-cli
src/util.rsPR #1
5  pub fn last(items: &[i32]) -> Option<i32> {
6      if items.is_empty() { return None; }
7+     Some(items[items.len()])
8  }
fixloophighbugconfidence 0.95

Off-by-one: index out of bounds

items.len() is one past the last index, so this panics on every non-empty slice.

Suggested change
-     Some(items[items.len()])+     Some(items[items.len() - 1])
Commit suggestion
Fixloop review: 2 findings: 1 critical (SQL injection in app/users.py), 1 high

How it works

Review → Find → File → Fix → Check → Close

One agent carries a bug from the pull request where it appears to the change that closes it. Today it reviews and finds. Each next stage ships as its own release.

  1. Review. On every opened or updated pull request, or on /fixloop review. Available
  2. Find. Bugs, security issues and broken team rules, on the changed lines only. Available
  3. File. Open an issue in GitHub or Jira, without duplicates. Next
  4. Fix. Write the fix in a sandbox. Planned
  5. Check. Build, test and lint must pass before a fix PR opens. Planned
  6. Close. Link the fix, close the issue, record the cost. Planned
Available now On the roadmap

For developers

A second reviewer that reads every line you changed.

Fixloop looks for real defects: off-by-ones, injection, unhandled errors, broken team rules. It tells you where, why and how to fix it.

Comments on the lines you changed

Each finding sits on the changed line, with a severity, a confidence score and a suggested fix you can commit in one click.

Review before you push

Run fixloop review in your repository. It checks your branch against main and prints findings. Nothing is posted.

Your rules, in plain words

Write team conventions as short Markdown files in .fixloop/rules. Every review checks against them.

Quiet by default

Findings below your confidence or severity threshold are dropped. No style nits unless you ask for them.

For engineering leads

Consistent review on every repository, at a cost you set.

Fixloop gives every pull request the same first pass, whoever wrote it and whenever it lands. You choose the model, the limits and where it runs.

A clear signal on every PR

A pass, warn or fail check on every pull request, so problems are caught before a human reviewer spends time on them.

Spend you can cap

Token and dollar budgets per job and per day. Cost is recorded for every review.

Your code stays where you decide

Self-host it. Mark a repository local-only and its code is only ever sent to models you run.

No lock-in

Apache-2.0, vendor-neutral, any model provider. Built to become a CNCF project.

Bring your own model

Hosted, local or both.

Model names live in one config file. List a fallback, and if the first model is down or rate limited, the next one takes over. Run fully offline with Ollama and no code leaves your network.

  • Claude
  • OpenAI
  • Gemini
  • OpenRouter
  • Azure OpenAI
  • Ollama
  • vLLM
  • llama.cpp
  • LM Studio
  • NVIDIA NIM
# fixloop.yaml: a hosted model with a local fallback
llm:
  providers:
    anthropic: { kind: anthropic, api_key_env: ANTHROPIC_API_KEY }
    ollama:    { kind: openai_compatible, preset: ollama }
  models:
    claude: { provider: anthropic, model: "claude-sonnet-5-5" }
    local:  { provider: ollama, model: "qwen3:30b-a3b"  }
  routes:
    review: [claude, local]
  budgets:
    daily: { max_cost_usd: 50 }

Security

Designed for code you cannot afford to leak.

An AI reviewer reads untrusted input by definition. Fixloop is built on that assumption.

Secrets never reach a model

Keys and tokens in a diff are redacted before any model call, and a committed secret is reported as a critical finding.

A PR cannot weaken its own review

Settings and rules are read from the base branch, never from the pull request.

Untrusted input stays data

Code, comments and PR text are passed to the model as data, never as instructions. Output is sanitised before it is posted.

Least privilege

The GitHub App you create reads code and writes reviews and checks. Nothing else. Only people with write access can run its commands.

Get started

Reviewing your first pull request in about 15 minutes.

  1. 1

    Install

    cargo install --locked --git https://github.com/bwalia/fixloop fixloop-cli
  2. 2

    Pick a model

    fixloop --config fixloop.yaml llm test
  3. 3

    Review your branch

    fixloop --config fixloop.yaml review
  4. 4

    Connect GitHub

    fixloop github create-app --name my-fixloop

Read the full guide

Roadmap

Built in the open, one stage at a time.

Done

Model layer

Any provider, routing, fallback, budgets

Done

Reviewer

GitHub App, inline reviews, check runs

Next

Issue filing

GitHub Issues and Jira, with dedupe

Planned

Fixer

Sandboxed, test-gated fix pull requests

Planned

Dashboard

Findings, costs and audit in one place

Planned

Cloud native

Helm, operator, signed images, SBOM

Full roadmap

Put a reviewer on every pull request.

Free and open source. Self-hosted. Your model, your rules.

Get startedView the code