Enterprise-grade autonomous code review powered by AI and MCP tools
Named after the Hindu deity of justice and death, Yama judges code quality and ensures only the worthy changes pass through.
Yama V2 represents a complete architectural shift from coded orchestration to AI-native autonomous orchestration:
| Aspect | V1 | V2 |
|---|---|---|
| Architecture | Coded orchestration | AI autonomous orchestration |
| Bitbucket Integration | Direct handler imports | External MCP server |
| Context Strategy | Pre-fetch everything | Lazy load on-demand |
| AI Role | Static analyzer | Autonomous agent with tools |
| Decision Making | TypeScript code | AI decides |
| Tool Access | None | All operations via MCP |
| File Analysis | All at once in prompt | File-by-file AI loop |
| Jira Integration | None | MCP tools for requirements |
| Comment Posting | Batch after analysis | Real-time as found |
| PR Blocking | Manual logic | AI decision based on criteria |
YamaV2Orchestrator
↓
NeuroLink AI Agent (Autonomous)
↓
MCP Tools (Bitbucket + Jira)
↓
Pull Request Operations
-
Context Gathering (AI-driven)
- Reads PR details
- Finds and reads Jira ticket
- Loads project standards from memory-bank
- Reads .clinerules for review guidelines
-
File-by-File Analysis (AI-driven)
- Reads each file diff individually
- Searches code for context when needed
- Reads reference files to understand patterns
- Comments on issues immediately
-
PR Description Enhancement (AI-driven)
- Analyzes changes and requirements
- Generates comprehensive description
- Updates PR with enhanced content
-
Final Decision (AI-driven)
- Evaluates all findings
- Applies blocking criteria
- Approves or blocks PR
# Node.js 18+ required
node --version
# Install Yama V2
npm install @juspay/yama@2.0.0Create a .env file:
# Bitbucket
BITBUCKET_USERNAME=your.email@company.com
BITBUCKET_APP_PASSWORD=your-http-access-token
BITBUCKET_BASE_URL=https://bitbucket.yourcompany.com
# Jira (optional)
JIRA_EMAIL=your-email@company.com
JIRA_API_TOKEN=your-jira-api-token
JIRA_BASE_URL=https://yourcompany.atlassian.net
# AI Provider (optional - defaults to auto)
AI_PROVIDER=google-ai
AI_MODEL=gemini-2.5-pro
# Langfuse Observability (optional)
LANGFUSE_PUBLIC_KEY=your-public-key
LANGFUSE_SECRET_KEY=your-secret-key
LANGFUSE_BASE_URL=https://cloud.langfuse.com# Create default config
npx yama init
# Or copy example
cp yama.config.example.yaml yama.config.yaml
# Edit configuration
vim yama.config.yaml# Test initialization
npx yama review --help# Review by PR ID
npx yama review \
--workspace YOUR_WORKSPACE \
--repository my-repo \
--pr 123
# Review by branch
npx yama review \
--workspace YOUR_WORKSPACE \
--repository my-repo \
--branch feature/new-feature# Test without posting comments
npx yama review \
--workspace YOUR_WORKSPACE \
--repository my-repo \
--pr 123 \
--dry-runnpx yama enhance \
--workspace YOUR_WORKSPACE \
--repository my-repo \
--pr 123import { createYamaV2 } from "@juspay/yama";
const yama = createYamaV2();
await yama.initialize();
const result = await yama.startReview({
workspace: "YOUR_WORKSPACE",
repository: "my-repo",
pullRequestId: 123,
dryRun: false,
});
console.log("Decision:", result.decision);
console.log("Issues:", result.statistics.issuesFound);version: 2
configType: "yama-v2"
ai:
provider: "auto"
model: "gemini-2.5-pro"
temperature: 0.2
mcpServers:
jira:
enabled: true
review:
enabled: true
focusAreas:
- name: "Security Analysis"
priority: "CRITICAL"
- name: "Performance Review"
priority: "MAJOR"See yama.config.example.yaml for complete configuration options.
Create custom review standards for your repository:
mkdir -p memory-bankCreate memory-bank/coding-standards.md:
# Project-Specific Review Standards
## Critical Security Rules
1. ALL payment data MUST be encrypted
2. NO credit card numbers in logs
3. ALL database queries MUST use parameterized statements
## Performance Requirements
- API response time: < 200ms p95
- Database queries: < 50ms p95Yama V2 AI will automatically read and apply these standards.
AI reads only what it needs:
- Sees unfamiliar function? →
search_code("functionName") - Needs to understand import? →
get_file_content("path/to/file.ts") - Confused about structure? →
list_directory_content("src/")
AI comments as it finds issues:
- No batching - immediate feedback
- Severity-based emojis (🔒 CRITICAL,
⚠️ MAJOR, 💡 MINOR, 💬 SUGGESTION) - Actionable suggestions with code examples
AI reads Jira tickets:
- Extracts acceptance criteria
- Verifies implementation matches requirements
- Calculates requirement coverage
- Blocks PR if coverage < 70%
AI uses tools to understand code:
search_code()- Find function definitionsget_file_content()- Read related fileslist_directory_content()- Explore structure
AI applies these criteria automatically:
-
ANY CRITICAL issue → BLOCKS PR
- Security vulnerabilities
- Data loss risks
- Authentication bypasses
-
3+ MAJOR issues → BLOCKS PR
- Significant bugs
- Performance problems
- Logic errors
-
Requirement coverage < 70% → BLOCKS PR (when Jira enabled)
- Incomplete Jira implementation
- Missing acceptance criteria
Yama V2 uses MCP (Model Context Protocol) servers for tool access:
- Package:
@anthropic/bitbucket-mcp-server - Tools: get_pull_request, add_comment, search_code, etc.
- Status: Production ready
- Package:
@nexus2520/jira-mcp-server - Tools: get_issue, search_issues, get_issue_comments
- Status: Optional integration
Track review performance with Langfuse integration:
# Set Langfuse environment variables
export LANGFUSE_PUBLIC_KEY=your-public-key
export LANGFUSE_SECRET_KEY=your-secret-keyAnalytics include:
- Tool calls made
- Token usage
- Cost estimate
- Duration
- Decision rationale
# Verify environment variables
echo $BITBUCKET_USERNAME
echo $BITBUCKET_APP_PASSWORD
echo $BITBUCKET_BASE_URL- Check
focusAreasin config - Verify
blockingCriteriaare clear - Ensure
temperatureis low (0.2-0.3) - Review project-specific standards in memory-bank
- Enable
lazyLoading: truein config - Reduce
maxFilesPerReview - Set
maxToolCallsPerFilelimit - Use
excludePatternsto skip generated files
| Metric | Target |
|---|---|
| Review time | < 10 min for 20 files |
| Token usage | < 500K per review |
| Cost per review | < $2 USD |
| Accuracy | > 95% of V1 findings |
- Use lazy loading - Don't pre-fetch everything
- Cache tool results - Reuse MCP responses
- Exclude generated files - Skip lock files, minified code
- Limit file count - Split large PRs
Breaking Change: V1 has been completely replaced by V2. There is no backward compatibility.
Use the built-in migration script to convert your V1 config to V2 format:
# Rename your current config to V1
mv yama.config.yaml yama.v1.config.yaml
# Run migration (dry-run first to preview)
npx yama migrate-config --dry-run
# Run actual migration
npx yama migrate-config
# Or with custom paths
npx yama migrate-config \
--input yama.v1.config.yaml \
--output yama.config.yaml \
--forceThe migration script will:
- ✅ Migrate AI provider settings
- ✅ Convert focus areas to structured format
- ✅ Transform required sections with descriptions
- ✅ Apply V2 defaults for new features
⚠️ Warn about dropped V1 features (batchProcessing, multiInstance, etc.)- 📊 Generate a detailed migration report
- Migrate configuration (automated):
npx yama migrate-config- Update imports:
// V1 (removed)
// import { Guardian } from "@juspay/yama";
// V2 (use this)
import { createYamaV2 } from "@juspay/yama";
const yama = createYamaV2();- Set environment variables: V2 uses MCP servers configured via env vars
# Bitbucket (required)
export BITBUCKET_USERNAME=your.email@company.com
export BITBUCKET_APP_PASSWORD=your-http-access-token
export BITBUCKET_BASE_URL=https://bitbucket.yourcompany.com
# Jira (optional)
export JIRA_EMAIL=your-email@company.com
export JIRA_API_TOKEN=your-jira-api-token
export JIRA_BASE_URL=https://yourcompany.atlassian.net- Test thoroughly: V2 uses autonomous AI orchestration - validate behavior in dry-run mode first
npx yama review --workspace YOUR_WORKSPACE --repository my-repo --pr 123 --dry-run| V1 Section | V2 Section | Notes |
|---|---|---|
providers.ai |
ai |
Direct mapping |
features.codeReview |
review |
Restructured |
features.descriptionEnhancement |
descriptionEnhancement |
Restructured |
monitoring |
monitoring |
Enhanced |
rules |
projectStandards |
Converted to focus areas |
These V1 features are removed in V2 (AI handles autonomously):
providers.git→ Use environment variablesfeatures.codeReview.batchProcessing→ AI manages batchingfeatures.codeReview.multiInstance→ Single autonomous agentfeatures.codeReview.semanticDeduplication→ AI deduplicates naturallyfeatures.securityScan→ Built into AI promptscache→ MCP tools handle caching
We welcome contributions! Please see our Contributing Guide for details.
- Fork the repository
- Create a feature branch (
git checkout -b feature/amazing-feature) - Commit your changes (
git commit -m 'Add amazing feature') - Push to the branch (
git push origin feature/amazing-feature) - Open a Pull Request
- Documentation: GitHub Wiki
- Issues: GitHub Issues
- Discussions: GitHub Discussions
MIT License - see LICENSE for details.
⚔️ Built with ❤️ by Juspay • Powered by AI & MCP • Autonomous Code Quality Justice