What Cody does differently
Generic diff summaries are easy to generate and easy to ignore. Cody focuses the review on correctness, security, reliability, and performance.
Focused feedback
The prompt prioritizes behavior and risk while keeping low-value nitpicks out of the review.
Choose your model
Use an Anthropic Claude or OpenAI model available to your provider account.
API-only review job
The documented workflow reads the proposed diff through GitHub's API without checking out or executing pull-request code.
Inspectable source
The source-available Action and its full hash-locked dependency set can be reviewed before you pin a release.
See the reviewer review itself
On a public Cody pull request, the reviewer found three concrete defects: a secret-handling boundary, an invalid numeric input path, and incorrect exclusion-glob semantics.
A data path you can explain
- The protected workflow reads the pull-request diff through the GitHub API.
- The GitHub Actions runner sends the review request directly to the Anthropic or OpenAI API selected by you.
- The runner writes the result back to a Cody-authored pull-request comment through the GitHub API.
The Action process and installed dependencies can access its environment, including the provider key. The inspected, unmodified release intentionally sends the key only to the selected provider SDK and contains no Cody Labs service integration. GitHub and your selected model provider process data under their own terms and retention settings; workflow logs and comments remain in GitHub.
Price
The GitHub Action is free. Bring your own Anthropic or OpenAI API key and pay only provider usage and any applicable GitHub Actions costs.
Need GitLab or Azure DevOps? Cody Pro is a separate one-time purchase, US$39.
Frequently asked questions
Does Cody Labs receive my code or API key?The unmodified Action has no integration with a Cody Labs-operated data service. The workflow runs on a GitHub-hosted runner (or an ephemeral, single-purpose self-hosted runner you secure) and calls your selected provider directly.
Which providers are supported?The live v1.7.0 Action accepts separate Anthropic and OpenAI API-key inputs and selects the provider from the configured model ID.
Can it review fork pull requests?Yes, with the documented pull_request_target setup. The review job must remain API-only: never check out or execute pull-request code in a job that receives secrets.
Is this Sourcegraph Cody?No. This is an independent pull-request review Action by Cody Labs and is not affiliated with Sourcegraph.
Practical guides
Private AI code review in GitHub Actions
Set the trust boundary correctly before an API key enters the workflow.
BYOK versus a hosted AI reviewer
Compare privacy, cost, maintenance, and control without marketing shorthand.