Mira Code Review
Run automated pull request reviews on your own infrastructure with team rules that keep feedback focused.
- Source repo
- miracodeai/mira
- Stars
- ★ 391
- Last updated
- 1d ago
- License
- Apache-2.0
- Primary language
- Python
- FA score
- 65/100 · Some gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformOpenAI API · Claude APICodex (Partial support)
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- Engineering teams that want diffs, indexes, and review records on infrastructure they control can deploy Mira and connect their code host.
- Not a fit if
- Teams unwilling to deploy and maintain a service
- Teams that do not want code and indexes stored in their own database
- Source review
- 65/100 · Some gaps
What does this agent do, and when should you use it?
Mira is a self-hosted AI code review service that connects to GitHub through a GitHub App and to GitLab, Forgejo, or Bitbucket Cloud through tokens. It reviews pull requests and merge requests with a model you choose, combining change data with a full-repository index for cross-file context. Mira posts concise review comments and walkthroughs, and includes vulnerability scanning, dependency and blast-radius graphs, organization-wide package search, custom rules, and a learning loop based on merged PRs. Its dashboard surfaces review events, model costs and token use, dependencies, and CVE details. Diffs, indexes, and review history are stored in SQLite or Postgres on infrastructure you control; the README documents Docker deployment and Railway, Fly.io, and Render configurations.
After deployment and webhook setup, Mira receives PR or MR events, fetches the changes, and adds repository context from its code index. It sends the configured model provider the review task, then applies confidence thresholds, deduplication, a self-critique pass, and per-PR comment caps before publishing feedback. Walkthroughs can flag merge-conflict risk or duplicate effort across other open PRs. The index and dependency data support cross-repository package search, dependency graphs, and blast-radius views; OSV.dev vulnerability data is polled hourly. Teams can configure repository rules in .mira.yaml or the dashboard, and Mira can synthesize rules from merged PRs. The dashboard shows review events, actual model costs, and token telemetry.
- Engineering teams that want diffs, indexes, and review records on infrastructure they control can deploy Mira and connect their code host.
- Teams maintaining many repositories can search for every repository using a particular package version.
- Maintainers assessing a dependency upgrade or symbol change can inspect dependency and file relationships to understand blast radius.
- Teams with repository-specific review standards can configure rules in
.mira.yamlor the dashboard. - Security and platform teams can use hourly OSV.dev scans and dashboard alerts to track vulnerable dependencies and fix versions.
- Teams using GitHub, GitLab, Forgejo, or Bitbucket Cloud for PRs or MRs can configure automatic reviews and inline questions.
How do you install or deploy this agent?
The README documents a Docker deployment. Configure code-host credentials, a webhook secret, and credentials for the model provider. This example uses GitHub App settings and an OpenRouter API key:
# mira.yaml
llm:
model: "anthropic/claude-sonnet-4-6"
indexing_model: "anthropic/claude-haiku-4-5"# .env
MIRA_GITHUB_APP_ID=123456
MIRA_GITHUB_PRIVATE_KEY="$(cat private-key.pem)"
MIRA_WEBHOOK_SECRET=your-secret
OPENROUTER_API_KEY=sk-or-...docker run -p 8000:8000 --env-file .env \
-v "$(pwd)/mira.yaml:/app/mira.yaml" \
ghcr.io/miracodeai/mira:latest --config /app/mira.yamlThe README also documents one-click Railway deployment and integration setup for GitLab, Forgejo/Codeberg, and Bitbucket Cloud.
How do you use this agent?
Once the service is running, install Mira on a GitHub repository or configure the appropriate access token and webhook for another supported host. New or updated PRs and MRs trigger reviews. Put a .mira.yaml file in a repository to override settings, for example:
filter:
confidence_threshold: 0.5
max_comments: 10Use the dashboard to inspect review events, costs, dependencies, and vulnerability information. For the Codex CLI model provider, set codex-cli in deployment configuration and mount the auth.json created by codex login; the README requires its sandbox policy to be read-only.
What are this agent's strengths and limitations?
- Diffs, indexes, review history, and vulnerability data can stay in your SQLite or Postgres instance on self-hosted infrastructure.
- Documented model paths include OpenRouter, vLLM, Ollama, Together, Groq, Fireworks, AWS Bedrock direct, and OpenAI-compatible endpoints.
- The product includes organization-wide package search, dependency blast-radius graphs, CVE alerts, and a review-health dashboard alongside PR comments.
- It supports PR and MR review on GitHub, GitLab, Forgejo (including Codeberg), and Bitbucket Cloud.
- Teams can set custom rules and have Mira synthesize rules from merged PRs to shape later reviews.
- You must deploy and maintain the service and configure code-host integrations and webhooks; it is not a ready-made hosted review service.
- Cloud model use requires your own provider credentials and incurs model charges.
- The default model example uses OpenRouter; other endpoints require the corresponding configuration.
- The Codex CLI route requires mounting sensitive Codex login credentials and disables ensemble sampling.
- The README's public benchmark uses 50 PRs and Claude Sonnet 4.6 as judge, so it does not establish results for every repository or model.
How does this agent compare with similar options?
The README compares Mira with CodeRabbit, Greptile, GitHub Copilot, and Cubic-v2 on a public benchmark, describing Mira as the fastest tool measured there. Its table reports Mira F1 of 44, below Cubic-v2's 56, and median review time of about 77 seconds, below the other listed tools. The README says the evaluation used a 50-PR offline Martian Code Review Bench dataset judged by Claude Sonnet 4.6.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Mira Code Review This agent | 65 · Some gaps | Self-hosted serviceFree + model costs | ★ 391 | 1d ago | Python | OpenAI API · Claude API |
| Kodus | 66 · Some gaps | Hosted serviceFreemium | ★ 1.6k | 1d ago | TypeScript | OpenAI API · Claude API |
| Helmor Local Agent Workbench | 52 · Major gaps | Desktop appFree + model costs | ★ 1.3k | 3mo ago | TypeScript | Codex · Claude Code |
| Cyrus | 50 · Major gaps | CLIFreemium | ★ 883 | today | TypeScript | Codex · Claude Code · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
SECURITY.md describes webhook signature checks, short-lived in-process token caching, secret-handling guidance, and read-only isolation for the Codex CLI; the README also discloses that code is sent to the selected LLM provider. Least privilege, data flow, and sensitive-data handling have concrete support. The supplied files do not show a complete permission inventory, per-action confirmation or rollback for external actions such as posting reviews, and publisher identity is unverified.
The README, pyproject.toml, and CI workflows broadly agree on Python versions, opt-in evaluations, and ordinary test scope; CI also includes build and boot checks. However, judge.py has no clear recovery path for empty or malformed model responses, and the supplied evidence for failure reporting is limited, so these criteria do not merit top scores.
The documentation identifies developer teams and GitHub, GitLab, Forgejo, and Bitbucket use cases, and lists model, database, and deployment choices. It also describes boundaries for Codex CLI settings. Trigger behavior, integration differences, and broader limitations are not fully documented in the supplied material.
The README is clearly organized and gives Docker, credential, repository-level configuration, and multi-host setup steps; the Apache-2.0 license file is present. A version is stated, but changelog contents were not supplied. Maintenance responsibility and limitations are addressed only partially, so full marks are not supported.
Actionable PR comments, indexing, vulnerability and dependency information, and cost dashboards suggest practical value, and the README provides benchmark figures. Those performance and benefit claims are primarily project-reported, with limited sample and methodology detail in the supplied files; deployment and LLM costs also depend on the operator's environment.
Some README claims about features and configuration are corroborated by SECURITY.md, pyproject.toml, CI, and judge.py. The benchmark table gives a measurement description, but the supplied material does not include complete raw results or independent replication. Claims are traceable, though the distinction between project assertions and verified facts still warrants care.
- Mira sends diffs or code context to the configured LLM provider; operators should assess that provider's data terms and isolate credentials and the instance.
- Deployment guidance calls for a webhook secret, a changed default administrator password, and restricted ingress; exposing an unhardened dashboard increases risk.
- Benchmark and quality figures are project-reported claims; this static review did not execute the code or independently reproduce results.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
What's Changed * fix(index): reject incomplete repository tree listings by @vikasagarwal101 in https://github.com/miracodeai/mira/pull/365 * fix(security): preserve ecosystem identity in PR dependency scans by @vikasagarwal101 in https://github.com/miracodeai/mira/pull/366 * fix(security): anchor vulnerability comments to their source manifest by @vikasagarwal101 in https://github.com/miracodeai/mira/pull/367 * fix(llm): align provider reasoning and output request shapes by @gavrh in https://github.com/miracodeai/mira/pull/368 …View on GitHub ↗ -
Release notes excerpt
What's Changed * deps(ui): bump vite from 8.2.2 to 8.3.0 in /ui/mira by @dependabot[bot] in https://github.com/miracodeai/mira/pull/304 * deps(ui): bump eslint from 10.9.1 to 10.10.0 in /ui/mira by @dependabot[bot] in https://github.com/miracodeai/mira/pull/305 * deps(ui): bump eslint-plugin-react-refresh from 0.5.5 to 0.5.7 in /ui/mira by @dependabot[bot] in https://github.com/miracodeai/mira/pull/306 * deps(ui): bump lucide-react from 1.38.0 to 1.46.0 in /ui/mira by @dependabot[bot] in https://github.com/miracodeai/mira/pull/308 …View on GitHub ↗ -
Release notes excerpt
What's Changed * feat: add Codex CLI LLM provider by @poonasor in https://github.com/miracodeai/mira/pull/142 * deps(ui): bump shadcn from 4.18.0 to 4.19.0 in /ui/mira by @dependabot[bot] in https://github.com/miracodeai/mira/pull/279 * deps(ui): bump eslint from 10.8.1 to 10.9.1 in /ui/mira by @dependabot[bot] in https://github.com/miracodeai/mira/pull/278 * deps(ui): bump lucide-react from 1.31.0 to 1.34.0 in /ui/mira by @dependabot[bot] in https://github.com/miracodeai/mira/pull/276 …View on GitHub ↗