Welcome to a new club tool

For the past month I have been building RepoLens, drawing from learning material I already use with my students as part of the CycleRunCode Club. The idea was simple: turn a teaching playbook into a tool anyone can run.

What is RepoLens?

RepoLens is a completely free, open-source (MIT) command-line tool that reviews a repository for security, reliability, and architecture before you ship. You run it in your own environment—on your machine, or against code cloned from GitHub, Bitbucket, Hugging Face, or any Git URL. There is no hosted SaaS requirement and no embedded API key.

Most tools give you either a scanner dump or a vague AI chat. RepoLens aims for the middle: a consistent P1 → P2 → P3 review (security → bugs/reliability → architecture), with Markdown reports that include impact, remediation, and code-example fixes for Critical/High findings—the same structure I use when teaching people how to review code properly.

Who it is for

• Engineers and tech leads who want a due-diligence pass before shipping
• Mentors and students practising real review habits
• Security-minded developers who want OWASP Top 10 and common weakness classes (CWE) framed in their code, plus optional scanners
• Anyone who prefers bring-your-own AI (cloud key or local Ollama) over a vendor-locked service

What makes it different

• Structured passes: repolens review runs P1 security → P2 reliability → P3 architecture
• Security-only mode: repolens sentinel for a fast P1 guardrail
• Bring your own AI: OpenAI, Anthropic, DeepSeek, or fully local via Ollama
• Graceful LLM spine: invalid model output still writes a report instead of dying on a stack trace
• Honest metrics: gate confidence is not a marketing “% secure” score
• Optional scanners: OSV-Scanner (CVEs), Semgrep (SAST), and gitleaks (secrets) merge into the same report
• Privacy-first local learning: opt-in, on-disk only, with informed consent

Security without the hand-waving

The LLM security playbook aligns findings to OWASP Top 10 and CWE-style weakness classes, with explanations and fixes. Optional plugins add deterministic evidence. AI alone is not a complete CVE database, and RepoLens does not stamp a project “OWASP certified”. It is a due-diligence layer beside pytest, CodeQL, Dependabot, and Snyk—not a replacement for them.

Tried on a real club project

I have been dogfooding RepoLens on PatternSorcerer, another CycleRunCode product. Over a couple of days the reports themselves improved: full review versus security-only sentinel, mode-aware filenames so runs do not overwrite each other, timestamps and run duration for long local-model jobs, and metrics that only score the passes that actually ran. The finding format stayed stable—impact, remediation, and code examples on Critical/High—so students and shipping teams can compare runs over time.

Where things stand

RepoLens is Alpha (0.1.0a1). Phases 0–5.1 are shipped. Next: publish to PyPI (pip install repolens), then richer per-finding explain/diagrams and broader CI recipes.

Today you can install from GitHub:

pip install "repolens @ git+https://github.com/vksvicky/RepoLens.git"
repolens init --provider ollama
repolens review --path ./my-app --verbose

Try it and tell me what you think

Source: github.com/vksvicky/RepoLens

Feedback via GitHub Issues (Bug report, Feature request, or Question / discussion): issues/new/choose. General teaching and shipping notes can also go on issue #6.

If you want help trying it in a club session, get in touch.