More than a dozen static analyzers, a full read of every changed file, a blast-radius pass, two frontier models, and live probes against the preview. Six passes before a single comment is posted.
We tried CodeRabbit, Greptile and more code review tools than I can count. Qodex outperforms them all by a mile. Honestly, the only AI reviewer that runs the tests instead of guessing.
Aravind MurthyCTO, Factors.aiDeterministic work is done deterministically. The models are spent on judgment, and nothing they claim is published until a running system agrees.
main from fix/tenant-billing-isolation+318-9414 filescheckout-api/billing.tsline 84const billing = await db.billing.find(orgId)const billing = await db.billing.find({ orgId, callerOrgId })Tenant isolation is broken here. An Org A admin can read another org’s billing. Scope the query to the caller’s org.
GET /v1/orgs/{orgB}/billing returns 200 for an Org A admin (expected 403). Cross-tenant billing is exposed.
Scenario “Admin cannot access tenant billing across orgs” failed: GET /v1/orgs/{orgB}/billing returned 200 instead of 403.
Qodex / code reviewreviewing...Qodex / securityscanning...Qodex / testsrunning...More than a dozen deterministic linters and scanners run first, per language.
Every changed file is read in full. No size gate, no truncation.
A code-graph pass finds what else the change reaches: callers, callees, routes.
An agentic primary and a second frontier model from a different lab, merged by fingerprint. Each finding is tagged with who found it.
Findings are probed against the preview deployment before they are trusted. Read-only, SSRF-guarded.
A Check Run posts with the review and blocks the merge if you told it to, per repo, in .qodex.yaml.
Reviews are incremental: a push scores only the commits added since the last one. Repo conventions are mined from your own merged pull request history, so the second month reads more like your team than the first.
Three findings from one pull request, each with a severity, the exact line, and what the review did about it.
The tenant id is read from the request body instead of the session, so any authenticated user can fetch another organization’s invoices by editing one field.
- const orgId = req.body.orgId + const orgId = req.session.orgId
The new filter runs on every dashboard load and the column has no index. Blast radius: eleven call sites across billing and reporting.
The retry path returns a promise nobody awaits or catches, so a failed retry is dropped without a log line.
Example review. Real findings from public repositories replace these.
Findings are probed live against the pull request’s own preview before they reach you.
Inline, committable suggestions, on the line that needs them.
Block on critical, warn on the rest, or observe only.
The review is scoped to the directory that changed.
Dismiss a finding once and it stops coming back.
Talk back to it in the thread:@qodex review@qodex fix@qodex ignore
Cursor writes it. Codex writes it. A person writes it. Qodex reviews it.
GitHub
SlackThe same agent that reviews the pull request can run your API, UI and security scenarios against the preview and attach the evidence: the failing request, the response, or a screenshot. Replays are generated code with no model call, so the suite grows without the bill growing.
See API testingGET /v1/orgs/{orgB}/billing as org_A_admin expected 403 · got 200
Screenshot attached · scenario: Admin can't read another org's billing
Example finding. Real ones link to the pull request.
The GitHub app asks for read access to pull requests, not write access to your source.
Data is encrypted in transit and at rest on US servers, and isolated per project.
Your code, findings and review history are never used to train models.
Use your own model key if you prefer. Every token is logged.
“We now detect issues in staging instead of finding them after deployment.”
Anshuk K.
AI & Data Engineer
Verified G2 review“The no-code interface helps our whole integration team write and manage test cases, and drastically reduces the time spent on QA.”
Rishabh V.
AI Engineer
Verified G2 review“It lets our small team stay confident in releases without needing a dedicated QA resource.”
Sameer C.
Software Engineer
Verified G2 reviewAn automated pass over a pull request that reads the change and posts feedback before a person reviews it. Most tools do this by reading the diff. Qodex runs six passes: static analyzers, a full read of every changed file, a blast-radius pass over the code graph, two frontier models, live probes against the preview, and a Check Run that can gate the merge.
They read the diff and tell you what looks wrong. Qodex probes what the models claim against the pull request’s own preview deployment before it posts, tags each finding with which model found it, and can hold the merge until it is fixed. If you want, the same agent runs your API, UI and security scenarios against the preview and attaches the evidence.
More than a dozen deterministic linters and scanners, chosen per language. Named ones include semgrep, gitleaks and osv-scanner. They run first, before any model reads the change, so the deterministic work is done deterministically.
Anything the diff alone cannot show. A tenant id read from the request body instead of the session reads as a clean diff; a live probe against the preview returns another organization’s invoices and the finding is verified. A new filter on a column with no index looks harmless in one file; the blast-radius pass counts the eleven call sites it slows down.
The GitHub app, which takes minutes. Nothing goes into your application and no runner goes into your CI. Merge gating is configured per repo in .qodex.yaml. The next pull request gets reviewed.
Yes, if you tell it to. A Check Run posts with every review; in .qodex.yaml you choose to block on critical, warn on the rest, or observe only. Fixes arrive as committable suggestions on the exact line, so a blocked pull request clears quickly.
The app has read access to pull requests, not write access to your source. Data is encrypted in transit and at rest on US servers, isolated per project, and never used to train models. Live probes are read-only and SSRF-guarded. If you bring your own model key, every token is logged.
Something else? Get in touch
Install the GitHub app, point Qodex at your staging URL, and the next pull request gets tested before it merges.
This query may leak data across tenants. Consider scoping billing lookups by organisation.