Buddy

Review

AI Code Review Inline findings anchored to the lines you changed Conversations @buddy answers, re-reviews, resolves and pauses Local Review Read the working tree before the PR exists Finishing Touches Tests, docstrings and autofix, as a stacked PR

Automate

Merge Gates A real check run, not a comment nobody reads CI Repair Classify a failing run and fix what is unambiguous Dependency Updates Eleven ecosystems, real changelogs, auto-merge

Platform

Workflow Security Supply-chain footguns in .github/workflows Your CI, Your Keys No hosted app, no diff leaving your pipeline
Nine jobs, one binary. All features →

By team

Open Source A reviewer a maintainer cannot hire Startups No spare reviewer, no time for updates Platform & Enterprise Standards as check runs, on your infrastructure Agencies Twenty client repositories, one config

By job

Monorepos Every manifest at every depth, no setting Security & Compliance Licences, advisories and supply-chain audits Migrating Bring the Renovate config you already wrote AI Coding Agents Close the loop before the PR exists
Find the shape of your problem. All use cases →
GuideCLIAIConfigAPIGitHub

features

One teammate, nine jobs

Buddy replaces a hosted code reviewer and a dependency bot with a single binary that runs inside your own pipeline. Pick the half you need — or run all of it.

Get Started Compare Buddy
buddy --help
$ buddy --help

             __
    (\,------'()'--o    buddy v0.11
     (_    ___    /~"   fetch. read. speak up.
      (_)_)  (_)_)

  review      read a PR, a branch, or the working tree
  gate        publish the pre-merge check run
  fix-ci      diagnose a failing run and repair it
  touch       run a finishing touch as a stacked PR
  security    audit workflows for supply-chain footguns
  scan        find outdated dependencies
  update      open the update pull requests
  dashboard   maintain the pinned dependency issue
  report      dependency health over a window
  doctor      what is configured, what is missing
🔍

AI Code Review

Inline findings anchored to the lines you changed, each stating the failure it causes rather than a style preference. Incremental by default — a second push gets new findings, not the ones you already read.

How the review works
💬

Conversations

Mention @buddy to re-review, summarise, resolve threads, pause, plan, or just ask a question about the diff.

Every command
💻

Local Review

buddy review reads your working tree. --light needs no key and no network, so it fits in a pre-commit hook.

Review before you push
🚦

Merge Gates

Title format, description quality, linked issue and dependency policy, published as a real check run rather than a comment nobody reads.

Gate the merge
🛠️

CI Repair

buddy fix-ci reads the failing workflow run, classifies the failure, and opens the repair when the fix is unambiguous.

Fix the build
✨

Finishing Touches

Docstrings, tests, simplification and autofix — delivered as a stacked pull request you can merge, ignore or close.

See the touches
📦

Dependency Updates

The whole Renovate and Dependabot job — scanning, grouping, real changelogs, OSV advisories, a pinned dashboard and auto-merge — across npm, Composer, Docker, Actions, Go, Rust, Python, Ruby and Zig.

The dependency half
🛡️

Workflow Security

Static analysis for the supply-chain footguns that live in .github/workflows — bash injection, excessive permissions, unpinned actions.

Audit your workflows
🏠

Your CI, Your Keys

No app installed on your repository, no diff leaving your pipeline. Anthropic, OpenAI, Google, OpenRouter — or no provider at all.

How self-hosting works

Two halves, no coupling

Neither half of Buddy depends on the other. Run the reviewer alone, run the updater alone, or run both from the same config.

ReviewDependencies
On a pull requestInline findings, summary, @buddy commands, merge gatesGrouped update PRs with real changelogs
Before you pushbuddy review on the working treebuddy scan
When CI failsbuddy fix-ci diagnoses and repairsLock files regenerated on rebase
OngoingFindings tracked, threads resolvedPinned dashboard issue, buddy report

Start in one command

bun add -g @buddysh/buddy
buddy setup

buddy setup reads your repository, spots the package managers you actually use, migrates a Renovate or Dependabot config if it finds one, writes buddy.config.ts, and generates the workflows. It asks before it writes anything.

Where to go next