Code Review Companion

Paste a GitHub pull request link and get an AI review that sits on the diff itself. Findings are anchored to the exact lines, grouped by severity, and saved to a personal history.

Live demo: https://code-review-companion-navy.vercel.app

The API runs on a free host, so the first request after a quiet period can take up to a minute. Sign-in is Google only.

What it does

• Fetches the whole PR. Every changed file comes from the GitHub API, so the review sees the full change, not one pasted file.
• Reviews across files. The model gets the complete diff at once, so it can flag a change in one file that breaks a caller in another.
• Inline findings. Each finding has a file, a line, a severity (critical, warning, suggestion) and a category (bug, style, security, cross-file, performance), and shows up as a comment on that line of the diff.
• History. Past reviews are saved per user and can be reopened or deleted.
• Landing page. A 3D scroll scene (React Three Fiber) built from the real diff and finding components. Phones, reduced-motion users and browsers without WebGL get a static version.

How it works

1. The web app sends the PR URL to the Express API with a signed token.
2. The API fetches the changed files from GitHub and builds one diff.
3. Gemini reviews it and returns JSON in a fixed schema (summary plus findings).
4. The review and findings are saved to Postgres and shown on the diff.

Design decisions

• Model fallback. The review tries three Gemini models in order (gemini-3.6-flash, then gemini-3.5-flash-lite, then gemini-3.8-flash) and moves on if one is overloaded, out of quota or too slow. Each request and the whole AI step have time limits. The GEMINI_MODELS variable can change the order.
• Stuck reviews. A review left pending past a time limit is treated as abandoned, so it never spins forever.
• Auth across two hosts. NextAuth (Google, JWT sessions) runs on the web app and the API verifies the signed token itself.
• Overflow test. A Playwright test checks that no page scrolls sideways at seven phone and tablet widths.

Tech stack

Layer	Tools
Frontend	Next.js (App Router), TypeScript, Tailwind CSS, Framer Motion, React Three Fiber, react-diff-view
Auth	NextAuth with Google OAuth
Backend	Node.js, Express, TypeScript
Database	PostgreSQL (Neon), Prisma
AI	Google Gemini
Hosting	Vercel (web), Render (API)

Project layout

server/       Express API: GitHub fetch, Gemini review, reviews routes
web/          Next.js app: landing page, review pages, diff viewer
render.yaml   Render service for the API

Run it locally

1. Create a Postgres database (Neon works) and a Google OAuth client.

2. In server/, copy .env.example to .env and fill in the variables below. Then run npm install, npx prisma migrate deploy and npm run dev.

   Variable	Required	What it is
   DATABASE_URL	Yes	Postgres connection string (Neon pooled URL)
   DIRECT_URL	Yes	Direct Postgres connection string, used by Prisma migrations
   GITHUB_TOKEN	Yes	GitHub personal access token for fetching PR diffs
   GEMINI_API_KEY	Yes	Google Gemini API key
   API_AUTH_SECRET	Yes	Shared secret, same value as in web/.env.local
   WEB_ORIGIN	Yes	Allowed web origins, comma-separated
   GEMINI_MODELS	No	Gemini models to try, in order, comma-separated. Default gemini-3.6-flash,gemini-3.5-flash-lite,gemini-3.8-flash
   TRUST_PROXY_HOPS	No (yes on Render)	Number of proxies in front of the API in production, 1 to 5, default 1. On Render it must be 3, see below

   On Render, set TRUST_PROXY_HOPS=3. That was measured: a request reaches the API through the visitor, then Cloudflare, then Render's proxy. Too low, and every visitor shows up as Render's internal proxy address and shares one rate-limit counter. Too high, and a visitor can fake their IP by sending their own X-Forwarded-For header. Other hosts default to 1; set it to however many proxies sit in front of the API there.

3. In web/, create .env.local with GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, NEXTAUTH_SECRET, API_AUTH_SECRET (same value as the server) and NEXT_PUBLIC_API_URL. Then run npm install and npm run dev.

4. Open http://localhost:3000.

Known limits

• Free-tier Gemini quotas limit how many reviews can run per day.
• Very large PRs may be slow or hit model limits.
• Public repos work with the server's GitHub token; private repos are not supported.

Author

Khizar Islam Rathore, Software Engineering student at the University of Karachi. GitHub: github.com/Khizar-Islam | LinkedIn: linkedin.com/in/khizar-islam-rathore