2 min read

Quickstart: 2-Minute Setup

Connect your GitHub repository, add your free Google or Groq API key, and receive AI-powered code reviews on your next pull request.

Connect your GitHub repository, add your free Google or Groq API key, and receive AI-powered code reviews on your next pull request.

Prerequisites

A GitHub account with administrator or collaborator access to at least one repository.
An API key from Google AI Studio (100% free tier available), Groq, Mistral, or OpenRouter.

Step 1: Install GitHub App

1.Go to the GitCaptain Dashboard and click Connect Repository.
2.Select your personal account or organization.
3.Choose whether to grant access to All repositories or select Specific repositories.
4.Authorize the GitCaptain GitHub App. The app only requests least-privilege permissions:
Pull Requests (Read & Write to post review comments)
Commit Statuses & Checks (Read & Write to report quality gates)

Step 2: Add Your BYOK Key

GitCaptain never marks up token costs. Individual builders connect directly to model providers:

1.Navigate to Dashboard > Settings > Inference Providers.
2.Select Google AI Studio (Recommended for zero-cost operation) or Groq Cloud (for sub-second latency).
3.Paste your API key.
4.GitCaptain validates the token and encrypts it at rest using AES-256-GCM.
bash
# Provider Key Setup Verification
curl -X POST https://api.gitcaptain.com/v1/auth/verify-key \
  -H "Authorization: Bearer <your-session-token>" \
  -d '{"provider": "google", "model": "gemini-2.5-flash"}'

Step 3: Open a Test PR

1.Create a new branch in your connected repository:

```bash

git checkout -b test-gitcaptain

echo "function calculateDiscount(price, pct) { return price - (price * pct); }" >> utils.js

git commit -am "test: add discount utility function"

git push origin test-gitcaptain

```

2.Open a Pull Request on GitHub.
3.Within 15 seconds, GitCaptain constructs the Tree-sitter AST diff, inspects changed symbols, and posts:
A high-level PR Summary & Architecture Scope in the main thread.
Actionable inline suggestions with 1-click GitHub commit suggestions.

Next Steps

4 min read

The Review Engine & AST Pipeline

How Tree-sitter concrete syntax trees, ephemeral RAM execution, and sub-second multi-model failover power zero-latency code reviews.

How Tree-sitter concrete syntax trees, ephemeral RAM execution, and sub-second multi-model failover power zero-latency code reviews.

The Problem with Raw LLMs

Traditional AI review tools feed raw 2,000-line git diffs directly into commercial LLM context windows. This approach causes:

Massive token waste: Whitespace, import reshuffling, and unchanged boilerplate burn up inference budgets.
Hallucinated suggestions: Models guess at type signatures and variable scopes that exist outside the raw diff chunks.
High latency: Parsing full files with LLMs takes 30-90 seconds per pull request.

The 5-Stage Pipeline

GitCaptain addresses this with a compiler-inspired architecture:

text
[GitHub Webhook]
       │ (HMAC Verified in 2ms)
       ▼
[Tree-sitter CST Engine] ─── Isolates modified AST function scopes in RAM
       │
       ▼
[Targeted Prompt Assembly] ─── 70% fewer tokens, includes exact parent symbol signatures
       │
       ▼
[BYOK Inference Router] ─── Sub-500ms failover across Google / Groq / OpenRouter
       │
       ▼
[GitHub Markdown Emitter] ─── Inline review comments & complexity radar metrics
       │
       ▼
[tmpfs Zero-Fill Wipe] ─── Complete in-memory teardown. Zero code on disk.

Tree-sitter AST Delta Isolation

When a PR webhook arrives, GitCaptain's worker loads the modified files into a temporary in-memory Linux virtual filesystem (tmpfs).

Language-native Tree-sitter parsers (TypeScript, Go, Python, Rust, Java, C++) construct Concrete Syntax Trees in under 8 milliseconds.
The engine calculates the syntax diff: identifying exactly which functions, interfaces, or classes changed semantic signatures.
Non-semantic edits (formatting, comments, variable renames within local scope) are categorized instantly without triggering expensive model inference.

Sub-Second Multi-Model Failover

If your primary model provider (e.g., Google AI Studio) responds with a 429 Rate Limit or temporary outage, GitCaptain's worker automatically reroutes the prompt payload to your secondary configured fallback provider (e.g., Groq Llama-3.3-70B) in under 500ms. The PR webhook never drops.


Ephemeral RAM Teardown

Once review comments are delivered to GitHub's REST API, the worker unmounts the tmpfs partition and zeros the memory space. No user repository source code is ever written to disk, and no code is ever used for model training.

3 min read

Bring-Your-Own-Keys (BYOK)

Connect your personal API keys directly from Google AI Studio, Groq, Mistral, or OpenRouter for 100% free individual usage with zero token markups.

Connect your personal API keys directly from Google AI Studio, Groq, Mistral, or OpenRouter for 100% free individual usage with zero token markups.

Why Bring-Your-Own-Keys?

Most AI developer tools act as billing middlemen, charging $20-$40/seat/month while marking up token prices by 300-500%.

GitCaptain is fundamentally different:

Zero Token Markup: You pay provider wholesale prices (often $0 on free developer tiers).
Inference Sovereignty: Your requests flow directly to your provider account with your organization's data protection terms.
Failover Redundancy: Configure primary and secondary keys to guarantee 99.99% webhook uptime.

Supported Inference Providers

2.Click Get API key and generate a new Gemini API key.
3.Recommended model: gemini-2.5-flash or gemini-1.5-pro.
4.Free Tier Limits: Up to 15 Requests Per Minute (RPM) and 1,000,000 Tokens Per Minute (TPM), plenty for active engineering teams.
1.Go to Groq Console.
2.Generate an API Key.
3.Recommended model: llama-3.3-70b-versatile or mixtral-8x7b-32768.
4.Inference latency: ~1.2s per full PR review.

OpenRouter & Custom Gateways

Support for Claude 3.5 Sonnet, DeepSeek V3, and OpenAI GPT-4o via unified endpoint.
Support for private corporate reverse proxies and Azure OpenAI endpoints.

Key Storage & Cryptographic Security

Your API keys are encrypted at rest using AES-256-GCM with a unique Initialization Vector (IV) per record.

Keys are never stored in browser local storage or plaintext databases.
Keys are decrypted strictly inside worker RAM during active webhook processing.
Worker RAM is wiped upon webhook completion.
3 min read

PR Summaries & Inline Suggestions

Understand the scope, architectural blast radius, and exact line-level improvements of every pull request.

Understand the scope, architectural blast radius, and exact line-level improvements of every pull request.

PR Walkthrough Comments

On every pull request, GitCaptain generates a concise, human-readable walkthrough comment pinned to the discussion thread:

Executive Summary: 2-3 sentences explaining the functional purpose of the PR.
Architectural Scope: Breakdown of mutated layers (API, business logic, persistence, tests).
High-Risk Flags: Callouts for unhandled error cases, memory leaks, or missing input validation.

Complexity Radar & AST Metrics

GitCaptain analyzes AST node depth and cyclomatic branches to compute code complexity metrics:

Cyclomatic Complexity Delta: Highlights functions whose conditional branches jumped above recommended thresholds.
Cognitive Load Index: Warns when nested callbacks or deeply chained promises impair maintainability.

1-Click GitHub Suggestions

When GitCaptain identifies an optimization or bug, it formats inline comments as GitHub Suggestion diff blocks:

diff
- const user = await db.users.find({ id: req.params.id });
- if (!user) return res.send(404);
+ const user = await db.users.findById(req.params.id).lean().exec();
+ if (!user) {
+ return res.status(404).json({ error: 'User not found' });
+ }

Engineers can click Commit suggestion directly in GitHub's UI to apply the fix in one click.


Interactive Comment Commands

You can interact with GitCaptain directly by mentioning @gitcaptain in any PR comment:

@gitcaptain review: Forces an immediate re-evaluation of the latest commit.
@gitcaptain summarize: Re-generates the high-level PR walkthrough.
@gitcaptain simplify: Focuses review on code simplification and dead-code removal.
3 min read

Ephemeral RAM & Zero Retention

Learn why GitCaptain never stores your source code on disk or uses your intellectual property for model training.

Learn why GitCaptain never stores your source code on disk or uses your intellectual property for model training.

Zero Code Retention Pledge

At GitCaptain, we believe your codebase is your most valuable intellectual property. Our architecture is built from the ground up around Zero Data Retention (ZDR):

1.Never Stored on Disk: Repository contents are uncompressed into Linux memory-only volumes (tmpfs).
2.Never Persisted in Databases: We store metadata (PR number, commit SHA, file paths, line counts), but never the source code.
3.Instant Zero-Fill Deletion: The in-memory volume is destroyed and overwritten the moment the review finishes.

Temporary tmpfs Sandboxes

When a review job starts:

bash
# Internal worker memory mounting
mount -t tmpfs -o size=256M,noexec,nosuid,nodev tmpfs /sandbox/pr-1284

The worker checks out the git diff into this isolated sandbox, runs Tree-sitter parsers, and dispatches the prompt. Upon task completion, the mount is unmounted and freed:

bash
umount /sandbox/pr-1284

No Public Model Training

Under our Bring-Your-Own-Key model:

Calls to Google AI Studio, Groq, Mistral, and OpenRouter execute under your commercial API agreement.
Enterprise API terms with Google, Groq, and OpenAI explicitly prohibit training public models on customer API payloads.