Robin

Free AI code reviews for every pull request. You bring an API key; Robin reviews show up like a teammate left comments.

What you get

• A review when you open a pull request (or when someone comments /robin)
• A short summary plus inline comments on changed lines
• Your choice of AI provider — including free options

When there's nothing worth flagging, Robin says so instead of inventing nitpicks:

You are not signing up for a separate review bot service. The workflow runs in your repo and calls the AI URL you configure.

For AI coding agents

Using Cursor, Copilot, Claude Code, or similar? Copy this prompt after secrets are set:

Add Robin to this repository.
- Workflow file: .github/workflows/robin.yml
- Reusable workflow: antongulin/robin/.github/workflows/review.yml@main
- Action ref if needed: antongulin/robin@main
- Secrets: LLM_API_KEY, LLM_BASE_URL, LLM_MODEL
- Do NOT use @v0 or any v0 tag
- Do NOT use pull_request_target or synchronize on pull_request
Read AGENTS.md in the robin repo for full rules.

Quick install

[!IMPORTANT] Run the installer from the root of the Git repository you want Robin to review — not from your home directory. The workflow and secrets are configured once per repository; the companion agent skill is installed globally once per machine.

From the target repository, run either:

npx robin-review

or, without Node.js:

curl -fsSL https://robinreview.dev/install.sh | bash

Either one keeps a single canonical .github/workflows/robin.yml and installs or updates the companion chat skill in your coding agents. If it finds an older Robin or Universal Code Reviewer workflow under another name, it moves that file to .github/robin-workflow-archive/ (where GitHub cannot trigger it) before creating the canonical workflow. Inspect the archived copy, then remove it after confirming the migration. An unrelated file already using the canonical path is never overwritten. Run an installer separately in every repository that should use Robin. Re-running it is safe and idempotent. You still need to add the three secrets — do Steps 1 and 2 below, then commit and push. You can skip Step 3: the installer already did it.

Auto-updates: the generated workflow references antongulin/robin/.github/workflows/review.yml@main, so every review runs the latest Robin automatically — nothing to bump or re-install. Prefer fixed versions? Pin a tag with ROBIN_REF=v2 npx robin-review (see Version pins).

Prefer to do it by hand, or read the installer first? It's bin/robin-review.js (npm) / scripts/install.sh (curl) — or follow the manual 3 steps instead.

Setup in 3 steps

Step 1 — Get an API key (free option)

The easiest free setup uses OpenRouter:

1. Create an account at openrouter.ai.
2. Create an API key in the dashboard.
3. Use these values for your GitHub secrets:

| Secret name | Value | | --- | --- | | LLM_API_KEY | Your OpenRouter key (sk-or-...) | | LLM_BASE_URL | https://openrouter.ai/api/v1 | | LLM_MODEL | openrouter/free |

[!TIP] openrouter/free picks a free model for each review — $0 from OpenRouter. OpenRouter rotates which model runs; leave this secret as openrouter/free — the action retries and uses provider fallbacks when a route is temporarily unavailable. You only spend GitHub Actions minutes while the job runs (often a few minutes per review).

GitHub Free includes about 2,000 Actions minutes/month (public and private repos); GitHub Pro includes about 3,000 minutes/month (check your plan for current limits). Reviews usually take a few minutes each.

Other providers (OpenAI, Groq, Ollama, etc.) work too. See Supported providers or docs/ADVANCED.md.

Step 2 — Add secrets on GitHub

1. Open your repository on GitHub (not this one).
2. Go to Settings → Secrets and variables → Actions.
3. Click New repository secret and add each name from the table above.

[!WARNING] Never put API keys inside workflow files, pull request comments, or chat with an AI. Only use GitHub Secrets.

Step 3 — Add the workflow file

[!NOTE] Ran the Quick install one-liner above? Skip this step — the script already created this file. Just finish Steps 1 and 2 (the secrets), then commit and push.

Create a new file in your repo:

Path: .github/workflows/robin.yml

Contents: copy this exactly:

name: Robin

on:
  pull_request:
    types: [opened, reopened, ready_for_review]
  issue_comment:
    types: [created]

permissions:
  actions: read
  contents: read
  pull-requests: write

jobs:
  review:
    uses: antongulin/robin/.github/workflows/review.yml@main
    secrets:
      LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
      LLM_BASE_URL: ${{ secrets.LLM_BASE_URL }}
      LLM_MODEL: ${{ secrets.LLM_MODEL }}

Commit and push. Open a pull request — you should see a review within a few minutes.

[!IMPORTANT] Use @main for the latest fixes, or pin a release tag (for example @v1 or @v1.0.0) after releases exist. Do not use @v0. See Version pins below.

Running on a self-hosted runner

By default, the reusable workflow runs on GitHub's hosted ubuntu-latest runner:

with:
  runner: '"ubuntu-latest"'

To run reviews on your own machine, Mac mini, home server, local Linux box, or Coolify runner, pass runner as valid JSON. Use a JSON string for one label or a JSON array for multiple labels.

To create a local runner, go to:

Repository Settings -> Actions -> Runners -> New self-hosted runner

Then add labels such as local, linux, mac, or coolify, and reference those labels through the runner input.

Does the runner need to run all the time?

A matching self-hosted runner must be online when GitHub starts the review job. It can be a local runner process (./run.sh), a service (./svc.sh start), a Docker container, or a Coolify-managed service. Docker is optional; it is just one way to run the GitHub Actions runner.

If no matching runner is online, GitHub queues the job until one comes online. It will not fall back to ubuntu-latest unless you add a separate fallback job. For reliable PR reviews, keep an always-on runner available, such as a Mac mini, home server, VPS, or Coolify service. A laptop runner only works while the laptop is awake and the runner process or service is running.

[!WARNING] Self-hosted runners can execute arbitrary workflow code. Do not use them for untrusted public pull requests. Prefer repo-owned private repos or trusted collaborators only. Consider ephemeral runners for stronger isolation.

Local machine runner:

jobs:
  review:
    uses: antongulin/robin/.github/workflows/review.yml@main
    with:
      runner: '["self-hosted", "local"]'
    secrets:
      LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
      LLM_BASE_URL: ${{ secrets.LLM_BASE_URL }}
      LLM_MODEL: ${{ secrets.LLM_MODEL }}

Coolify runner:

jobs:
  review:
    uses: antongulin/robin/.github/workflows/review.yml@main
    with:
      runner: '["self-hosted", "linux", "coolify"]'
    secrets:
      LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
      LLM_BASE_URL: ${{ secrets.LLM_BASE_URL }}
      LLM_MODEL: ${{ secrets.LLM_MODEL }}

Using it day to day

| When | What happens | | --- | --- | | You open a PR | Review runs once automatically | | You push more commits | No new review (saves time and API usage) | | You want another review | Comment /robin on the PR (first line of the comment) | | You want a short overview only | Comment /summary | | You need help | Comment /help |

/review still works as an alias for /robin. Only people with write access (or higher) on the repo can run these commands by default.

Example

The bot posts a status comment, then a review with severity counts:

## 🏹 Robin

🚨 **1 High** | ⚠️ **1 Medium** | 💡 **2 Suggestions**

### Summary
Focused change. Main risk: timeout errors are not handled clearly.

### Findings Not Posted Inline
**1 (`src/example.ts:24`)** — Retries exist but timeout failures lack context.

Robin in your editor

The one-line installer also installs a small companion skill into every coding agent on your machine (Claude Code, Cursor, Copilot, Windsurf, …) via the cross-platform skills CLI — npx -y skills add https://github.com/antongulin/robin --skill robin --agent '*' --global --yes. It ships with Robin; there's nothing separate to sign up for. (Skip it with ROBIN_SKILL=0, or install it by hand with that command.) Once installed, the skill activates for ordinary pull-request work: the agent detects Robin on the base branch, so you do not need to ask for Robin explicitly. Explicit requests still work too:

"create a pull request" · "review this PR with Robin" · "fix the Robin feedback"

The agent drives a bounded review → verify → fix → reply → resolve → re-review loop. It fixes only findings confirmed against the full repository and skips noise with a factual reply. Five completed Robin reviews are approved by default; above five, the agent asks for one additional review at a time unless you explicitly enabled full-auto review for that PR. Merge is a separate permission and remains manual by default. After an authorized merge, the agent verifies base-branch sync and task-branch cleanup. Release preparation is never automatic; when the repository already publishes releases, the final report may offer it as a separate next step. Source: skills/robin/SKILL.md.

Supported providers

| Provider | LLM_BASE_URL | LLM_MODEL example | | --- | --- | --- | | OpenRouter (free) | https://openrouter.ai/api/v1 | openrouter/free | | OpenAI | https://api.openai.com/v1 | gpt-4o | | Groq | https://api.groq.com/openai/v1 | llama-3.3-70b-versatile | | Ollama (your server) | http://YOUR_SERVER:11434/v1 | llama3.2 |

GitHub’s servers cannot reach localhost on your laptop. For Ollama at home, use a public server, a tunnel, or a self-hosted runner.

Optional: config and custom rules

Copy .github/robin.yml.example to .github/robin.yml to set max-diff-size, skip extra paths, and more. Details: docs/ADVANCED.md.

Add .github/code-reviewer.md in your repo:

# Reviewer rules

- Focus on bugs and security, not formatting.
- Ask for tests when business logic changes.

Something went wrong?

| Problem | What to try | | --- | --- | | Workflow fails immediately | Check all three secrets exist and the workflow uses @main | | Input required: model or llm-base-url | Add missing secrets (Step 2) | | Review never appears | Open Actions tab → open the failed run → read the error | | /robin does nothing | Put /robin on the first line; you need write access on the repo. On @v1, pin @v1.4.0+ or use /review if the tag predates v1.4.0 | | Review is very short | PR may be huge — see docs/ADVANCED.md (max-diff-size) | | Empty response from LLM | Free routers sometimes return no text — the action retries automatically; comment /robin again | | OpenRouter stall / job runs 15 min with no review | Auto-router hung — action now aborts after 45s with no stream and retries | Watch Actions log for LLM resolved model (routing OK); pin @v2 or @main for the fix | | 404 Provider returned error | Normal for openrouter/free when one provider is down — the action retries up to 5 times; keep LLM_MODEL=openrouter/free |

More fixes: docs/ADVANCED.md#troubleshooting

Version pins

| Pin | When to use | | --- | --- | | @main | Latest changes on the default branch | | @v1 | Latest 1.x release (updated on each release) | | @v1.0.0 | Exact version (most predictable) | | Full commit SHA | Maximum supply-chain safety |

uses: antongulin/robin/.github/workflows/review.yml@v1

Releases and notes are published automatically from CHANGELOG.md when changes land on main. See CONTRIBUTING.md for commit message format.

Learn more

• docs/ADVANCED.md — all settings, strict mode, manual-only reviews, security notes
• CONTRIBUTING.md — run tests and send pull requests
• CHANGELOG.md — release history

Support

Robin is free and open source (MIT). If it saves you money on code review, you can help keep it maintained:

• ⭐ Star the repo — it's the cheapest way to help others find it.
• 💛 Sponsor the project to support ongoing work.
• 🐛 Open an issue for bugs or ideas.

Built by Anton Gulin, AI Architect building AI systems, agent workflows, and software automation. Need a custom AI agent, code-review pipeline, or QA automation? Visit Anton.QA.

Development

git clone https://github.com/antongulin/robin.git
cd robin
npm ci
npm run lint
npm test
npm run build

Runtime code lives in dist/index.js; run npm run build before releasing. A full build removes intermediate files under dist/ after bundling so only index.js remains locally (same file CI checks against).

If you ran tsc alone and see extra files under dist/, run npm run clean.