Pre-launch · validating with early teams

Code review that gets to the point.

Corax is your go-to GitHub App for pull request review. Every PR gets a clear verdict and the findings that actually matter — each pinned to a file and line, with fixes you can commit in one click.

Install on GitHub See what it does

Install → pick your repos → open a PR. No YAML, no pipelines, no credit card.

pull request #482Corax review

corax-reviewcommented just now

Verdict: blockers · confidence: high · checked: full diff, tests

Blockersrc/auth/session.ts:42

Token refresh runs before the expiry check — expired sessions get renewed instead of rejected.

suggestion

- await this.refresh()

+ if (this.isExpired()) throw new SessionExpiredError()

Commit suggestionAdd to batch

Blockersrc/api/orders.ts:118

getOrder is also imported in reporting.ts — this signature change will break that call site.

Questionsrc/lib/retry.ts:8

Is maxAttempts = 0 meant to disable retries? Right now it still retries once.

0YAML files, pipelines or webhooks to wire up

ΔEvery push re-reviewed: Fixed · Still open · Regressed

/coraxAsk, fix, commit, push — all from the PR thread

What it does

Everything you need to decide on a PR — and nothing you'll skim past.

Starts where you start: the intent

Corax reads your PR description first, then AGENTS.md, CONTRIBUTING.md and the docs they point to. Your change is judged against what you set out to do — and the rules your repo already lives by.

A verdict you can act on

Every review opens with one line: blockers or no blockers, how confident Corax is, what it checked and what it couldn't verify. A clean PR gets a clear “no blockers” — not a page of filler.

Every comment earns its place

Bugs, regressions, security and missing tests come first. No style nitpicks, no compliments, no recap of your own diff. Blockers come with proof: the scenario that breaks, or the repo rule it violates.

Sees past the diff

Corax works on a full checkout of your branch, so it spots the change that breaks a caller two files away — a renamed export, a shifted signature.

Just say /corax

Wondering why something was flagged? Ask in the thread. Want it fixed? Ask for that too — Corax commits and pushes for owners and collaborators. Fork PRs aren't supported yet.

Keeps score on every push

New commit, fresh look: Corax tells you what's Fixed, what's Still open and what Regressed — no rereading the whole review.

In any PR thread

/corax add null checks in parseWebhook

- if (!payload.data) return

+ if (!payload?.data?.id) return null

Committed & pushed to fix/webhook-null-guards

Auto-fix + push requires owner or collaborator access. Pull requests from forks are not supported yet.

Delta review · commit 4f2c9e1

Fixed

session.ts:42 — expiry check now runs before refresh.

Still open

orders.ts:118 — call site in reporting.ts still needs updating.

Regressed

retry.ts:31 — new loop can exceed the deadline budget.

Not a linter. Not a chat window.

Keep your linter for the rules it enforces — Corax handles what no rule can express.

Capability	Corax	Linters	AI Chat assistant
Reads the PR's intent and your repo's guidelines
Comments on the exact file and line
Answers follow-ups right in the PR
Re-reviews every push
Ready the moment you install

How it works

No YAML. No webhooks to wire. No config files to maintain.

Install & pick your repos

GitHub checks you're an owner or admin and lets you choose repositories right in the install flow. Nothing else to wire up.

Open a PR — Corax takes it from there

It reads the diff and the thread and posts its review. Every new commit gets a re-review.

Want to pick the model, add your own review guidelines or watch a run live? The dashboard at app.getcorax.com has you covered — entirely optional.

Security & trust

What actually protects your code today — not promises, current behavior.

Isolated Docker sandbox

Every review runs in its own Docker sandbox, torn down (--rm) after each run. The host filesystem stays isolated from your code.

Authorization gate

Only repository owners and collaborators can trigger actions. Pull requests from forks are not supported yet, so untrusted code never reaches the sandbox.