AI-Powered Code Review CLI — BYOK
Cora is a fast, native CLI for AI-powered code review and code intelligence — in your terminal, CI/CD, git hooks, or directly inside AI coding agents. Bring your own key, pick any model, index your codebase, and search semantically. All local, zero cloud.
Why Cora?
- 🤖 Multi-LLM — OpenAI, Anthropic, Groq, Ollama, Z.AI, or any OpenAI-compatible API
- ⚡ Native Rust — fast binary, no runtime dependencies, cross-platform
- 🪝 Pre-commit hooks — catch issues before they reach CI
- 📋 SARIF output — upload to GitHub Code Scanning
- 🛡️ Deterministic scanners — 12 built-in rules + 13 security patterns + 15 secret detection patterns that run without LLM
- 🧠 Language-specific analysis — tailored review guidance for Dart/Flutter, Svelte, TypeScript, Go, Rust, Python
- 🚧 Quality gate — configurable pass/fail thresholds for CI enforcement
- 📐 Quality profiles — strict, balanced, or lax presets for different project needs
- 📏 Custom rule engine — write your own regex rules in
.cora.yaml
- ✂️ Auto-chunking — splits large PRs into reviewable chunks automatically
- 🔍 Code Intelligence — index symbols across 15 languages, call graph, trace, impact analysis
- 🧠 Brain Mode — hybrid semantic search (FTS5 + vector KNN + graph) with RRF fusion
- 🗄️ Multi-project database — one global index, search across all your repos at once
- 🌳 Tree-sitter (opt-in) — AST-based symbol extraction for 13 languages: Rust, Go, Python, TypeScript/TSX, Java, C, C++, C#, Ruby, PHP, Scala, JavaScript, Svelte (via TypeScript delegation, zero extra dependency)
- 🔌 MCP server — 22 tools for AI coding agents (review, search, brain, debt, trace, dead code, graph query, agent-as-reviewer, ...)
- 💾 Diff-hash caching — skip repeat reviews automatically
- 🔧 Configurable — per-project
.cora.yaml, global ~/.cora/config.yaml, or env vars
Quick Start
Install
Pick one install method — mixing channels can leave stale binaries on your PATH.
| Method | When to use |
|---|
curl … install.sh (recommended) | Quick standalone install; fetches the latest GitHub release binary |
cargo install --git … | You already have a Rust toolchain; builds from source |
| Pre-built binaries | Manual download from Releases |
# Install with the quick installer
curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-code/main/install-bundle.sh | sh
# Or build from source with cargo
cargo install --git https://github.com/codecoradev/cora-code
Pin a version: CORA_VERSION=v0.6.1 curl -fsSL ... | sh
Upgrading: run cora upgrade (downloads the latest release, verifies its SHA-256 checksum and, when cosign is installed, its Sigstore signature, replaces the binary) or cora upgrade --check to just see if one is available. If you installed via cargo install --path ., re-run that instead.
Verify which cora you're running — which -a cora will reveal stale copies from other channels:
which -a cora # list every `cora` on your PATH (one entry = healthy)
cora --version # should match the latest release
If which -a cora shows more than one path (e.g. ~/.local/bin/cora and ~/.cargo/bin/cora), remove the one you don't want or reorder your PATH. See Issue #314 for background.
The prebuilt aarch64-apple-darwin binary is not Apple-notarized. On macOS, downloaded
binaries may be tagged with com.apple.quarantine / com.apple.provenance and killed by
Gatekeeper with no error message.
The install.sh installer strips these attributes automatically. If you downloaded the
binary manually (e.g. gh release download), strip them yourself:
xattr -dr com.apple.quarantine /path/to/cora
xattr -dr com.apple.provenance /path/to/cora
Or install via cargo / Homebrew to sidestep Gatekeeper entirely.
Authenticate
cora auth login
Pick a provider, enter your API key. Done. Provider env vars (ZAI_API_KEY, OPENAI_API_KEY, etc.) are auto-detected.
No key? Still useful. cora review and cora scan run the deterministic checks (rules, secrets, security) with no LLM configured, and your AI coding agent can do the AI review itself: see Review with your agent.
Review
cora review # staged changes
cora review --base main # vs a branch
cora review --unpushed # unpushed commits
cora commit # review + generate commit msg + commit
cora commit --yolo # auto-commit, no prompts
Project Config
cora init # creates .cora.yaml + installs pre-commit hook
Configuration
Priority: CLI flags → env vars → .cora.yaml (project) → ~/.cora/config.yaml (global) → defaults
# .cora.yaml
provider: zai
model: glm-5.1
focus: [security, bugs]
# Quality gate — enforce code quality in CI
quality_gate:
enabled: true
thresholds:
max_critical: 0 # 0 critical = gate FAIL
max_security: 0 # 0 security findings = gate FAIL
categories:
performance:
action: warn # warn only, don't fail CI
max_findings: 5
cora config show # effective merged config
cora config show --global # ~/.cora/config.yaml
cora config show --project # .cora.yaml
| File | Purpose |
|---|
~/.cora/auth.toml | API key (secret, chmod 600) |
~/.cora/config.yaml | Global defaults (provider, model, etc.) |
.cora.yaml | Per-project overrides |
See Configuration → for full reference.
CI/CD
# .github/workflows/cora-review.yml
on: pull_request
jobs:
review:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with: { fetch-depth: 0 }
- uses: codecoradev/cora-review-action@v1
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
cora-api-key: ${{ secrets.CORA_API_KEY }}
Required secrets: CORA_API_KEY, CORA_BASE_URL (optional), CORA_MODEL (optional)
See GitHub Marketplace for full documentation.
Works on all CI platforms — Gitea, GitLab, Bitbucket →
Commands
Code Review
| Command | Description |
|---|
cora review | Review code changes (diff, branch, commit, file) |
cora scan | Scan files for issues |
cora commit | Review + generate commit message + commit |
cora debt | Show tech debt report from review history |
cora findings | Track, dismiss, and reopen review/scan findings |
Code Intelligence
| Command | Description |
|---|
cora index | Index project symbols, vectors, and call graph |
cora explore | Search symbols by keyword (FTS5) |
cora brain | Hybrid semantic search (FTS5 + vectors + graph → RRF) |
cora trace | Trace call chains through the codebase |
cora arch | Architecture overview (modules, edges, hotspots) |
cora callers | Find all callers of a symbol |
cora impact | Analyze blast radius of changing a symbol |
cora affected | Find tests impacted by changed files |
cora dead-code | Detect dead code — functions with zero callers |
cora query | Query the code graph (e.g. "main -> *") |
cora routes | List detected HTTP routes (Axum, Actix, Express, FastAPI, Flask, Go) |
Config & Setup
| Command | Description |
|---|
cora init | Create project config + hook |
cora auth login | Save API key |
cora config show | Show resolved config |
cora config validate | Validate configuration |
cora providers | List available LLM providers |
cora profile list | List quality profiles (strict, balanced, lax) |
cora mcp | Start MCP server (22 tools) for AI coding agents |
cora serve | Start MCP server + auto-reindex on startup |
cora install | Auto-detect and configure AI coding agents |
cora hook install | Install pre-commit hook |
cora upgrade | Self-upgrade from GitHub Releases (checksum-verified) |
See CLI Reference → for all flags and examples.
Performance
Benchmarked on the cora-code repository (1,864 symbols, 115 Rust files, x86_64, single-thread baseline → Rayon parallel).
| Operation | Time | Notes |
|---|
| Cold index (full rebuild) | ~936ms | Walk + parse + embed + HNSW insert (Rayon parallel) |
| Incremental (no changes) | ~6ms | mtime:size fingerprint — skips unchanged files |
| Brain search (hybrid) | ~5ms | FTS5 + vector KNN + graph BFS → RRF fusion |
| Binary size | 10.4 MB | Single static binary, zero runtime dependencies |
Measurements are indicative, not contractual. Your numbers will vary with codebase size, CPU cores, and disk I/O.
Environment Variables
| Variable | Description |
|---|
CORA_API_KEY | API key (CI use) |
CORA_PROVIDER | Override provider |
CORA_MODEL | Override model |
CORA_BASE_URL | Override API base URL |
Provider-specific keys are auto-detected: OPENAI_API_KEY, ANTHROPIC_API_KEY, GROQ_API_KEY, ZAI_API_KEY
Documentation
Star History
Contributing
See CONTRIBUTING.md for guidelines. PRs welcome!
License
MIT
