Code review
Automatic AI reviews on pull and merge requests, plus local reviews before you push.
Hull reviews your pull requests and merge requests automatically. When a PR or MR is opened or updated, the review agent reads the diff and the surrounding code, then posts a summary and inline comments with severity and suggested fixes. You can also run the same review locally with /review before you push.
Plans
Code review is included on Starter, Pro, Teams and Enterprise. It isn't part of the Free plan. Reviews use your AI allowance like any other Hull work. See withhull.com/pricing.
Supported platforms
| Platform | Connection | Setup |
|---|---|---|
| GitHub | HullConnect GitHub App | GitHub code review |
| GitLab | OAuth or personal access token | GitLab code review |
Turn on code review
Connect GitHub or GitLab on the Integrations page. See Integrations.
Open Code Reviews at app.withhull.com/code-reviews, or in your organization's sidebar.
Turn on Enable AI Code Review.
Choose a Default AI Model, a Review Style and any Focus Areas.
Choose which repositories to review, then click Save Configuration.
From then on, Hull reviews new and updated pull or merge requests in those repositories. Draft PRs and MRs are skipped until they're ready for review.
Settings
| Setting | What it does |
|---|---|
| Default AI Model | The model used for reviews. Thinking Effort sets its reasoning effort when the model supports it. |
| PR Gate Threshold | When the review's status check fails: Off, All findings, Warnings and above or Critical issues only. |
| Review Style | How strict the review is (see below). |
| Use REVIEW.md | Loads REVIEW.md from the base branch for repository-specific guidance. |
| Skip pull requests from bots | Skips PRs opened by bot accounts such as Dependabot or Renovate (GitHub only, on by default). |
| Focus Areas | Areas the reviewer pays extra attention to. |
| Repositories | All repositories, or only the ones you select. Under advanced settings you can also set a model per repository. |
Review styles
- Strict: flags all potential issues and prioritizes quality and security. Good for production services and critical paths.
- Balanced: balances thoroughness with practicality. This is the default.
- Lenient: only critical bugs and security issues, with an encouraging tone. Good for prototypes and early work.
- Roast: brutally honest, technically accurate feedback with sharp, witty commentary.
Focus areas
- Security vulnerabilities: SQL injection, XSS and similar issues
- Performance issues: N+1 queries, inefficient loops
- Bug detection: logic errors, edge cases
- Code style: formatting, naming conventions
- Test coverage: missing or inadequate tests
- Documentation: missing comments, unclear APIs
Repository guidance with REVIEW.md
Use REVIEW.md to keep review policy in the repository, next to the code. It's the place for domain rules, severity calibration, files to skip, verification expectations, summary style and how the reviewer should use sub-agents.
- Create
REVIEW.mdat the repository root. - Commit it to the base branch your pull or merge requests target.
- In Code Reviews, turn on Use REVIEW.md and save.
Hull reads REVIEW.md from the base branch, not the feature branch, so a change can't rewrite the policy used to review itself. If the file is missing, empty or unreadable, Hull uses its built-in guidance. Files longer than 10,000 characters are truncated, and the review summary notes it.
The older Custom Instructions field is being retired. Move those guidelines into REVIEW.md.
Sub-agents
By default, the reviewer uses sub-agents only when they improve coverage. After reading the diff, it picks the largest tier that the file count or changed lines trigger:
| Diff size | Default |
|---|---|
| Up to 2 files and under 100 changed lines | No sub-agents. The reviewer works directly. |
| 3 to 5 files, or 100 to 300 changed lines | At most 1 sub-agent, for a distinct risky area. |
| 6 or more files, or more than 300 changed lines | 6 sub-agents, split by independent areas. |
Sub-agents are read-only and never post comments. They return findings with path, line, severity and rationale, and the main reviewer verifies them, removes duplicates and posts the final comments.
REVIEW.md can replace this policy. For example:
## Sub-agent usage
Use 0 sub-agents for docs-only, formatting-only or lockfile-only changes.
Use 1 sub-agent for changes under 300 lines that touch one risky area,
such as authentication, billing or database migrations.
Use 3 sub-agents when a PR spans API, data model and UI:
1. API and data: validation, authorization, persistence, migrations.
2. UI: user-visible behavior, accessibility, empty and error states.
3. Tests: coverage of observable behavior and edge cases.
Each sub-agent stays read-only, posts nothing, and returns findings with
path, line, severity, rationale and confidence.REVIEW.md can change review policy and sub-agent use. It can't override Hull's safety constraints, read-only review mode, diff-line rules, duplicate-comment rules or output format.
Review locally with /review
Run the same reviewer on your machine before you open a pull request. In Hull Code or the Hull CLI, type /review:
| Command | Reviews |
|---|---|
/review | Uncommitted changes: staged, unstaged and untracked |
/review staged | Staged changes only |
/review unpushed | Local commits not yet pushed |
/review branch [base] | The current branch against base, or the detected default branch |
/review <commit> | A single commit |
/review <PR URL or number> | A GitHub pull request |
Add free-form guidance after the scope, for example /review branch main focus on error handling. Use quick or deep (or --effort 1 to 10) to change how thorough the review is. The local review only reports findings. It doesn't edit files until you ask it to fix them.
Related
- Auto triage and auto fix for GitHub issues
- Security agent