Buddy

Review

AI Code Review Inline findings anchored to the lines you changed Conversations @buddy answers, re-reviews, resolves and pauses Local Review Read the working tree before the PR exists Finishing Touches Tests, docstrings and autofix, as a stacked PR

Automate

Merge Gates A real check run, not a comment nobody reads CI Repair Classify a failing run and fix what is unambiguous Dependency Updates Eleven ecosystems, real changelogs, auto-merge

Platform

Workflow Security Supply-chain footguns in .github/workflows Your CI, Your Keys No hosted app, no diff leaving your pipeline
Nine jobs, one binary. All features →

By team

Open Source A reviewer a maintainer cannot hire Startups No spare reviewer, no time for updates Platform & Enterprise Standards as check runs, on your infrastructure Agencies Twenty client repositories, one config

By job

Monorepos Every manifest at every depth, no setting Security & Compliance Licences, advisories and supply-chain audits Migrating Bring the Renovate config you already wrote AI Coding Agents Close the loop before the PR exists
Find the shape of your problem. All use cases →
GuideCLIAIConfigAPIGitHub

use cases

Find the shape of your problem

The same binary solves quite different problems depending on who is running it. Pick the situation that looks like yours and start from the configuration that fits it.

Get Started Browse the features Compare Buddy
🌱

Open Source Maintainers

A free reviewer for a project with no budget, running on GitHub's free minutes, that helps first-time contributors instead of scolding them — and never gives a drive-by comment the power to make the bot act.

For maintainers
🚀

Startups

Four engineers, no reviewer to spare, and dependencies quietly rotting. Automate the review nobody has time for and the updates nobody wants.

For small teams
🏢

Platform & Enterprise Teams

Standards enforced as check runs across every repository, on your own infrastructure, with no vendor holding your source.

For platform teams
🧰

Agencies & Consultancies

Twenty client repositories on eight stacks. One config template, one workflow, and a dependency-health report the client can read.

For agencies
🏗️

Monorepos

Every manifest at every depth, discovered by walking the tree. No workspaces setting, because there is nothing to configure.

At scale
🛡️

Security & Compliance

Licence allowlists, OSV advisories, end-of-life base images and workflow supply-chain audits — enforced as blocking checks, with an auditable trail and nothing leaving your perimeter.

For security teams
🔄

Migrating off Renovate or Dependabot

buddy setup reads your existing config, converts what maps, and reports what does not. Nothing changes silently.

How migration works
🤖

Working with AI Coding Agents

When most of the diff was written by an agent, review is the bottleneck. buddy review --format agent closes the loop before the PR exists.

Close the loop

Not sure which one you are

Answer one question: what is the thing you keep not getting to?

If it is…Start here
Nobody reviews the PRs properlyAI code review
Dependencies are six months behindDependency updates
Standards exist but nobody enforces themMerge gates
The build breaks and sits red for a dayCI repair
A vendor cannot have our sourceYour CI, your keys
We cannot justify another per-seat toolLocal review — it runs with no key at all

Or just try it

bun add -g @buddysh/buddy
buddy review --light

No account, no key, no repository access. It reads your working tree and tells you what it finds.