Add Pull Pilot’s skills to your project, then review before you push with Claude Code, Codex or another coding agent using its own model.
Run in your Git project’s root:
npm install -g pullpilot
pullpilot agents install allThen open a new agent session and say: Review my changes with Pull Pilot
No Pull Pilot login or separate provider API key for delegated review. Your agent needs its normal model access. CLI 1.2.0+ required for agent skills.
Install the CLI, add the skills for your coding agent, and ask for a review in your own project.
npm v1.2.0 · Git and Node.js required · Your coding agent needs its normal access.
npm install -g pullpilotFrom your Git project’s root:
pullpilot agents install allOr install for one agent: pullpilot agents install codex (also claude, copilot, gemini, windsurf, cursor or cline).
Open your project in your agent and start a new session:
Review my changes with Pull PilotAgent skills require CLI 1.2.0+. See the installation options.
In PowerShell, use npm.cmd and pullpilot.cmd if script execution is blocked.
AI providers
Cloud APIs or local Ollama
Review scope
Changes and related context
Key encryption
GCM, encrypted at rest
Repository rules
Guidelines and ignored files
Open source
Inspect it or self-host
Solo developers
Get review comments on your own pull requests, with repository rules, related code context, and suggestions to verify.
Engineering teams
Share GitHub App repository access, repository rules and a review history with finding feedback.
Self-hosters
Run the AGPL source on your own infrastructure and point reviews at an Ollama server you operate.
A GitHub App that reads the diff and related code, applies your repository rules, and posts findings for a developer to verify.
Cloud providers require your own key. Model selection is configured by the deployment operator; availability and review time depend on the provider.
Configure your providerProvider credentials are encrypted at rest with AES-256-GCM and bound to their owner and provider.
Use .aipr.yml to set guidelines, ignored files and a severity threshold.
Follow queued reviews, inspect findings and record feedback in the dashboard.
The reviewer can read related JS/TS imports, callers and tests within configured limits. Coverage can be partial.
Repository files used to give the AI surrounding context are encrypted at rest with AES-256-GCM. It is kept for as long as your repository stays connected to PullPilot, and is deleted when you disconnect the repository.
These fictional examples show how review feedback can look. The controls only change this demonstration; they do not run AI, edit a repository or apply a patch.
Illustrative examples, not customer results or measured detection guarantees.
A finding may ask whether a changed input path still enforces the required validation.
A finding may identify a sequence of overlapping operations that needs a regression test.
A finding may point to a removed failure path and describe which caller contract to check.
Pull Pilot reviews GitHub changes and supplies findings for a developer to verify. It can miss bugs and report false positives.
| Capability | Current behavior |
|---|---|
| GitHub feedback | Inline review comments where locations can be verified, with a summary fallback. |
| Suggested fixes | Read-only advice for manual review; no automatic patches or merge protection. |
| Tests | Test-gap suggestions and editable drafts. Execution requires the opt-in owner CI workflow. |
| Provider costs | Cloud usage is billed by your provider. Local Ollama uses your own server resources. |
Start with agent skills for local review before pushing, or install the GitHub App for pull request feedback. Setup is required for either workflow.
Install the skills once, then just ask. Your agent reviews with its own model, with no separate Pull Pilot provider API key.
Install the CLI from npm
Run npm install -g pullpilot. Git and a supported Node.js version are required.
Install your agent’s skills
From your Git project’s root, run pullpilot agents install all, or replace all with your agent’s name. Requires CLI 1.2.0 or newer.
Open your agent and ask
Start a new session in your project and say: “Review my changes with Pull Pilot”. Your agent investigates the changes and reports findings and file coverage.
Local reviews do not include hosted repository context discovery, dashboard rules, or GitHub comment delivery.
Automatic feedback on new and updated PRs, with review history in your dashboard.
Sign in and install the GitHub App
Sign in with GitHub and grant the GitHub App access to the repositories you want reviewed.
Configure your provider
Cloud providers require your own API key, saved in the API Key Vault. Ollama requires a server and model configured by your deployment operator.
Add repository rules
Optionally add .aipr.yml rules and exclusions to your repository.
.aipr.yml
min_severity: medium ignore: - "dist/**" - "package-lock.json" guidelines: - "Never log secrets or PII"
Open a pull request
Open or update a pull request, then verify the findings in GitHub or review history.
Agent skills, local reviews and GitHub App integration.
Install Pull Pilot and your agent’s skills, then say “Review my changes with Pull Pilot”. Delegated local review uses your agent’s model. For automatic GitHub PR feedback, install the GitHub App and configure your provider.
Timing Attack on HMAC Token Comparison: Standard JavaScript string equality (===) performs byte-by-byte comparison and returns immediately on first mismatch. Attackers can measure response latency down to sub-microseconds to reconstruct auth secrets.
+ return expBuf.length === tokBuf.length && crypto.timingSafeEqual(expBuf, tokBuf);