Connect GitHub and run your first AntiCode review

Choose a repository you can evaluate

Start with a repository whose behavior you understand and whose code you are authorized to process with the chosen service. A focused pull request with a clear purpose makes the first review easier to evaluate. You can compare the tool's findings against the change instead of trying to learn an unfamiliar codebase at the same time.

AntiCode's current hosted workflow uses GitHub sign-in. Repository connection is a separate step: signing in establishes your account, while repository authorization allows the service to retrieve the code and pull-request information needed for review. Customers do not need to create or paste a personal OpenAI API key.

Read the authorization request

In Setup, choose repositories and complete the GitHub authorization flow when requested. AntiCode lists repositories available to your GitHub account, then connects the repositories you select. If an organization repository is missing, check the account you used and your organization's access requirements before trying a different token or account.

The current OAuth connection requests GitHub's broad repo scope for private repository access. The service uses that authorization for read operations, but the permission itself is broader than a read-only scope. GitHub's scope documentation explains that distinction. Review the request in the context of your organization's policy before authorizing it.

Sync before starting a review

Connect one repository first, then sync it. Sync brings recently updated pull requests into the workspace; it is not a full-history import or a continuous event subscription. If the repository has no pull requests, an empty list is the expected result. Create a meaningful change in your usual development workflow rather than relying on sample data.

Open Reviews and identify the repository, pull-request number, and title you intend to inspect. If the author has recently pushed commits or changed the target branch, sync again before starting. A review is useful only when its results can be connected to the current version of the proposed change.

• Confirm that you are signed into the intended GitHub account.
• Connect the intended repository and complete a sync.
• Check the pull-request number and the purpose of its diff.
• Choose the review method deliberately.

Understand the two review actions

Run checks applies a limited set of deterministic patterns to added diff lines. Managed AI review sends the selected diff through AntiCode's hosted service to OpenAI for analysis. These are different methods with different limitations. Neither action provides a complete security assessment or a guarantee that the pull request is safe to merge.

Reviews are started manually in the current product. Do not wait for a GitHub bot comment or an automatic merge check after pressing the button. Results are saved in the AntiCode workspace. Read each finding, verify its evidence, and use your normal pull-request discussion to coordinate any changes with the author.

Verify the result, then build a routine

After a successful review, open the finding details and reload the page to confirm that you are looking at saved results. Use personal triage to distinguish findings you accept, dismiss, or still need to investigate. An accepted status records your decision; it does not change code or approve a merge.

If a review fails, read the error before retrying. A stale revision requires a sync; a large diff may require a smaller change. Previous successful results can remain available after a failed attempt, so check their revision status rather than assuming they are fresh. Make sync, review, verification, and human approval four explicit steps in your team's routine.

Further reading

• GitHub: Scopes for OAuth apps ↗

Put it into practice

Start with a small change you are authorized to review. Follow the AntiCode setup guide, inspect each finding, and keep your tests and human approval in the loop.