Sovri

Free plan Self-hosted

What Sovri is

Sovri is a self-hosted GitHub pull-request review bot intended for regulated EU organizations. It reads pull-request diffs and posts walkthroughs with inline findings. Findings can carry provenance details for the model, prompt digest, and hosting region, and may reference GDPR, DORA, or NIS2 through CWE mappings when the confidence gate passes. The project describes bring-your-own-LLM support for Anthropic, Mistral, OpenAI, and OpenAI-compatible endpoints; its active self-host providers are Anthropic and Mistral. Pre-alpha v0.10.1 adds SARIF 2.1.0 ingestion and cross-tool deduplication between scanner and LLM findings. The Community edition runs on customer infrastructure without a Sovri-controlled backend, as a multi-architecture container from GitHub Container Registry or a Node.js process built from source. Repositories use .sovri.yml and environment variables for GitHub App credentials and LLM keys. Sovri publishes Apache 2.0 source, pinned dependencies, and an SBOM, but states it has no ISO 27001, SOC 2, HDS, or SecNumCloud certification.

Who it suits

Sovri is intended for banks, healthcare providers, public-sector operators, and defense or dual-use industries needing self-hosted pull-request review. It suits teams able to manage GitHub configuration, infrastructure, and an LLM provider.

What it does well

Self-hosted on customer infrastructure
Inline findings include provenance details
Supports SARIF 2.1.0 ingestion
Cross-tool deduplication of findings
Apache 2.0 source with SBOM releases

What to know first

Project status is pre-alpha
v0.10.1 is not the complete Community product
No listed ISO 27001 or SOC 2 certification
Requires configuring an LLM provider

Plans

Plan	Billed and limits	Price
Cloud	EU-managed · SSO · multi-tenancy · billing · audit log	On request
Community	Apache 2.0 · self-hosted · not feature-complete; pre-alpha	Free

As github.com lists them, read 11 Oct 2026. The maker's own page has the final word.

Verdict

Sovri combines automated pull-request review with self-hosting, provenance information, and compliance references. Its pre-alpha status and stated absence of several certifications are important for organizations evaluating deployment.

Facts from Sovri's own pages

Certifications: Sovri states it currently has no ISO 27001, SOC 2, HDS, or SecNumCloud certification. · github.com, 11 Oct 2026
Compliance references: Findings can include GDPR, DORA, and NIS2 references derived from CWE mappings when the confidence gate passes. · github.com, 11 Oct 2026
Configuration: Repositories configure Sovri through a .sovri.yml file and environment variables for GitHub App credentials and LLM API keys. · github.com, 11 Oct 2026
Deployment: The Community bot is distributed as a multi-architecture container image on GitHub Container Registry or as a standalone Node.js process built from source. · github.com, 11 Oct 2026
LLM providers: The README describes bring-your-own LLM support for Anthropic, Mistral, OpenAI, and OpenAI-compatible endpoints; the active self-host providers listed are Anthropic and Mistral. · github.com, 11 Oct 2026
Provenance: Each finding includes a provenance trail with the model, prompt digest, and hosting region. · github.com, 11 Oct 2026
Purpose: Sovri is a GitHub pull-request review bot for regulated EU organizations. · github.com, 11 Oct 2026
Release status: The README describes the product as pre-alpha and says the v0.10.1 bot is not yet the complete self-host Community product. · github.com, 11 Oct 2026
Review output: It reads pull-request diffs and posts a walkthrough with inline findings. · github.com, 11 Oct 2026
Scanner integration: The pre-alpha v0.10.1 release adds SARIF 2.1.0 ingestion and merges external scanner findings with LLM findings using cross-tool deduplication. · github.com, 11 Oct 2026
Security design: The Community edition runs on customer infrastructure without a Sovri-controlled backend and publishes Apache 2.0 source with pinned dependencies and an SBOM at each release. · github.com, 11 Oct 2026
Target users: The README identifies banks, healthcare providers, public-sector operators, and defense or dual-use industries as intended users. · github.com, 11 Oct 2026

Where Sovri stands on Freedom251

AI Code Review Tools#29 of 47
Code review software#38 of 50