Quick start · How it works · Search · GitHub Actions · Docs

Repo Audit uses Jev to search code by behavior and review changes against plain-English rules. It returns source locations and model scores, and ranks the changed code by risk so you know what to read first, on top of your CI. Run it in your terminal, a coding agent, or GitHub Actions with your own provider key.

Live Jev output on the swallowed-error fixture, captured with v1.0.0 on September 22, 2026. This is a demonstration, not an accuracy benchmark.

Quick start

You'll need Node 22+, git, and a TypeSafe or Vercel AI Gateway key.

npm install -g @amtec-advisory/repo-audit
repo-audit auth login

Then, inside a repository:

repo-audit check --code

This reviews your branch against origin/main, including working-tree changes. Use --base main if you don't have an origin remote, or --staged to review what you're about to commit.

Your login works across repositories. With no config, Repo Audit selects rule packs from your project's stack. Installation and provider setup →

Check code while the agent writes it

Install the live edit hook once:

repo-audit live init

That adds a PostToolUse hook for Claude Code and Codex. After an Edit, Write, MultiEdit or apply_patch, Repo Audit checks tracked edits against the working-tree diff from HEAD and checks brand-new files whole-file, then hands any findings straight back to the agent to repair before it continues. Use repo-audit live init claude or repo-audit live init codex for one agent, and add --project to keep the hook inside a repository instead of your user config.

Live hooks fail open on malformed payloads, missing credentials or provider failures so they never break a coding session. Keep the normal CI check as the final enforcement layer.

How a review runs

The CLI and GitHub Action use the same review engine. Jev scores the questions; Repo Audit applies your rule thresholds and builds the report.

flowchart LR
    changes["Diff or whole files"] --> select["Select code and questions"]
    policy["Config and compiled guidance"] --> select
    select -->|Code + questions| jev["Jev at your provider"]
    jev -->|Scores| report["Findings + source lines + coverage"]
    select -.->|Skipped work| report
    jev -.->|Provider failures| report

On pull requests, configuration and compiled guidance come from the base commit. Skipped work and provider failures appear in the report and make the review incomplete.

Search by behavior

Describe the behavior you're looking for without guessing a function name:

repo-audit find "Does this code report success after a failed write?" --mode condition

The same fixture, searched with Jev. Read the surrounding code before treating a match as a bug.

Or describe a change to find implementation, callers, contracts, tests, and existing patterns:

repo-audit find "add retries to failed writes"

Search evaluates every selected chunk without an embedding index. No rules or config required.

flowchart LR
    files["Selected repository files"] --> chunks["Split into source chunks"]
    chunks --> jev["Jev at your provider"]
    query["Condition or intended change"] --> jev
    jev -->|Scores| results["Rank and filter source locations"]

The score threshold and result limit control what you see, not which chunks get evaluated. Search options and coverage →

Write a review rule

Try a rule for one run:

repo-audit check --rule api/errors="Error responses keep their code field."

Keep recurring rules in repo-audit.config.ts:

import { defineConfig } from "@amtec-advisory/repo-audit";

export default defineConfig({
  extends: ["repo-audit:recommended"],
  rules: {
    "api/errors": ["warn", "Error responses keep their code field."],
  },
});

The built-in packs cover swallowed failures, weakened tests, stale async results, missing identity checks, and other concerns that need judgment. TypeScript, Rust, Next.js, and Supabase packs add more specific questions.

Browse the packs · Write and tune rules · Share a config · Compile AGENTS.md and skills

Review pull requests

Generate a workflow pinned to a reviewed commit:

repo-audit init --target actions

Add AI_GATEWAY_API_KEY as a repository secret, then commit the generated config and workflow to your default branch. Reviews appear as line annotations and a job summary under Checks → Repo Audit.

PR reviews read policy from the base commit. PR code and configuration never run with credentials. GitHub Actions setup →

For reviews inside a coding agent, use the Agent Skill or the Claude Code stop hook.

Reading a result

A finding means a model scored the code against a configured concern. Check the source before agreeing with it. The Read first list is an order by score, not a set of findings: a place can top it without crossing any threshold. An empty report doesn't prove the code is correct.

Runs report skipped work and exit non-zero when coverage is incomplete. Selected source and questions go to your provider; usage depends on how much code you send and how many questions you ask. Keep your linters, type checks, and tests.

Report formats and exit codes · Suppress a finding · Measure a rule's ordering and precision

Contributing

Start with AGENTS.md and the architecture. For a new rule pack, include labeled fixtures and results from repo-audit eval.

CLI reference · Troubleshooting · Research notes

MIT, © 2026 Amtec Advisory. License · Third-party notices