Help / Orange Codens
AI code review & security audit. An LLM automatically reviews GitHub PR diffs, then hands code-quality and security findings off to Purple / Red to produce an actual fix PR.
Orange Codens can be started just by installing the GitHub App. Sign up for a Codens account, install the "Orange Codens" GitHub App on the target repository, and automatic reviews start running the next time a PR is opened (see Step 1 below).
Orange Codens is an automated code review and security audit agent for GitHub Pull Requests. It creates a review run on every PR open / synchronize event and runs two review tracks in parallel.
Results are posted to the PR as one summary comment plus a small number of high-severity inline comments (up to 5). Unlike bots that only "flag" issues, Orange can automatically hand findings off to Purple / Red to produce an actual fix PR (whether handoff fires depends on the handoff policy — see below).
Orange is not currently part of codens-mcp's action-dispatch tools (the 38-tool catalog). Project creation and repository connection happen through the dashboard (app.orange.codens.ai) and GitHub.
To re-run a review without pushing a new commit, you can also trigger it manually via the REST API.
POST /api/v1/review-runs
{
"pr_url": "https://github.com/Corevice/your-repo/pull/123",
"organization_id": "..."
}high or above and confidence ≥ 0.7 get inline comments, capped at 5 per PR (a deliberate design to keep noise low).blocker / critical / high / medium / low / info.The Security Module runs three sub-modules in parallel.
sec.sast.*): Claude reviews the diff for OWASP Top 10 / CWE Top 25 issues, crypto misuse, and authorization gaps. This is the only sub-module in Security Review that's credit-billed.sec.secret.*): detects leaked secrets such as API keys.sec.dep.*): detects vulnerable dependencies in package.json / requirements.txt / Cargo.toml / go.sum, etc.Dedup within a single review run uses a fingerprint of rule_id + file_path + start_line. If the same finding is still unresolved across commits, it updates the existing finding instead of creating a new one. Any rule_id listed in rule_set.disabled_rules is fully suppressed.
Each finding's category determines its default handoff target.
security → Red (routed into Red's auto-fix path).code_quality / performance / maintainability → Purple (filed as a task spec).HandoffPolicy.mode has four levels, and the default depends on plan tier.
off: PR comments only, nothing auto-filed — the default for Free / Starter.manual_only: filed only when someone clicks the "request fix" button in the UI.threshold_auto: auto-files when severity ≥ auto_threshold_severity and category is in auto_categories — the default for Pro and above (severity ≥ high, category = security, target = Red).full_auto: auto-files every finding (not recommended as a starting point).Code-quality findings are opt-in on every tier (by design, so credit isn't auto-consumed without consent).
Handoff is merge-gated. Orange reviews PRs before they're merged, but the fix PRs Purple / Red produce are based on main / develop. If handoff fired while the original PR were still unmerged, the code it targets wouldn't exist on main yet. So auto-handoff only fires once the PR is merged. If someone clicks "request fix" under manual_only before merge, the request is queued; if the PR is closed without merging, the queued request is discarded.
To prevent infinite loops, PRs authored by a Codens bot (the Purple / Red GitHub App user) are still reviewed but excluded from auto-handoff (manual handoff is still possible). Review runs triggered as a Purple verify pass always have auto-handoff disabled.
See the Pricing page for current plan details.
rule_id + file_path + start_line fingerprint. Editing a line so its start_line shifts is a known limitation that can make it register as a "new" finding.