Terms

Plug and Play Reviewer reads a pull request and suggests findings. A human decides what gets posted. No finding reaches your repository until a person approves it.

It is not a security audit, a compliance control, or a substitute for review by someone who knows the code. Do not treat a clean run as proof that a change is safe.

It misses real bugs and it raises findings that are wrong. The scorecard shows the measured rate on the sample we ran.

The runner calls whichever model provider you configured, using your own API key or provider plan. That bill is between you and them.

We do not resell model access, mark it up, or hold your key. We cannot refund a provider charge and we cannot cap your spend on their side.

Set your own spend limits with your provider before you point this at a busy repository.

The hosted control plane allows one GitHub user and one repository per installation on the free tier.

Self-hosting is not limited by that. The code is MIT and you can run the whole thing yourself.

Only connect repositories you own or have permission to review. You are responsible for having that permission.

Do not use this to process code you were not given access to.

The hosted control plane is a free service run by one person. It may be slow, down, or discontinued.

Your runner and your data are local, so you keep working when the hosted side does not. That is the point of the split.

The software is provided as is, without warranty of any kind, express or implied. The MIT licence in the repository governs the code and its wording controls.

To the extent the law allows, we are not liable for any damage arising from use of the software or the hosted service, including a bug it failed to catch.