AI-Powered Code Review CLI — BYOK

---

Cora is a fast, native CLI for AI-powered code review and code intelligence — in your terminal, CI/CD, git hooks, or directly inside AI coding agents. Bring your own key, pick any model, index your codebase, and search semantically. All local, zero cloud.

Why Cora?

• 🤖 Multi-LLM — OpenAI, Anthropic, Groq, Ollama, Z.AI, or any OpenAI-compatible API
• ⚡ Native Rust — fast binary, no runtime dependencies, cross-platform
• 🪝 Pre-commit hooks — catch issues before they reach CI
• 📋 SARIF output — upload to GitHub Code Scanning
• 🛡️ Deterministic scanners — 12 built-in rules + 13 security patterns + 15 secret detection patterns that run without LLM
• 🧠 Language-specific analysis — tailored review guidance for Dart/Flutter, Svelte, TypeScript, Go, Rust, Python
• 🚧 Quality gate — configurable pass/fail thresholds for CI enforcement
• 📐 Quality profiles — strict, balanced, or lax presets for different project needs
• 📏 Custom rule engine — write your own regex rules in .cora.yaml
• ✂️ Auto-chunking — splits large PRs into reviewable chunks automatically
• 🔍 Code Intelligence — index symbols across 15 languages, call graph, trace, impact analysis
• 🧠 Brain Mode — hybrid semantic search (FTS5 + vector KNN + graph) with RRF fusion
• 🗄️ Multi-project database — one global index, search across all your repos at once
• 🌳 Tree-sitter (opt-in) — AST-based symbol extraction for 13 languages: Rust, Go, Python, TypeScript/TSX, Java, C, C++, C#, Ruby, PHP, Scala, JavaScript, Svelte (via TypeScript delegation, zero extra dependency)
• 🔌 MCP server — 18 tools for AI coding agents (review, search, brain, debt, trace, dead code, graph query, ...)
• 💾 Diff-hash caching — skip repeat reviews automatically
• 🔧 Configurable — per-project .cora.yaml, global ~/.cora/config.yaml, or env vars

Quick Start

Install

Pick one install method — mixing channels can leave stale binaries on your PATH.

Method	When to use
curl … install.sh (recommended)	Quick standalone install; fetches the latest GitHub release binary
cargo install --git …	You already have a Rust toolchain; builds from source
Pre-built binaries	Manual download from Releases

# Install with the quick installer
curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-code/main/install-bundle.sh | sh
# Or build from source with cargo
cargo install --git https://github.com/codecoradev/cora-code

Pin a version: CORA_VERSION=v0.6.1 curl -fsSL ... | sh

Upgrading: run cora upgrade (downloads the latest release, verifies its SHA-256 checksum, replaces the binary) or cora upgrade --check to just see if one is available. If you installed via cargo install --path ., re-run that instead.

Verify which cora you're running — which -a cora will reveal stale copies from other channels:

which -a cora # list every `cora` on your PATH (one entry = healthy)
cora --version # should match the latest release

If which -a cora shows more than one path (e.g. ~/.local/bin/cora and ~/.cargo/bin/cora), remove the one you don't want or reorder your PATH. See Issue #314 for background.

macOS note — binary killed on launch (Killed: 9)?

The prebuilt aarch64-apple-darwin binary is not Apple-notarized. On macOS, downloaded binaries may be tagged with com.apple.quarantine / com.apple.provenance and killed by Gatekeeper with no error message.

The install.sh installer strips these attributes automatically. If you downloaded the binary manually (e.g. gh release download), strip them yourself:

xattr -dr com.apple.quarantine /path/to/cora
xattr -dr com.apple.provenance /path/to/cora

Or install via cargo / Homebrew to sidestep Gatekeeper entirely.

Authenticate

cora auth login

Pick a provider, enter your API key. Done. Provider env vars (ZAI_API_KEY, OPENAI_API_KEY, etc.) are auto-detected.

Review

cora review # staged changes
cora review --base main # vs a branch
cora review --unpushed # unpushed commits
cora commit # review + generate commit msg + commit
cora commit --yolo # auto-commit, no prompts

Project Config

cora init # creates .cora.yaml + installs pre-commit hook

Configuration

Priority: CLI flags → env vars → .cora.yaml (project) → ~/.cora/config.yaml (global) → defaults

# .cora.yamlprovider: zaimodel: glm-5.1focus: [security, bugs]# Quality gate — enforce code quality in CIquality_gate:
enabled: truethresholds:
max_critical: 0# 0 critical = gate FAILmax_security: 0# 0 security findings = gate FAILcategories:
performance:
action: warn # warn only, don't fail CImax_findings: 5

cora config show # effective merged config
cora config show --global # ~/.cora/config.yaml
cora config show --project # .cora.yaml

File	Purpose
~/.cora/auth.toml	API key (secret, chmod 600)
~/.cora/config.yaml	Global defaults (provider, model, etc.)
.cora.yaml	Per-project overrides

See Configuration → for full reference.

CI/CD

# .github/workflows/cora-review.ymlon: pull_requestjobs:
review:
runs-on: ubuntu-lateststeps:
- uses: actions/checkout@v4with: { fetch-depth: 0 }
- uses: codecoradev/cora-review-action@v1with:
github-token: ${{ secrets.GITHUB_TOKEN }}cora-api-key: ${{ secrets.CORA_API_KEY }}

Required secrets: CORA_API_KEY, CORA_BASE_URL (optional), CORA_MODEL (optional)

See GitHub Marketplace for full documentation.

Works on all CI platforms — Gitea, GitLab, Bitbucket →

Commands

Code Review

Command	Description
cora review	Review code changes (diff, branch, commit, file)
cora scan	Scan files for issues
cora commit	Review + generate commit message + commit
cora debt	Show tech debt report from review history
cora findings	Track, dismiss, and reopen review/scan findings

Code Intelligence

Command	Description
cora index	Index project symbols, vectors, and call graph
cora explore	Search symbols by keyword (FTS5)
cora brain	Hybrid semantic search (FTS5 + vectors + graph → RRF)
cora trace	Trace call chains through the codebase
cora arch	Architecture overview (modules, edges, hotspots)
cora callers	Find all callers of a symbol
cora impact	Analyze blast radius of changing a symbol
cora affected	Find tests impacted by changed files
cora dead-code	Detect dead code — functions with zero callers
cora query	Query the code graph (e.g. "main -> *")
cora routes	List detected HTTP routes (Axum, Actix, Express, FastAPI, Flask, Go)

Config & Setup

Command	Description
cora init	Create project config + hook
cora auth login	Save API key
cora config show	Show resolved config
cora config validate	Validate configuration
cora providers	List available LLM providers
cora profile list	List quality profiles (strict, balanced, lax)
cora mcp	Start MCP server (18 tools) for AI coding agents
cora serve	Start MCP server + auto-reindex on startup
cora install	Auto-detect and configure AI coding agents
cora hook install	Install pre-commit hook
cora upgrade	Self-upgrade from GitHub Releases (checksum-verified)

See CLI Reference → for all flags and examples.

Performance

Benchmarked on the cora-code repository (1,864 symbols, 115 Rust files, x86_64, single-thread baseline → Rayon parallel).

Operation	Time	Notes
Cold index (full rebuild)	~936ms	Walk + parse + embed + HNSW insert (Rayon parallel)
Incremental (no changes)	~6ms	mtime:size fingerprint — skips unchanged files
Brain search (hybrid)	~5ms	FTS5 + vector KNN + graph BFS → RRF fusion
Binary size	10.4 MB	Single static binary, zero runtime dependencies

Measurements are indicative, not contractual. Your numbers will vary with codebase size, CPU cores, and disk I/O.

Environment Variables

Variable	Description
CORA_API_KEY	API key (CI use)
CORA_PROVIDER	Override provider
CORA_MODEL	Override model
CORA_BASE_URL	Override API base URL

Provider-specific keys are auto-detected: OPENAI_API_KEY, ANTHROPIC_API_KEY, GROQ_API_KEY, ZAI_API_KEY

Documentation

Page	Description
Getting Started	Install, auth, first review
Configuration	Config files, env vars, priority
CLI Reference	All commands and flags
Providers	Supported LLM providers
Examples	Common workflows & CI setup
Changelog	Release history
Roadmap	Planned features

Star History

Contributing

See CONTRIBUTING.md for guidelines. PRs welcome!

License

MIT