AI Pull Request Reviewer

What it does

Reviews each pull request's diff for bugs, security issues and missing tests, and comments on GitHub.

• Receives each new or updated pull request (title, description and diff) from a short GitHub Actions step, or any CI job, through a webhook.
• AI reviews only the changed lines for bugs, security issues (injection, missing auth or tenant checks, leaked secrets, which it never repeats), missing tests and the conventions you paste in.
• Posts a structured comment on the pull request through the GitHub API with your token: verdict, up to 10 findings with file, line, severity and a suggested fix, and a note on tests.
• Critical or high findings are also posted to your engineering channel in Slack.
• Every review is kept in the run history.

What it needs

• A paid plan (agents run live on paid plans).
• An AI provider key (Settings → AI Providers).
• An HTTP / Custom API connection to https://api.github.com with a token that can comment on pull requests, and Slack.
• A GitHub Actions step (provided in the FAQ) or another CI job that sends each pull request's diff to the webhook.

What it doesn't do

• It doesn't approve, block, merge or push code, and doesn't run your code or tests.
• It only sees the diff your CI sends (the provided step sends the first 60 KB); it doesn't read the rest of the repository or check dependencies for CVEs.
• It doesn't learn from accepted or rejected suggestions; update your conventions to tune it.
• There is no built-in GitHub or GitLab app: it works through your CI and your API token.

Availability and plans

Included free on the Enterprise plan; on other paid plans it's a one-time purchase per workspace (the price is on the Agents page). The Agents page in the app always shows its current status.

Before you start

• A paid plan: agents run live, and the Free plan only runs Dry Runs.
• An AI provider key (OpenAI, Anthropic, Google and more) in Settings → AI Providers. AI usage is billed by your provider.
• These apps, connected in Settings → Integrations: HTTP / Custom API and Slack.
• A form, app or system that can send each new item to a webhook URL (the agent starts from a webhook).
• About 25 minutes.

• Bring your own AI key
• HTTP / Custom API (live)
• Slack (live)

Set it up step by step

Get the agent first (buy it, or it's already yours when your plan includes it), then in Agents → My agents press “Set up this agent”. That creates the agent's workflow in your workspace (it counts towards your plan's workflow limit) and opens the canvas with a setup checklist above it. Each item links to the exact place to go and ticks itself off when it's done.

1. Connect your AI provider

The AI steps run on your own key (OpenAI, Anthropic, Google and more). Add one in Settings → AI Providers.

• Connect your AI provider

2. Connect GitHub (HTTP / Custom API)

In Settings → Integrations, add an HTTP / Custom API connection: base URL https://api.github.com, Authentication “Bearer token”, and a fine-grained personal access token for your repositories with “Pull requests: Read and write”.

• Connecting HTTP / Custom API

3. Connect Slack

Connect the Slack workspace your engineers use (Settings → Integrations → Slack).

• Connecting Slack

4. Paste your conventions

Open “Review the diff” and replace the placeholder with your stack and the conventions reviews should enforce.

5. Pick the GitHub connection

Open the two “Post the review on the pull request” steps and pick your GitHub connection in each.

6. Pick the Slack account and channel

Open “Alert the team in Slack” and pick your account and channel. Invite the app to private channels first (/invite @Fluxo Flow).

7. Test it with Dry Run

Press Dry Run: the agent runs on sample data with no messages sent and nothing written to your apps.

• Dry Run vs Run

8. Switch the trigger on

Switch the webhook on, copy its URL and secret into your repository secrets FLUXO_REVIEW_URL and FLUXO_REVIEW_SECRET, and add the GitHub Actions step from the agent's FAQ (.github/workflows/ai-review.yml).

How it works

The agent is a normal workflow with 9 steps (1 AI step). You can open, edit and monitor it like any other workflow.

• Pull request opened or updated — Starts when your form or app sends data to the agent's webhook URL. A short GitHub Actions step (or any CI job) posts each pull request's title, description and diff to the workflow's webhook URL.
• Review the diff — AI step (runs on your AI provider key). AI reviews the diff like a senior engineer: bugs, security issues (injection, auth, leaked secrets), missing tests, your conventions, and writes a structured review comment with severities.
• Critical or high findings? — Decision: picks the branch to follow. Reviews with a critical or high finding also alert your team in Slack; every review is posted on the pull request.
• Post the review on the pull request — HTTP / Custom API: Send a request. Branch: Critical or high. Posts the review as a comment on the pull request through the GitHub API, with your token.
• Review posted — Kept in the run history. The run history keeps the review and GitHub's response.
• Alert the team in Slack — Slack: Post a message. Branch: Critical or high. Posts the pull request, the verdict and the blocking findings to your engineering channel.
• Team alerted — Kept in the run history. The run history keeps the alert.
• Post the review on the pull request — HTTP / Custom API: Send a request. Branch: Other. Posts the review as a comment on the pull request through the GitHub API, with your token.
• Review posted — Kept in the run history. The run history keeps the review and GitHub's response.

Test it with Dry Run

Press Dry Run in the canvas. The agent runs on the sample data stored on its trigger (the “Sample data for Dry Run” box), so you can check every step's output before anything is live. Edit the sample to match the fields your own form or app sends.

Sample data fields

repository, pr_number, title, description, author, url, base_branch, diff.

• Nothing is sent or written: app actions, emails and Slack posts are simulated, and AI steps don't call your AI provider.

Go live

• Switch the webhook on, copy its URL and secret into your repository secrets FLUXO_REVIEW_URL and FLUXO_REVIEW_SECRET, and add the GitHub Actions step from the agent's FAQ (.github/workflows/ai-review.yml).
• The webhook is protected by a secret: send it in the header shown in the Activation panel (requests without it are refused with 403). Each request starts one run.
• The setup checklist adds a “paid plan” item before activation: live runs need a paid plan (the Free plan only runs Dry Runs).
• When every checklist item is done and the trigger is on, the checklist says “Live — this agent is running”. Follow its runs in the workflow's History tab and in Analytics → Agents.

• Webhook triggers
• Switching a trigger on (Activation)

Questions

How do pull requests reach the agent?

Add this workflow to your repository as .github/workflows/ai-review.yml and save the webhook URL and secret as the repository secrets FLUXO_REVIEW_URL and FLUXO_REVIEW_SECRET: name: AI code review on: pull_request: types: [opened, synchronize, ready_for_review] jobs: review: if: github.event.pull_request.draft == false runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: { fetch-depth: 0 } - env: URL: ${{ secrets.FLUXO_REVIEW_URL }} SECRET: ${{ secrets.FLUXO_REVIEW_SECRET }} TITLE: ${{ github.event.pull_request.title }} BODY: ${{ github.event.pull_request.body }} AUTHOR: ${{ github.event.pull_request.user.login }} PR_URL: ${{ github.event.pull_request.html_url }} PR: ${{ github.event.pull_request.number }} BASE: ${{ github.base_ref }} run: | git diff "origin/$BASE...HEAD" | head -c 60000 > pr.diff jq -n --rawfile diff pr.diff --arg repo "$GITHUB_REPOSITORY" --argjson pr "$PR" \ --arg title "$TITLE" --arg body "$BODY" --arg author "$AUTHOR" --arg url "$PR_URL" --arg base "$BASE" \ '{repository:$repo, pr_number:$pr, title:$title, description:$body, author:$author, url:$url, base_branch:$base, diff:$diff}' \ | curl -sf -X POST "$URL" -H "Content-Type: application/json" -H "x-fluxo-secret: $SECRET" --data @- GitHub doesn't share secrets with pull requests from forks, so forks aren't reviewed.

Does it work with GitLab?

Yes, with two changes: send the same JSON from a GitLab CI job, and in the two comment steps use a GitLab connection (base URL https://gitlab.com/api/v4, API key header PRIVATE-TOKEN) with the path /projects/<project id>/merge_requests/{{input.json.pr_number}}/notes.

Can it approve or merge?

No. It only comments. Your reviewers and branch protection rules decide.

Troubleshooting

• “No AI provider connected” or a rejected key: connect or fix the key in Settings → AI Providers, then press Test there.
• A checklist item stays unticked: the setting is still empty or still contains its placeholder text. Open the step from the checklist and fill it in.
• An app step fails with “Needs reconnect”: the account's access was revoked or expired. Reconnect it in Settings → Integrations.
• Slack says the app isn't in the channel: in Slack, type /invite @Fluxo Flow in that channel (always needed for private channels).
• Nothing happens when your form sends data: check the webhook is switched on and the request carries the secret header (403 means it's missing or wrong).
• A step failed: open the run in History and check that step in the Trace tab for the error and what it received.

• Debugging failed runs
• Error messages
• Get help