BerriAI releases LiteReview for self-hosted AI pull request analysis

BerriAI has released LiteReview, an open-source platform that enables engineering teams to run configurable AI agents for code reviews on GitHub. Published on October 11, 2026, this tool allows organizations to self-host the review workspace, giving them full control over model connections, instructions, and security boundaries while leveraging isolated sandboxes for execution.

What happened

LiteReview introduces a system where developers can trigger AI-powered reviews by commenting on a pull request. The platform runs these reviewers in isolated environments provided by Modal, ensuring that code analysis, test execution, and browser checks happen without compromising the host infrastructure. The agents post their findings, including reports and links to specific diffs, directly back to the GitHub interface, but they do not push code fixes automatically.

The project is designed for teams that want to automate parts of their code review process while maintaining strict data governance. By self-hosting the workspace, companies can connect their own large language model APIs, such as OpenAI or compatible gateways for Anthropic models, and define custom review instructions. The setup supports multiple reviewers with distinct roles, such as frontend or security specialists, which can be triggered simultaneously or combined into a single report using a feature called Fusion.

Deployment is streamlined through a Render Blueprint that provisions the necessary web service and Postgres database. However, the architecture relies on external services for specific components: Render for hosting, Modal for sandboxed execution, and Google Workspace for team authentication. This hybrid approach means that while the core application logic and configuration remain under the user’s control, the runtime environment for the AI agents depends on third-party infrastructure.

Key details

• Trigger mechanism: Reviews are initiated by posting @litereview as a comment on an open GitHub pull request.
• Isolation: Code analysis and tool usage occur in Modal sandboxes, separating execution from the main application server.
• Model flexibility: Supports OpenAI API keys and Responses-compatible gateways, allowing use of various large language models.
• Authentication: Requires a Google Workspace organization for team sign-in and a GitHub App installation for repository access.
• Cost structure: Users pay for Render hosting, Modal sandbox usage, and model API calls; spend visibility is limited to configured admins.
• Local development: A local mode is available for UI and API testing using SQLite, though actual reviews still require cloud connectivity.

Background

Self-hosting AI tools has become a priority for many mid-sized companies concerned about data privacy and vendor lock-in. Traditional SaaS code review assistants often send proprietary code to external servers, which can violate compliance requirements or internal security policies. LiteReview addresses this by keeping the orchestration layer and configuration within the company’s own infrastructure.

The concept of "agents" in this context refers to AI systems that can not only read text but also use tools. These agents can execute terminal commands, run tests, and even browse a live version of the application to check for visual or functional regressions. By running these agents in sandboxes, LiteReview ensures that any potentially dangerous operations, such as executing untrusted code, are contained and cannot affect the underlying host system or network.

Why it matters

For DevOps engineers and IT leads, the ability to control the AI model and its instructions is critical. It allows teams to enforce specific coding standards, security protocols, or architectural patterns that generic models might miss. Since the workspace is self-hosted, administrators can audit exactly what data is sent to the model provider and manage costs more effectively than with opaque per-seat SaaS subscriptions.

However, the complexity of the setup requires careful consideration. The dependency on multiple external services—Render, Modal, Google Workspace, and an LLM provider—means that failure in any one component can disrupt the review process. Teams must manage credentials for all these services and understand the security implications of connecting private repositories to a system that spawns external sandboxes. The beta status also implies that the security boundary should be thoroughly evaluated before handling highly sensitive code.

Additionally, the cost model is distributed. While the software itself is open source, the operational costs include hosting fees, sandbox execution time, and token usage for the AI models. Admins need to configure budgets and monitor spend across these different providers to avoid unexpected bills, especially if reviewers are triggered automatically on every commit or pull request event.

What you can do

• Evaluate the security boundary: Read the provided security documentation carefully before connecting private repositories or shared tools to the workspace.
• Test with a public repo: Start by deploying the Render Blueprint and connecting a non-sensitive public repository to understand the workflow and costs.
• Configure spend limits: Set up review time and model-call limits in the agent editor to prevent excessive usage during initial testing.
• Define clear instructions: Customize the reviewer instructions to match your team’s specific coding standards rather than relying on default prompts.
• Monitor admin logs: Use the admin dashboard to track model spend and review activity, ensuring that only authorized users are managing configurations.
• Explore local UI: Run the local development setup to familiarize yourself with the interface and API without incurring cloud costs.