Momus Review

A code and security review product named after the Greek god of criticism: it makes fast, staged judgments on your diffs with concrete evidence, severity and owner routing. It runs as a Rust binary, momus, with the engine being TypeSafe Jev through a thin HTTP client speaking the system_one wire format.

Both feed one funnel. momus review reviews the current Git diff, tracked changes plus untracked files; momus scan scans every non-ignored source file under a scope. Both accept one or more scope directories, --exclude for vendored subtrees, and a follow-up budget via --follow-ups (unlimited by default).

momus github-review runs inside GitHub Actions and reads GITHUB_TOKEN (needs pull-requests: write), GITHUB_REPOSITORY and the pull_request event. Findings on changed lines become inline comments, at most --max-comments (default 10), best-ranked first; everything else goes into one summary comment. Re-runs are idempotent through hidden fingerprint and topic markers, and blocking is left to the check status via --fail-on-blocking.

0.9.0 is the beta milestone for team testing. Real-history calibration and the comparison benchmark remain acceptance gates for 1.0.0, Jeeves is planned for 1.1.0, and merge approval stays disabled by default. The README points to release milestones for the remaining work.

momus review --base REV diffs against the merge base of REV and HEAD instead of HEAD, giving the branch's commits plus uncommitted changes to tracked files. In CI you run it on a clean checkout of the pull request with --base origin/main, which needs enough history to find the merge base — for example actions/checkout with fetch-depth: 0.

Redaction is on by default for outgoing requests, and published text is redacted like outgoing requests. --no-redact sends code without secret redaction, and the summary comment reports redaction totals alongside counts and an explicitly uncalibrated risk score.

The core funnel — review, scan and dashboard — shipped in Rust and was validated on OWASP Juice Shop through a golden-set eval harness called momus-eval, with evidence excerpts, an OWASP-aligned security mechanism vocabulary and crypto/misconfig screen steering; the release notes describe offline benchmarks and API documentation.