# PatchPatrol > Review GitLab merge requests through a model endpoint you control. PatchPatrol also supports GitHub Actions and local diff reviews. # AI code reviews for GitLab, GitHub, and private code [Original page](https://patchpatrol.ai/en/) Review GitLab merge requests through a model endpoint you control. PatchPatrol also supports GitHub Actions and local diff reviews. PatchPatrol by aistack [Contact](https://patchpatrol.ai/en/contact/) [How it works](https://patchpatrol.ai/en/#platform-services) ## Code Reviews ```sh $ git push ``` - checkout-web: P1, 1 finding (`src/session.ts:42`). Example value: 84 token/s. - orders-api: P1, 1 finding (`api/orders.py:87`). Example value: 62 token/s. - payment-worker: P1, 1 finding (`jobs/charge.ts:31`). Example value: 96 token/s. - shared-auth: P2, 1 finding (`auth/token.go:64`). Example value: 73 token/s. ## From diff to review. Within clear limits. PatchPatrol reviews the change in front of you. It is not a full-repository coding agent or GitHub bot. ### One review for GitLab merge requests, GitHub pull requests, branches, staged changes, and the working tree. ### One run, four reports A merge request review can produce JSON, Markdown, HTML, and GitLab Code Quality. Your configuration determines which reports are written. [Read the documentation](https://docs.patchpatrol.ai/docs/reference/artifacts-schema) ### Large diffs, bounded context Large diffs are split into bounded chunks. Byte, file, and chunk limits apply before the first provider call. Omitted parts are recorded in the report. [Read the documentation](https://docs.patchpatrol.ai/docs/reference/policy-controls) ### Retry with a clear limit A provider timeout is retried according to the transport retry setting. Invalid JSON gets one corrective retry. If it remains invalid, reports contain fallback metadata. [Read the documentation](https://docs.patchpatrol.ai/docs/reference/configuration) ### One summary across pushes In summary-only or full feedback mode, PatchPatrol updates its existing merge request summary note. Saved review state keeps findings tied to the reviewed commit. [Read the documentation](https://docs.patchpatrol.ai/docs/get-started/feedback-modes) ### Follow the review run The CLI reports validation, retries, and fallbacks. Warnings appear in amber; LLM_OUTPUT_INVALID marks a response that is still invalid after the corrective retry. These example lines show different possible outcomes. [Read the documentation](https://docs.patchpatrol.ai/docs/reference/cli-reference) ## AI-assisted code reviews Concept ### Use the endpoint you configure Transparent AI use PatchPatrol sends selected review context only to the model endpoint you configure. You can also restrict calls with an endpoint allowlist. If that endpoint is remote, the provider receives the selected content under its own data-handling terms. Configured endpoint, optional allowlist ### Review relevant changes Limited context PatchPatrol limits changed files, changed lines, diff size, and any supporting context before review. MR, GitHub PR, and local diff context ### Feedback in review context Directly traceable Depending on your setup, PatchPatrol publishes a compact GitLab Review Summary. Priority Findings appear as inline discussions on the affected lines. The HTML Run Report contains the full record of the run. Reviewers can quickly see what needs a closer look. GitLab Review Summary, inline findings, HTML Run Report ### Spot risks sooner Risk in focus PatchPatrol surfaces signals that deserve attention and adds context for the affected change. Context for decisions ## Review code against your team's own rules Repository-aware rules For individual paths, components, and file types, teams can define targeted review guidance. PatchPatrol checks changes against your project's standards instead of relying only on generic review logic. .ai-review.yml ### Repo-local review rules ```yaml version: 1 review: rules: - id: privacy.no-raw-payload-logging severity: error scope: - "src/api/**" instruction: "Flag new logging paths that could expose raw request data." - id: tests.runtime-behavior-needs-regression severity: warning scope: - "src/**/*.py" instruction: "Check whether behavior changes include regression coverage." ``` [Technical documentation](https://docs.patchpatrol.ai/docs/reference/repository-aware-rules) ### Version rules with the code Store review guidance next to the project. Rules can target specific paths, modules, or file types. ### Keep context bounded PatchPatrol applies matching rules as review guidance, but findings still need evidence from the reviewed diff and context. ### Audit what was used Reports show repository-context mode, matched rules, included sources, and context budget usage. ## AI feedback directly in your pipeline Pipeline integration PatchPatrol extends your existing merge request or pull request pipeline. Feedback appears directly in the CI run so reviewers can see which changes need attention. GitLab CI ### .gitlab-ci.yml ```yaml include: - component: $CI_SERVER_FQDN/patchpatrol/components/gitlab-review@1.0.0 inputs: feedback-mode: artifact-only readiness-mode: 'off' output-dir: .ai-review artifact-expire-in: 7 days ``` Uses existing tools from your project - Node - Python - Go - Java - Ruby - Rust ## Selected change, bounded context, traceable review result. How it works ### Step 01: Code change as the starting point The run starts with a concrete change: a GitLab merge request, a GitHub pull request workflow, or a local diff. Excerpt from a local run with the mock provider. ```text ai-review run --mode working-tree --provider mock [START] PatchPatrol AI review pipeline mode: run [STEP] Artifact write: Human-readable and machine-readable artifacts persisted successfully. [INFO] Chunked provider review + validation complete. PatchPatrol uses AI. Check for mistakes. ``` ### Step 02: Bound the relevant context Configured limits cap changed files, changed lines, diff size, and any supporting context before the provider call. Review stages and a finding from the report shown below; no autonomous tool calls. Example review run Review the selected diff No assertion for invalid JSON retry fallback. tests/test_retry.py:1–30. Fixed review stages - Diff - Trust Gate - Local Discovery - Finding Verification - Review Artifacts ### Step 03: Trust checks before AI review Before provider calls, PatchPatrol applies configured review bounds and optional endpoint restrictions. Selected source and evidence reach the configured model in their original form, including credentials. The Run Report records endpoint-policy blocks. You control the endpoint and its data retention. Review stages and a finding from the report shown below; no autonomous tool calls. Example review run Review the selected diff No assertion for invalid JSON retry fallback. tests/test_retry.py:1–30. Fixed review stages - Diff - Trust Gate - Local Discovery - Finding Verification - Review Artifacts ### Step 04: Code review The LLM checks the change context, scope limits, and affected code paths. The result is a set of prioritized findings with clear reasoning. Review stages and a finding from the report shown below; no autonomous tool calls. Example review run Review the selected diff No assertion for invalid JSON retry fallback. tests/test_retry.py:1–30. Fixed review stages - Diff - Trust Gate - Local Discovery - Finding Verification - Review Artifacts ### Step 05: Make findings traceable PatchPatrol validates the model response before publishing any feedback. The compact GitLab Review Summary shows what needs a closer look. Priority Findings appear as inline discussions on the affected lines, while the HTML Run Report contains the full record of the run. HTML Run Report ![Preview of the PatchPatrol HTML Run Report on the homepage](https://patchpatrol.ai/images/html-report-preview.png) ## PatchPatrol in numbers Product facts ### 100% Self-hosted Runs in your CI or locally. Review context goes only to the model endpoint you configure. ### 2 Supported platforms GitLab and GitHub. ### 5 Review targets GitLab merge requests, GitHub pull requests, branches, staged changes, and the working tree. ### 4 Report formats JSON, Markdown, HTML, and GitLab Code Quality. ## Configure PatchPatrol Documentation Start with the GitLab setup, or open the configuration reference for providers, variables, and review limits. ### GitLab merge request GitLab pipeline The admin quickstart shows how to prepare providers and GitLab CI, then run the first artifact-based merge-request review. [Open admin quickstart](https://docs.patchpatrol.ai/docs/get-started/admin) ### Pipeline, providers, reports Configuration Use the configuration reference to set providers, environment variables, review limits, and report output for production. [Open configuration reference](https://docs.patchpatrol.ai/docs/reference/configuration) ## Evaluate PatchPatrol in your GitLab workflow Next step Tell us about your GitLab review job, the model endpoint you plan to use, and what PatchPatrol needs to prove in your environment. We will reply with evaluation and pricing information. Product access and any pilot are agreed separately. [Discuss an AI review for your project](https://patchpatrol.ai/en/contact) [Technical documentation (English)](https://docs.patchpatrol.ai/docs) # Discuss a private GitLab review pilot [Original page](https://patchpatrol.ai/en/contact) Describe your GitLab environment, the model endpoint you plan to use, and your evaluation requirements. We will reply with information about deployment, evaluation, and pricing and arrange a conversation if useful. Submitting the form does not itself provide product access or start a pilot. Contact PatchPatrol does not publish public pricing yet. Use this form to describe your GitLab environment and evaluation requirements and to ask about pricing. ## Start the conversation Share the context a technical buyer or reviewer needs: environment, model setup, code area, and timeline. - Name - Work email - Company - Message [Send inquiry](https://patchpatrol.ai/en/contact) We use your details only to answer your request. More in our [privacy policy](https://patchpatrol.ai/en/privacy). ## PatchPatrol is a product by aistack. [aistack](https://aistack.at/#kontakt) is an Austrian AI company that builds GDPR-compliant custom AI applications for companies with high requirements for privacy, integration, and operations. That experience also shapes PatchPatrol: a product for teams that want to use AI in code review without losing control or traceability. [Technical documentation (English)](https://docs.patchpatrol.ai/docs) # Imprint [Original page](https://patchpatrol.ai/en/imprint) Information according to § 5 ECG, § 14 UGB and disclosure according to § 25 MedienG. ## Company information aistack GmbH Business purpose: Consulting, research, and services in the field of artificial intelligence Managing director: Moritz Tanzer Siezenheimer Str 39B 5020 Salzburg Austria ## Contact Email: [contact@patchpatrol.ai](mailto:contact@patchpatrol.ai) Contact form: [patchpatrol.ai/en/contact](https://patchpatrol.ai/en/contact) ## Company register Company register number: FN 659303p Company register court: Landesgericht Salzburg ## Liability for content The content of this website is prepared with care. We do not guarantee that all information is complete, current, or error-free. As a service provider, we are responsible for our own content under the general laws. Obligations to remove or block information after becoming aware of a concrete legal violation remain unaffected. ## Liability for links This website may contain links to external third-party websites. We have no influence over their content. The respective provider or operator is responsible for linked pages. If we become aware of legal violations, we will remove the affected links. ## Copyright Content and works created by the site operator are subject to Austrian copyright law. Reproduction, editing, distribution, or use outside the limits of copyright law requires prior written consent. If you notice a possible copyright violation, please contact us so we can review and remove affected content where required. ## PatchPatrol PatchPatrol is a product by [aistack GmbH](https://aistack.at/). [Technical documentation (English)](https://docs.patchpatrol.ai/docs) # Privacy policy [Original page](https://patchpatrol.ai/en/privacy) Last updated: 20 October 2026 This policy explains which personal data we process when you visit patchpatrol.ai or the documentation at docs.patchpatrol.ai, or when you contact us. ## 1. Controller aistack GmbH Managing director: Moritz Tanzer Siezenheimer Str 39B, 5020 Salzburg, Austria Email: contact@patchpatrol.ai We have not appointed a data protection officer because we are not legally required to. Please send any privacy questions to the address above. ## 2. What this policy does not cover: the PatchPatrol software PatchPatrol runs in your own infrastructure, for example in your CI or locally. Review content goes only to the model endpoint you configure. The software sends no usage data to us, and the licence is checked locally, without contacting a licence server. So we receive no data from your review runs. If you configure a remote model provider, that provider processes the content it receives under its own terms. ## 3. Hosting Both websites run on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, in its Falkenstein data centre in Germany. Hetzner processes data on our behalf under a data processing agreement (Art. 28 GDPR). When you open a page, your browser sends the technical data needed to deliver it: your IP address, the date and time, the requested address, the page you came from (referrer), and your browser and operating system. We use this data only to deliver the pages and to fend off attacks. We do not keep access logs with this data. The legal basis is our legitimate interest in running the websites securely and reliably (Art. 6(1)(f) GDPR). ## 4. Contact form When you use the contact form, we process your name, your work email address, your company, your message and the language of the page you write from. We use these details only to answer your request. Providing them is voluntary, but we cannot handle your request without them. How your request travels: - Your browser sends the form to our server over an encrypted connection. - To prevent abuse, the server forwards at most five requests from one IP address within ten minutes. For this, the IP address is held only in the server's memory. It is not written to disk and is deleted at the latest when the server restarts. - The server hands your request to the email service Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA), which delivers it as an email to our mailbox contact@patchpatrol.ai. Your email address is set as the reply-to address so we can answer you directly. Resend processes data in the USA. The transfer is based on Resend's certification under the EU-US Data Privacy Framework (Art. 45 GDPR) and, in addition, on the European Commission's standard contractual clauses in our data processing agreement with Resend (Art. 46 GDPR). Legal basis: if your request is about a pilot, pricing or working together, we process it to take steps at your request before a possible contract (Art. 6(1)(b) GDPR). For all other requests, the basis is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Retention: we delete your request six months after the last message on the matter, unless it leads to a business relationship. Statutory retention obligations, for example under commercial or tax law, remain unaffected. ## 5. Contact by email If you write to contact@patchpatrol.ai directly, we process your message and the details from the email exchange. The legal basis and retention period are the same as for the contact form. ## 6. Audience measurement with Plausible Analytics To understand which pages people read, we use Plausible Analytics by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Plausible sets no cookies and stores nothing in your browser. The data is processed in the EU. Plausible records the page you open, the page that referred you, how long you stay on it and how far you scroll, your approximate location (country, region, city), and your device type, browser and operating system. We send page addresses without query parameters or fragments. Nothing you type into a form is ever sent. Plausible processes the data on our behalf under a data processing agreement (Art. 28 GDPR). The legal basis is our legitimate interest in improving our websites based on aggregated usage figures (Art. 6(1)(f) GDPR). You can object at any time (section 9). You can also block the measurement technically, for example with a tracking blocker. ## 7. Storage in your browser If you switch between the light and dark theme, your browser saves your choice in its local storage (entry "theme"). The entry stays on your device and is not sent to us. It is strictly necessary for the function you asked for (§ 165(3) of the Austrian Telecommunications Act 2021). You can delete it at any time in your browser settings. patchpatrol.ai and docs.patchpatrol.ai do not set cookies. ## 8. Fonts and links We serve all fonts from our own server. Apart from Plausible (section 6), opening our pages makes no connection to third parties. Links to other websites, such as aistack.at, open only when you click them; the privacy policy of that site's operator applies there. ## 9. Your rights You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). Where we process data based on legitimate interests, you can object on grounds relating to your particular situation (Art. 21 GDPR). To exercise these rights, write to contact@patchpatrol.ai. If you believe we process your data unlawfully, you can lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at, www.dsb.gv.at. ## 10. No automated decisions We make no automated individual decisions and do no profiling (Art. 22 GDPR). ## 11. Changes We update this policy when our websites or the law change. The version published on this page applies. [Technical documentation (English)](https://docs.patchpatrol.ai/docs)