Last updated: April 16, 2026

Documentation

This guide covers everything you need to get started with BlueAI Akira, understand how reviews work, and get the most out of the Console. If anything here isn't clear or is missing, just reach out to us.

1. Overview

Akira automatically reviews your Pull Requests and flags vulnerabilities directly on GitHub — right where your team already works.

Whenever someone opens a Pull Request (or pushes new commits to an already open PR), Akira receives the event via webhook, analyzes the diff with AI, and posts comments directly on the PR. Each comment includes a severity level, the CWE code for the vulnerability found, and a suggested fix.

The focus is real security, based on the OWASP Top 10 — SQL Injection, XSS, secret exposure, broken access control, and the rest of the list. Akira runs in parallel with your CI (never on the critical path): it doesn't block merges, doesn't delay deploys, and typically returns its analysis within seconds.

2. Getting started

Three steps until the first review happens on its own.

Create your account

Go to the Akira website and click Create account. You can sign up with email and password or log in directly with your GitHub account (OAuth). If you already use GitHub daily, OAuth is the shortest path.

Install the GitHub App

After entering the Console for the first time, the onboarding screen will ask you to install the Akira GitHub App. Click Install — you'll be taken to GitHub.

On GitHub, choose whether Akira will have access to all repositories in your account/organization or only selected ones. You can change this choice later at any time. Click Install & Authorize.

Open a Pull Request

You're redirected to the Console and your repositories are synced automatically. That's it — from this point on, any PR opened in the authorized repositories will trigger an automatic review.

No YAML, no CI workflow, no manual webhook. Akira listens to GitHub events and acts on its own.

If something goes wrong during onboarding:

Profile sync delay: wait a few seconds and try again.
GitHub App already linked to another Akira account: go to github.com/settings/installations, remove the old installation, and reinstall it from Akira.

3. How reviews work

Every review is triggered by a webhook, runs in parallel with your CI, and posts comments right on the line of code.

When a review is triggered

When a Pull Request is opened.
On every new push to an already open PR — each push generates a new review and consumes 1 unit of the monthly quota.

What gets analyzed

The PR's diff against the target branch (only the changes, never the whole repository).
OWASP Top 10 vulnerabilities — SQL Injection, XSS, secret exposure, broken access control, and others.
Code patterns related to security, performance, and best practices.

Where comments show up

Right on the Files changed tab of the Pull Request on GitHub, on the exact line of the issue. Each comment includes the type, severity, CWE code (when applicable), and a suggested fix — it's not just "this is wrong," it's "replace it with this."

The 8 comment types

Bug — a functional error in the code.
Typo — a typing mistake.
Code Smell — code that works but signals poor structure.
Best Practice — a deviation from the language or framework's best practices.
Security — a general security concern.
Vulnerability — a known vulnerability, with CWE classification.
Performance — an impact on performance.
Architecture — a structural or architectural concern.

4. The Console

The web dashboard where you track metrics and manage repositories, licenses, and your plan.

Home: key metrics — PRs reviewed in the last 7 days, total comments, average comments per PR, monthly quota usage, trend chart, and comment type breakdown.
My Account: profile data, GitHub integration, password changes, and plan information.
Repositories: the list of repos synced from GitHub — turn review on/off, filter by status, sync manually.
Licenses: manage the developers with access to Akira (seat-based, limited by your plan).
Plans: view your current plan, compare options, and upgrade.
Settings: general preferences, including the comment language.
Notifications bell: important alerts (quota running out, review failure, plan change) at the top of the Console.

5. Managing repositories

On the Repositories screen you control which projects Akira works on.

Turning review on/off: each repository has a toggle. Turning it off doesn't uninstall the GitHub App — Akira simply ignores events from that repo. Useful for pausing reviews on legacy projects or documentation repositories.
Filter by status: separate active from disabled ones to find them quickly.
Sync with GitHub: if a new repository doesn't show up yet, click Sync — Akira fetches it from GitHub and updates the list.
Public vs. private: on the Open plan only public repositories are supported. Starting with Squad, private ones too.

To grant or remove access to entire repositories, that's configured on the GitHub App page, inside your organization's settings on GitHub. Akira strictly follows what was authorized there.

6. Managing developers (licenses)

On paid plans, every developer who has PRs reviewed occupies a license (seat).

The Licenses screen shows who in your organization is active, how many licenses you have available, and how many are already taken. You can add and remove devs as your team changes.

Add a developer: enter an email or GitHub username and send the invite.
Remove a developer: frees up the seat to be assigned to someone else. Every removal asks for confirmation before it runs.
Limits per plan: Open (1 dev), Squad (up to 5), Scale (as contracted), Enterprise (up to 30).

If you try to add more people than your plan allows, the Console suggests an upgrade. On Enterprise, team management gains extra features like SSO and centralized controls.

7. Plans and quotas

The quota is always in PRs reviewed per month — each push to an open PR counts as 1 review.

How the quota works

A PR with 4 subsequent pushes consumes 5 reviews from your quota (1 open + 4 pushes). The quota renews at the start of each monthly cycle.

Available plans

Open — free forever: public repositories, 30 PRs/month, basic review, Console access. Ideal for open source projects and for trying it out without a card.
Squad — R$ 79/dev/month: up to 5 devs, private repositories, 150 PRs/month/dev, email support.
Scale — R$ 97/dev/month (most popular): 500 PRs/month/dev, full OWASP analysis, performance alerts, unlimited diff, priority support.
Enterprise — R$ 2,497/month (up to 30 devs): SSO, team management, formal SLA, on-premise option.

When the quota is reached

Further reviews are paused until the next cycle or until you upgrade. PRs keep opening normally on GitHub — only Akira stops commenting. The notifications bell warns you before you get there.

How to upgrade

Go to Plans in the Console, choose the plan you want, and complete the payment. The new limit takes effect immediately.

8. Language and settings

Today Akira comments in Brazilian Portuguese.

In the Console's Settings section, you can adjust your language preference:

Brazilian Portuguese (pt-BR): available.
English (en-US): coming soon.
Spanish (es): coming soon.

Being upfront about customization: today Akira does not let you customize OWASP rules, severity thresholds, ignore lists, or comment format. The analysis is standardized precisely to keep quality and consistency across teams. Custom rules are on the roadmap.

9. Your code's privacy

Your code isn't stored. Period.

When a PR triggers a review, Akira receives the diff from GitHub, processes it in memory, generates the comments, and discards the content. Nothing is written to disk, nothing goes to logs, nothing is used to train any model.

What persists in our database is only metadata: which PR was reviewed, how many comments were generated, which repository it belongs to, and which user it's linked to — enough for your quota, the Console's metrics, and billing history.

If you uninstall the GitHub App, Akira immediately stops receiving events from your repositories. Full details in Security and Privacy Policy.

10. Frequently asked questions

The questions that come up the most.

Is my code stored anywhere?

No. The analysis runs in memory and the diff is discarded as soon as the comments are generated. We only keep review metadata (which PR, how many comments, when it happened). We currently use the Google Gemini API for analysis. The provider does not permanently retain any part of the submitted diff.

Is my code used to train AI models?

No. The Google Gemini API officially guarantees it does not use submitted diffs to train its models.

How long does Akira keep the data sent for analysis?

No permanent storage. The diff is processed by the Google Gemini API and discarded as soon as the analysis finishes — usually within a few seconds.

What exactly gets sent to Google?

Only the pull request diff (added/removed lines, changed file names) and the fixed analysis prompt. The PR title, description, and comments are never sent. Note: Akira does not filter the diff's content — if a credential is hardcoded in the changed code, it gets sent like any other line.

Does anyone at Akira read my code?

No. The process is automatic: the diff goes straight from Akira's worker to the Google Gemini API, and the analysis comes back as PR comments, with no human involved.

Does Akira slow down my CI or block the merge?

By default, no. It runs in parallel with your pipeline, not inside it — and if Akira becomes unavailable, your CI and merge keep working normally. Starting with the Squad plan there's an optional feature: when Akira finds a critical issue, it marks the review check as failed. If you require that check in your branch protection rules (on GitHub), the merge is blocked until it's resolved — you decide whether to turn it on.

How long does a review take?

Typically a few seconds after GitHub triggers the webhook. Very large PRs may take a bit longer.

How does the PR quota work?

The quota counts every review performed — that includes opening the PR and every subsequent push while it's open. So 1 PR with 4 pushes = 5 reviews.

Can I disable a type of alert (e.g., Code Smell)?

Not yet. For now Akira doesn't let you customize rules, severities, ignores, or comment format. Coverage is standardized to keep quality and consistency across teams. Custom rules are on the roadmap.

Can I add my own rules?

Not part of the product yet. It's on the roadmap.

Does Akira review private repositories?

Yes, starting with the Squad plan. On the Open (free) plan, only public repositories are supported.

How do I choose which repos Akira works on?

On the Console's Repositories screen, each repo has an ON/OFF toggle. To grant or block access to entire repositories, that's configured on the GitHub App page, inside your organization's settings on GitHub.

What happens if I go over my monthly quota?

New reviews are paused until the next monthly cycle or until you upgrade your plan. When a review is skipped for lack of quota, Akira posts a comment on the PR and you get an alert in the notifications bell.

Are the comments in English?

They come in whatever language you pick in the dashboard. Today Akira comments in Portuguese (pt-BR), English (en-US), or Spanish (es) — the body of each comment is translated into the language set in your profile.

Can I install Akira on more than one GitHub organization?

Yes. Just repeat the GitHub App installation process in each organization and authorize the repositories you want.

11. Support

If you're stuck on something, talk to us instead of guessing.

Open plan: public documentation (this page) and knowledge base.
Squad plan: email support.
Scale plan: priority support, with a shorter response time.
Enterprise plan: formal SLA defined by contract and a dedicated channel with the team.

General contact: contato.akira@blueaisolutions.com.br

If you ran into a technical issue, include in your email: your organization's name on GitHub, the affected repository, the PR URL (when applicable), and roughly when it happened. This speeds up the investigation a lot.

If you think Akira got a comment wrong, let us know too. Feedback about false positives is what helps us calibrate reviews better over time.

BlueAI Solutions Ltda. — April 16, 2026

This page evolves with the product. Suggestions for topics that should be here? Write to contato.akira@blueaisolutions.com.br.