Open source · BYOK · Self-hostable

Code review that leaps ahead

katak hops onto every pull request, reviewing changes, answering mentions, and fixing what it finds. On GitHub's cloud or your own runners, with your own model keys.

katak-reviewbot2m ago

Overall looks good. One thing worth fixing before merge:

mediumsrc/auth/session.ts:42

The session token is compared with ===, which leaks timing information. Use a constant-time comparison.

-if (token === stored) {
+if (timingSafeEqual(token, stored)) {
Fix it ➔via katak·glm-5.3
MITlicensed action
8+model providers
2runner modes
0repo secrets in cloud mode

Features

Everything a great reviewer does. Automatically.

Reviews on autopilot

Every pull request gets a structured review in minutes: severity-ranked findings, inline suggestions, and a summary check. New pushes trigger incremental reviews of just what changed.

Mention the frog

Comment @katak-review anywhere. It reads the whole thread, answers questions, and can implement the change and push it.

Buttons that fix things

Every review ships with a Fix it ➔ button. CI red? Conflicts with main? One click and the bot repairs it on the branch.

Bring your own keys

OpenAI, OpenRouter, Z.ai, Groq, DeepSeek. Any OpenAI-compatible endpoint works. Keys stay encrypted in your own vault scope; repos never see them.

Cloud or self-hosted

Run on GitHub-hosted runners with zero repo secrets, or bring your own runners and your own GitHub App. Nothing leaves your network except the model call.

A console that comes with it

Connect organizations, tune per-repo behavior, manage provider connections, and watch runs, success rates, and model spend in one place.

How it works

Live on your repos in three hops

  1. 01

    Install the GitHub App

    Pick the organizations and repositories katak can see. No code changes, no secrets to rotate.

  2. 02

    Enable the bot per repo

    One click in the console commits the workflow and wires your model provider. Or commit katak.yml yourself.

  3. 03

    Open a pull request

    The review lands in minutes. Push again, and an incremental review follows. Mention the frog anytime.

Start with the install
.github/workflows/katak.yml
1# one file - that's the whole setup
2name: Katak
3on:
4 workflow_dispatch:
5 inputs:
6 prompt: { type: string }
7 name: { type: string }
8permissions: { contents: read }
9jobs:
10 katak:
11 runs-on: ubuntu-latest # or your own runner label
12 permissions:
13 contents: read
14 id-token: write # keyless auth to the katak vault
15 steps:
16 - uses: actions/checkout@v6
17 - uses: trykatak/pullfrog@v0.1.82-selfhost.5
18 env:
19 API_URL: https://api.katak.review
20 PULLFROG_MODEL: openai-compatible/byok

...or skip the YAML entirely. The console can enable a repo in one click.

Two ways to run

Your cloud. Or ours.

Cloud mode

Zero setup, runs on GitHub-hosted runners

  • One click per repo. No workflow editing, no repo secrets
  • Model key fetched at runtime from your encrypted vault (OIDC)
  • Private-key operations stay on katak's Workers. Runners only get short-lived, repo-scoped tokens
  • Uses your GitHub Actions minutes (free on public repos)

Self-hosted mode

Your app, your runners, your rules

  • Bring your own GitHub App. Tokens are minted directly from it
  • Runners live on your infrastructure with unlimited minutes and warm caches
  • The MIT-licensed action runs from source you can read and pin
  • Console optional. Config can live in a .katak.yml file in the repo

Pricing

Free. You only pay your model provider.

Cloud BYOK

beta

$0/mo

  • · Unlimited repositories & organizations
  • · Reviews, mentions, fix buttons
  • · Console, vault & analytics
  • · You pay only model tokens

Self-host

$0 forever

  • · MIT-licensed action, runs from source
  • · Your GitHub App & runners
  • · No dependency on katak servers
  • · Optional console for your team

FAQ

Questions, answered

Does katak store my code?+

No. Code flows between GitHub and the runner executing the review. The console stores only settings, run metadata, and your encrypted model keys, never repository contents.

Which models can I use?+

Any OpenAI-compatible endpoint: OpenAI, OpenRouter, Z.ai (GLM), Groq, DeepSeek, Together, Moonshot, or your own proxy. You pick the model per organization, and can override it per repository.

What does a review cost?+

katak itself is free while in beta. You only pay your model provider for the tokens a run uses. A typical review costs a few cents. The console shows tokens per run so you always know.

Does it work with public repos and forks?+

Yes. Cloud mode on public repositories uses GitHub's free hosted minutes. Reviews of fork pull requests are disabled by default and can be enabled per repository.

Can I run it fully on my own infrastructure?+

Yes. That's the self-hosted mode. Bring your own GitHub App and your own Actions runners; the action mints tokens directly from your app. Nothing touches katak's servers unless you want the console.

Give your pull requests a frog

Install the app, enable a repo, and watch the first review land on your next PR.

@katak-review review this PR