HowItWorks
Zero retention, Tree-sitter AST parsing, and in-memory vector intelligence.
Under the Hood: The Four-Stage Review Engine
For engineers and security teams who want to inspect the exact cryptographic checks, Tree-sitter AST queries, and quota-smart relational context assembly.
Pipeline Stages
Connect Your Repository
One-click official GitHub App connection
Install once in under a minute. Zero servers or YAML configs.
Think of GitCaptain like adding an experienced senior engineer into your team’s code reviews. Authorize the official GitHub App with a single click. You choose whether to protect your entire organization or test on just one specific repository.
Developer Opens a PR
Automated GitHub webhook notification
No commands to run. GitHub triggers the review automatically.
Whenever anyone creates or updates a Pull Request, GitHub securely notifies GitCaptain. Only the changed code diff is sent—your full commit history, issues, and main branches remain completely untouched.
Isolated RAM Analysis
Zero-persistence Linux RAM sandbox
Runs purely in volatile RAM. 0 bytes written to hard drive.
A secure worker spins up in temporary Linux RAM. It analyzes grammatical syntax structures (not just plain text lines) and queries your own private AI API key (BYOK). Your proprietary code is never stored on disk and never used to train public AI models.
Instant GitHub Feedback
Inline suggestions & immediate RAM purge
Clear review comments in GitHub. Memory wiped instantly.
Helpful, line-by-line comments with one-click fix buttons appear directly inside your GitHub Pull Request. The moment the review is dispatched, the temporary Linux RAM worker is unmounted and wiped clean—leaving zero trace.
Real-World Code Understanding in Action
Explore three distinct scenarios showing how syntax intelligence catches critical bugs that regular linters and raw text diffs overlook.
src/middleware/auth.ts
@@ -34,7 +34,9 @@ export async function authenticateRequest(req: Request) {const token = req.headers.get('authorization')?.replace('Bearer ', '');if (!token) throw new UnauthorizedError();- const user = await verifyJwt(token);+ // Potential unhandled Promise rejection and session bypass+ const user = verifyJwt(token); // Missing await keyword+ req.context = { user };return next();}
(call_expression function: (identifier "verifyJwt") arguments: (arguments (identifier "token")))Critical bug: `verifyJwt` is an asynchronous function returned without `await`. In JavaScript/TypeScript, an unhandled Promise truthy check will pass downstream middleware, resulting in unauthenticated request execution.
- const user = verifyJwt(token);+ const user = await verifyJwt(token);
Architecture Matrix: Syntax Intelligence vs Linters vs Generic LLMs
Why syntax tree intelligence and quota-aware context outperform generic chat prompts and rigid regex rules.
| Evaluation Dimension | Traditional Linters | Generic LLM Bots | GitCaptain In-Memory AST |
|---|---|---|---|
| Core Mechanism | Regex patterns & static token regexes | Raw diff text dumped into generic prompt | Tree-sitter CST + Whole-Repo Dependency Graph |
| Cross-File Awareness | Single-file only (zero import awareness) | Hallucinated or truncated due to token ceilings | Full import blast radius & caller ripple tracking |
| Hallucination Rate | Zero (strictly rule-bound) | High (cites nonexistent libraries/functions) | Near-zero (grounded in verified syntax node ranges) |
| Token Efficiency | N/A (No LLM calls) | Wasteful (burns tokens on whitespace & comments) | Extreme (sends only AST-distilled semantic nodes) |
| Context Assembly | None | Expensive full-vector embedding lookups | Quota-aware direct PostgreSQL lookups (0 embed calls) |
| Execution Latency | < 500ms | 10s to 45s (frequent timeouts) | Sub-2 seconds end-to-end pipeline |
| Code Privacy & Retention | Local workstation only | Stored in provider cloud logs or model memory | 100% Ephemeral Linux tmpfs sandboxes (0 bytes retained) |
Cryptographic Zero-Retention Guarantees
Engineering guarantees built into every layer of our execution infrastructure.
Volatile tmpfs Sandboxes
Review workers operate inside temporary RAM volumes (`tmpfs`). Zero code is ever written to persistent disk storage. When the process halts, the memory is instantly reclaimed by Linux kernel paging.
AES-256 Key Encryption
Provider API keys are encrypted at rest using AES-256-GCM authenticated encryption. Keys are decrypted strictly in volatile RAM for the webhook execution and are never logged or exported.
Deterministic Rulesets
Teams configure deterministic syntax gates via `.gitcaptain.json` (maximum complexity, forbidden libraries, mandatory docstrings). These rules are evaluated before LLM inference.
Connect Your Repository in Under Two Minutes
Free forever with your own API keys. Keep your code private, secure, and syntax-verified on every pull request.