AI code review for GitHub, GitLab & Bitbucket

Every pull request, reviewed.

Solemly reviews every pull request the moment it opens - inline comments on the diff, and a merge gate that holds until the findings are answered.

Free for 14 days · No credit card · Installs in 60 seconds

src/billing/charge.ts+8−1

40 export async function chargeOrder(order: Order) {

41 const params = { ...intentFor(order), confirm: true };

42- return stripe.paymentIntents.create(params);

42+ for (let attempt = 1; ; attempt++) {

43+ try {

44+ return await stripe.paymentIntents.create(params);

solemlybotcommented just now

P1 Retries can charge the card twice. isRetryable treats a timeout as retryable (errors.ts:18), but a timed-out charge may have gone through. Send one idempotency key so a retry returns that charge instead of making a new one.

Suggested change

- return await stripe.paymentIntents.create(params);

+ return await stripe.paymentIntents.create(params, {

+ idempotencyKey: `charge-${order.id}`,

+ });

Commit suggestion

45+ } catch (err) {

46+ if (attempt === MAX_TRIES || !isRetryable(err)) throw err;

47+ await sleep(2 ** attempt * 100);

48+ }

49+ }

50 }

Solemly / ReviewBlocking: 1 high-severity findingMerging is blocked

The kind of thing it catches

P1Retry without an idempotency key
P0SQL built from request input
P1Token written to logs
P2N+1 query inside a loop
P1Admin route missing an auth check
P2Race on a read-modify-write
P0Secret committed to config
P3Error swallowed by an empty catch
P2Unbounded query on user input
P1Webhook signature never verified
P1Retry without an idempotency key
P0SQL built from request input
P1Token written to logs
P2N+1 query inside a loop
P1Admin route missing an auth check
P2Race on a read-modify-write
P0Secret committed to config
P3Error swallowed by an empty catch
P2Unbounded query on user input
P1Webhook signature never verified

Reviews on

GitHubGitLabBitbucket

Bugs + security

Both covered on every review

~2 min

From PR opened to review posted

Merge gate

Blocks until findings are answered

Full repo

Context beyond the diff

Why it exists

Coding agents and copilots open pull requests faster than a team can read them. Every one still goes through the same gate: reviewed, and held when it shouldn't merge yet.

Coding agents

Copilots

Your team

Solemlyreviews every PR

Merged

Blocked

The dashboard

The reviews land on the pull request. The dashboard is where you see all of them - across providers, repos and teams.

Every review, in one place

Reviews from GitHub, GitLab and Bitbucket in one list. Open any PR to read the summary, the inline comments and the security findings it got.

See where the risk is

Findings by severity, day by day, per repository — and how reviewed pull requests merge compared with unreviewed ones.

Reports you can hand to anyone

An executive summary with period-over-period changes, plus comparison, repo scorecard and author views. Export to CSV or print to PDF.

How AI-written code is landing

Solemly spots AI-authored pull requests from their commits and descriptions, then tracks how often they merge and how long they take.

It follows your house rules

CLAUDE.md, AGENTS.md and Cursor rules in each repo are read as conventions, so reviews hold code to your standards, not generic ones.

Reviews page listing recent pull requests, one expanded to show its summary and inline comments

Watch it work

The film is why it exists. The Short is one review start to finish: a retry loop that writes the auth token to the logs, caught and fixed on the pull request.

How it reviews

It reads the repo, not just the diff

Before it says a word, the reviewer pulls in related files, the project structure and your conventions - so its comments read like they came from someone who knows the codebase.

Follows CLAUDE.md, AGENTS.md and Cursor rules as house style
Deep review mode searches and reads the repo before concluding
A second pass re-checks every finding and drops the speculative ones

Context for checkout-service #4827 files

Changedsrc/billing/charge.ts
Importssrc/billing/errors.ts
Importssrc/lib/stripe.ts
Imported bysrc/checkout/submit.ts
ConventionsCLAUDE.md
Configpackage.json
DocsREADME.md

From CLAUDE.md: “Idempotency keys are required on every POST to the payment gateway.”

A merge gate that means something

Solemly sets a status the moment a PR opens and resolves it when the review lands. Make it required in branch protection and nothing merges with a high-severity finding still open.

A separate security pass, reported on its own check
Jira acceptance check: does the PR do what its ticket asks?
Fix and push - the review re-runs and the gate clears itself

Merging is blocked

2 failing checks, 1 required

Solemly / Review
Blocking: 1 high-severity finding
Required
Solemly / Security
Blocking: 1 high-severity security finding
Solemly / Acceptance
Matches the Jira ticket · PAY-412

Fix and push — the review re-runs and the gate clears.

Merge

Ask it why, right on the PR

Reply to any finding to get the reasoning and evidence behind it, ask a question about the change, or dismiss what doesn't apply. No context switch, no dashboard.

@solemly ask, explain, ignore and describe
@solemly review to re-run on demand, pause and resume per PR
Only people with write access to the repo can run commands

src/session/rotate.ts · line 58

solemlyP1

The old session token is never revoked after a role change.

marcus.w

@solemly explain

solemly

issueToken() creates the new session, but nothing calls sessions.revoke() on the old one, and middleware/auth.ts accepts any unexpired token. A demoted admin keeps admin access for up to an hour.

One current review, never a wall of bot spam

Push a new commit and the stale review is superseded automatically. Each PR carries one up-to-date review, not a trail of outdated ones.

Review every push, once per PR, or only on request - per repo
Inline comments sit on the exact lines, with severity on each
One-click suggested fixes on GitHub for single-line changes

checkout-service #4823 pushes

e41c0a9Review complete · 1 finding
b7d2f13Superseded — a newer commit was pushed
9a0e6c2Superseded — a newer commit was pushed

Review

Every pushOnce per PROn request

Also included

PR descriptions

Let Solemly write the pull request summary automatically, or on demand with @solemly describe.

Workspaces and teams

Belong to several organizations and switch in a click. Group people into teams so each sees the repos they own.

Admin and member roles

Admins manage repos, settings and people. Members get the reviews and reports for their work.

AI-authored PR detection

Spots pull requests written with AI assistants from commit trailers and descriptions, and tracks how they fare.

Export and print

Every report exports to CSV or prints to a clean PDF for the people who won't open a dashboard.

Sign in your way

Email, or one click with the GitHub, GitLab or Bitbucket account you already have.

Integrations

One install per provider. Reviews and merge statuses arrive natively on each platform.

GitHub

A GitHub App. Reviews land as native PR reviews with inline comments and required checks.

PR reviews · Check runs

GitLab

Connect with an access token. Reviews post as MR notes with a commit status that gates the merge.

MR notes · Commit status

Bitbucket

Install the app on your workspace. Reviews post as PR comments with a build status for merge checks.

PR comments · Build status

Jira

Finds the ticket from the branch, title or description and checks the PR against its acceptance criteria.

Acceptance check

Slack

A message in the channel you pick the moment a review finishes: the PR, what was found, and a link.

Review notifications

Microsoft Teams

The same review notifications, posted to a Teams channel through an incoming webhook.

Review notifications

Simple setup

No CI config, no YAML, no bot accounts to manage. Install the app and the next PR gets reviewed.

Connect your repos

Install Solemly on your GitHub, GitLab, or Bitbucket workspace. Pick which repos get reviews.

Open a pull request

That's the trigger. The review starts straight away, with the surrounding repo in view.

Review lands on the PR

A summary with ranked risks, inline comments on the lines that need them, a security pass, and a merge status your branch protection can require.

Free 14-day trial, then pay per user. 40 PR reviews per user every month. Cancel anytime.