katak hops onto every pull request, reviewing changes, answering mentions, and fixing what it finds. On GitHub's cloud or your own runners, with your own model keys.
Overall looks good. One thing worth fixing before merge:
src/auth/session.ts:42The session token is compared with ===, which leaks timing information. Use a constant-time comparison.
Features
Every pull request gets a structured review in minutes: severity-ranked findings, inline suggestions, and a summary check. New pushes trigger incremental reviews of just what changed.
Comment @katak-review anywhere. It reads the whole thread, answers questions, and can implement the change and push it.
Every review ships with a Fix it ➔ button. CI red? Conflicts with main? One click and the bot repairs it on the branch.
OpenAI, OpenRouter, Z.ai, Groq, DeepSeek. Any OpenAI-compatible endpoint works. Keys stay encrypted in your own vault scope; repos never see them.
Run on GitHub-hosted runners with zero repo secrets, or bring your own runners and your own GitHub App. Nothing leaves your network except the model call.
Connect organizations, tune per-repo behavior, manage provider connections, and watch runs, success rates, and model spend in one place.
How it works
Pick the organizations and repositories katak can see. No code changes, no secrets to rotate.
One click in the console commits the workflow and wires your model provider. Or commit katak.yml yourself.
The review lands in minutes. Push again, and an incremental review follows. Mention the frog anytime.
...or skip the YAML entirely. The console can enable a repo in one click.
Two ways to run
Zero setup, runs on GitHub-hosted runners
Your app, your runners, your rules
Pricing
$0/mo
$0 forever
FAQ
No. Code flows between GitHub and the runner executing the review. The console stores only settings, run metadata, and your encrypted model keys, never repository contents.
Any OpenAI-compatible endpoint: OpenAI, OpenRouter, Z.ai (GLM), Groq, DeepSeek, Together, Moonshot, or your own proxy. You pick the model per organization, and can override it per repository.
katak itself is free while in beta. You only pay your model provider for the tokens a run uses. A typical review costs a few cents. The console shows tokens per run so you always know.
Yes. Cloud mode on public repositories uses GitHub's free hosted minutes. Reviews of fork pull requests are disabled by default and can be enabled per repository.
Yes. That's the self-hosted mode. Bring your own GitHub App and your own Actions runners; the action mints tokens directly from your app. Nothing touches katak's servers unless you want the console.
Install the app, enable a repo, and watch the first review land on your next PR.
@katak-review review this PR