chaff review

Code review on Workers AI.

Every pull request gets a walkthrough and inline comments from open models. Inference bills to your Cloudflare account, not ours.

get started

a human friendly project by tinytown.studio

$ review pull request

src/api/users.tsL41critical
40 export async function getUser(id: string) {
41− return db.get(`SELECT * FROM users WHERE id=${id}`);
41+ return db.get("SELECT * FROM users WHERE id=?", id);
42 }

chaff-review[bot] · critical · security

SQL injection via interpolated id

id comes from the request path. Use a bound parameter instead of string interpolation.

```suggestion return db.get("SELECT * FROM users WHERE id=?", id); ```

@cf/zai-org/glm-5.3-flash · Workers AI

open ↵

how it works

  1. 01

    Connect Cloudflare

    Open a pre-filled API token with Workers AI permissions, paste it back, and your account is detected automatically.

  2. 02

    Paste a GitHub token

    Create a fine-grained personal access token with the pre-filled permissions, pick the repos to review, and paste it back. Reviews post as that account.

  3. 03

    Get reviews

    Webhooks fire on new PRs and pushes. Comments land as the token owner. Comment /review any time.

features

inline comments
Findings on the exact diff line, ranked by severity, with one-click GitHub suggestions.
incremental
New commits are reviewed from the last reviewed commit so you are not re-told the same thing.
models
GPT-OSS 120B on Workers Free. Per repo, switch to GLM-5.3 Flash or Kimi K2.7 Code.
AI Gateway
Requests log in your AI Gateway with token counts, cost, and caching, same token.
instructions
Per-repo reviewer instructions and paths to skip.
credentials
Cloudflare and GitHub tokens are AES-GCM encrypted at rest and never logged.
workflows
Reviews run on Cloudflare Workflows and retry if a model call fails.

faq

What does it cost?+

Chaff Review is free, with no paid tier. You supply a Workers AI token; inference bills at Workers AI rates on your account. GPT-OSS 120B fits the free daily quota; GLM-5.3 Flash and Kimi K2 need Workers Paid ($5/month).

What permissions are needed?+

Cloudflare: Workers AI Read and Edit, plus Account Settings Read. GitHub fine-grained PAT: Pull requests and Commit statuses (write), Contents (read), Webhooks (write), Metadata (read). Classic tokens need repo and admin:repo_hook. You need admin access on a repo for the webhook to install.

Is my code sent anywhere else?+

Diffs go from GitHub to Workers AI inside your Cloudflare account. Workers AI does not train on your data. Tokens are encrypted at rest and never logged.

How do I trigger a review manually?+

Comment /review on a pull request, or press Review on the Repositories page. Only collaborators can trigger via comment.

Can I block merges on critical findings?+

Yes. Each repo has a commit-status policy: fail on critical, fail on major, or always success. Default blocks merges when the model finds a critical security or correctness issue.

review.chaff.run