Self-hosted AI code review

Every pull request looked over, on the AI subscription you already pay for.

Lookover runs on your own computer, reviews your pull requests with Claude or ChatGPT through their official CLIs, and posts what it finds on GitHub. Built for coding agents: they wait for the review, fix, and ask again.

npm install -g lookover

No account to create. Needs a Claude or ChatGPT plan, git, gh and Node.js 18 or later. Windows (x64), macOS, Linux.

Add rate limiting to /v1/invoices #148
Openagent wants to merge add-rate-limit into main · 4 files changed
lookover bot reviewed a1f9c2e · round 1

One thing to fix. The rest can go.

Found by Codex, double-checked by Claude.

src/middleware/rateLimit.ts
41if (limited) {
42 log.warn("throttled", { headers: req.headers });
43 return res.status(429).end();
Blocking

API key is written to the request log. When a client is throttled, the full headers are logged, including Authorization. Log the client id instead.

agent · Fixed in b2c3d4e: logs the key id only.Resolved · verified fixed in b2c3d4e
Nothing to fix. Checked b2c3d4e · round 2

One pull request, two rounds. A condensed preview of the review, the fix and the passing check on GitHub.

Nothing extra to pay

Reviews use the Claude or ChatGPT plan you already have. No per-review price, no credits to buy, no seats.

Runs on your machine

On your computer. No account with us, no hosted service in between, no telemetry.

Never touches your logins

It runs the official claude and codex CLIs, signed in as you. It never reads or stores your tokens.

Setup

Up and running in five minutes.

Three steps. The first review posts for real, on a pull request you pick.

  1. 1

    Install it, start it

    Two commands, and the setup opens in your browser. It checks that Claude or ChatGPT is installed and signed in. One AI is enough; two cross-check each other.

    Terminal
    $ npm install -g lookoveradded 2 packages in 22s$ lookover startLookover runs in the background.Lookover is opening in your browser.Don't see it? `lookover open --no-open` prints a link to paste (it works once, within 2 minutes).You can close this terminal.
  2. 2

    Connect GitHub

    Create your App: a GitHub App on your account or an organisation's, which posts the reviews as itself. Then you pick the repositories it reviews.

    Setup · GitHub
    App createdlookover-q7x2ka posts as itself, never as you.
    Reviewing 2 repositoriesledger-api, web
    First reviewPick an open pull request
  3. 3

    Open pull requests as usual

    Each one gets a review on GitHub. Lookover keeps a list of where each stands; fix, push, and ask for another look, or let your agent ask.

    Reviews · ledger-api
    To fix#148Add rate limiting to /v1/invoices2 min ago
    Nothing to fix#151Retry the webhook queue1 h ago
    Reviewing#152Split the ledger workernow

How it works · built for coding agents

Your agent waits for the review, fixes, and stops when it is done.

Every review ends with a check on the commit and findings an agent can read. One command, lookover wait, does the waiting and says what to do next. Here is one pull request, from the agent's terminal to the merge button, with Lookover's own screen beside it.

  1. The agent pushes and opens a pull request. GitHub is the only thing it talks to.
  2. Lookover sees the push and runs the review: Codex finds, Claude double-checks.
  3. One review lands: the verdict, one finding on its line, the check. The agent is told what to do.
  4. The agent reads it, fixes, replies, pushes. Round 2 checks the fix only.
  5. Verified fixed. The check turns green. Merging stays your call.
ledger-api/Pull requests

No open pull requests.

Add rate limiting to /v1/invoices #148
Openadd-rate-limit into main · by the agent
LookoverWaitingReviewing · round 11 blocking findingChecking the fixNothing to fix
lookover bot reviewed

Looked over a1f9c2e. One thing to fix, rateLimit.ts line 42. The rest can go.

Looked over b2c3d4e. Nothing new to fix. The rest can go.

src/middleware/rateLimit.ts line 42
41if (limited) {
42 log.warn("throttled", req.headers);
43 return res.status(429).end();
BlockingVerified fixedAPI key is written to the request log

When a client is throttled, the full headers are logged, including Authorization.

agent · Fixed in b2c3d4eResolved · verified fixed in b2c3d4e ✓
Merge pull requestYour call, not the reviewer's.

The loop settles. "Fixed" is checked on the new commit, never trusted. Nothing runs on half-finished pushes: the agent asks when it is ready. When the agent and the reviewer cannot agree, the check says a person is needed, and the agent stops.

Works with the agents you run. A skill makes the loop one sentence for Claude Code or Codex: "get this pull request through review". Anything that can call gh can do the same by hand. Setting up your agent, in the docs.

What it posts

Few findings, said plainly.

A reviewer that posts twelve nits gets muted. Lookover is built to post the two that matter.

Cross-model

The other AI reads it

Code written by Claude is looked over by Codex, and the reverse. Models miss their own habits; a second model catches them.

Double-checked

Checked before it is posted

Unless you pick Quick, every finding is re-checked in a fresh session before it reaches you: one ruled out is dropped, one left in doubt is marked unconfirmed. Posted: 2 of 5.

Thread-aware

It remembers the thread

On the next push it checks each earlier finding: fixed, still there, or no longer relevant. It only posts what is new. An empty review is one line.

Give your next pull request a second look.

npm install -g lookover

Five minutes to set up. No account to create.

Questions

Before you run it

What does it cost?

Nothing beyond the Claude or ChatGPT plan you have. A review draws on your plan's limits the way a session in the terminal would. Lookover reviews one pull request at a time per AI, uses no API key, and waits for your plan's limit to reset rather than paying past it. If your plan can buy extra usage, leave that off.

Which plans work?

Claude Pro or Max, through the claude CLI; ChatGPT Plus or Pro, through the codex CLI. One is enough. With both, the AI that did not write the code looks first and the other double-checks.

Does my code leave my machine?

Only where it already goes: to GitHub, and to Claude or ChatGPT through their own CLIs. Nothing to us. No account, no telemetry; the source is open, so you can check. Where your code goes, in the docs.

What does it post on GitHub?

One review in a few words with the findings on the lines they are about, one summary comment that stays up to date, and a check on the commit. An empty review is one line. It never merges, approves or requests changes.

Is this allowed by Claude's and ChatGPT's terms?

Lookover only runs the official claude and codex CLIs, signed in through their own flows, on your machine, for your own pull requests. It never reads or stores your tokens. Your plan's terms apply: one subscription, one person, so each colleague runs their own. Lookover is not affiliated with Anthropic or OpenAI. Your plan's terms, in the docs.