Aptu is a context-engineering experiment: instead of throwing big models at problems, it crafts tight prompts that let smaller models do the job with fewer tokens and surprising precision.
Demo

Why It Works
Aptu uses task specialization over raw model capability:
| Factor | Aptu | General Agent |
|---|---|---|
| Context | Only the diff | Entire conversation + tools |
| Prompt | Tuned for code review patterns | General reasoning |
| Attention | 100% on code quality | Split across many tasks |
The small specialized model is not smarter, just less distracted. In real-world testing, aptu's PR review (using the default gemini-3-flash-preview) caught regex-based HTML parsing and missing error handling that claude-opus-4.5 shipped as "done".
Features
- AI Triage - Summaries, suggested labels, clarifying questions, and contributor guidance
- Issue Discovery - Find good-first-issues from curated repositories
- PR Analysis - AI-powered pull request review and feedback
- Release Notes - AI-curated changelogs from merged PRs
- GitHub Action - Auto-triage incoming issues with labels and comments
- Multiple Providers - Gemini (default), Cerebras, Groq, OpenRouter, Z.AI, and ZenMux
- Local History - Track your contributions offline
- Multiple Outputs - Text, JSON, YAML, and Markdown
Installation
# Homebrew (macOS/Linux)
# Snap (Linux)
# Cargo-binstall (fast)
# Cargo
Quick Start
Security Scanning
Aptu includes built-in security pattern detection for PR reviews. Scanning is performed locally, and no code is sent to external services.
See docs/SECURITY_SCANNING.md for SARIF upload and GitHub integration.
GitHub Action
Auto-triage new issues with AI using any supported provider.
- uses: clouatre-labs/aptu@v0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
gemini-api-key: ${{ secrets.GEMINI_API_KEY }}
Options: apply-labels, no-comment, skip-labeled, dry-run, model, provider.
See docs/GITHUB_ACTION.md for setup and examples.
Configuration
See docs/CONFIGURATION.md for AI provider setup.
Security
- SLSA Level 3 - Provenance attestations for all releases
- REUSE/SPDX - License compliance for all files
- Signed Commits - GPG-signed commits required
- Dependency Scanning - Automated updates via Renovate
See SECURITY.md for reporting and verification.
Contributing
We welcome contributions! See CONTRIBUTING.md for guidelines.
License
Apache-2.0. See LICENSE.