ThinkReview

Reviews read from GitHub, GitLab, Azure DevOps and Bitbucket, in the cloud or self hosted, through a GitHub App, GitLab OAuth or a personal access token stored encrypted in the portal. During a review the model calls the code host's API itself to fetch related files, base branch content, linked issues, commit and comment history, and other open pull requests touching the same files. Writing back stays with a person, who posts chosen findings as comments on GitHub, GitLab or Azure DevOps with one click each, and deeplinks hand a fix to Cursor, Claude Code or Copilot.

Sourcethinkreview.dev/release-notes/cloud-v2.4.0read 2026-11-01

Each review runs a main analysis while up to ten custom review agents work in parallel in the cloud, each filling its own tab, and the panel can be closed while they finish. Every agent carries its own goal, scope and reference material, plus a run condition that fires it on every review or only when the project or stack matches. Inside a review the model calls tools across several steps to gather repository context, and a failed model call is rerouted up to three times to another allowed model, often one with a larger context window.

Sourcethinkreview.dev/docs/review-agentsread 2026-11-01

Context is gathered fresh for each review. The model pulls related files, imports, base branch content, linked issue text, project structure, the pull request's history and overlapping open pull requests from the code host, and it can look up library versions, model and API names, advisories and changelogs on the live web when a finding depends on them. Review agents add reference material such as OWASP guidance or internal standards by link. Source code is never stored or indexed, so no retrieval index is kept over a customer's repositories or documents.

Sourcethinkreview.dev/release-notes/cloud-v2.4.0read 2026-11-01

The review stays in a private panel that only the person reviewing sees. Each finding has its own Post control, so they publish the ones worth sharing, post a generated comment or skip the rest, and nothing lands on the pull request until then. Comments post under the user's own name on GitLab and Azure DevOps, or as ThinkReview through the GitHub App. ThinkReview cannot approve, merge or block a change, and the MCP review and the Cursor plugin return findings to the assistant without posting anything to the code host.

Sourcethinkreview.dev/blog/2026-09-18-post-review-findings-as-pr-commentsread 2026-11-01

Users sign in with Google OAuth, git tokens are encrypted at rest with keys derived server side and decrypted only in memory during a review, and traffic runs over TLS. Accounts are individual, with no organization roles, SSO, SAML, SCIM or audit log for an administrator to manage. No SOC 2 or ISO 27001 report is named, and a data processing agreement stating zero code retention is offered on request. On the self hosted gateway, an optional extension token mode limits which clients can call it.

Sourcethinkreview.dev/privacy-policyread 2026-11-01

Users see how many credits they used this month and today, and when the pool resets, in the extension menu and on the portal's usage card. Pull request URLs, review counts and timestamps are kept for each account, each user's past reviews reopen from cache, and the self hosted gateway reports engine readiness, configuration version and secret status on a health endpoint. A review keeps no trace of which files it fetched or which tools it called, and there is no audit log of what users or agents did across an organization.

Sourcethinkreview.dev/docs/billing-review-creditsread 2026-11-01

A review chat sends the current patch, the original review summary and the last 6 to 11 messages to the model, depending on the model, and keeps that history in the browser during the session, with server copies held up to 90 days for operations. Each user's finished reviews are cached against a fingerprint of the changes and the pull request ID, survive browser restarts and are reused until the code changes. Rules and agents shape every review, and nothing learned from one pull request or from a reviewer's feedback carries into the next.

Sourcethinkreview.dev/docs/conversational-reviewsread 2026-11-01

Cloud reviews run on Google Cloud, where diffs are processed in memory and discarded. On the Teams plan, the Enterprise Gateway runs inside the customer's network as a container on a virtual machine with Docker Compose or in Azure Container Apps, keeping diffs, repository tool results, git tokens and model keys on the customer's side, while accounts, billing, agents and signed review bundles come from ThinkReview's cloud on a six hour heartbeat. Local Ollama keeps the patch on the user's own machine, including air gapped use, with only a usage count sent.

Sourcethinkreview.dev/docs/self-hosted-gatewayread 2026-11-01

Teams build their own review agents from a goal, a scope and reference material, up to ten per account, and ThinkReview suggests niche agents drafted from the stack signals of projects a user reviews, ready to switch on. Custom rules come from a predefined list of security checks, such as cross site scripting and sensitive data exposure, and a list of best practice checks, up to ten of each, with room for the team's own. There is no catalog of ready made review agents to adopt by name.

Sourcethinkreview.dev/docs/custom-rulesread 2026-11-01

Work starts when a person asks for it. A reviewer opens the review panel on a pull or merge request page on any of the four code hosts, runs a URL review from the portal, or asks Cursor, Claude Code, Claude Desktop or VS Code Copilot to call the hosted review over MCP, where a Cursor skill routes any pull request link to it. After new commits, the next request produces a fresh review on its own. No webhook, schedule or pull request event starts a review, and the hosted engine calls tools only inside a review someone requested.

Sourcethinkreview.dev/docs/mcp-integrationread 2026-11-01

Users choose preferred models in the portal and block others from use, and each review tries the chosen models first within the plan's tier and the size of the patch. The lineup spans Claude, GPT, Gemini, Grok, Kimi, Qwen, MiniMax and Devstral models through Anthropic, OpenAI, Google and OpenRouter, and pricier models cost more credits per action. An Ollama Cloud key can run hosted, follow up and MCP reviews on the customer's own models, and the Enterprise Gateway points at any OpenAI compatible endpoint the customer runs, such as Azure OpenAI or vLLM.

Sourcethinkreview.dev/docs/model-selectionread 2026-11-01

A hosted MCP server at mcp.thinkreview.dev/v1 signs in with OAuth or a portal bearer token and offers one tool, review_url_code, which takes a pull or merge request URL with optional language, tracking ID and force regenerate arguments. Each call runs a full hosted review with the account's custom rules, caches the result and draws on the same credits as the extension. A Cursor plugin on the Cursor Directory packages the server with a review skill. Custom review agents do not run over MCP, and the hosted review endpoints have no published API reference.

Sourcethinkreview.dev/docs/mcp-integrationread 2026-11-01

Before a finding is reported, a connected review looks through the repository for how the change is used and whether the issue is already handled elsewhere, which cuts findings that ignore the rest of the codebase. A reviewer can regenerate a review for a second opinion and rate it, and the scoring layout grades the change itself on quality, security and best practices. Teams get no test cases, shadow mode or harness to check a review agent or a rule change against past pull requests before it goes live.

Sourcethinkreview.dev/release-notes/cloud-v2.4.0read 2026-11-01

The review lives in a browser but never drives one. The extension reads the patch from the open pull request page, and the cloud engine reaches code hosts through their APIs with stored credentials. The panel displays findings for a person to read, and posting a comment is a single call that person triggers. Nothing in the product clicks, types or navigates through a web page or a desktop application on its own, and the MCP review runs entirely through the hosted engine.

Sourcethinkreview.dev/docs/github-integrationread 2026-11-01