Get started
Introduction
What Audit Bench Ai is, what it reviews, and where to begin.
Audit Bench Ai reviews pull requests the way a careful senior engineer would: it reads the change, looks at the code that calls it, and comments only where something would actually break, leak or mislead. Each finding says what goes wrong, when it goes wrong, and how to fix it, with a one-click suggestion where it can.
It works on GitHub, GitLab and Bitbucket, and the same engine runs in VS Code, in the terminal and in CI, so you can catch problems before a pull request exists.
Install the GitHub App and get your first review in about five minutes.
Free local checks first, then a focused AI pass with the context that matters.
Severities, categories, the summary comment and the merge check.
Teach it your conventions and decide how picky it should be.
What happens on a pull request#
- You open or update a pull request. An Audit Bench Ai check appears at once with “Reviewing…”. A review usually takes one to two minutes.
- Local checks run first, for free. Linters, type checks, secret scanning and complexity analysis find the mechanical problems without using any AI.
- Each changed file gets one focused AI review. The model sees the changed lines, the code elsewhere in the repository that calls them, and related tests, so it can tell whether a change breaks a caller.
- Findings are calibrated before they’re posted. Low-confidence guesses are dropped, unproven “critical” claims are toned down, and anything already raised on the pull request isn’t posted again.
- You get inline comments, a summary and a verdict. The check passes, passes with notes, or fails on a blocking issue. You can make it a required check.
- Reply and it rechecks. Push back on a finding and it looks at the code again: it withdraws the finding, lowers it, or explains why it still applies. Your team’s 👍 and 👎 teach it what to stop raising.
Where it runs#
| Surface | What it does | Guide |
|---|---|---|
| GitHub | Automatic reviews, inline comments, the merge check, replies, re-run | GitHub |
| GitLab | Automatic merge request reviews and @auditbench answers | GitLab |
| Bitbucket Cloud | Automatic pull request reviews and a build status | Bitbucket |
| VS Code | Review the file you’re editing, before you commit | VS Code |
| CLI and CI | Review files or folders, fail a pipeline on blocking issues | CLI |
| Web app | Whole-repository scans, reports, team rules and metrics | Repository scans |
What it looks for#
Every finding has one of twelve categories: Security, Logic, Performance, Reliability, Data Integrity, Concurrency, Resource Management, API Design, Semantic Accuracy (a name or comment that says something different from what the code does), Testing, Architecture and Maintainability.
It reviews TypeScript, JavaScript, Python, Go, Java, Kotlin, C#, PHP, Ruby, Rust, Swift, Scala, C and C++, along with SQL, Prisma schemas, YAML and JSON.