Setup guide
From zero to an attested review
Four steps. No YAML ceremony required — the agent works out of the box, and every choice it makes is documented below.
1
Install the GitHub App
Grant exactly what the review needs — nothing more:
- Pull requests: read & write — posts the review comment and the check run on each PR.
- Contents: read‑only — clones the PR head to run analyzers and fork simulations.
- Events:
pull_requestonly — the app ignores everything else.
The app installs per‑repository. Your source never leaves the review pipeline; the only artifacts it publishes are the PR comment and the on‑chain attestation.
2
Optionally add rextor.yaml
The agent audits every PR against its default profile. A config file tunes scope and thresholds per repo shipping Oct 2026:
rextor.yaml — copy‑paste
# paths audited on every PR (globs, relative to repo root) include: - "contracts/**/*.sol" exclude: - "test/**" - "node_modules/**" # the check run fails when a finding at or above this severity is present severity_gate: high
Without a config, the defaults above apply — Solidity sources audited, tests excluded, no merge gate.
3
Open a pull request
Any PR that touches the audited paths triggers a review: the diff is scoped to changed functions and callsites, deterministic analyzers run sandboxed, the LLM triages with citations, and criticals are reproduced on a fork before anything is reported.
4
What arrives on the PR
A review comment with the verdict — and an attestation footer pointing at the on‑chain record. The anatomy below mirrors a real comment from our test repository:
rextor‑audit[bot] · riskScore 41 / 100 · 1 reclassification, 0 additions
| Severity | Finding | Location |
|---|---|---|
| medium | ETH lock‑in via unguarded setOwner — added by triage, cited lines | Vault.sol:L41‑44 |
| high | unchecked send before state finalization — reclassified high→critical, reverted to high on PoC | Vault.sol:L19‑23 |
attested on Tempo testnet (42431) · tx 0x6456…9e20 ↗
reviewId = keccak256("rextor/review/v1|owner/repo|2|<headSha>")
findingsHash = sha256 of the exact findings JSON in this comment — recompute it and call verify()
The check run reports the same verdict, so branch protection can consume it. Every number in the comment is recomputable from the findings JSON alone — the rubric is published, the hash is on‑chain, and the PR comment carries the exact recipe.