momus-review
Rust code and security reviewer that asks Jev staged questions about diffs and posts findings with severity and owner routing.
Overview
Momus is a code and security review tool written in Rust that uses TypeSafe Jev through a thin HTTP client speaking the system_one wire format. It reviews the current Git diff (momus review) or scans all source files in a scope (momus scan), producing staged judgments with evidence excerpts, severity and owner routing across lenses such as correctness, security, reliability, compatibility and test gaps.
A GitHub Action publishes inline PR comments via momus github-review, and momus dashboard browses reports locally. Features include secret redaction before sending code, cached answers, a refinement stage, a follow-up budget and a --fail-on-blocking CI exit contract. Version 0.9.0 is the beta milestone, validated on OWASP Juice Shop through a golden-set eval harness; real-history calibration and a comparison benchmark are gates for 1.0.0, and merge approval is disabled by default.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Does this hunk contain a finding under the given lens?(inferred) | yes · no |
| Score | Severity of the finding(inferred) | — |
| Choice | Which owner or mechanism category applies?(inferred) | — |
How it works
- Collect the diff (or scan scope) with excludes and redaction.
- Run staged Jev questions per lens with optional refinement.
- Assemble findings with evidence, severity and owner.
- Publish to the PR and fail CI if blocking findings exist.
Strengths
- Fast, staged judgments with concrete evidence excerpts.
- Secret redaction by default before sending code.
- CI-friendly exit contract and GitHub Action.
Caveats
- Beta (0.9.0); calibration on real history is still pending.
- Requires a TypeSafe Jev key and sends code to the hosted API.
Getting started
Install the momus binary from signed releases or source, then run momus review in a Git repo (or momus review --base origin/main in CI).At a glance
- Type
- Project
- Status
- beta
- Language
- Rust
- Runtime
- CLI, GitHub Action
- Has code
- yes
- Has tests
- yes
- License
- MIT
Use cases and integrations
How curated lists describe it
Code review on rust and javascript (+languages soon) applications. Following lenses correctness, security, reliability, compatibility and testGap.
logicrw/awesome-jev-projects
Frequently asked questions
What does Momus ask Jev?
Staged review questions about each change across correctness, security, reliability, compatibility and test-gap lenses.
Does it send my code to TypeSafe?
Yes, after secret redaction unless you pass --no-redact.
Can it block merges?
It can fail CI with --fail-on-blocking; merge approval is disabled by default.
Related projects
CLI that scans source, build and CI files with Jev for hidden, deceptive or data-stealing behavior before you run unfamiliar code.
CLIbetaTypeScriptUnix-style tools where Jev learns a repo's decision norms and judges each node of a code lead as a bug, lead or clean.
ProjectbetaJavaScriptSemantic code linter that reads each method with its callers and callees and asks decision models about defects, kind, line and severity.
CLIbetaTypeScriptStaged code-review workflow for JS/TS where Jev screens risk, picks evidence, classifies mechanism, scores severity and routes reviewers.
AppprototypeTypeScriptProof-of-concept scanner that asks Jev hundreds of bug questions per Solidity file and writes a heat map of likely vulnerabilities.
ProjectprototypePythonRust CLI that classifies Git commit diffs with Jev into bug fixes, security fixes with CWEs, and change types.
CLIbetaRust