AI-Codereview-Gitlab is an automated code review tool based on large models, designed to help development teams quickly perform intelligent Code Review when code is merged or submitted, improving code quality and development efficiency.
Purpose
When a user submits code on GitLab (such as a Merge Request or Push operation), GitLab automatically triggers a webhook event and calls this system's interface. The system uses a third-party large model to review the code and feeds the review results directly back into the Note of the corresponding Merge Request or Commit, making it easy for the team to view and handle.
Main Capabilities
- Multi-model support: Compatible with DeepSeek, ZhipuAI, OpenAI, Anthropic, Tongyi Qianwen, and Ollama, freely selectable.
- Instant message push: Review results are delivered directly to DingTalk, WeCom, or Feishu with one click.
- Automated daily report generation: Automatically organizes daily development progress based on GitLab, GitHub, and Gitea Commit records.
- Visual Dashboard: Centrally displays all Code Review records, providing project statistics and developer statistics.
- Selectable Review Style: Offers four styles: professional, sarcastic, gentlemanly, and humorous.
- Agentic Review mode (optional): The LLM has tool-calling capabilities (read_file / sandboxed run_command), can autonomously explore within a locally cloned code repository, and produces more comprehensive review results. By default, the shell only allows read-type commands (ls / cat / grep / find / git log, etc.), with triple protection consisting of a sandbox, path traversal checks, and a 30s timeout. Failure at any stage (clone / fetch / LLM / tool call) automatically degrades back to diff_only, ensuring at least a review consistent with the original version is returned.
Usage
Docker Deployment
After configuring the key parameters in the conf/.env file, access the main service at http://your-server-ip:5001 displays "The code review server is running.", indicating successful startup; access the Dashboard at http://your-server-ip:5002 to see the review log page.
Local Python Environment Deployment
Use a Python environment (a virtual environment venv is recommended, Python version 3.10+) to install the project dependencies; the configuration file is the same .env as in the Docker solution.
Configure GitLab Webhook
- Method 1: Create a Personal Access Token in GitLab personal settings.
- Method 2: Create a Project Access Token in GitLab project settings. Configure the Webhook in GitLab project settings:
- URL:http://{your-server-ip}:5001/review/webhook
- Trigger Events: check Push Events and Merge Request Events (do not check other Events)
- Secret Token: the Access Token configured above (optional)
The system prioritizes using GITLAB_ACCESS_TOKEN from the .env file; if it is not configured, it uses the Secret Token passed by the Webhook. It is necessary to ensure that GitLab can access this system. In restricted intranet environments, it is recommended to deploy on an external network server.
Message Push Configuration
Using DingTalk as an example, add a custom bot in the DingTalk group to obtain the Webhook URL, and update the configuration in .env:
#钉钉配置
DINGTALK_ENABLED=1 #0不发送钉钉消息，1发送钉钉消息
DINGTALK_WEBHOOK_URL=https://oapi.dingtalk.com/robot/send?access_token=xxx #替换为你的Webhook URL
The push configuration for WeCom and Feishu is similar.
Agentic Review Mode (optional)
Switch via the REVIEW_STRATEGY environment variable:
diff_only(default): only review the diff, with behavior exactly the same as the original version.agentic: LLM has tool-calling capabilities (read_file / sandboxed shell), and can autonomously explore within a locally cloned code repository to produce more comprehensive review results.
The agentic mode will clone/update the target project under REPO_CACHE_DIR as needed (approximately 10MB~2GB/project). Failure at any stage (clone / fetch / LLM / tool-call exception) will automatically fall back to diff_only. Additional overhead: peak memory per session is approximately 500MB; average tokens per review are 5k-50k tokens (3-10 times that of diff_only); latency is 30s~5min/review. The shell tool has a sandbox (command allowlist + blocklist + path escape checks + 30s timeout), and by default only read-type commands are allowed; if you need to open it up, adjust it via AGENT_SHELL_ALLOWLIST / AGENT_SHELL_BLOCKLIST.
Applicable Scenarios
Suitable for development teams that use GitLab for code hosting and want to introduce AI-assisted Code Review, especially for scenarios that need to push review results to DingTalk/WeCom/Feishu for collaboration and automatically generate development daily reports. It is also suitable for teams that want self-hosted deployment and have data control requirements.
Limitations
- Depends on third-party large models, and review effectiveness is affected by the capabilities of the selected model.
- Agentic mode increases memory, token consumption, and latency.
- In restricted intranet environments, it needs to be deployed on an external network server.
- Other specific limitations or pricing information are not yet provided.
