AI-Powered Code Review CLI — BYOK

Cora is a fast, native CLI for AI-powered code review and code intelligence — in your terminal, CI/CD, git hooks, or directly inside AI coding agents. Bring your own key, pick any model, index your codebase, and search semantically. All local, zero cloud.

• 🤖 Multi-LLM — OpenAI, Anthropic, Groq, Ollama, Z.AI, or any OpenAI-compatible API
• ⚡ Native Rust — fast binary, no runtime dependencies, cross-platform
• 🪝 Pre-commit hooks — catch issues before they reach CI
• 📋 SARIF output — upload to GitHub Code Scanning
• 🛡️ Deterministic scanners — 12 built-in rules + 13 security patterns + 15 secret detection patterns that run without LLM
• 🧠 Language-specific analysis — tailored review guidance for Dart/Flutter, Svelte, TypeScript, Go, Rust, Python
• 🚧 Quality gate — configurable pass/fail thresholds for CI enforcement
• 📐 Quality profiles — strict, balanced, or lax presets for different project needs
• 📏 Custom rule engine — write your own regex rules in .cora.yaml
• ✂️ Auto-chunking — splits large PRs into reviewable chunks automatically
• 🔍 Code Intelligence — index symbols across 15 languages, call graph, trace, impact analysis
• 🧠 Brain Mode — hybrid semantic search (FTS5 + vector KNN + graph) with RRF fusion
• 🗄️ Multi-project database — one global index, search across all your repos at once
• 🌳 Tree-sitter (opt-in) — AST-based symbol extraction for 13 languages: Rust, Go, Python, TypeScript/TSX, Java, C, C++, C#, Ruby, PHP, Scala, JavaScript, Svelte (via TypeScript delegation, zero extra dependency)
• 🔌 MCP server — 18 tools for AI coding agents (review, search, brain, debt, trace, dead code, graph query, ...)
• 💾 Diff-hash caching — skip repeat reviews automatically
• 🔧 Configurable — per-project .cora.yaml, global ~/.cora/config.yaml, or env vars

Pick one install method — mixing channels can leave stale binaries on your PATH.

# Install with the quick installer
curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-code/main/install-bundle.sh | sh

# Or build from source with cargo
cargo install --git https://github.com/codecoradev/cora-code

Pin a version: CORA_VERSION=v0.6.1 curl -fsSL ... | sh

Upgrading: run cora upgrade (downloads the latest release, verifies its SHA-256 checksum, replaces the binary) or cora upgrade --check to just see if one is available. If you installed via cargo install --path ., re-run that instead.

Verify which cora you're running — which -a cora will reveal stale copies from other channels:

which -a cora            # list every `cora` on your PATH (one entry = healthy)
cora --version           # should match the latest release

If which -a cora shows more than one path (e.g. ~/.local/bin/cora and ~/.cargo/bin/cora), remove the one you don't want or reorder your PATH. See Issue #314 for background.

xattr -dr com.apple.quarantine /path/to/cora
xattr -dr com.apple.provenance /path/to/cora

cora auth login

Pick a provider, enter your API key. Done. Provider env vars (ZAI_API_KEY, OPENAI_API_KEY, etc.) are auto-detected.

cora review              # staged changes
cora review --base main  # vs a branch
cora review --unpushed   # unpushed commits
cora commit              # review + generate commit msg + commit
cora commit --yolo       # auto-commit, no prompts

cora init  # creates .cora.yaml + installs pre-commit hook

Priority: CLI flags → env vars → .cora.yaml (project) → ~/.cora/config.yaml (global) → defaults

# .cora.yaml
provider: zai
model: glm-5.1
focus: [security, bugs]

# Quality gate — enforce code quality in CI
quality_gate:
  enabled: true
  thresholds:
    max_critical: 0     # 0 critical = gate FAIL
    max_security: 0     # 0 security findings = gate FAIL
  categories:
    performance:
      action: warn      # warn only, don't fail CI
      max_findings: 5

cora config show           # effective merged config
cora config show --global  # ~/.cora/config.yaml
cora config show --project # .cora.yaml

See Configuration → for full reference.

# .github/workflows/cora-review.yml
on: pull_request
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: codecoradev/cora-review-action@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          cora-api-key: ${{ secrets.CORA_API_KEY }}

Required secrets: CORA_API_KEY, CORA_BASE_URL (optional), CORA_MODEL (optional)

See GitHub Marketplace for full documentation.

Works on all CI platforms — Gitea, GitLab, Bitbucket →

See CLI Reference → for all flags and examples.

Benchmarked on the cora-code repository (1,864 symbols, 115 Rust files, x86_64, single-thread baseline → Rayon parallel).

Measurements are indicative, not contractual. Your numbers will vary with codebase size, CPU cores, and disk I/O.

Provider-specific keys are auto-detected: OPENAI_API_KEY, ANTHROPIC_API_KEY, GROQ_API_KEY, ZAI_API_KEY

See CONTRIBUTING.md for guidelines. PRs welcome!

MIT