Skip to main content
Find answers to the most common questions about setting up and using BugViper. If your question isn’t covered here, check Common errors for specific error messages and fixes.
BugViper uses Tree-sitter to parse source code into ASTs, and ships parsers for 17 languages:
LanguageLanguageLanguage
PythonTypeScriptJavaScript
GoRustJava
C++CC#
RubyPHPSwift
KotlinScalaHaskell
LuaBash
Files in unsupported languages are skipped during ingestion and excluded from code graph queries and reviews.
Several conditions must be true before BugViper posts an inline comment:
  1. The repository must be indexed. BugViper won’t review a PR unless the repo has been ingested first. If it isn’t, BugViper posts a message on the PR explaining this.
  2. Issues must meet the confidence threshold. BugViper filters out findings with a confidence score below 7/10. A review that finds no high-confidence issues will post a walkthrough summary but no inline comments.
  3. You must mention @bugviper in a PR comment. Webhooks only trigger a review when someone explicitly calls @bugviper review or @bugviper full review. Opening a PR alone does not trigger a review.
If none of these apply, check the Recent Deliveries tab in your GitHub App settings to confirm the webhook was delivered and returned a 200 response.
For large refactors or after adding many new files, trigger a full re-ingestion to rebuild the graph from scratch:
curl -X POST https://your-bugviper-domain.com/api/v1/ingest/github \
  -H "Authorization: Bearer YOUR_FIREBASE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"owner": "your-org", "repo_name": "your-repo", "clear_existing": true}'
Setting "clear_existing": true removes all existing graph nodes for the repository before re-ingesting. Alternatively, use the Re-ingest button in the BugViper dashboard if you have one configured.For smaller incremental changes — like a single push to a branch — BugViper handles those automatically through the push webhook without a full re-index.
Yes. BugViper uses a GitHub App for all repository access, and GitHub Apps can be granted access to private repositories. When you install your GitHub App, choose Only select repositories and add the private repos you want BugViper to work with.BugViper clones repositories using the App’s installation token, which respects the access you granted. No personal access tokens or SSH keys are needed.
You can check the status of any ingestion job using its job ID:
GET /api/v1/ingest/jobs/{job_id}
The response includes a status field (pending, running, completed, or failed) and an error_message field that describes what went wrong.Common causes of ingestion failures:
  • Invalid GitHub credentials — the GitHub App private key or App ID is wrong
  • Neo4j connection issues — the database is unreachable or the credentials are incorrect
  • Repository not found — the App may not have been granted access to that repository
Jobs that stay in pending or dispatched for more than 10 minutes are automatically marked stale. You can safely re-trigger ingestion for a stale job and a new one will be created.
Yes. When you ingest a repository, BugViper stores the full source code of each file as a property on the corresponding File node in your Neo4j graph. This is what enables code search, the peek viewer, and the AI review agent’s ability to look up functions, callers, and dependencies during a review.Only repositories you explicitly ingest are stored. BugViper does not scan or store repositories on its own.Your Neo4j database is the authoritative store — you can delete a repository and all its graph data at any time using DELETE /api/v1/repos/{owner}/{repo}.
Cost depends on the model you configure and the number of changed files in the PR.
ModelApproximate cost per file
openai/gpt-4o-mini (default)Very low
openai/gpt-4oLow to medium
anthropic/claude-sonnet-4-5~$0.12 per file (~6,500 tokens)
You can reduce cost in two ways:
  • Lower MAX_TOOL_ROUNDS — the default is 8; setting it to 4 or 5 cuts exploration tokens roughly in half while still catching most issues.
  • Use a cheaper model for synthesis — set SYNTHESIS_MODEL=openai/gpt-4o-mini even if you use a more capable model for REVIEW_MODEL.
See Configure AI models for a full breakdown.
BugViper uses OpenRouter as its LLM gateway, which gives you access to 200+ models from OpenAI, Anthropic, Google, Meta, Mistral, and others — all through a single API key. You do not need separate accounts with each provider.To switch models, set REVIEW_MODEL and SYNTHESIS_MODEL in your .env to any valid OpenRouter model slug:
REVIEW_MODEL=meta-llama/llama-3.1-70b-instruct
SYNTHESIS_MODEL=openai/gpt-4o-mini
BugViper’s synthesis phase uses robust JSON extraction that works with any model — it does not require structured-output API support, so you can freely experiment with newer or open-weight models.
If you posted @bugviper review on a PR and nothing happened, work through this checklist:
  1. Is the GitHub App installed on the repository? Go to your GitHub App settings → Install App and confirm the repo is listed.
  2. Is the webhook URL correct? In your GitHub App settings, check that the webhook URL points to https://your-bugviper-domain.com/api/v1/webhook/onComment.
  3. Was the webhook delivered? Open Recent Deliveries in your GitHub App settings. A failed delivery (non-2xx status) indicates a server or network issue.
  4. Has the repository been indexed? BugViper posts a message on the PR if the repo isn’t indexed — check the PR for that message.
  5. Is BugViper running? Confirm the API service is up and reachable from GitHub’s webhook IPs.
If you’re developing locally, make sure ngrok is running and the tunnel URL matches the webhook URL in your GitHub App settings.