Skip to main content
Glama

Leveret

A leveret is a young hare β€” small, fast, and born with its eyes open.

Leveret is a self-hosted, hybrid engine for private code reviews: the successor to hosted AI review bots for teams whose code stays home. It combines a deterministic static-analysis layer, a code graph built into every checkout, a graded noise filter with durable memory, and adversarial agent contracts β€” driven by the AI you bring (BYOAI: your provider and model β€” Anthropic or OpenAI by API key or subscription, or a local OpenAI-compatible endpoint). The engine layer itself never calls an LLM, and nothing leaves your infrastructure.

How a review works

flowchart TD
    D[/"πŸ“„ PR diff"/]:::gh
    S["πŸ” scan<br>engines + delta vs base<br>+ profile + memory"]:::core
    R["πŸ‡ review agent<br>five lenses,<br>cross-file blast radius"]:::agent
    V["βš–οΈ verification agent<br>refute or evidence,<br>three grades"]:::agent
    T[/"πŸ“‹ tiered findings<br>+ walkthrough report"/]:::gh
    D --> S
    D --> R -- concerns --> V -- survivors only --> T
    S -- bounded post-walk leads --> V
    classDef gh fill:#6ea8fe,stroke:#3d6fd9,color:#111
    classDef tun fill:#ffc86b,stroke:#cc8f22,color:#111
    classDef core fill:#7ed6a2,stroke:#3d9e6a,color:#111
    classDef agent fill:#c9a0f5,stroke:#9059d1,color:#111
    classDef store fill:#9fd8e3,stroke:#4d9aab,color:#111
  1. Deterministic first pass. Engines run only against what the change touches: semgrep (registry security + per-language rulesets, offline-capable), gitleaks (secrets over the commit range), shellcheck, ruff, actionlint, zizmor (workflow security), osv-scanner (lockfile CVEs), typos, jscpd (duplication, corpus-gated), custom semgrep/ast-grep rule packs, and any SARIF-emitting command via profile custom: entries (recipes: psalm taint, hadolint, trivy, …). Delta scanning is on by default with a base ref: findings already present at the base tree are dropped as pre-existing β€” counted, never silent β€” with multiset identity (a copy of a known-bad line still surfaces), rename tracking, and surfaced base-pass failures. A code graph is generated into the checkout at the exact reviewed commit, so agents query structure instead of grepping for it.

  2. Accounted filter. After discovery completes, surviving deterministic leads enter verification as one bounded, routed stream. Every supplied concern and lead ends as actionable, priced-noise, false-positive, or dropped; profile and memory suppression happens before routing. Nothing is silent: suppression, exact-mechanism deduplication, overflow IDs/bytes, verifier rationale, and publication state remain separate structured accounting.

  3. Memory that learns from humans. .leveret/memory.jsonl, versioned in the reviewed repo: fingerprint verdicts (optionally anchored to a source line β€” the memory dies when the line changes) plus conventions β€” free-text rulings taught by maintainers via learn, injected into the agent prompts as repo case law, able both to suppress noise and to raise findings that violate them.

  4. Adversarial contracts. The discovery walk runs five lenses (correctness and hostile inputs, contract conformance, test honesty, blast radius, and explicitly deferred leads triage) without deterministic lead material, and traces changed symbols to call sites outside the diff. After the walk, the verification agent tries to refute every concern and routed lead; claims it can neither refute nor ground in executed evidence are dropped, not published.

  5. Reporting. Findings publish in importance tiers (critical / major / minor / nit, distinct from engine severity), out-of-diff findings appear with their stated correlation to the change, pre-existing defects adjacent to edited lines return as reminders, and every review carries a walkthrough: per-lens outcomes (clean included), per-file verdicts, post-walk lead/overflow metrics, the engine table, and a run-configuration line naming the harness, model, and thinking level that produced the review.

Related MCP server: reporelay

Ways to run it

GitHub App (autonomous). A self-hosted App layer receives PR webhooks, checks out the head, builds the code graph, runs the scan, drives the standardized runner, and posts the review β€” inline comments plus walkthrough. The App holds only a GitHub App key and webhook secret; model credentials live exclusively in the runner. Human replies on findings feed learn. Getting started + diagram: docs/app.md.

Standardized runner. leveret-runner-pi drives the review/verify contracts through a pinned Pi runtime. Leveret supplies the system prompt, phase-specific terminal submission schema, and read-only review tools; Pi supplies the provider/model runtime and trusted host resources. Models submit phase results through leveret_submit_phase; assistant text is not parsed as JSON. Host-installed Pi/OMP extensions and hooks, Pi/Claude/ Codex skills, prompt templates, and context are loaded. The reviewed checkout is never Pi's working directory, so its settings, hooks, skills, prompts, MCP configuration, and context cannot extend the session. You choose provider, model, and effort (--model / --effort / --provider, or the matching LEVERET_RUNNER_* env vars; defaults openai/gpt-5.6-sol at high). Every walkthrough records the effective client, model, prompt hash, capabilities, and tool metrics. A custom LEVERET_RUNNER remains the bring-your-own-harness escape hatch.

Autonomous reviews retain a private, owner-controlled audit trace by default: Pi's native per-attempt sessions, normalized harness events, App/scanner/subprocess activity, exact failed output, checksums, and a verified zstd-or-gzip archive under LEVERET_DATA. Raw content never enters default stdout. See Private audit traces for policy, retention, export, security, and inspection controls.

Interactive (MCP). Register the server in any MCP-capable client and drive reviews yourself β€” the served review/verify prompts arrive with your repo's accumulated rulings substituted in (getting started + diagram: docs/interactive.md):

npm install && npm run build
claude mcp add leveret -- node /path/to/leveret/dist/server.js

MCP tools: scan, ast_search (structural search via ast-grep), context (per-function complexity, churn, recency β€” prioritization signal, not findings), remember (persist a graded verdict), memory (inspect the store), learn (persist a human-taught convention); MCP prompts: review, verify.

The reviewer toolbelt

The engines and structural indexes are capabilities of the reviewer, not the reviewed repository: install them beside Leveret. Full belt: codegraph, graphify, semgrep, gitleaks, shellcheck, ruff, actionlint, zizmor, osv-scanner, typos, jscpd, ast-grep, lizard, and a pre-staged Serena LSP bundle for semantic navigation. From a clone, build one with node dist/runner/prefetch-serena.js --bundle /opt/leveret/serena-bundle and run with LEVERET_SERENA_BUNDLE set to that path (the installed package also exposes leveret-prefetch-serena). Runtime downloads are refused.

Before autonomous model work, Leveret builds and validates exact-checkout CodeGraph and code-only Graphify indexes, then warms one Serena symbol query per detected packaged language. Missing indexes fail closed by default; set LEVERET_REQUIRE_INDEXES=0 only for an explicitly degraded run.

npm test        # integration suite; exercises the real tools

Design and status

DESIGN.md holds the architecture and decisions: the three-grade filter, memory and learnings, runner standardization, the GitHub App split, and the validation benchmark that gates replacing a hosted review bot with Leveret.

License

AGPL-3.0-or-later.

Available Tools

5 tools
contextA

Prioritization context for reviewing a change β€” NOT findings: per-function cyclomatic complexity (lizard, multi-language), 12-month git churn, and last-touched date per file. High complexity in a high-churn file deserves the deepest review; use this to decide where to dig before reading code.

ParametersJSON Schema
NameRequiredDescriptionDefault
repoYesabsolute path to the repo
filesYesrepo-relative files to profile

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description must disclose behavior. It clearly explains the data it returns (cyclomatic complexity, git churn, last-touched date) and its multi-language coverage via lizard. It doesn't state side effects, but the read-only nature is strongly implied by the context (profiling for review).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with the core value proposition and ending with actionable guidance. No redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description sufficiently explains the tool's purpose and output for an agent to use it appropriately. It covers what metrics are returned and how to interpret them (high complexity + high churn β†’ deep review). No formal output schema exists, but the described behavior is complete enough for decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Both parameters (repo and files) are fully described in the schema (100% coverage). The description adds no additional parameter-specific guidance beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states this tool provides prioritization context (complexity, churn, last-touched) for reviewing a change, explicitly distinguishing it from findings. It is specific about what it computes and names the tool's purpose precisely.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit guidance: 'use this to decide where to dig before reading code' and excludes findings ('NOT findings'). It doesn't name sibling tools as alternatives, but the context for when to use is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

memoryA

List the repo's review-memory entries (fingerprint, grade, reason, created, lastApplied). Use lastApplied to spot dead pricing worth deleting, and repeated same-rule entries under one subtree as candidates for promotion to a glob memory or a .leveret.yml profile rule.

ParametersJSON Schema
NameRequiredDescriptionDefault
repoYesabsolute path to the reviewed repo

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the burden of disclosing behavior. It explains the output fields and gives interpretive guidance, but does not mention whether the tool is read-only, if it triggers side effects, or if it requires authentication. For a listing tool, this is adequate but not exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loads the core purpose, and each clause adds value: the first lists fields, the second provides actionable guidance. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema) and no annotations, the description is complete enough. It explains what the output contains and how to interpret it for maintenance actions. It could mention if it only returns a summary or full details, but the field list implies enough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema fully describes the single parameter 'repo' with a description, so schema coverage is 100%. The description does not add additional semantic meaning beyond what the schema provides, and since parameter count is only 1, the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists repo review-memory entries and specifies the exact fields (fingerprint, grade, reason, created, lastApplied). It distinctly differentiates from siblings like 'remember' (likely adds entries) and 'context' (likely broader context retrieval) by focusing on listing memory entries with a specific purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides usage guidance by describing when to use the lastApplied field to identify dead pricing and repeated entries for promotion, but does not explicitly exclude alternatives or mention when not to use it. Sibling tools are not directly referenced, but the workflow context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

rememberA

Persist a graded verdict to the repo's review memory (.leveret/memory.jsonl) so the finding class never re-surfaces ungraded. Grades: priced-noise (true but the repo prices fixing it at zero) or false-positive (the claim is wrong). Only drops are stored β€” actionable findings are reported, not remembered. Give anchorFile + anchorLine to pin an instance verdict to its source line: the memory dies when that line changes. Omit the anchor for a class-wide verdict (fp may use a glob).

ParametersJSON Schema
NameRequiredDescriptionDefault
fpYesfingerprint: engine/RULE/path-or-glob, e.g. shellcheck/SC2016/tests/**
repoYesabsolute path to the reviewed repo
gradeYes
authorNowho graded (agent id or human)
reasonYeswhy this class is priced or false β€” mandatory, auditable
anchorFileNorepo-relative file for an instance anchor
anchorLineNo1-based line the verdict anchors to

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description takes on the burden of behavioral disclosure. It explains that only drops are stored, that anchoring ties the verdict to a specific line, and that the memory entry dies when that line changes. It also clarifies grade semantics, adding value beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action and then explains grades and anchoring. It is concise, with each sentence contributing meaningful guidanceβ€”no fluff. It could be slightly tighter but is well-organized and readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a write operation with 7 parameters and no output schema, the description covers the essential behavioral context: what is stored, when to use anchors, and the side effect of anchor invalidation. It does not describe the return value, which is acceptable for a write operation without an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is high (86%), so the baseline is 3. The description adds semantic detail to the anchor parameters (pin to source line, memory dies on change) and clarifies grade meanings, going beyond the schema's lean field descriptions. This enriches the agent's understanding of parameter usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: persisting graded verdicts to a review memory file. It specifies the verb (persist), the resource (.leveret/memory.jsonl), and the effect (prevents re-surfacing ungraded findings). It also distinguishes from siblings by noting only drops are stored and actionable findings are reported, not remembered.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides usage context such as when to use anchors (instance verdict) vs omit (class-wide verdict) and explains that only drops are stored, implying when not to use it for actionable findings. It does not explicitly name alternative tools (like 'memory'), but the context makes the appropriate scenario clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scanA

Run the applicable static-analysis engines (semgrep security rules, gitleaks secrets, shellcheck, ruff, actionlint) over a change set and return normalized findings. Findings are review LEADS, not verdicts: validate each against current code. Give either base (git ref; scans base...HEAD changed files, secrets over base..HEAD commits) or an explicit files list (repo-relative). A .leveret.yml profile in the repo (or profilePath) scopes engines by path and suppresses priced rules; suppressions come back tallied with their reasons, never silently.

ParametersJSON Schema
NameRequiredDescriptionDefault
baseNogit base ref, e.g. origin/devel
repoYesabsolute path to the git repo / worktree to scan
filesNoexplicit repo-relative files
enginesNorestrict to these engine ids (default: all applicable)
profilePathNoprofile file overriding <repo>/.leveret.yml

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that findings are review leads, not verdicts, and must be validated against current code. It also explains that suppressions are tallied with reasons and never silent, which is valuable behavioral context. However, it does not mention side effects, permissions, or performance characteristics, but the core behavioral traits are well covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded: it starts with the core action, lists engines, explains the two modes, and ends with profile behavior. Every sentence adds value, and it is concise without being terse. The length is appropriate for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (multiple engines, two modes, profile handling) and the absence of an output schema, the description does a good job covering the essential context. It explains the change-set scope, the profile mechanism, and the nature of findings. It could mention what the normalized findings look like or how to interpret them, but the description already states they are review leads, which is sufficient for an agent to proceed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% coverage with descriptions for all five parameters. The description adds context about the base mode (scans base...HEAD changed files, secrets over base..HEAD commits) and the profilePath override, which enriches the schema. However, since the schema is already thorough, the description's added value is moderate, so a baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool runs multiple static-analysis engines over a change set and returns normalized findings. It specifies the engines (semgrep, gitleaks, shellcheck, ruff, actionlint) and the two modes (base ref or explicit files), distinguishing it from sibling tools like ast_search or context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly explains when to use the tool (scanning a change set) and provides two usage modes with clear instructions: give either a base git ref or an explicit files list. It also mentions the optional profilePath and how profiles scope engines, giving the agent actionable guidance on invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 5 tool updatesv0.1.0
    • First observedast_search
    • First observedcontext
    • First observedmemory
    • First observedremember
    • First observedscan

TDQS

A4.3/5.0
Disambiguation5/5

Each tool serves a distinct function: context for prioritization, scan for finding issues, ast_search for syntactic search, remember for storing verdicts, and memory for listing stored verdicts. There is no overlap or ambiguity in their purposes.

Naming Consistency4/5

Tool names are concise and lowercase, but ast_search uses an underscore while others are single words. This is a minor deviation, but the naming style is otherwise consistent and intuitive.

Tool Count5/5

With 5 tools, the server is well-scoped for a code review assistant. Each tool covers a necessary step in the workflow without redundancy, and the count is neither too sparse nor excessive.

Completeness4/5

The tools cover the core review lifecycle: contextual prioritization, scanning, code search, verdict memory, and memory inspection. Minor gaps exist (e.g., no explicit update/delete for memory entries), but the surface is otherwise complete and functional.

Maintenance

ActivityMaintained
ResponsivenessResponsive

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/leveret-dev/leveret'

If you have feedback or need assistance with the MCP directory API, please join our Discord server