AI code review for GitHub, GitLab and Bitbucket
Every pull
request gets a
first pass.
Firstpass reads each pull request before your team does. It runs the tests, finds the bug and leaves the fix as a suggestion you apply in one click.
Reviewed in 01:34
Retry failed captures with backoff
+48 −12 3 files
src/capture/retry.ts
37
export async function captureWithRetry(id: string) {
38
let attempt = 0;
39
−
for (; attempt < MAX_ATTEMPTS; attempt++) {
39
+
while (attempt < MAX_ATTEMPTS) {
40
const res = await gateway.capture(id);
41
if (res.ok) return res;
42
+
await sleep(backoff(attempt));
firstpass
BLOCKING
line 42
attempt is never incremented inside the loop, so a failed capture retries forever. The test retries stop after 5 attempts times out.
−
await sleep(backoff(attempt));
+
await sleep(backoff(attempt++));
43
}
44
throw new CaptureError(id, attempt);
2 more comments · 1 should fix · 1 nit
94 s
Median time to first review
1 in 3
Reviews end in an applied fix
0 lines
Of your code kept after review
Used by engineering teams at
Fennwick
Maren Labs
Orrin Health
Kestrel Works
Brightwater
Tallis Reed
01 What it catches
Four kinds of problem,
found before a person looks.
Firstpass does not comment on style. It reports what breaks, what slows down and what leaks.
Bugs it can prove.
It checks out your branch, builds it and runs the tests. A comment arrives with the failing test attached, not a guess.
test output
1 failed
$ pnpm test capture
captures on the first attempt (38 ms)
backs off between attempts (112 ms)
retries stop after 5 attempts (timeout 5000 ms)
at src/capture/retry.test.ts:58
41 passed · 1 failed · 12.4 s
Slow queries and loops.
N+1 queries, missing indexes and work repeated inside a loop, with the measured cost.
Before
201 queries
1,840 ms
After
2 queries
38 ms
Secrets and unsafe input.
Keys in a diff, SQL built from strings, unchecked redirects. Blocked before merge.
config/payments.env
9
# payments
10
PAYMENTS_PROVIDER=stripe
11
PAYMENTS_CURRENCY=usd
12
PAYMENTS_REGION=eu-west-2
13
PAYMENTS_TIMEOUT_MS=8000
14
STRIPE_KEY=sk_live_••••••••••••4f2a
Secret found · push blocked
config/payments.env:14
Stripe live key
Your own rules.
Write the team’s rules once in plain words. Firstpass applies them to every pull request and cites the rule.
firstpass.yml
1
rules:
2
- “Money is stored as integer cents, never floats”
3
- “Every new endpoint needs an auth test”
4
- “No direct imports from /internal in /web”
5
ignore:
6
- “**/*.snap”
7
severity: block_on_bug
firstpass
Rule 1
amount is parsed with parseFloat
billing/invoice.ts · line 88
02 One review, start to finish
From push to review
in the time it takes to get coffee.
Sample data. Replace with your own.
38%
Of blocking comments lead to a code change
Measured by the next commit touching the flagged lines.
6.2 h
Review wait saved per developer, per week
Reported by 23 teams that measured before and after.
0
Lines of code stored
Branches are deleted when the review is posted.
03 Customers
Teams that merge
with fewer surprises.
Fennwick
Review wait down from 9 hours to 40 minutes.
The first comment is there before I have switched tabs.
Jonas Feld
Staff Engineer
Orrin Health
Zero secrets merged in 11 months.
It caught a production key in a test fixture in week one.
Amara Osei
Head of Platform
Kestrel Works
31% fewer rollbacks in a quarter.
We stopped arguing about style and started reading logic.
Kenji Mori
Engineering Manager
04 Works with
Installs in two minutes.
No pipeline changes.
Add the app to your organisation, pick the repositories, open a pull request.
1
Install the app
2
Choose repositories
3
Open a pull request
Hosts
GitHub
GitLab
Bitbucket
Azure Repos
Languages
TypeScript
Python
Go
Ruby
Java
Kotlin
Rust
C#
PHP
Swift
Tests
Jest
Vitest
pytest
go test
RSpec
JUnit
cargo test
05 Pricing
Priced per developer.
Reviews are unlimited.
Open source
$0
For public repositories.
Unlimited public repos
Bug and security comments
Community support
Team
$24
per developer / month
For private repositories.
Everything in Open source
Runs your tests
Team rules file
14-day trial, no card
Enterprise
Custom
For 100+ developers.
Self-hosted runners
SSO and audit log
Data residency in US or EU
Named support engineer
Deleted after review
Branches and build containers are destroyed when the review is posted.
Audited
SOC 2 Type II report available under NDA. Sample claim: replace with your own.
07 Questions
Asked before
every install.
No. It does the first pass so people can spend their review on design and intent. You decide whether a blocking comment stops the merge.