
Company News
Free Business Plan Upgrades for Open Source Maintainers
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.
Shippie is a prebuilt code-review agent built on flue. It runs an agent loop (on pi) that reads your diff, explores the codebase with real developer tools, and posts focused review comments — picking up issues a human reviewer would, such as:
The agent uses flue's built-in pi tools (read, write, edit, bash, grep, glob, task) plus shippie's suggest_change tool for inline comments. It can also act as a Model Context Protocol (MCP) client to reach external tools like browser automation, infrastructure, and observability.
https://github.com/mattzcarey/shippie/assets/77928207/92029baf-f691-465f-8d15-e1363fcb808e
pi.Run npx shippie init to scaffold the workflow below, then add your provider API key as a repo secret. Or add it manually — it needs a full checkout (fetch-depth: 0), PR write permissions, and a provider API key.
# .github/workflows/shippie.yml
name: Shippie
on:
pull_request:
permissions:
pull-requests: write
contents: read
jobs:
review:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: mattzcarey/shippie@v0
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
See Action Options for all inputs (MODEL, THINKING_LEVEL, IGNORE, CUSTOM_INSTRUCTIONS, MCP_SERVERS, and the provider keys).
Run the review workflow locally with no server. Local mode reviews your staged changes (git diff --cached) and writes results to .shippie/review/local_*.md:
flue run review --target node --payload '{"platform":"local"}'
Or via the package script:
npm run review
/shippieComment /shippie review on a pull request to run shippie on demand — either via a GitHub Actions workflow (no server) or a deployed webhook channel. See Run Shippie on demand.
See the setup instructions for more docs on how to set up shippie in your CI/CD pipeline and run it locally.
AGENTS.md / CLAUDE.md and Agent Skillstask tool/shippie (Actions or webhook)This repo targets Node >= 22.19 with npm.
Clone the repository:
git clone https://github.com/mattzcarey/shippie.git
cd shippie
Install dependencies:
npm install
Set up your API key:
.env.example to .env.ANTHROPIC_API_KEY (or OPENAI_API_KEY, OPENROUTER_API_KEY, CLOUDFLARE_API_KEY + CLOUDFLARE_ACCOUNT_ID).Run the review workflow:
npm run review
Useful commands:
npm run dev — run flue in dev modenpm run build — build a publishable Node server to dist/server.mjs (run it with npm run start, then POST /workflows/review?wait=result)npm run check — lint/format with biomenpm run check:types — typecheck with tscnpm test — run testsSee package.json for the full list of scripts.
Make a PR 🎉
We use release-please on this project. If you want to create a new release from your PR, please make sure your PR title follows the Conventional Commits format. The release-please bot will automatically create a new release for you when your PR is merged.
Thanks to our wonderful contributors!
Have a look at the discussion tab for the latest chat and ideas. I am actively working on the items in todo.md.
FAQs
an extensible code review agent
The npm package shippie receives a total of 53 weekly downloads. As such, shippie popularity was classified as not popular.
We found that shippie demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.