Frequently Asked Questions (FAQ)

Everything you need to know about how CodeJackRabbit works across local workstations, Docker VMs, CI/CD pipelines, coding agents, and official GitHub SDKs.

Architecture & Runtime Environments

What is the difference between CodeJackRabbit and running a linter or AI script inside a Docker VM?

A plain Docker VM or CI container is only an execution box — it runs a stateless command and exits. If you wire a raw LLM or linter directly inside a Docker container, it has:

• No cross-file Blast-Radius Graph: it sees only the raw diff lines, missing 1-hop and 2-hop callers/callees that break downstream modules.
• No Multi-Pass Critic Filter: raw LLM prompts flood pull requests with speculative advice and false positives.
• No Incremental Commit Delta Tracking: pushing a 5-line fix to a 40-file PR re-reviews all 40 files from scratch, burning 5-10x more tokens and repeating resolved comments.
• No Persistent Team Memory (learnings): it forgets every team convention the moment the container stops.
• No Native Forge & Agent Protocol: it cannot post line-anchored committable suggestion blocks, update interactive PR walkthrough checkboxes, or expose 22 MCP tools to your IDE.

Best of both worlds: CodeJackRabbit is not a replacement for Docker — it is the intelligence and orchestration engine that you can run directly on your laptop (cjr review --local), inside your own self-hosted Docker containers and CI runners, or paired with ephemeral micro-VM sandboxes to validate autofix patches before they are proposed on a pull request.

When should I use Local CLI (--local), a Self-Hosted Docker container, or Managed Cloud?

1. Local CLI (cjr review --local): Run on your laptop before git commit or git push, or inside local IDE agents via MCP. Requires no account and makes zero network calls for deterministic analysis.
2. Self-Hosted Docker / CI Runner: Run CodeJackRabbit inside your own Docker infrastructure or GitHub Actions / GitLab CI runners, connected to your private Git forge and internal LLM endpoint (Ollama, vLLM, Azure OpenAI, AWS Bedrock).
3. Managed Cloud (By Invitation): Zero-maintenance webhook automation for GitHub, GitLab, Bitbucket, and Azure DevOps, cross-repository PR Triage Queue (P0–P3), shared organization policies, and managed coding task sandboxes.

How is CodeJackRabbit different from pasting a diff into ChatGPT or Claude?

Pasting a diff into a chat window gives you unverified prose without repository structure, dependency vulnerability databases, or committable patches. CodeJackRabbit runs a 5-stage pipeline:

1. Planner & Triage: classifies PR risk and architectural layers.
2. Dependency Graph & Context Explorer: computes the 0–100 Blast Radius and checks linked issues.
3. Deterministic + Specialist Analyzers: runs structural AST rules across 17 languages, Shannon entropy secret detection, 15 structured linter adapters, Supply-Chain typosquatting/slopsquatting checks, Performance N+1 detection, and optional LLM semantic review.
4. Critic Self-Verification: filters out low-confidence noise and enforces policy gates.
5. Actionable Output: produces conflict-free multi-file patches, Stacked PR split plans, SARIF 2.1.0 reports, and phased coding plans for agents.

Privacy, Security & AI Models

Does local review send my source code anywhere?

No. cjr review --local reads the selected Git diff directly from your workstation and performs zero network calls. Connected cloud features and external model calls are strictly opt-in through your configuration.

Which AI models and providers can I use?

You can configure openai, anthropic, google, ollama, vllm, llamacpp, lmstudio, or any OpenAI-compatible endpoint in .codejackrabbit.yaml. API keys are read exclusively from environment variables — never stored in repository configuration. Deterministic review works offline even without an LLM configured.

Can CodeJackRabbit enforce SOC2, PCI-DSS, or HIPAA compliance gates and export to GitHub Security?

Yes:

• SARIF 2.1.0: cjr sarif --output cjr.sarif.json exports findings with CWE and OWASP Top-10 metadata for GitHub Advanced Security Code Scanning.
• CycloneDX 1.5 SBOM: cjr sbom --output sbom.cdx.json generates a standards-compliant Software Bill of Materials and flags typosquatted, AI-hallucinated ("slopsquatted"), or copyleft-restricted packages.
• Compliance Gates: cjr compliance-gate --profile soc2 (or pci-dss, hipaa) evaluates regulatory controls and emits a pass/block verdict with a cryptographic attestation digest.

Coding Agents & Official GitHub SDKs

How do coding agents (Claude Code, Cursor, Windsurf, Copilot, Antigravity, Codex, Cline) connect?

Run a single command in your repository:

cjr ai connect --agent all --mcp

This wires CodeJackRabbit's 22-tool stdio MCP server (cjr mcp) and instruction contracts so your agent can autonomously run reviews, inspect the blast-radius graph, generate 6-section phased coding plans, apply conflict-free autofixes, and verify compliance gates.

Where are the official GitHub SDKs located and how are they kept up to date?

All official client SDKs are published on GitHub under github.com/orgs/jackai-dev, with an umbrella index at github.com/jackai-dev/codejackrabbit-sdk and dedicated repositories per language:

• TypeScript: github.com/jackai-dev/codejackrabbit-sdk-typescript
• JavaScript (ESM + CJS): github.com/jackai-dev/codejackrabbit-sdk-javascript
• Python: github.com/jackai-dev/codejackrabbit-sdk-python
• Go: github.com/jackai-dev/codejackrabbit-sdk-go
• Rust: github.com/jackai-dev/codejackrabbit-sdk-rust
• Java: github.com/jackai-dev/codejackrabbit-sdk-java
• .NET (C#): github.com/jackai-dev/codejackrabbit-sdk-dotnet
• Kotlin: github.com/jackai-dev/codejackrabbit-sdk-kotlin

Every SDK is generated from our OpenAPI 3.1.0 contract via OmniWrap and automatically synchronized by CI/CD whenever a new CodeJackRabbit release or a new language generator is published.

Workflow, Noise Control & Onboarding

How does CodeJackRabbit avoid noisy comments and learn our team's rules?

1. Review profiles: choose quiet (high-severity defects only), chill (balanced default), or assertive (comprehensive).
2. Path instructions: scope custom instructions to file globs in .codejackrabbit.yaml (for example src/db/** or packages/api/**).
3. Scoped Learnings: reply @codejackrabbit remember: stop flagging TODO in scripts/** on a PR or run cjr learnings add locally; CodeJackRabbit suppresses matching rules in future reviews.

What if a pull request is huge or breaks an API/database contract?

• Stacked PR Splitter (cjr split-pr): decomposes a large diff into an ordered 5-layer topological stack (Database/Schema → Core Domain → API/Services → UI/Clients → Tests/Docs) with ready-to-run Git commands.
• Contract Drift Guard (cjr contract-drift): detects removed exports, narrowed function signatures, OpenAPI/GraphQL breaking changes, and destructive SQL migrations (DROP COLUMN, ALTER TYPE), recommending a safe Expand-and-Contract migration path.

Why does cjr review --local say "No changes selected"?

Local review analyzes a Git diff, not static untouched files. In a clean working tree with no uncommitted edits, compare your branch against a base branch with cjr review --local --base main or inspect the last commit with cjr review --local --committed --base HEAD~1.

Why is Cloud & Team access by invitation, and how do I get an invite?

The CLI (cjr), MCP server, and GitHub SDKs are open to everyone today without an account. Managed Cloud workspaces (hosted webhooks, cross-repo triage, and cloud coding boxes) are rolling out by invitation to ensure dedicated sandbox capacity. Register your email on the home page or pricing page to join the waitlist and receive your cjr_inv_... invite code.