ShippingApache-2.0Rust · Tauri

rev-local

A code reviewer that reads your whole repository and uploads none of it.

Get the source

git clone https://github.com/dmoore-dwmmholdings/rev-local

Command line

cargo build --release --workspace

Desktop app

cargo tauri build --features desktop

The desktop app needs tauri-cli and is built from crates/revlocal-tauri. On Linux you’ll also need the WebKitGTK development packages. The public source is updated in batches, so it can be behind the newest features described here.

Source on GitHub

One review

From a commit to a report, and what happens next time.

rev-local finds the commit, reviews a copy of it with the coding CLI you already use, and files what it finds. Each finding gets a fingerprint built from the repository, file, category and title. Line numbers and severity are left out, so the same defect found again updates what’s already there.

acme · 7c41e2a · src/auth/session.rs

@@ -36,6 +36,7 @@ impl SessionStore {     pub fn validate(&self, token: &str) -> Result<UserId, AuthError> {         let row = self.lookup(token)?;-        if row.expires_at <= now() {+        // Allow for clock drift between app servers.+        if row.expires_at + GRACE_SECS <= now() {             return Err(AuthError::Expired);         }         Ok(row.user_id)

The run

queued
Polling found 7c41e2a on main.
preparing
Checked the commit out into a scratch worktree. ~/code/acme isn’t touched.
reviewing
Depth deep, because src/auth/ counts as security-relevant (25 minute limit). Engine claude, with GITHUB_TOKEN, NPM_TOKEN and DATABASE_PASSWORD held back from its environment.
synthesizing
1 finding, normalized and fingerprinted.
publishing
Local report written. Local reports never wait for approval.
done
reviewed acme 7c41e2a — request_changes (1 finding(s), 1 action(s), claude)

~/.local/share/rev-local/reports/acme/25f3c9c09015e4b6.md

# Session check accepts tokens up to 300 seconds after expiry

`validate` now adds `GRACE_SECS` to the expiry before comparing, so an expired token keeps working for another five minutes. Clock drift between servers is usually a few seconds.

## Failure scenario

A token copied from a shared machine at 12:00, which expires at 12:30, still signs in at 12:34.

## Suggested fix

Keep the window to a few seconds, or apply it only when refreshing a session.

## Where

- Location: `src/auth/session.rs:39`
- Change: 7c41e2a
- Review page: not published
- Severity: high · Category: security · Confidence: 0.82

---
rev-local-fingerprint: 25f3c9c09015e4b6

The next commit. Pick what happened, then see where the finding goes.

Field	This run	Fingerprint
repo	acme	hashed
file	src/auth/session.rs	hashed
category	security	hashed
title	Session check accepts tokens up to 300 seconds after expiryhashed as “session check accepts tokens up to ### seconds after expiry”	hashed
line	53	not hashed
severity	high	not hashed

Same fingerprint, 25f3c9c09015e4b6. It’s the same defect, so the existing report is rewritten. A tracker issue would get a “rev-local saw this again” comment.

reports/acme/

25f3c9c09015e4b6.md rewritten

An illustration. The run states, report format, path and fingerprint formula are rev-local’s own, and the fingerprints shown were computed with that formula. The repository, the diff and the finding are invented, and the line under each state is written for this page.

Where findings go

A file on your disk, or your tracker.

A repository only files to the targets it names. Anything that goes to somebody else’s system is high risk, so under the default mode it waits for you.

report
A markdown file
One file per finding under reports/<repo>/, named by its fingerprint. Needs no setup, and it’s on by default.
andare
An Andare issue
Through Andare’s MCP server, over stdio or HTTP. Held for your approval unless the repository is on auto.
github
A GitHub issue
Uses the gh login you already have. Also held for approval unless you choose auto.

Getting started

Point it at your code.

revlocal review defaults to a mock engine that spends nothing and makes up its findings, and it says so every time. Pass --engine claude or --engine codex for a real review. The desktop app and revlocal watch use each repository’s own engine.

# check prerequisites
revlocal doctor

# register every checkout under ~/code
revlocal repo scan ~/code --dry-run --database ~/rl.db
revlocal repo scan ~/code --database ~/rl.db

# one pass: discover, review, deliver
revlocal watch --once --database ~/rl.db

Capabilities

What it does.

Engineers whose policy forbids sending source code to a third party, and engineers who never wanted to.

01
Finds new commits in git and Subversion checkouts, and reviews a copy of the code
02
Picks a review depth, trims large diffs, and dedupes findings across runs
03
Keeps credentials out of the review process with an environment denylist
04
SQLite store with an audit log and spending limits, plus an MCP client over stdio and HTTP

Specification

What it’s built with, and when.

Pulled from the repository each time this site is built.

State: Shipping
Discipline: Developer tooling
Shape: Developer tooling
Started: Aug 2026
Last change: Sep 2026
Commits: 76

Rust
Tauri
SQLite
MCP
Claude Code
Codex

Rust 93%
TypeScript 5%

Related work

Built alongside rev-local

Agent Lab Docker sandboxes so coding agents can run without restrictions, safely Andare Code A desktop app that hands tracker issues to a coding agent framewatch Screen capture that only saves the frames that matter

Build rev-local

It’s open source under the Apache 2.0 license. There are no prebuilt downloads yet, so you build it from source with Rust.

Get the source git clone https://github.com/dmoore-dwmmholdings/rev-local

Command line cargo build --release --workspace

Desktop app cargo tauri build --features desktop

Source on GitHub Read the source

Questions, or something it doesn’t do yet? Email dmoore@dwmmholdings.com