AI Code Review

Once you’ve connected an AI model and enabled review for a repo, TigerGate posts review-style feedback on every pull request:

• Inline comments on the exact lines where new findings landed.
• A summary comment at the top of the PR with the gate verdict and a link to the dashboard.
• AI-suggested fixes when the engine proposes one — posted as a commit-suggestion block you can apply from the PR.

​

Prerequisites

AI code review is opt-in and needs an AI model connected first. Two one-time setup steps, then turn it on per repo:

​

How it runs

AI code review runs two ways — use either or both:

• Automatic — via the code connector. Connect a code provider with PR-write permission and TigerGate reviews every pull request automatically, server-side. The provider webhook triggers the scan and the review posts back to the PR — no CI wiring, no pipeline changes. Uses your org-level AI model. Review is off by default — enable it per repo first (see Prerequisites).
• In your CI/CD pipeline. Add tigergate code-review as a pipeline step to review the current PR/MR diff and post inline comments — on your own LLM key (TG_LLM_TOKEN / TG_LLM_MODEL / …). Use it when you want the review inside an existing gated build. See the CLI reference.

Both modes post the same inline comments and one-click AI fix suggestions described below.

​

What it looks like

A typical PR will get one summary comment + one inline comment per new finding. Findings already on the base branch are not re-commented. In a monorepo scanned per component, each component posts its own status check (TigerGate Security (web), TigerGate Security (api)) and its own summary comment, so components never overwrite each other’s verdict on the same commit. Require the per-component contexts in branch protection rather than the single repo-wide one.

​

When it works (per provider)

AI fix suggestions are generated for every supported provider and posted as a “commit suggestion” you can apply in one click — on GitHub, GitLab, Azure DevOps, and Bitbucket.

​

How findings are mapped to lines

Each finding carries a file path and line range. The inline comment is anchored at the last line of that range (or the single line when there’s no range). Findings on lines the PR diff doesn’t include are surfaced in the summary comment on the thread instead of as inline comments — so unrelated files stay clean.

​

AI-suggested fixes

When the review engine proposes a concrete fix, TigerGate posts the corrected code as a commit-suggestion block on that comment, so you can apply it without leaving the PR. When it has no mechanical fix to offer, the comment still carries the explanation and remediation guidance — just no suggestion block. Fix suggestions come from the same org-level LLM you connect under TigerGuard AI — the credential shared with AI Pentest, configured once per org, not per repo.

​

Enable / disable per repo

Each repository has a PR review toggle under Organization Settings → Product Settings → Code Security → PR Review — off by default (see Prerequisites). Turn it on for the repos you want reviewed; turn it off (or leave it off) to stop TigerGate posting AI review comments on that repo’s PRs — useful for an experimental branch you’re flooding with intentional bad code. Scans and the quality gate still run; only the AI review comments are suppressed. To tune what the AI flags, edit your organization’s custom review rules rather than muting per repo.

​

Re-runs

The review re-runs when new commits land on the PR and posts an updated set of comments. Comments from earlier runs are left in the thread as a record of what was found — TigerGate doesn’t delete them.