lgtmaybe¶

lgtmaybe reviews pull and merge requests on GitHub, GitLab, Gitea, and Azure DevOps, posting inline comments and one summary. Choose a hosted model, ollama, or another OpenAI-compatible endpoint.

It works before a pull request exists. Run lgtmaybe review on your branch, add a pre-commit hook, or hand its findings to your coding agent to fix. With a local model, your code stays local.

It reads the diff plus a little surrounding code and comments only on changed lines. It never checks out or runs the change, skips generated files and binaries, redacts secrets, and treats author-supplied text as untrusted.

It checks for:

Correctness and security: logic errors, missed awaits, injection, auth mistakes, and leaked secrets.
Code health: performance problems, needless complexity, deprecations, and risky dependencies.
Tests and documentation: missing or weak tests, stale comments, and undocumented APIs.
Intent: whether the change does what its title, description, and commits say.
Ponytail: code you don't need, and simpler or standard-library ways to do the job.
Architecture: coupling, wrong-way dependencies, and broken subclass contracts that will be hard to undo.

Each finding is graded info to critical and lands on its changed line. A clean change gets a 👍 LGTM!.

An inline lgtmaybe comment flagging a critical SQL injection and suggesting a fix

Slash commands refresh a review (/review, /improve), answer a question (/ask), or post a description (/describe) or change overview (/diagram). The overview rates the risk of change, lists high-impact areas, and draws a flowchart, plus a sequence diagram when the change alters a runtime flow. lgtmaybe diagram prints a text version locally.

flowchart LR
    web["Storefront<br/>React<br/>places orders"]
    api["Order API<br/>Python<br/>creates orders (changed)"]
    db["Order database<br/>PostgreSQL<br/>stores orders"]
    queue["Order events<br/>SQS<br/>buffers events (new)"]
    worker["Notification worker<br/>Python<br/>sends confirmations (new)"]
    email["Email provider<br/>delivers messages"]
    web -->|calls| api
    api -->|stores in| db
    api -->|publishes to| queue
    queue -->|delivers to| worker
    worker -->|sends via| email

Start here¶

Tutorial: Getting started: your first review with ollama, locally and free.
How-to: install the CLI, choose a review model, run locally, Bedrock OIDC, Vertex WIF, Azure OpenAI, GitHub Action, GitLab, Gitea, Forgejo, Azure DevOps.
Reference: Configuration: every config field and schema.
Explanation: What gets reviewed, Architecture, Auth model, Data & privacy.

What's New¶

2.15.2 · 2026-10-17 · ci: wait out PyPI index lag and winget token quota on release
2.15.1 · 2026-10-17 · ci: pin the tap checkout branch so it skips the REST API
2.15.0 · 2026-10-17 · gitea: resolve fixed findings' comments on Gitea 1.26+; provider: review with a ChatGPT subscription; and 3 more changes
2.14.0 · 2026-10-16 · forgejo: keyless Bedrock, Azure and Vertex from a runner's OIDC token; forgejo: review Forgejo pull requests from Forgejo Actions; and 25 more changes
2.13.0 · 2026-10-16 · engine: add architecture review lens; engine: arbitrate opposing findings and refresh ponytail lens for ponytail 5; and 5 more changes

Full changelog

Providers¶

Provider	Auth
`openai`	`OPENAI_API_KEY`
`anthropic`	`ANTHROPIC_API_KEY`
`openrouter`	`OPENROUTER_API_KEY`
`zai`	`ZAI_API_KEY` for GLM / Zhipu AI; optional `--api-base` for the China / coding-plan endpoint
`chatgpt`	A ChatGPT Plus or Pro subscription, signed in with `lgtmaybe login chatgpt`; local reviews only
`bedrock`	Ambient AWS creds via GitHub OIDC, no static key
`vertex`	Ambient GCP creds via Workload Identity Federation, no key
`azure`	Resource endpoint, plus `AZURE_API_KEY` or keyless Entra (Azure AD) creds via GitHub OIDC
`ollama`	None: local only, zero cost
`openai-compatible`	`--api-base` to any OpenAI `/v1` endpoint; key optional (placeholder for keyless local servers)