Docs › All features

All features

Everything mrsentry does, grouped by where it runs: on your laptop, in every merge request pipeline, and in a nightly scheduled pipeline. Click a feature for its details. The grey line under each one is how you switch it on or tune it.

1On your laptopbefore you push · no GitLab needed

1On your laptop

Local review Your commits, uncommitted edits and new files against origin/main, in the terminal. mrsentry review --local Git hooks Pre-push or pre-commit hook that blocks only on serious findings. mrsentry hook install

2Merge request pipelinemrsentry-review job · every push

2aUnderstand the change

Full-repo context Clones the MR head: enclosing code, imports, related symbols, repo docs. always on Linked issues & Jira Issues the MR closes and Jira tickets, so the change is checked against the ask. JIRA_URL + JIRA_API_TOKEN Guidelines & pattern rules Your team rules; regex rules hit without an LLM call. mrsentry guidelines test Secret detection Keys and tokens become critical findings; secrets never reach the LLM. MRSENTRY_REVIEW__SECRETS

2bReview it

Any LLM Azure OpenAI, Bedrock, Anthropic, OpenAI, LiteLLM proxy or a local model. MRSENTRY_MODEL or AZURE_OPENAI_* Agent tools The model reads files and greps the repo to check its claims. MRSENTRY_REVIEW__AGENT__ENABLED Evidence check & critic Each finding must quote the real line; a critic pass removes noise. MRSENTRY_REVIEW__SUMMARIZER Learns from 👍/👎 Kinds of comments your team keeps rejecting stop being posted. MRSENTRY_REVIEW__FEEDBACK__ENABLED

2cReport back

Inline comments On the exact line, with one-click suggestions; never duplicated. MRSENTRY_REVIEW__SUGGESTIONS Overview & reviewer guide One note, edited in place: verdict, key changes, where to look. MRSENTRY_REVIEW__GUIDE Answers replies Replies to developers in its threads; concedes and resolves when wrong. MRSENTRY_REVIEW__REPLIES Labels mrsentry::<verdict> and mrsentry-security on the MR. MRSENTRY_LABELS__ENABLED MR descriptions Suggests (or fills) a description when the author left it empty. MRSENTRY_REVIEW__DESCRIBE Slack / Teams alerts One message per new critical finding or CVE. MRSENTRY_NOTIFY_WEBHOOK Reviewer-thread gate Checks people's open threads against the code; can block the merge. mrsentry threads

2dSecure the image

ECR scan, freshness-aware Basic or enhanced, on-push or continuous; rescans stale results. MRSENTRY_ECR_IMAGE CVE → dependency path Finds the direct or transitive dependency behind each CVE. Maven · Gradle · npm · pnpm · yarn · Poetry · uv · pip Fix pushed into the MR A generated child pipeline commits the upgrade to the MR branch. MRSENTRY_FIX_WHEN

3Every nightmrsentry-scheduled-fix job · no review

3Every night

One fix MR Scans the newest image and keeps one fix MR open and up to date. mrsentry run scheduled Verify & AI repair Builds with your tools; the AI repairs code a bump breaks. MRSENTRY_FIX__ALLOW_LLM_REPAIR CVE digest Sends the open critical CVEs to Slack or Teams. MRSENTRY_NOTIFY_WEBHOOK

on by default opt-in or needs setupClick any feature for details · the grey line is how you switch it on

Put it in a pipeline in three steps

Install it, or use the image
Unpack the standalone binary and link it onto your PATH, with no Python needed. Or clone your copy of the repository and run its installer. It brings its own Python, so it works the same on Debian, Ubuntu, Amazon Linux 2/2023, RHEL and macOS. For CI you can also build the slim or full Docker image once and use it as the job image. See Installation.
```
git clone https://gitlab.example.com/platform/mrsentry.git
sh mrsentry/install.sh
mrsentry doctor            # checks token scopes, LLM, AWS and tools
```
Add two CI/CD variables (Settings › CI/CD › Variables, masked)
A bot token in GITLAB_TOKEN (scopes api + write_repository, role Developer), and credentials for one LLM. With AZURE_OPENAI_API_ENDPOINT, AZURE_OPENAI_API_KEY and AZURE_OPENAI_API_DEPLOYMENT_NAME set, nothing else is needed. Otherwise set MRSENTRY_MODEL. See LLM providers.

Include the template

include:
  - project: platform/mrsentry          # where you host mrsentry
    ref: v0.1.0
    file: templates/ci/mrsentry.gitlab-ci.yml

variables:
  MRSENTRY_IMAGE: registry.example.com/platform/mrsentry:full
  # optional switches, all shown on the map above:
  MRSENTRY_ECR_IMAGE: 123456789012.dkr.ecr.eu-west-1.amazonaws.com/orders-service   # scan + fix
  MRSENTRY_REVIEW__HUMAN_THREADS: report                                             # reviewer-thread check
  MRSENTRY_REVIEW__DESCRIBE: fill                                                    # fill empty descriptions

Secrets such as MRSENTRY_NOTIFY_WEBHOOK, JIRA_API_TOKEN and LLM keys go in masked CI/CD variables, not in the file. For the nightly fix MR, add a pipeline schedule. The full walkthrough is in GitLab pipelines.

Any setting works as a CI variable. Take the config key, upper-case it, join the parts with __ and prefix MRSENTRY_. For example, review.feedback.min_votes becomes MRSENTRY_REVIEW__FEEDBACK__MIN_VOTES. Every key is listed in the Configuration reference.

Every feature at a glance

Feature	What it does	Default	Switch it with
1 · On your laptop before you push
Local review	Your commits, uncommitted edits and new files against origin/main, in the terminal.	on	`mrsentry review --local`
Git hooks	Pre-push or pre-commit hook that blocks only on serious findings.	opt-in	`mrsentry hook install`
2a · Understand the change MR pipeline · review job
Full-repo context	Clones the MR head: enclosing code, imports, related symbols, repo docs.	on	`always on`
Linked issues & Jira	Issues the MR closes and Jira tickets, so the change is checked against the ask.	on	`JIRA_URL + JIRA_API_TOKEN` `issues.enabled` `MRSENTRY_ISSUES__ENABLED`
Guidelines & pattern rules	Your team rules; regex rules hit without an LLM call.	on	`mrsentry guidelines test` `review.guidelines` `MRSENTRY_REVIEW__GUIDELINES`
Secret detection	Keys and tokens become critical findings; secrets never reach the LLM.	on	`review.secrets` `MRSENTRY_REVIEW__SECRETS`
2b · Review it MR pipeline · review job
Any LLM	Azure OpenAI, Bedrock, Anthropic, OpenAI, LiteLLM proxy or a local model.	on	`MRSENTRY_MODEL or AZURE_OPENAI_*`
Agent tools	The model reads files and greps the repo to check its claims.	on	`review.agent.enabled` `MRSENTRY_REVIEW__AGENT__ENABLED`
Evidence check & critic	Each finding must quote the real line; a critic pass removes noise.	on	`review.summarizer` `MRSENTRY_REVIEW__SUMMARIZER`
Learns from 👍/👎	Kinds of comments your team keeps rejecting stop being posted.	on	`review.feedback.enabled` `MRSENTRY_REVIEW__FEEDBACK__ENABLED`
2c · Report back MR pipeline · review job
Inline comments	On the exact line, with one-click suggestions; never duplicated.	on	`review.suggestions` `MRSENTRY_REVIEW__SUGGESTIONS`
Overview & reviewer guide	One note, edited in place: verdict, key changes, where to look.	on	`review.guide` `MRSENTRY_REVIEW__GUIDE`
Answers replies	Replies to developers in its threads; concedes and resolves when wrong.	on	`review.replies` `MRSENTRY_REVIEW__REPLIES`
Labels	mrsentry::<verdict> and mrsentry-security on the MR.	on	`labels.enabled` `MRSENTRY_LABELS__ENABLED`
MR descriptions	Suggests (or fills) a description when the author left it empty.	on	`review.describe` `MRSENTRY_REVIEW__DESCRIBE`
Slack / Teams alerts	One message per new critical finding or CVE.	opt-in	`MRSENTRY_NOTIFY_WEBHOOK` `notify.min_severity` `MRSENTRY_NOTIFY__MIN_SEVERITY`
Reviewer-thread gate	Checks people's open threads against the code; can block the merge.	opt-in	`mrsentry threads` `review.human_threads` `MRSENTRY_REVIEW__HUMAN_THREADS`
2d · Secure the image MR pipeline · when an ECR image is set
ECR scan, freshness-aware	Basic or enhanced, on-push or continuous; rescans stale results.	opt-in	`MRSENTRY_ECR_IMAGE` `ecr.on_stale` `MRSENTRY_ECR__ON_STALE`
CVE → dependency path	Finds the direct or transitive dependency behind each CVE.	opt-in	`Maven · Gradle · npm · pnpm · yarn · Poetry · uv · pip`
Fix pushed into the MR	A generated child pipeline commits the upgrade to the MR branch.	opt-in	`MRSENTRY_FIX_WHEN` `fix.enabled` `MRSENTRY_FIX__ENABLED`
3 · Every night scheduled pipeline
One fix MR	Scans the newest image and keeps one fix MR open and up to date.	opt-in	`mrsentry run scheduled`
Verify & AI repair	Builds with your tools; the AI repairs code a bump breaks.	on	`fix.allow_llm_repair` `MRSENTRY_FIX__ALLOW_LLM_REPAIR`
CVE digest	Sends the open critical CVEs to Slack or Teams.	opt-in	`MRSENTRY_NOTIFY_WEBHOOK` `notify.scheduled` `MRSENTRY_NOTIFY__SCHEDULED`