BlueBear Security has launched Baloo, an open-source GitHub App designed for teams that want AI-powered pull request review without handing their code to a third-party SaaS. Unlike hosted competitors, Baloo runs on your own infrastructure, allowing you to control the GitHub App installation scope and provide your own API keys for models like Claude or Gemini.
Agentic Review Beyond the Diff
Baloo distinguishes itself by using a 'PI Agent' that can read files, grep patterns, and explore the repository context, rather than just analyzing the PR diff. This agentic approach allows it to catch logic errors, silent failures, and security antipatterns that traditional linters miss. The system also respects your team's specific conventions by reading and enforcing rules defined in AGENTS.md and CONTRIBUTING.md files.
Flexible Architecture and Provider Support
The tool is built with a FastAPI backend and supports a wide range of LLM providers, including Anthropic, Amazon Bedrock, Google, OpenAI, and Databricks AI Gateway. Developers can configure the agent to use specific models like Sonnet, Haiku, or Gemini Pro via environment variables. For teams concerned about noise, Baloo includes a false-positive verification pass using a second LLM to filter out low-severity or incorrect findings before they reach developers.
Integration and Workflow Features
Baloo integrates deeply with GitHub workflows, posting inline comments on specific lines with severity labels and approval or request-changes decisions. It features 'per-PR review briefs' where developers can add specific guidance to a PR description, which Baloo then verifies against the code. The system also tracks discussion threads across iterations, skipping duplicates and detecting when feedback has been addressed, making it a more persistent teammate than a one-shot reviewer.
Local Testing and Dry Runs
Local dry-run scripts allow developers to test the review pipeline against a local git diff before opening a PR, ensuring the configuration works as expected without spamming GitHub comments.
Key Takeaways
- Self-Hosted Privacy: Code never leaves your infrastructure; you bring your own API keys.
- Context-Aware: The agent explores the repo, not just the diff, to understand impact.
- Convention Enforcement: Automatically checks against AGENTS.md and CONTRIBUTING.md rules.
- Multi-Provider Support: Compatible with Anthropic, Google, OpenAI, Bedrock, and Databricks.
The Bottom Line
If you're tired of sending proprietary code to black-box SaaS reviewers, Baloo is a compelling, practical alternative that puts you back in control of your review pipeline.
Sources
- [BlueBear Security GitHub Repository](https://github.com/bluebear-io/baloo-bear)