One grumpy caveman. Whole software lifecycle. Grug crush bug, block evil CVE, gate weak code, run project smooth like rock. Grug know SDLC. Grug live in GitHub, post Check Runs, never spam comments. You ship. Grug guard.
| Persona | Verdict |
|---|---|
| smasher | 2 null-deref paths in parser.goblock |
| guard | CVE-2026-1144 in lodash@4.17.20block |
| elder | complexity 18 in resolveTree()warn |
| chief | missing acceptance criteriablock |
| warder | changelog · semver hint minorpass |
Static analysis, symbolic execution, and LLM diff review on every PR.
Vulnerable dependencies and known exploits get gated before merge.
Complexity, coverage, dead code, and review hygiene held to a line.
Stale PRs, sprint burndown, changelog drafts, semver hints. No yaml.
// One GitHub App. Many personas. Posts as Check Runs so branch-protection rules can require any of them. Toggle the ones your team needs.
Static analysis + symbolic execution + LLM diff review. Finds null-derefs, race conditions, off-by-ones, and the sneaky logic bugs your linter misses.
SCA on every dependency, secret scanning, SAST on the diff, and a CVE database refreshed hourly. Evil shall not pass.
Line-by-line review for naming, complexity, test coverage and dead code. Posts inline suggestions you can accept with one click.
Hunt Plan on every PR (Chief ask before tribe leave cave). Stale-PR Pulse. Auto-changelog with semver hint. Sprint burndown that lives in your repo, not a Jira tab. Warder gates the deploy before virus infect tribe.
// Each persona is its own Check Run. Require any of them in branch protection. Toggle per-repo. Bring your own model key if you self-host.
Diff-scoped mutation testing today (mutate the changed lines, run your suite, surface surviving mutants). LLM diff review rides the Elder; broader static analysis is on the roadmap.
SCA, secret scanning, SAST on the diff, hourly CVE feed. Quarantines evil dependencies before they reach main.
Style, naming, complexity, test coverage, dead code. "Strong code only" is the motto. Grumpy but fair.
Hunt Plan first. Before the tribe leave the cave, Chief ask: hunt have a name? meat counted? path home known? Project management without leaving the repo.
Stand at cave mouth. Drafts the changelog from merged PRs, picks semver, gates the deploy on staging health, posts release notes to Slack. Bad release not get past warder. Virus not infect tribe.
Define a persona in YAML or TS. Hook into the same Check Run pipeline. Grug ecosystem, your rules.
// Drop-in skills extend Grug. Some are capabilities (Terraform plan review, GraphQL breaking-change). Some are cosmetic skins. All of them are free.
// Two kinds of skills. Capabilities are extra checks Grug runs on your PRs — turn them on and Grug starts reviewing that thing too. Skins just change how Grug looks and talks.
Grug reads your Terraform changes before you apply them. Yells if you're about to delete a database, change permissions, or break something already running.
Watches your GraphQL or OpenAPI schema. If a PR removes a field or renames a type that callers still use, Grug blocks the merge until someone owns the migration.
Renders any UI components your PR touched and checks contrast, labels, and screen-reader behaviour. Won't let you ship a button no one can read.
Reads your Postgres or MySQL migrations and warns about ones that lock big tables, can't be re-run, or have no rollback. Catches the migrations that take prod down at 2am.
Caveman. Wooden club. Orange polka-dot vest. The Grug your repo deserves.
Suit and tie. Replaces caveman speak with passive-aggressive memos. For repos that take themselves seriously.
Three haircuts and a leather jacket. Includes a "club smash" reaction GIF.
Bring your own emoji set and override Grug's failure copy. For in-jokes and angrier teams.
// After GitHub OAuth you land here. Three columns: repos, personas, configuration. No yaml. No setup wizard.
// Grug is free and open source, AGPL-3.0. The way you get Grug is to run your own — the cave on this website is one tribe's private cave, not a public service.
// Lifted verbatim from real check-run output. Unedited.