Free to start — install in 60 seconds

Your AI
senior reviewer
never sleeps

BugLens reviews every pull request before your team does - catching bugs, vulnerabilities, and style violations using your own codebase as context.

buglens - PR #142 review
$ buglens review --pr 142
Fetching diff... 847 lines changed across 12 files
Running Lens agent -> Context agent -> Review agent
 
[!] auth/middleware.ts:34 - SQL injection risk
// User input directly interpolated into query string
[x] api/upload.ts:89 - No file size validation
// Max 10MB enforced in docs but not in code (see RFC-22)
[ok] utils/cache.ts - Matches team caching standard
 
-> Posted 3 inline comments to PR #142
-> Severity score: 6.4 / 10 | Request changes: yes
$
// see it in action

What your team
actually sees

BugLens posts structured review comments directly on your pull requests — with the bug, why it matters in your codebase, and the fix.

PR #142feat: add user authentication middleware
buglens reviewed
auth/middleware.ts
31 const user = await getUser(req.headers.authorization);
32 if (!user) return res.status(401).json({ error: 'Unauthorized' });
33 const q = `SELECT * FROM sessions WHERE token = ${req.body.token}`;
34 const q = db.prepare('SELECT * FROM sessions WHERE token = ?');
35 return q.get(req.body.token);
BL
buglens[bot]commented on auth/middleware.ts:33
CRITICAL

SQL injection — user input interpolated directly into query string

The token from req.body.token is concatenated into the SQL string, letting an attacker manipulate the query. Matches OWASP A03:2021 — Injection.

From your Knowledge Base: RFC-22 mandates parameterized queries for all DB access. See the team pattern in lib/db.ts:12.
// how it works

Three agents.
One verdict.

BugLens uses a LangGraph pipeline of three specialised AI agents that work in sequence on every PR diff.

Lens agent

Parses diffs with AST analysis. Detects OWASP vulnerabilities, logic errors, and anti-patterns at the line level.

Context agent

Searches your team's docs, past PR comments, and standards via RAG. Every review knows your codebase.

Review agent

Writes structured inline comments with severity scores and one-click suggested fixes - posted directly on the PR.

GitHub native

Install via GitHub App in 60 seconds. Works on any repo, any language. No config files needed to get started.

MCP server

Expose BugLens agents to any MCP-compatible AI tool. Let your IDE assistant query review history and standards.

Review analytics

Track bug patterns, recurring violations, and team-wide code health over time on your BugLens dashboard.
// knowledge base

BugLens learns
your rules

Write team conventions once as Lessons. BugLens applies them to every PR — catching violations your senior devs would flag, without needing them to review every diff.

0config files needed
rules you can teach
Start teaching BugLens →
Your team's lessons3 active
Architecture

Never call the database directly from route handlers. Always go through the service layer in /lib/services.

Security

All user-facing file uploads must validate MIME type server-side. Do not trust the Content-Type header.

Patterns

Async functions that can fail must return a Result type. No bare try/catch at the call site.

+Add a lesson...
// pricing

Scale your
engineering quality

Simple, transparent pricing for teams of all sizes. No hidden fees.

Free
$0forever

Perfect for students and early explorers.

  • 1 repository
  • 50 AI reviews / month
  • Generic review only
  • Community support
  • Public repos only
Start for Free
Business (Soon)
$49per seat / month

The ultimate solution for scaling engineering teams.

  • Everything in Pro
  • Custom AI Coding Standards
  • Slack & Discord integrations
  • Organization-wide installation
  • Priority Slack support
Join Waitlist
// from the builder's log

Building in public

Technical deep-dives on AI agents, RAG pipelines, and the engineering decisions behind BugLens.

View Journal →
Follow the build

New post every week. No spam - just honest engineering notes from building BugLens in public.