# Introduction

# An autonomous reviewer for every pull request

**inline reads every pull request your team opens, reviews it the way a senior engineer would, and posts its findings inline on GitHub — automatically, within minutes, at a few cents per PR.** Around that core it adds a merge gate, a feedback loop that learns your team's taste, and a suite of monitors for repository security, CI/CD health, cloud posture, compliance, and autonomous penetration testing.

It is one product: an admin portal, a GitHub integration, an always-on background reviewer, and an MCP server for coding agents — powered by Claude, with your data kept in your own cloud tenancy.

> **The one-liner:** A code reviewer that never sleeps, never rubber-stamps, and gets quieter and sharper the more your team uses it — plus the security and operational monitors that live in the same PR-shaped workflow.

## What it does

When a pull request is opened or updated, inline runs a cost-optimized pipeline: it filters out generated files, diffs only what changed since it last looked, uses a fast model to triage whether the change is substantive, and — only when it is — runs a deep, frontier-model agentic review that can read files, search code, and traverse a code graph before it comments. A validation gate then drops anything low-confidence, below your severity bar, duplicated, or un-anchorable, and posts the rest as a real GitHub review.

- **Two-tier by design.** A fast model triages every PR cheaply; the deep model only runs on the ~40–60% that warrant it. Blended cost lands at **a few cents per PR**.
- **Quiet on purpose.** A confidence floor, a per-repo severity threshold, cross-commit dedup, and a hard comment cap mean inline comments only when it's confident it's right. "Zero comments" is a successful review.
- **It learns.** When your team dismisses, rejects, resolves, or reacts to findings, inline harvests those signals on PR close, proposes suppression rules for patterns you clearly don't want, and distills durable per-repo knowledge into a memory it re-reads on every review.

## More than review

The same PR-shaped engine powers a family of monitors, each an optional per-repo or per-org module:

| Module | What it does |
| --- | --- |
| **Merge gate** | A required `inline / review` check that blocks merges while open findings remain — off, report-only, or block by severity. |
| **Auto-fix** | Opens a stacked fix-PR that patches a finding and verifies the patch in a sandbox before you see it. |
| **Sentinel** | Continuously scans repositories for security issues and raises confirmed alerts. |
| **Pentest** | Autonomous red-team agents attack a repo's own code in an isolated sandbox and prove exploitability with non-destructive PoCs. |
| **Actions** | Watches CI/CD, triages failures with AI, flags flaky tests, and surfaces GitHub-native security alerts. |
| **Cloud** | Monitors your Azure posture, health, and spend with zero stored secrets. |
| **Compliance** | Tracks BAA and vendor-agreement coverage across your dependencies and services. |

## Who it's for

- **The engineer** who wants a fast, substantive review on every PR without waiting for a human, and inline comments precise enough to act on directly.
- **The team lead** who wants a merge gate they can trust, a dashboard of findings and cost, and a reviewer that gets quieter as it learns the team's conventions.
- **The security and platform owner** who wants repo scanning, autonomous pentesting, CI/CD health, and cloud posture in one place — all speaking the same finding, severity, and dedup vocabulary.

## Where to next

- **[Quickstart →](./quickstart.html)** — connect a repo and get your first review.
- **[Core concepts →](./concepts.html)** — repos, reviews, findings, jobs, connections.
- **[The review pipeline →](./review-pipeline.html)** — the full path from webhook to posted review.
- **[Architecture →](./architecture.html)** — how the portal, background reviewer, and Claude fit together.