Skip to main content
If you’re new to BugViper or running into something unexpected, you’ll likely find the answer here. These are the questions that come up most often from teams setting up BugViper for the first time or exploring how it works under the hood.
BugViper requires the following GitHub App permissions to clone repositories, listen for PR events, and post review comments:BugViper does not request access to your GitHub organization’s members, secrets, or settings. You can also limit the app to specific repositories during installation — it will only review PRs in repos you explicitly grant access to.
BugViper’s call graph and blast radius analysis is powered by tree-sitter, which supports 17 languages out of the box:Python, JavaScript, TypeScript, Go, Rust, Java, Ruby, C++, C#, Svelte, Dart, PHP, Swift, Kotlin, Scala, Haskell, and C.For static analysis (the @bugviper run lint command), the supported languages are determined by the configured linters: Ruff for Python, ESLint for JavaScript and TypeScript, and golangci-lint for Go. You can enable or disable individual linters from the Dashboard → Tools page.
BugViper clones your repository into an isolated E2B cloud sandbox for the duration of the review. The sandbox — and the cloned code inside it — is destroyed as soon as the review completes or the sandbox timeout is reached. BugViper does not persist raw source code anywhere after that point.As part of the review, BugViper generates a call graph from your repository. This graph contains function names, file paths, and call relationships — not the full source text of your files — and is stored in your self-hosted database instance.
BugViper supports two AI review modes, which you configure with the DEEPAGENT_REVIEW_MODE environment variable:Normal mode (default) runs a single generalist agent that reviews batches of four files sequentially. It is fast and efficient — typically the right choice for everyday PRs.Deep mode runs three specialized sub-agents in parallel — one focused on correctness bugs, one on security vulnerabilities, and one on performance issues. Each agent gets its own isolated E2B sandbox and reviews batches of two files at a time. Deep mode is more thorough and catches issues that specialist framing surfaces, but it takes longer and uses more E2B sandbox time.Both modes run the same verifier pass and deduplication step after the agents finish, so findings are always validated before being posted to GitHub.
Yes. BugViper lets you configure a different model for each role in the review pipeline — the review agent, the orchestrator, the sub-agents, the verifier, and the deduplication step. You can mix models from different providers in the same pipeline.Supported providers are:
  • OpenRouter — access to hundreds of models (Claude, GPT-4o, DeepSeek, Mistral, and more) via a single API key
  • Google Gemini — use any Gemini model identifier prefixed with gemini/
  • MiniMax — use MiniMax model identifiers prefixed with MiniMax-
See the LLM Providers page for setup instructions and model assignment details.
There are two common reasons BugViper completes a review without posting inline comments:
  1. All findings were classified as nitpick — The verifier scored every finding below the NITPICK_CONFIDENCE_FLOOR threshold (default: 7 out of 10). Nitpick findings are intentionally suppressed from GitHub to avoid noise. You can lower NITPICK_CONFIDENCE_FLOOR to post more findings, or check the BugViper dashboard to see the full list of findings including nitpicks.
  2. All findings were classified as outside_diff — The verifier determined that the reported issues are in parts of the codebase that were not modified by the PR. These are also suppressed from inline comments to keep reviews focused on the actual changes.
In both cases, you can view every finding — including nitpicks and outside-diff items — from the Dashboard → Repos → PR detail view.
You can trigger a BugViper review by commenting on any open pull request in a repository where BugViper is installed:
  • @bugviper full review or @bugviper review — Runs the full AI DeepAgent review pipeline: clones the repo, builds the call graph, runs agents, verifies findings, and posts inline comments plus a summary.
  • @bugviper run lint or @bugviper lint — Runs the fast static analysis pass using ESLint, Ruff, and golangci-lint. No AI agents, no call graph — results are posted in seconds.
BugViper will respond to comments made by any contributor who has access to the repository.
When you comment @bugviper resolve on a PR, BugViper will resolve all of its own inline review comment threads on that pull request. This is useful for cleaning up the PR view after you have addressed the reported issues and want to mark the review threads as done without manually resolving them one by one.BugViper only resolves threads it created — it will not touch comments or threads from other reviewers.
Yes. BugViper is released under the MIT License and the full source code is available on GitHub at github.com/MabudAlam/BugViper.You are free to self-host, modify, and contribute to BugViper. Pull requests are welcome.