# LGTM — Looks Good To Meow

> AI code review + CI/CD security for GitHub PRs. India-built,
> INR-priced. Six specialist review agents plus one deterministic
> ci-security agent, an adversarial verifier LLM pass, and a
> synthesizer. 36 built-in CI/CD security detectors across GitHub
> Actions, GitLab CI, CircleCI, and Azure Pipelines — plus a YAML
> DSL for authoring your own custom detectors (with per-repo
> scoping) that run alongside them, and a Detector Recipes tab
> with 20+ ready-to-copy YAML blocks. Every scan generates a
> CycloneDX 1.5 SBOM (9 ecosystems) — downloadable + cross-repo
> searchable. Every enrolled repo gets a Posture Score (0-100,
> letter grade, deduction-based) with a 30-day trend, plus a
> Security Analytics dashboard for fleet-wide posture, MTTR by
> severity, top firing rules, opened-vs-resolved flow, CI-system
> distribution, and false-positive leaderboard. Public README
> badges are served as shields.io-style SVG. Org-scale RBAC
> with 4 roles + shared policy inheritance + enforced-rule
> locking + cross-org detector marketplace + GitHub org
> membership sync. BYOK — OpenAI direct, or OpenRouter for 100+
> models (Claude Opus 5, Sonnet 5, Gemini 3.1 Pro, Grok 4.5,
> DeepSeek V4, Llama 4, Mistral Large, Qwen 3.8 Max, and more).

LGTM reviews pull requests with a six-lens review pipeline (bugs,
security, performance, documentation, readability, best-practices)
joined by a deterministic ci-security agent when CI/CD files
change. As of the v2 merged pipeline (2026-08-09), the six lenses
are batched into two structured-output LLM calls (Correctness =
bugs+security+perf, Style = docs+readability+best-practices)
followed by one batched verifier — same review depth as the split
6-agent version, 5-10× cheaper per review, ~4× lower latency, and
the batched verifier catches cross-lens duplicates + contradictions
that the old per-finding verifier couldn't. The 6-agent user
experience is preserved (6 tabs, per-agent progress ticks, .lgtm.yml
filters) by bucketing merged output back into 6 phantom agent
entries. A synthesizer merges surviving findings into one verdict
with inline comments. Every LLM finding must quote the offending
code verbatim (evidence-quote validator) — unverifiable claims are
dropped. Mechanical single-line fixes are posted as GitHub
```suggestion``` blocks so reviewers can Apply-suggestion in one
click. The pipeline also loads repo conventions (CLAUDE.md,
AGENTS.md, .cursorrules, CONTRIBUTING.md, etc.) — CACHED on the
RepoContext row and refreshed on every push, so per-review context
assembly takes ~1s instead of ~7-10s. Framework awareness (Next.js,
Django, Prisma, Rails, …) and per-language hints across 13
languages. Repo indexing is zero-touch: auto-triggers on repo
enrollment AND on every push to the default branch. Manual
Index Codebase button is SHA-diff aware — if nothing changed since
the last index, it's an honest no-op with an "already up to date"
toast.

The "LGTM Security" feature scans GitHub Actions, GitLab CI,
CircleCI, and Azure Pipelines workflows plus Docker/IaC configs
for 36 supply-chain + CI risks and can block merges or auto-revert
risky pushes via a runtime watchdog Action. Teams can create
organizations, invite teammates with 4 roles (Owner, Policy Admin,
Member, Viewer), and share one policy across every attached repo —
repos override per rule except on rules the org marks as Enforced.
GitHub org membership sync (opt-in per org) auto-provisions
teammates from your GitHub organization. Teams can also author
their own security detectors in a small YAML DSL (Custom Detector
Authoring v1) — same block/warn/off semantics and enforcement as
the built-ins, personal + org scope, and a cross-org marketplace
that lets Policy Admins share detectors and import them as copies
with sourceDetectorId provenance.

The whole product runs from a dashboard at app.looksgoodtomeow.in
or from a CLI (`npm i -g @tarin/lgtm-cli`). Reviews use the user's
own OpenAI key OR an OpenRouter key (BYOK) — OpenRouter unlocks
21 curated models plus 400+ more in its catalog through one API.
Keys are AES-256-GCM encrypted at rest, decrypted only inside the
review worker at review time — we never see provider tokens
unencrypted. Curated OpenRouter models include: anthropic/claude-
opus-5, anthropic/claude-sonnet-5 (default), anthropic/claude-opus-
5-fast, anthropic/claude-opus-4.8, openai/gpt-5.6-sol-pro,
openai/gpt-5.5, openai/gpt-5.4-mini, openai/gpt-5.4-nano, openai/o3,
google/gemini-3.1-pro-preview, google/gemini-3.6-flash,
google/gemini-3.1-flash-lite, x-ai/grok-4.5, x-ai/grok-4.3,
deepseek/deepseek-v4-pro, deepseek/deepseek-v4-flash,
meta-llama/llama-4-maverick, mistralai/mistral-large-2512,
mistralai/codestral-2508, qwen/qwen3.8-max, qwen/qwen3.7-flash.

## Documentation

- [Full docs (long-form)](https://docs.looksgoodtomeow.in/llms-full.txt): single-file dump of every section below for one-shot LLM ingest
- [Browsable docs](https://docs.looksgoodtomeow.in/docs): same content rendered as a web page with navigation

## Getting started

- [Sign in](https://app.looksgoodtomeow.in/login): GitHub OAuth, no email/password
- [Install GitHub App](https://github.com/apps/lgtm-app): grants LGTM the ability to read PR diffs and post review comments
- [Pricing](https://looksgoodtomeow.in/pricing): 5 tiers — Free (10 reviews/mo + 5 lifetime scans) · Go ₹999 · Pro ₹1,999 (adds auto-review + PR chat) · Max ₹9,999 (adds Organizations & RBAC) · Enterprise from ₹29,999 (adds SBOM Search + Custom Detectors + SSO). Top-up packs valid 12 months.

## Product surfaces

- [Marketing landing](https://looksgoodtomeow.in/): product overview + signup
- [Dashboard](https://app.looksgoodtomeow.in/dashboard): authenticated PR + review list
- [Review Analytics](https://app.looksgoodtomeow.in/dashboard/analytics): PR-review verdicts, agent-firing counts, review-time trends
- [LGTM Security](https://app.looksgoodtomeow.in/dashboard/security): enrolled repos, per-repo Posture Score gauge + 30-day trend + fleet posture strip
- [Security Analytics](https://app.looksgoodtomeow.in/dashboard/security/analytics): fleet posture over time, top firing rules, MTTR by severity, opened-vs-resolved flow, CI-system distribution, FP-rate leaderboard (30/90/365-day windows)
- [SBOM search](https://app.looksgoodtomeow.in/dashboard/security/sbom-search): cross-repo package search across every SBOM you can see
- [Custom detectors](https://app.looksgoodtomeow.in/dashboard/security/custom-detectors): author your own security rules in YAML — personal or org scope, per-repo scoping, cross-org marketplace, in-app test playground
- [API Tokens](https://app.looksgoodtomeow.in/dashboard/security/tokens): mint watchdog + CLI tokens with scoped permissions
- [Organizations & RBAC](https://app.looksgoodtomeow.in/dashboard/security/orgs): create orgs, invite teammates, share policy, enforce rules
- [AI Providers](https://app.looksgoodtomeow.in/dashboard/ai-providers): three tabs (LGTM Mode / API Keys / Models) — toggle between Managed AI (LGTM-funded DeepSeek V4 Flash on CoreWeave, zero setup) and BYOK (OpenAI direct, or OpenRouter for 400+ models incl. Claude, Gemini, Grok, DeepSeek, Llama, Mistral, Qwen). Multiple keys per provider with labels + per-repo mode/key overrides + separate PR-chat key + model override.
- [Settings](https://app.looksgoodtomeow.in/dashboard/settings): plan + email + notification + privacy consents
- [Security notifications (per-user)](https://app.looksgoodtomeow.in/dashboard/settings#security-notifications): global email + in-app prefs, respected across every monitor you can see
- [Public review reports](https://app.looksgoodtomeow.in/review/:id): shareable summary of a single review
- [Public README badge](https://lgtm-server.fly.dev/security/badge/:repoId.svg): shields.io-style Posture Score badge for a repo's README

## Pipeline capabilities

- Six specialist LLM lenses (bugs, security, performance, docs, readability, best-practices) with framework-aware + language-aware prompts
- v2 merged pipeline (2026-08-09): 6 lenses batched into 2 structured-output LLM calls (Correctness + Style) — same review depth, 5-10× cheaper, 4× lower latency
- Batched adversarial verifier refutes weak findings in ONE LLM call (was 5-25 per-finding calls). Catches cross-lens duplicates + contradictions.
- Cross-agent dedup by (file, line) with consensus tag ("Flagged by: bugs, security, ...")
- Tiered findings — Actionable (critical/high), Suggestion (medium), Nitpick (low/info)
- `codeSuggestion` field renders as a native GitHub Apply-suggestion block on mechanical fixes
- Evidence-quote validator: every finding must quote the offending code verbatim
- Prompt-injection defense: untrusted content wrapped in tags, treated as data not instructions
- Convention loader reads CLAUDE.md / AGENTS.md / .cursorrules / .github/copilot-instructions.md / .windsurfrules / CONTRIBUTING.md / .claude/CLAUDE.md (CACHED — refreshed on every push, not fetched per review)
- Framework detection from package.json, pyproject.toml, requirements.txt, go.mod, Gemfile, pom.xml, build.gradle, Cargo.toml, composer.json (CACHED — same refresh cycle)
- 40-class vulnerability taxonomy on the security lens with CWE cross-references
- Per-lens model routing (Style lens routes to same-provider mini/flash/haiku)
- Claude prompt caching via OpenRouter cache_control forwarding — ~90% discount on the shared context block after first call
- OpenRouter catalog cache (400+ slugs) warmed on server boot + refreshed hourly — validateModel is a µs Set lookup
- Golden-set eval harness (`npm run eval:full`) grades pipeline precision/recall/noise — expanded synonyms table (30+ entries) for real precision measurement
- Zero-touch first-time indexing: connect a repo → auto-index kicks in the background → first PR review works ~2-5 min later
- SHA-diff aware manual re-index — "already up to date" toast when nothing changed, no wasted work
- `.lgtm.yml` repo-level config (v0.14.0): opt-in per repo, 9 rule types (disabled_agents, paths[].skip, suppress_categories, severity_overrides, auto_approve_docs_only, skip_lockfile_changes, max_inline_comments, per-repo model, framework override). Full spec: https://looksgoodtomeow.in/docs#lgtm-yml
- Per-repo Settings page (v0.14.0): /dashboard/repos/:id/settings with 5 tabs (General / .lgtm.yml / Model / Branches / Danger). Model tab overrides global default per-repo.
- Branch opt-in (v0.14.0): reviewBranches[] narrows which base branches trigger reviews; securityBranches[] adds branches on top of default-branch security scans.

## CLI

The CLI is the same surface as the dashboard, callable from a
terminal or CI. Install with `npm i -g @tarin/lgtm-cli`, sign in
with `lgtm login`. Run `lgtm --help` for the command index. Notable
commands:

- `lgtm review` — review the local diff or a specific PR
- `lgtm security` — enroll a repo, list findings, mint a runtime watchdog token
- `lgtm billing` — view plan, schedule cancellation, open customer portal
- `lgtm consent` — view and accept current Terms + Privacy versions
- `lgtm doctor` — diagnose setup issues (auth, network, AI provider, consent)

## Optional

- [Privacy Policy](https://looksgoodtomeow.in/privacy): what we collect, why, and how to exercise DPDP rights
- [Terms of Service](https://looksgoodtomeow.in/terms): the contract — pricing, refund policy, dispute resolution
- [Security disclosure](https://looksgoodtomeow.in/security): how to report a vulnerability
- [.well-known/security.txt](https://looksgoodtomeow.in/.well-known/security.txt): RFC 9116 security contact
- [Changelog](https://looksgoodtomeow.in/changelog): build log of every shipped change