Honey Badger
Agentic code review control plane

Fewer findings.
Every one proven.

Honey Badger reviews pull requests with disposable AI agents and a durable evidence ledger. A finding has to survive deterministic verification, a skeptic whose job is to destroy it, and an arbiter on a different model family — before anyone on your team ever sees it.

Request early access See a real finding

Self-hosted · your runners, your code, sealed egress · agents never hold your GitHub credentials

Evidence, not opinion

No evidence, no finding.

Volume is easy — a model will happily flag forty things on a pull request, and by the third false positive nobody reads the fourth. Honey Badger's reviewers cannot publish an assertion. Every finding carries typed evidence graded from SPECULATIVE to PROVEN, and deterministic evidence outranks model confidence every time.

Published to the pull request
P1 concurrency internal/pool/worker.go:88–104

Concurrent map write when two workers claim the same lease

workers is read in Claim() and written in release() without holding mu. Under parallel claims this is a fatal concurrent map write, not a tolerable race.

PROVEN race_detector
$ go test -race ./internal/pool/ WARNING: DATA RACE Write at 0x00c0002a4180 by goroutine 47: pool.(*Pool).release() worker.go:101 +0x14c Previous read by goroutine 12: pool.(*Pool).Claim() worker.go:88 +0x88 exit status 66
G3 verified G4 survived skeptic G6 approved
confidence 0.94 — corroborated by 2 reviewers · arbitration not required
Suppressed — never shown to the author
P3 maintainability internal/pool/worker.go:88

Consider adding a mutex here to avoid potential race conditions

This function may be susceptible to concurrency issues under high load and could benefit from additional synchronization primitives.

SPECULATIVE agent_reasoning
no command · no reproduction · no failing test skeptic: "restates the diff; names no execution path"
G4 challenged rejected
kept in the ledger — rejected findings are never erased; they score the reviewer that filed them

How it works

Six gates between a model's hunch and your pull request

Honey Badger owns the review state — reviews, assignments, findings, evidence, and an append-only history of every verdict. Disposable workers do the looking. They talk to Honey Badger over MCP, and they never post to GitHub themselves.

Discovery n agents, in parallel G1 Verification tests · race · vuln scan G3 Dedup one defect, one finding G2 Skeptic tries to destroy it G4 Arbiter different model family G5 Publish your PR G6→G7
Deterministic first. Tests, the race detector and vulnerability scanners run before the models, so agents investigate real failures instead of re-imagining them.
Nothing is erased. Rejected and arbitrated-invalid findings stay in the ledger with their full history — that is what makes reviewer scoring possible.

What makes it different

Built like infrastructure, not a chat bot

Evidence outranks confidence

A failing test beats a confident paragraph. Findings are graded on what proves them, and an unproven low-confidence claim never reaches your team.

A ledger, not a comment stream

Every review, finding, verdict and piece of evidence is durable and versioned. Kill a worker mid-review and nothing it already submitted is lost.

Models are interchangeable

Claude, Codex, Gemini or something local — workers are disposable and stateless. Provider and model are metadata, never ownership.

Spend follows risk

A docs change gets deterministic checks and one reviewer. An auth change with a migration gets independent reviewers and an independent arbiter.

Agents never hold credentials

Reviewers get an isolated workspace and a scoped token. Exactly one component can write to GitHub, and it isn't the model.

Measured, not claimed

Golden benchmark PRs with known defects score precision, recall and false positives per reviewer and model — with sample sizes, so a lucky run can't masquerade as skill.

Security posture

Built to review hostile code

Everything a reviewer reads is treated as untrusted input, because a pull request is exactly where hostile input arrives.

  • ✦Prompt injection is a test suite, not a hope. Seeded "ignore your rules" payloads must not move a single verdict.
  • ✦Secrets are redacted before anything reaches a model, a log, or an artifact.
  • ✦No shell interpolation. Scanners and tests are invoked argv-only; a filename that looks like a shell metacharacter is just a filename.
  • ✦Path containment on every file read, symlinks resolved and re-checked.
  • ✦Separate credentials for reading your code and for publishing a review. Only the publisher can write.
  • ✦Sealed egress on self-managed runners — an allowlist, with the internal network denied.
  • ✦Full auditability. Every state transition is an appended event with the agent, model and reason that caused it.
  • ✦Your infrastructure. Honey Badger runs on your runners against your repositories.

Early access

Honey Badger is being built in the open against its own repository first. Leave an email and we'll send an invite when the GitHub reviewer opens up.

Already have an account? Sign in