chaff review

Code review on Workers AI.

Every pull request gets a walkthrough and inline comments from open models on Workers AI.

get started

a human friendly project by tinytown.studio

$ review pull request

src/api/users.tsL41critical
40 export async function getUser(id: string) {
41− return db.get(`SELECT * FROM users WHERE id=${id}`);
41+ return db.get("SELECT * FROM users WHERE id=?", id);
42 }

chaff-review[bot] · critical · security

SQL injection via interpolated id

id comes from the request path. Use a bound parameter instead of string interpolation.

```suggestion return db.get("SELECT * FROM users WHERE id=?", id); ```

@cf/zai-org/glm-5.3-flash · Workers AI

open ↵

how it works

  1. 01

    Pick a model

    Choose a Workers AI text model. Inference runs on the host account.

  2. 02

    Connect GitHub

    Link GitHub and pick the repos to review so comments can land on your pull requests.

  3. 03

    Reviews post

    New PRs get a walkthrough and inline comments. Comment /review any time to run again.

features

inline comments
Findings on the exact diff line, ranked by severity, with one-click GitHub suggestions.
incremental
New commits are reviewed from the last reviewed commit so you are not re-told the same thing.
models
Pick any text-generation model from Workers AI. Override per repository when you want.
instructions
Per-repo reviewer instructions and paths to skip.
credentials
GitHub tokens are AES-GCM encrypted at rest and never logged.
workflows
Reviews run on Cloudflare Workflows and retry if a model call fails.

pricing

self-host

Coming soon

Deploy on your own Cloudflare account. Full features, no subscription.

cloud

$3 / month

Hosted at review.chaff.run. Workers AI included, up to 1000 completed reviews per billing period.

Get started →

faq

What does it cost?+

The hosted Cloud plan is $3/month and includes Workers AI on our account, up to 1000 completed reviews per billing period. Self-host is coming soon. Pick any text-generation model from the Workers AI catalog.

What permissions are needed?+

You connect a model provider and GitHub during setup. The exact grants are shown there when you link each account—no need to memorize scopes ahead of time.

Is my code sent anywhere else?+

Diffs go from GitHub to Workers AI on the host account. Workers AI does not train on your data. GitHub tokens are encrypted at rest and never logged.

How do I trigger a review manually?+

Comment /review on a pull request, or press Review on the Repositories page. Only collaborators can trigger via comment.

Can I block merges on critical findings?+

Yes. Each repo has a commit-status policy: fail on critical, fail on major, or always success. Default blocks merges when the model finds a critical security or correctness issue.

review.chaff.run