Introduction
Patchlight reviews every pull request and scans your code for vulnerabilities — from GitHub, your terminal, or any CI pipeline.
Patchlight reads code and tells you what is wrong with it. It runs in three places, and they all report into the same dashboard, the same findings list, and the same balance.
GitHub App
Install it once. Every pull request and commit gets reviewed, with findings posted as inline comments. No config, no tokens.
CLI
Scan the code on your disk right now — uncommitted work included — and triage the findings without leaving the terminal.
SDK
A zero-dependency TypeScript client and a CI-shaped command. For GitLab, Bitbucket, Azure, or anything you script yourself.
REST API
Everything the SDK does, over plain HTTP, if TypeScript is not where you live.
Two kinds of analysis
| Review | Security scan | |
|---|---|---|
| Reads | a diff | whole files |
| Answers | “is this change correct and safe?” | “what is wrong with this codebase?” |
| Triggered by | a pull request, a commit, patchlight review | a schedule, patchlight scan |
| Billed | per review | per token, so cost tracks repository size |
| Reports | cwe is null | findings carry a CWE classification |
Both produce findings with the same shape, in the same list, triaged the same way.
What you get
- Findings where you already are — inline PR comments, a terminal UI, JSON for your own tooling.
- Uncommitted code included — the CLI reads your working tree, which a server that clones your repository structurally cannot.
- Multi-repo, multi-workspace — personal and organization workspaces, each with its own balance and API keys.
- Provider-agnostic AI — Gemini by default, switchable to Claude or OpenAI.
- Your code stays yours — one-click deletion, never used for training.
- Pay as you go — your first 20 reviews are free; top up from $5.
Start here
New to Patchlight? Quickstart gets a repository reviewed in about two minutes. Already installed and want findings in your terminal? Jump to the CLI.