Get early access

AI code review for GitLab merge requests

Deterministic checks that can block a merge. Quality signals from Lilly, the AI reviewer, that never block. The first layer has yes or no answers. Lilly reads the diff and leaves a few comments for a person to weigh.

Get early accessSupply chain proxy

Code review is a paid add-on to MopokeHQ.

Checks that can block a merge

These pass or fail. Nothing is guessed, and every result can be reproduced.

Missing package
The merge request adds a dependency that is not on the registry
Typosquat
The name is one slip away from a popular package
Days-old package
A brand-new package that deserves a second look before production
Missing API
A call to a function or method that does not exist, found with your project’s type checker, such as tsc or PHPStan

Why package checks belong in review

Code assistants sometimes suggest packages that do not exist. A USENIX Security 2025 study of 576,000 generated code samples found that, on average, at least 5.2% of packages suggested by commercial models, and 21.7% by open-source models, did not exist.

If someone registers one of those names, the next install runs their code. The risk is called slopsquatting. Package age matters too: in the March 2026 axios attack, the malicious dependency was published about 18 hours early as a clean decoy, to get past “brand-new package” alarms. A rule measured in days still catches that.

!482 Add PDF exportPipeline failed
  • pdf-render-utilsNot found on the registry
  • Str::toSlugCase()No such method, reported by PHPStan
  • dompdf/dompdfPublished 6 years ago, no typosquat match

Example data

Quality signals, not authorship

MopokeHQ does not guess who or what wrote the code. It flags patterns that make code harder to trust, whoever typed them. Lilly also looks for security issues in the diff.

  • Tests that assert nothing

    The test runs, passes, and checks no outcome.

  • Tests that mock the thing under test

    The code being tested is replaced, so the test proves the mock.

  • Duplicate helpers

    A new helper that does what an existing one already does.

  • Swallowed errors

    An error is caught and dropped, so failures go quiet.

  • Narrating comments

    Comments that restate what the next line does.

  • Needless abstraction

    Layers the code does not need yet.

Five comments, one summary, no blocks

Noisy review bots get muted. Lilly leaves at most five inline comments and one summary, and never blocks a merge. Only the deterministic checks can fail the pipeline.

LillyAIon ExportController.php line 48

This catch block drops the exception and returns an empty PDF, so a failed export looks like a successful one. Consider logging it or letting it reach the error handler.

Quality signal: swallowed error

Where your code goes

Code leaves MopokeHQ’s Sydney hosting for this feature, because an AI provider reads the diff. So code review is off by default for client projects. The project owner opts in, and MopokeHQ logs the decision.

Alert triage is different. When Lilly writes alert notes it never sees source code; it works from the package, version, extensions and public advisory text.

Security and data
Client projects
Off by default
Turning it on
The project owner opts in, and the decision is logged
AI off switch
Per organisation
AI off switch
Turns AI features off

Fits the GitLab you run

Comments land on the merge request in GitLab. Built for teams on GitLab Free and Premium, next to MopokeHQ’s merge request gate, which fails pipelines only on new findings. Pull requests on GitHub, Gitea, Forgejo and Bitbucket follow with each native integration.

MopokeHQ for GitLab
Pricing
A paid add-on, priced separately
AI usage
From your organisation’s pooled AI credits

Questions

Should you review AI-generated code?

Review all code the same way, whoever or whatever wrote it. MopokeHQ adds checks for problems that show up in fast-written code: packages that do not exist, typosquats, brand-new packages and calls to APIs that do not exist.

Does MopokeHQ detect AI-generated code?

No. It does not guess authorship. It flags quality signals, such as tests that assert nothing or errors that get swallowed, whoever wrote the code.

Can the AI reviewer block a merge request?

No. Lilly’s comments never block. Only the deterministic checks can fail a pipeline.

How many comments will it leave?

At most five inline comments and one summary from Lilly.

Does my code leave MopokeHQ?

Yes, for this feature: the diff goes to an AI provider outside MopokeHQ’s Sydney hosting. That is why it is off by default for client projects. The project owner opts in and the decision is logged. Organisations can also turn AI off entirely.

Does GitLab have its own AI code review?

Yes. GitLab lists its agentic Code Review Flow for Free, Premium and Ultimate through the GitLab Duo Agent Platform, and its older Duo Code Review needs the Duo Enterprise add-on. Check GitLab’s pricing for your setup. MopokeHQ’s add-on is separate: blocking checks on packages and APIs, plus a capped set of AI comments.

What is slopsquatting?

Registering a package name that code assistants tend to invent, so the next person who installs the suggestion gets the attacker’s code. The term dates from April 2025. MopokeHQ’s check for packages that do not exist, plus the package age check, targets this risk.

Review the risky part first

Blocking checks for packages and APIs, and a handful of quality signals a person can weigh. A paid add-on to MopokeHQ.

Get early accessSee how it works