Ask your codebase
Ask questions in plain language and get answers grounded in your repository, with the files and lines that support them.
Where do we retry failed webhooks?
retry.policy.tswebhook.worker.ts
Now accepting pilot teams
Make every engineer fluent in your codebase.
CodePilot AI is an intelligent software engineering workspace. It reads your repositories, answers questions with cited source files, reviews pull requests, and drafts the documentation and test cases your team never has time for.
Read-only repository access. Built on AWS with Amazon Bedrock.
Built for repositories that mix languages
- TypeScript
- JavaScript
- Python
- Java
- C#
- Go
- PHP
- Kotlin
- SQL
From repository to answer in four stages
CodePilot AI turns your repositories into a searchable model of your software, then uses that model to answer, review and document.
- 1
Connect
Link repositories with read-only access. CodePilot AI never writes to your code.
repo payments-platform access read-only
- 2
Index
Files are parsed, split at function and class boundaries, and embedded for semantic search.
1,284 files 9,610 chunks embedded
- 3
Retrieve
Each question pulls the most relevant code, tests and docs, along with how they connect.
top_k 8 similarity 0.82
- 4
Answer
Models on Amazon Bedrock draft the response, and every claim links to a file and line.
auth.middleware.ts:5-12 token.service.ts:19-28
Everything a development team needs to understand its software
One workspace replaces scattered wikis, stale diagrams and hours of code archaeology.
AI-assisted code review
Every pull request gets a first pass for bugs, security concerns and performance problems, ranked by severity with suggested fixes.
Security concernPotential bugPerformance issueSuggested improvement
Documentation generation
Create READMEs, API references and onboarding guides straight from the code, and regenerate them when it changes.
Test-case suggestions
Find untested branches and edge cases, then get ready-to-adapt test skeletons for your framework.
Architecture understanding
See how services, modules and data stores connect, and which parts of the system are risky to change.
Better developer productivity, without more meetings
Shorter onboarding, faster reviews and fewer interruptions for the engineers everyone else depends on.
Ask a question. Get an answer you can verify.
CodePilot AI answers from your actual code, not from guesswork. Every answer lists the files it used, and you can open any of them in place.
- Answers cite file paths and line ranges
- Follow-up questions keep their context
- Says so when the code does not contain an answer
How does authentication work?
CodePilot AI
Searched 1,284 files and found 3 relevant modules
Authentication uses stateless JWT sessions. A token is issued at login and verified by middleware on every protected route.
- Login.
UserService.verifyPassword()checks the credentials, thenTokenService.issue()returns a 15 minute access token and a 7 day refresh token. - Verification.
authMiddlewarereads the Bearer token, callsTokenService.verify()and attachesreq.userbefore the route handler runs. - Refresh.
TokenService.rotate()revokes the used refresh token and issues a new pair.
Ask next
src/middleware/auth.middleware.ts
import { Request, Response, NextFunction } from "express";import { TokenService } from "../services/token.service"; export async function authMiddleware(req: Request, res: Response, next: NextFunction) { const header = req.headers.authorization ?? ""; const [scheme, token] = header.split(" "); if (scheme !== "Bearer" || !token) { return res.status(401).json({ error: "Missing bearer token" }); } try { req.user = await TokenService.verify(token); return next(); } catch { return res.status(401).json({ error: "Invalid or expired token" }); }}src/services/token.service.ts
export class TokenService { static issue(user: User) { const access = jwt.sign({ sub: user.id, org: user.orgId }, env.JWT_SECRET, { expiresIn: "15m" }); const refresh = jwt.sign({ sub: user.id, jti: randomUUID() }, env.JWT_REFRESH_SECRET, { expiresIn: "7d" }); return { access, refresh }; } static async verify(token: string) { const payload = jwt.verify(token, env.JWT_SECRET) as JwtPayload; return UserService.findById(String(payload.sub)); } static async rotate(refreshToken: string) { const { sub, jti } = jwt.verify(refreshToken, env.JWT_REFRESH_SECRET) as JwtPayload; await RevokedTokens.add(String(jti)); return this.issue(await UserService.findById(String(sub))); }}src/services/user.service.ts
export class UserService { static async verifyPassword(email: string, password: string) { const user = await db.user.findUnique({ where: { email } }); if (!user) throw new AuthError("INVALID_CREDENTIALS"); const ok = await argon2.verify(user.passwordHash, password); if (!ok) throw new AuthError("INVALID_CREDENTIALS"); return user; } static findById(id: string) { return db.user.findUnique({ where: { id } }); }}A first-pass reviewer that never gets tired
CodePilot AI reads each pull request in the context of the whole repository, so it can flag problems that are invisible in the diff alone.
- Bugs, security concerns and performance issues
- Findings ranked by severity
- Suggested fixes you can apply in one step
Select a category to filter the findings.
feat: add invoice export endpointPull request #482 into main, 1 file changed
AI review complete
src/controllers/invoice.controller.ts
10export async function exportInvoices(req: Request, res: Response) {- const where = { orgId: req.user.orgId };- const invoices = await db.invoice.findMany({ where });11+ const { customerId } = req.query;12+ const invoices = await db.$queryRawUnsafe(13+ `SELECT * FROM invoices WHERE customer_id = '${customerId}'`14+ );15+ for (const inv of invoices) {16+ inv.customer = await db.customer.findUnique({ where: { id: inv.customerId } });17+ }18+ const total = invoices.reduce((sum, i) => sum + i.amount, 0);19+ const avg = total / invoices.length;20 return res.json({ invoices, avg });21}- Security concernCritical
SQL injection through customerId
invoice.controller.ts:12-14
customerIdfrom the query string is placed directly into a raw SQL string. The previousorgIdfilter was also removed, so any signed-in user could read invoices that belong to other organisations.const invoices = await db.invoice.findMany({ where: { orgId: req.user.orgId, customerId: String(customerId) },}); - Potential bugHigh
Average becomes NaN for empty results
invoice.controller.ts:19
When no invoices match,
invoices.lengthis 0 andavgisNaN, which serialises tonullin the JSON response. Return 0 or omit the field. - Performance issueMedium
One customer query per invoice
invoice.controller.ts:15-17
The loop issues a separate customer lookup for every invoice, so 500 invoices means 501 database round trips. Load the relation in the original query.
const invoices = await db.invoice.findMany({ where: { orgId: req.user.orgId }, include: { customer: true }, take: 500,}); - Suggested improvementLow
Paginate or stream large exports
invoice.controller.ts:11
Every matching invoice is held in memory before responding. Add cursor pagination or stream a CSV, and add tests for the empty result and cross-organisation cases.
TokenService
Issues, verifies and rotates JSON Web Tokens for user sessions. Source: src/services/token.service.ts
| Method | Description | Returns |
|---|---|---|
issue(user) | Creates a 15 minute access token and a 7 day refresh token. | { access, refresh } |
verify(token) | Validates an access token and loads the matching user. | Promise<User> |
rotate(refreshToken) | Revokes the used refresh token and issues a new pair. | Promise<Tokens> |
Configuration
JWT_SECRET and JWT_REFRESH_SECRET sign access and refresh tokens. Load both from a secrets manager in production.
Errors
Invalid signatures and expired tokens throw from jwt.verify(). authMiddleware converts them into a 401 response.
Request flow
Every request passes through authMiddleware before it reaches a controller. Controllers call services, and services own all database access through Prisma.
- src/middleware holds authentication, rate limiting and request logging.
- src/controllers maps HTTP routes to service calls and shapes responses.
- src/services contains business rules such as invoicing, tokens and users.
- prisma/schema.prisma is the single source of truth for the data model.
Dependencies to know about
billing-service is the most connected module: 14 files import it, so changes there deserve extra review.
Your first week on payments-platform
- Install dependencies and start the stack with
npm run dev:stack. - Read the request flow in the architecture overview, then trace one route end to end.
- Run the test suite and open the coverage report to see which modules are least tested.
- Pick a starter issue labelled
good-first-changeand ask CodePilot AI where to begin.
People and ownership
Invoicing changes are usually reviewed by the billing team. Authentication changes need a second reviewer.
Generated from 3 files. Regenerates when main changes.Copy MarkdownExport
Documentation that keeps up with the code
Generate the documents your team keeps meaning to write, and refresh them whenever the code changes.
- README, API reference, architecture and onboarding guides
- Generated from your source, with references back to it
- Regenerated when the main branch changes
Planned cloud architecture
Designed for AWS from the first commit
CodePilot AI is planned around managed AWS services, so the platform can scale, stay observable and keep customer code isolated.
Access and edgeHow people reach the app
Amazon CloudFront
Fast, cached delivery of the web app and static assets.
AWS WAF
Filters malicious requests before they reach the application.
ApplicationWhere the product runs
Amazon ECS Fargate
Runs the web app, API and AI orchestration as containers, with no servers to manage.
AWS Lambda
Event-driven jobs that fetch, parse and index repositories.
Intelligence and dataWhere code becomes searchable
Amazon Bedrock
Foundation models for answers, reviews, documentation and embeddings.
Amazon RDS for PostgreSQL
Relational store for workspaces, repositories and metadata.
pgvector
PostgreSQL extension for similarity search over code embeddings.
Amazon S3
Repository snapshots, generated documents and exports.
Security and operationsApplies to every layer
AWS Secrets Manager
Keeps credentials and keys out of code and configuration files.
Amazon CloudWatch
Logs, metrics and alarms for every component.
AWS CloudTrail
Audit trail of API and account activity.
Built for the moments engineering teams slow down
From a new hire's first week to a legacy migration, CodePilot AI shortens the distance between a question and a confident change.
Onboard developers faster
New joiners ask the codebase instead of interrupting senior engineers, and get answers with links to the exact files.
Review pull requests with a second pair of eyes
Catch bugs, security concerns and slow queries before human reviewers spend their time on the diff.
Understand and modernise legacy code
Map dependencies, find dead code and see what a change will touch before you start refactoring.
Close documentation and test gaps
Generate READMEs, API references and test-case ideas from the code you already have.
See what CodePilot AI finds in your codebase
Book a walkthrough and we will run CodePilot AI against a repository so you can judge the answers, reviews and documentation for yourself.