- Compared to popular code review tools. -
- - -| Feature | -- cora - | -CodeRabbit | -Copilot | -SonarQube | -
|---|---|---|---|---|
| {feat.name} | -- {#if cellIcon(feat.cora) === 'check'} - ✓ - {:else} - {feat.cora} - {/if} - | -- {#if cellIcon(feat[competitors[0].key]) === 'check'} - ✓ - {:else if cellIcon(feat[competitors[0].key]) === 'cross'} - ✗ - {:else if cellIcon(feat[competitors[0].key]) === 'dash'} - — - {:else} - {feat[competitors[0].key]} - {/if} - | -- {#if cellIcon(feat[competitors[1].key]) === 'check'} - ✓ - {:else if cellIcon(feat[competitors[1].key]) === 'cross'} - ✗ - {:else if cellIcon(feat[competitors[1].key]) === 'dash'} - — - {:else} - {feat[competitors[1].key]} - {/if} - | -- {#if cellIcon(feat[competitors[2].key]) === 'check'} - ✓ - {:else if cellIcon(feat[competitors[2].key]) === 'cross'} - ✗ - {:else if cellIcon(feat[competitors[2].key]) === 'dash'} - — - {:else} - {feat[competitors[2].key]} - {/if} - | -
- Everything you need to know about using cora. -
- -{accent}
-{@html description}
-- Everything you need, nothing you don't. -
- -- cora catches bugs, security issues, and code smells before they land in your PR. - Bring your own API key. Your code never leaves your machine. -
- - - - - -- Three steps from code to confidence. -
- -- Trusted by developers who ship fast -
-- Run cora against staged changes. Results in seconds, not minutes. -
- -- No account required. No subscription. No cloud. -
- -- No account. No subscription. No cloud. -
- -{description}
-{description}
- {#if terminalCode} - {@render terminalCode()} - {/if} -- {@render children?.()} -
diff --git a/website/src/lib/components/ui/card/card-footer.svelte b/website/src/lib/components/ui/card/card-footer.svelte deleted file mode 100644 index 591c3f71..00000000 --- a/website/src/lib/components/ui/card/card-footer.svelte +++ /dev/null @@ -1,20 +0,0 @@ - - -- For the full changelog, see the - repository. -
- - {#each releases as release, i} -Complete command reference for the cora CLI.
- - -| Flag | -Description | -
|---|---|
--config <path> |
- Override config file path (default: .cora.yaml) |
-
--format <fmt> |
- Output format: pretty, json, compact, sarif | -
--no-color |
- Disable colored output | -
--provider <name> |
- Override provider | -
--model <name> |
- Override model | -
--base-url <url> |
- Override API base URL | -
--api-key <key> |
- Override API key | -
--verbose |
- Enable debug logging | -
| Command | -Description | -
|---|---|
cora init |
- Create .cora.yaml config file |
-
cora review |
- Review code changes (default: staged files) | -
cora review --staged |
- Review staged git changes explicitly | -
cora review --unstaged |
- Review unstaged working changes | -
cora review --unpushed |
- Review unpushed commits | -
cora review --base <branch> |
- Compare current branch against target | -
cora review --commit <ref> |
- Review specific commit or range | -
cora review --diff-file <path> |
- Review from a diff file | -
cora review --upload |
- Review and upload SARIF to GitHub Code Scanning | -
cora scan <path> |
- Scan files for issues | -
cora scan . [--incremental] |
- Scan only changed files | -
cora config show |
- Show resolved configuration | -
cora config set <key> <value> |
- Set a config value | -
cora hook install |
- Install pre-commit hook | -
cora hook uninstall |
- Remove pre-commit hook | -
cora auth login |
- Save API key to ~/.cora/config.toml |
-
cora auth status |
- Check current auth status | -
cora auth remove |
- Remove stored API key | -
cora providers |
- List detected AI providers | -
cora upload-sarif <file> |
- Upload SARIF to GitHub Code Scanning | -
cora completion <shell> |
- Generate shell completions (bash/zsh/fish) | -
cora uses a layered config system. Later sources override earlier ones.
- - -Settings are resolved in this order (highest priority first):
-Create this file in your project root. Run cora init to generate it.
# cora project config -provider: - provider: openai - model: gpt-4o - base_url: https://api.openai.com/v1 - -llm: - temperature: 0 - max_tokens: 4096 - timeout: 120 - cache_ttl: 1440 - -review: - system_prompt: "You are a senior code reviewer." - # system_prompt_file: ./review-prompt.md - response_format: json_object - -focus: security, performance, bugs - -hook: - mode: warn - min_severity: major - max_diff_size: 51200 - -ignore: - files: - - "vendor/**" - - "*.min.js"-
| Variable | -Description | -
|---|---|
CORA_API_KEY |
- API key for the active provider | -
CORA_PROVIDER |
- Active provider (openai, anthropic, groq, ollama, zai) | -
CORA_MODEL |
- Model name override | -
CORA_BASE_URL |
- Custom API base URL | -
CORA_CONFIG |
- Path to config file | -
CORA_FORMAT |
- Output format (pretty, json, compact, sarif) | -
CORA_NO_COLOR |
- Disable colored output | -
CORA_NO_CACHE |
- Skip diff-hash review cache (same as --no-cache) |
-
GITHUB_TOKEN |
- GitHub token for SARIF upload | -
GITHUB_REPOSITORY |
- GitHub repo for SARIF upload | -
GITHUB_REF |
- GitHub ref for SARIF upload | -
Each provider has its own API key variable. cora checks these for auto-detection.
-# OpenAI -OPENAI_API_KEY=sk-... -OPENAI_BASE_URL=https://api.openai.com/v1 - -# Anthropic -ANTHROPIC_API_KEY=sk-ant-... - -# Groq -GROQ_API_KEY=gsk_... - -# Ollama (local, no key needed) -OLLAMA_HOST=http://localhost:11434 -# Optional: OLLAMA_API_KEY if your Ollama instance requires auth -OLLAMA_API_KEY=... - -# Z.AI -ZAI_API_KEY=...-
cora caches review results by diff hash in ~/.cache/cora/reviews/. If you re-review the same diff, the cached result is returned instantly.
llm.cache_ttl — TTL in minutes (default: 1440 / 24h)
- --no-cache or CORA_NO_CACHE=1 to bypass
- Override the default system prompt for review or scan commands to match your project's coding standards and review criteria.
review: - system_prompt: "Focus on Rust idioms and error handling." - # Or load from a file: - system_prompt_file: ./prompts/review.md - -scan: - system_prompt: "Check for OWASP Top 10 vulnerabilities." - system_prompt_file: ./prompts/scan.md-
If both system_prompt and system_prompt_file are set, the file takes precedence.
Opt into structured JSON output from the LLM by setting review.response_format to json_object. This instructs the LLM to return valid JSON, enabling machine-readable parsing and pipeline integration.
review: - response_format: json_object-
Requires provider support for structured output. Works with OpenAI, Anthropic, and compatible APIs.
-cora uses two mechanisms to prevent the LLM from fabricating findings:
-Practical examples to get you started with cora.
- - -Review your staged changes before committing.
-Compare your current branch against main.
-Scan your entire project for issues.
-Only scan files that changed since the last scan.
-Stream results as they come in from the LLM.
-Add cora to your CI pipeline.
-name: Code Review - -on: - pull_request: - branches: [main] - -jobs: - review: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Install cora - run: cargo install cora-cli - - name: Run AI code review - env: - {@html 'CORA_API_KEY: ${{ secrets.CORA_API_KEY }}'} - CORA_PROVIDER: openai - run: cora review --base main --format sarif-
Install once, then every commit gets reviewed automatically.
-Generate SARIF output and upload to GitHub Code Scanning.
-Get up and running with cora in three simple steps.
- -curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-cli/main/install.sh | sh
- cora auth login to pick your provider and enter your API key.
- Cora stores it securely in ~/.cora/auth.toml (never committed to git).
- cora review
- cora auth login- The interactive login guides you through provider selection: -
- -Check your auth status anytime:
-
- You can also use environment variables instead of cora auth login:
- CORA_API_KEY, OPENAI_API_KEY, ANTHROPIC_API_KEY, etc.
-
cora outputs a structured, color-coded summary of findings for each file reviewed.
- -Each line in the output contains:
-cora init
- Create a .cora.yaml config file in your project root.
- Automatically installs a pre-commit hook that runs cora review --staged --format compact before each commit.
- Use --no-hook to skip hook installation.
-
Set provider, model, and base URL directly in .cora.yaml (no nested section needed):
Key configuration options:
-Now that you have cora running, explore these topics to get the most out of it:
- -The fastest way to get cora — single command, no Rust required:
- -Installs to ~/.local/bin. Add to PATH if needed:
Pin a specific version:
- -If you have Rust 1.85+ installed:
- -This compiles cora from source and installs it to Cargo's binary directory (typically ~/.cargo/bin/).
Pre-built binaries are available from the GitHub Releases page.
- -Supported platforms:
-If you prefer to build from the latest source:
- -cora provides shell completions for bash, zsh, and fish:
- -Confirm cora is installed correctly:
- -To update cora to the latest version:
- -cargo install cora-cli --force
- cora supports multiple AI providers. Use your own API key — no subscriptions to us.
- - -| Provider | -Default Model | -Env Var | -Custom Base URL | -
|---|---|---|---|
| OpenAI | -gpt-4o-mini |
- OPENAI_API_KEY |
- OPENAI_BASE_URL |
-
| Anthropic | -claude-sonnet-4-20250514 |
- ANTHROPIC_API_KEY |
- ANTHROPIC_BASE_URL |
-
| Groq | -llama-3.1-8b-instant |
- GROQ_API_KEY |
- GROQ_BASE_URL |
-
| Ollama | -llama3.1 |
- — (local) | -OLLAMA_HOST (default: http://localhost:11434) |
-
| Z.AI | -glm-5.1 |
- ZAI_API_KEY |
- ZAI_BASE_URL |
-
- cora automatically detects which provider to use by checking environment variables in this order: -
-{item}
-
- Override auto-detection with CORA_PROVIDER env var or --provider flag.
-
Demand-gated — we build what people actually need. Track progress on GitHub Issues.
- -cora supports multiple review modes, each suited to a different workflow:
- -| Mode | -Flag | -Scope | -Best For | -
|---|---|---|---|
| Default | -(no flag) | -Tries staged first, then unpushed | -Quick feedback | -
| Staged | ---staged |
- Files in git staging area | -Pre-commit review | -
| Unstaged | ---unstaged |
- Unstaged working changes | -Review work in progress | -
| Unpushed | ---unpushed |
- Commits not yet pushed | -Review before push | -
| Base Branch | ---base <branch> |
- Diff against base branch | -PR review workflow | -
| Commit | ---commit <ref> |
- Specific commit or range | -Review specific changes | -
| Diff File | ---diff-file <path> |
- External diff file | -Review patch files | -
cora can output results in three formats:
- -The .cora.yaml file provides persistent configuration. Place it in your project root. API keys are stored at ~/.cora/config.toml.
Environment variables override configuration file settings:
- -| Variable | -Description | -Required | -
|---|---|---|
CORA_API_KEY |
- API key for the configured provider | -Yes (unless using cora auth) | -
CORA_PROVIDER |
- Override the LLM provider | -No | -
CORA_MODEL |
- Override the model name | -No | -
CORA_BASE_URL |
- Override the API base URL | -No | -
CORA_CONFIG |
- Path to alternative config file | -No | -
cora works well in monorepo setups. Use include patterns to limit review scope to specific packages:
- -Alternatively, set include/exclude patterns in .cora.yaml for persistent configuration.
cora uses standard exit codes for scripting and CI integration:
- -| Code | -Meaning | -CI Behavior | -
|---|---|---|
0 |
- No issues found | -Pass | -
1 |
- Issues found | -Fail (warning/error) | -
2 |
- Review blocked | -Fail (auth/config error) | -
3 |
- Authentication error | -Fail (missing API key) | -
cora review with no flags for the fastest pre-commit feedback
- --format json with --base main in CI pipelines
- cora scan . --incremental for large codebases — only changed files are analyzed
- --quiet for minimal output and --severity to filter by severity level
- cora auth login to store API keys securely instead of environment variables
-