Santinel
Code review · Coding agent

Everyone automated the noise. We automated the judgment.

AI writes code faster than any team can review it — so the bots bury your pull requests in confident guesses, and you stop reading. Santinel reads every line, and speaks only when a compiler, your codebase's own structure, or repeated proof agrees it's right.

Get started See how it proves

Works with GitHub and GitLab — as a PR bot or in your CI.

Runs your own tools first:
tscclippyruffeslintmypysemgrepgitleakspyrightcargo checktrivyshellcheckbandittscclippyruffeslintmypysemgrepgitleakspyrightcargo checktrivyshellcheckbandit
01 — The noise

Guesses don't ship.

Same pull request. Two very different reviews.

A typical review bot 23 comments

Consider renaming this variable for clarity.

This function could be simplified.

Nit: missing blank line.

Maybe add a comment here?

Possible issue? Please double-check.

Santinel 2 comments

Auth guard removed — requireUser() no longer runs. proven · guard-on-every-path

1 unverified guess suppressed (never posted)

02 — The discipline

Three ways to prove a finding

A finding ships only when at least one objective channel confirms it.

Types & tools

Compilers, type-checkers, linters, secret and dependency scanners run first — sub-second, no model in the loop. If the tool is certain, so are we.

$ tsc --noEmit -> error TS2345

Your structure

A versioned map of your code's structure — across every repository. Santinel diffs the structure between commits and catches contracts that break across services, even ones nobody declared.

structure diff: endpoint shape changed · 3 callers stale

Repeated agreement

For the semantic tail, many independent passes must agree — and survive an objective check that tries to refute them — before a word reaches your PR.

8 passes agree · refuter found no counter-example
03 — The depth

Catches contracts breaking ACROSS repositories

An endpoint changes shape in one repo; the client that calls it lives in another. Santinel maps your whole fleet's structure and flags the break before merge — even when nobody declared the dependency.

payments-apiweb-clientshared-lib
Client still sends cents — contract broken by this PR body: { amount: total * 100 }
04 — The craft

What you get

Cross-repo contract drift

Catches a client calling an endpoint that changed shape — across repositories, with zero manual wiring.

Docs and requirements vs. code

Flags when code drifts from its own documentation, or from the behavior your spec promised.

Deterministic first pass

Compilers, type-checkers, linters and SAST across many languages — sub-second, no model in the loop.

An agent that verifies its own work

Writes code in an isolated sandbox, gates every draft, and opens a PR only after it passes.

Propose, confirm, apply

Suggests a fix and shows exactly what it changes — then applies it on your approval. Never a silent edit.

Principle-aware review

Explains why something breaks a principle — SOLID, YAGNI, KISS — not just that a line looks off.

Learns per repository

Sharpens on the findings your team confirms. What it learns never crosses a repository boundary.

Native board, or your CI

Run delivery on a built-in board with sprints — or drop Santinel into GitHub Actions or GitLab CI. Locked to neither.

From ticket to merged — with gates that don't blink

A workflow enforced by git hooks: branch per task, a regression test before the fix, a sub-second deterministic pre-push gate that blocks on errors, and an auto-review on every PR.

Agents run in isolated sandboxes with no production secrets present.

A reviewer your team trusts enough to read.

Log in and connect your first repository. It proves the rest.

Get started