> ## Documentation Index > Fetch the complete documentation index at: https://personal-ce79cb71.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # BugViper Frequently Asked Questions: Setup and Usage > Answers to common questions about BugViper: GitHub App permissions, review modes, supported languages, LLM providers, security, and pricing. If you're new to BugViper or running into something unexpected, you'll likely find the answer here. These are the questions that come up most often from teams setting up BugViper for the first time or exploring how it works under the hood. BugViper requires the following GitHub App permissions to clone repositories, listen for PR events, and post review comments: | Permission | Level | | --------------- | ------------ | | Contents | Read | | Issues | Read & Write | | Pull Requests | Read & Write | | Metadata | Read | | Commit Comments | Read & Write | | GitHub Actions | Read | BugViper does not request access to your GitHub organization's members, secrets, or settings. You can also limit the app to specific repositories during installation — it will only review PRs in repos you explicitly grant access to. BugViper's call graph and blast radius analysis is powered by [tree-sitter](https://tree-sitter.github.io/tree-sitter/), which supports 17 languages out of the box: Python, JavaScript, TypeScript, Go, Rust, Java, Ruby, C++, C#, Svelte, Dart, PHP, Swift, Kotlin, Scala, Haskell, and C. For static analysis (the `@bugviper run lint` command), the supported languages are determined by the configured linters: Ruff for Python, ESLint for JavaScript and TypeScript, and golangci-lint for Go. You can enable or disable individual linters from the **Dashboard → Tools** page. BugViper clones your repository into an isolated [E2B](https://e2b.dev/) cloud sandbox for the duration of the review. The sandbox — and the cloned code inside it — is destroyed as soon as the review completes or the sandbox timeout is reached. BugViper does not persist raw source code anywhere after that point. As part of the review, BugViper generates a call graph from your repository. This graph contains function names, file paths, and call relationships — not the full source text of your files — and is stored in your self-hosted database instance. BugViper supports two AI review modes, which you configure with the `DEEPAGENT_REVIEW_MODE` environment variable: **Normal mode** (default) runs a single generalist agent that reviews batches of four files sequentially. It is fast and efficient — typically the right choice for everyday PRs. **Deep mode** runs three specialized sub-agents in parallel — one focused on correctness bugs, one on security vulnerabilities, and one on performance issues. Each agent gets its own isolated E2B sandbox and reviews batches of two files at a time. Deep mode is more thorough and catches issues that specialist framing surfaces, but it takes longer and uses more E2B sandbox time. Both modes run the same verifier pass and deduplication step after the agents finish, so findings are always validated before being posted to GitHub. Yes. BugViper lets you configure a different model for each role in the review pipeline — the review agent, the orchestrator, the sub-agents, the verifier, and the deduplication step. You can mix models from different providers in the same pipeline. Supported providers are: * **OpenRouter** — access to hundreds of models (Claude, GPT-4o, DeepSeek, Mistral, and more) via a single API key * **Google Gemini** — use any Gemini model identifier prefixed with `gemini/` * **MiniMax** — use MiniMax model identifiers prefixed with `MiniMax-` See the [LLM Providers](/configuration/llm-providers) page for setup instructions and model assignment details. There are two common reasons BugViper completes a review without posting inline comments: 1. **All findings were classified as `nitpick`** — The verifier scored every finding below the `NITPICK_CONFIDENCE_FLOOR` threshold (default: 7 out of 10\). Nitpick findings are intentionally suppressed from GitHub to avoid noise. You can lower `NITPICK_CONFIDENCE_FLOOR` to post more findings, or check the BugViper dashboard to see the full list of findings including nitpicks. 2. **All findings were classified as `outside_diff`** — The verifier determined that the reported issues are in parts of the codebase that were not modified by the PR. These are also suppressed from inline comments to keep reviews focused on the actual changes. In both cases, you can view every finding — including nitpicks and outside-diff items — from the **Dashboard → Repos → PR detail** view. You can trigger a BugViper review by commenting on any open pull request in a repository where BugViper is installed: * **`@bugviper full review`** or **`@bugviper review`** — Runs the full AI DeepAgent review pipeline: clones the repo, builds the call graph, runs agents, verifies findings, and posts inline comments plus a summary. * **`@bugviper run lint`** or **`@bugviper lint`** — Runs the fast static analysis pass using ESLint, Ruff, and golangci-lint. No AI agents, no call graph — results are posted in seconds. BugViper will respond to comments made by any contributor who has access to the repository. When you comment `@bugviper resolve` on a PR, BugViper will resolve all of its own inline review comment threads on that pull request. This is useful for cleaning up the PR view after you have addressed the reported issues and want to mark the review threads as done without manually resolving them one by one. BugViper only resolves threads it created — it will not touch comments or threads from other reviewers. Yes. BugViper is released under the [MIT License](https://opensource.org/licenses/MIT) and the full source code is available on GitHub at [github.com/MabudAlam/BugViper](https://github.com/MabudAlam/BugViper). You are free to self-host, modify, and contribute to BugViper. Pull requests are welcome.