AI PR Reviews

Overview

AI PR Reviews adds an AI-powered security reviewer to your pull request workflow. When enabled, Fencer can review the changeset in a pull request and post findings and suggested fixes as a comment, alongside an optional check status. In the product, this shows up as a Changeset Security Review in the Agent Activity view.

This is separate from standard Code Scanning, which runs a fixed suite of scanners on a schedule or webhook trigger, and separate from Automated Remediation, which opens a full pull request for a specific vulnerability. AI PR Reviews focuses on reviewing the diff itself and leaving inline suggestions in the same pull request.

Prerequisites

A connected source code integration whose repository supports pull requests (GitHub, GitLab, Bitbucket, Azure DevOps, or Cursor Origin — plain Git repositories don’t support this feature).
AI PR Reviews enabled for the repository or your organization’s default.

How it works

Enablement resolves in order: a per-repository setting, falling back to your organization’s default. There are two modes:

Confirm each review (the default) — Fencer posts an invitation comment on new pull requests rather than reviewing automatically. On GitHub, check the box in that comment to start the review; on GitLab, Bitbucket, Azure DevOps, and Cursor Origin, reply with /fencer review instead, since those providers don’t support the checkbox.
Review automatically — a global or per-repository setting that skips the invitation comment and starts a review on every pull request without waiting for confirmation.

Once started, the review’s progress appears live in the Agent Activity view, including a collapsible section showing the reviewer’s reasoning as it works. When it finishes, Fencer posts inline comments on the specific lines with findings, plus a summary comment, and (on GitHub and Cursor Origin) syncs a check run reflecting the result. Cursor Origin has no line-anchored comment API, so on Origin pull requests every finding is collected into the summary comment with a path:line prefix instead of being posted inline.

Findings taxonomy

Each finding is classified two ways:

Category — a specific finding type (for example, IDOR, SSRF, missing authorization, weak cryptography, business logic flaw), which rolls up into a domain (Authentication, Authorization, Data Handling, Cryptography, API Integration, Concurrency, Configuration, Logic & Design, or Other).
Severity (Info through Critical) and Confidence (Low, Medium, High) — tracked separately from category, so you can judge both how serious a finding is and how sure the reviewer is.

Suggested fixes

Where applicable, a finding includes a suggested fix — a description and, where possible, a suggested patch — shown inline in the review comment. This is a suggestion for you to apply yourself; it does not open a pull request. To have Fencer generate and open a PR for a specific vulnerability, use Automated Remediation from that vulnerability’s detail page instead.

Usage / Configuration

Enabling AI PR Reviews

Navigate to a repository’s settings, or your organization’s integration defaults, to find the AI PR Reviews setting.
Turn it on for the repository, or set your organization’s default so new repositories inherit it. Choose whether reviews require confirmation or run automatically on every pull request.
A repository-level setting always overrides the organization default.

Starting a review

If your repository requires confirmation (the default):

Open a pull request on a repository with AI PR Reviews enabled.
Fencer posts an invitation comment. On GitHub, check the box in that comment; on GitLab, Bitbucket, Azure DevOps, or Cursor Origin, reply with /fencer review instead.
Watch progress in the Agent Activity view while the review runs.
When it finishes, review the inline findings and summary comment on the pull request itself.

If your repository (or organization) is set to review automatically, this happens without any of the above — a review starts as soon as the pull request is opened.

Troubleshooting

No invitation comment appears — Confirm AI PR Reviews is enabled for the repository (or its organization default), and that the repository’s provider supports pull requests. Plain Git repositories aren’t eligible. Also check whether the repository is set to review automatically — in that mode, no invitation comment is posted at all.
Checking the box doesn’t start a review — The checkbox only works on GitHub. On GitLab, Bitbucket, Azure DevOps, and Cursor Origin, reply with /fencer review instead.
No check status on the pull request — Check runs are synced for GitHub and Cursor Origin. Findings still post as comments on GitLab, Bitbucket, and Azure DevOps pull requests.
No inline comments on a Cursor Origin pull request — Expected. Origin’s comment API is general-discussion only, so findings are listed in the summary comment with a path:line prefix.