# CoderHelm > CoderHelm is an AI coding agent for GitHub and Jira. Assign it an issue or a ticket and it opens a pull request in your repository, then it stays on the code: it answers review comments, fixes its own failing CI, reviews your team's pull requests and turns production alerts into fixes that a person approves. Teams can also ask it about their code and documents in Chat, and run it hosted or in their own AWS account. Updated 2026-11-05. Each page below is separated by a horizontal rule. --- # Ship code, not tickets. > Assign a GitHub issue or Jira ticket and get a pull request. CoderHelm reads your codebase, plans the change, writes it and reviews its own work, then keeps the code healthy after it ships. CoderHelm is an AI coding agent for GitHub and Jira. Assign it an issue or a ticket and it opens a pull request in your repository, then it stays on the code: it answers review comments, fixes its own failing CI, reviews your team's pull requests and turns production alerts into fixes that a person approves. Teams can also ask it about their code and documents in Chat, and run it hosted or in their own AWS account. ## One ticket, followed all the way to production. ### Turn tickets into pull requests 1. **Assign the ticket.** Assign an issue or a ticket, or add a label. On GitHub, assign the issue to CoderHelm, add the `coderhelm` label or comment `/coderhelm`. On Jira, assign the ticket or add the label. It reads the ticket, your AGENTS.md and the code, then writes a plan with the files it will touch. [Tickets to pull requests](https://coderhelm.com/pull-requests/) *Product view: A Jira ticket assigned to CoderHelm, and the plan it wrote before touching any code.* 2. **Open the pull request.** It builds, tests and reviews its own work first. It writes the change on a `coderhelm/` branch, runs your build, lint and tests in a sandbox that holds no credentials, reviews its own work for up to three rounds, runs a security check and opens the pull request. [What happens during a run](https://coderhelm.com/pull-requests/) *Product view: A run in the CoderHelm dashboard: each stage from triage to the opened pull request, with the files it changed.* ### Keep pull requests healthy after they open 3. **Fix failing CI.** A check fails. It reads the logs and fixes the cause. It pushes again until the checks pass, stops when the same failure repeats and caps automatic pushes at eight. When an end to end test fails for a reason the change did not cause, it runs it once more and says so. [How it fixes CI](https://coderhelm.com/maintenance/) *Product view: A failing check on a CoderHelm pull request: the log line it read, the fix it pushed and the checks going green.* 4. **Answer review comments.** Ask for a change on its pull request and it makes it. It replies in the thread, pushes the fix and says what changed. It also resolves conflicts with the base branch, so the pull request does not go stale while it waits. [Maintenance before and after the merge](https://coderhelm.com/maintenance/) *Product view: A review comment on a CoderHelm pull request, its reply and the commit that made the change.* 5. **Review every pull request.** Add a label to any pull request and it reviews it. Not only its own. It reads the callers and tests around the change, comments on exact lines with suggestions you can apply, rates the risk and says why, and reviews again on every push. It learns from which comments your team acts on or dismisses, and shows what it changed and why. [Everything the reviewer does](https://coderhelm.com/reviewer/) *Product view: A CoderHelm review: a risk level with the reason, a comment on the exact line with a suggested fix, and earlier comments it resolved after they were fixed.* 6. **Merge and check the deploy.** Nothing it wrote merges without a person's approval. Auto merge is off by default. Turned on, it waits for a person's approval and green checks on the exact reviewed commit, then watches the deploy checks and reports only failures that are new since the merge. [After the merge](https://coderhelm.com/maintenance/) *Product view: An approved pull request merged on the reviewed commit, followed by the deploy check CoderHelm ran after it.* ### Catch problems in production 7. **Turn alerts into fixes.** A production alarm becomes a fix in the right repository. Route CloudWatch alarms to CoderHelm through SNS and a rule picks the repository. It analyzes the alert, opens a pull request for a person to approve, and pairs the recovery with the original alert. It also reads the log groups you choose every six hours through a read only role, and can open a fix for each new finding on its own. [Alerts to pull requests](https://coderhelm.com/alerts/) *Product view: A CloudWatch alarm routed to the right repository, the pull request CoderHelm opened, and the recovery paired with the alert.* 8. **Keep tests from blocking.** Flaky tests stop failing builds. Broken ones are never hidden. It reads your Playwright, JUnit and Cucumber reports and tells flaky tests from broken ones. With quarantine on, flaky tests stop failing builds, and its fix pull requests must pass twenty runs in a row. [Flaky test detection](https://coderhelm.com/tests/) *Product view: Tests sorted into flaky, broken, quarantined and passing from their last ten runs, and a fix pull request with twenty green runs.* ## Ask about your code. Get answers you can check. Chat reads your team's repositories itself: it looks a repository over, searches the code, reads the files and follows the code graph. Every claim has a numbered citation with the real file path and lines, and it never asks you to paste what it can open. - It reads everything you can see; type @ to narrow a question to one repository or knowledge collection - Knowledge from Notion, Confluence, Google Drive, Sanity, GitHub, websites and files, kept in sync - When nothing in your sources supports an answer, it says so - [How Chat works](https://coderhelm.com/chat/) *Screenshot: Chat answering a question about a repository: what it read, then an answer with numbered citations. Example data.* ## What it uses to get the change right. - **[Checks your real systems before it guesses](https://coderhelm.com/data-sources/):** Read only lookups in your GraphQL API, CloudWatch Logs, PostgreSQL and Redshift, enforced in code and recorded with who asked and for which pull request. - **[Plans you approve](https://coderhelm.com/pull-requests/#plans):** Describe the work in the dashboard. CoderHelm streams a plan, and each task you approve becomes an issue and a run, in order. - **[Works your way](https://coderhelm.com/skills/):** Reads your AGENTS.md, the skills your team keeps in a repository and the MCP servers you connect, and keeps a memory you can see and edit. - **[Guarded in code, not in a prompt](https://coderhelm.com/security/):** Allow, ask or deny for everything an agent does, with approvals. Its own branch, a build sandbox with no credentials, read only data access, secrets encrypted with AWS KMS and custom roles. Works with GitHub, Jira, Microsoft Teams, AWS, Playwright, JUnit and Cucumber reports, 17 MCP servers, and Claude models through your own Anthropic API key or Amazon Bedrock. Build on it with the [public API](https://docs.coderhelm.com/api/) and [signed webhooks](https://docs.coderhelm.com/api/webhooks/) that tell your systems what it did. ## Gets better with your team. CoderHelm learns from what happens to its work on your repositories, and everything it learns is written down where you can read it. - **Learns from what happens next:** A pull request merged as written or after edits, closed or reverted. CI passing on the first try or needing fixes. Review comments acted on or dismissed, and a thumbs up or down on a review. Each outcome scores the work. - **Reads past work before it writes:** Before a change or a review, it reads the closest past examples from that repository: the ones that went best, to follow, and the ones that went worst, to avoid. - **[The reviewer learns from pushback](https://coderhelm.com/reviewer/):** When someone dismisses a review, argues a comment or merges anyway, it checks whether the review was wrong. If it was, it writes one lesson for later reviews and shows what it changed and why. - **[Everything it learns, you can see](https://coderhelm.com/skills/#memory):** Lessons, memories, examples and each change to how it works are listed with the evidence behind them. Admins can delete a lesson, edit or forget a memory, and turn off any change. - [How the reviewer learns](https://docs.coderhelm.com/getting-started/reviewer/#it-learns-from-pushback) - [Memories in the docs](https://docs.coderhelm.com/concepts/memories/) ## Run it in your own AWS account. Your code, tickets, logs and model calls stay in your account. The install guide sets it up from your browser and checks every step against your own install. - One click opens AWS with every value filled in, and the guide follows the install as it runs - Your GitHub App in one click, and a check that Claude answers on Amazon Bedrock - Your own domain, set up in Route 53 for you or with DNS records to copy, checked live - The same install checks in the guide, the `doctor` command and the dashboard's Setup page - Updates applied from the app in one click, or automatically in your maintenance window, from the Stable or nightly Beta channel - Quiet email: only when you need to act or something went wrong, plus an optional weekly what's new - Every install and update checks the release's signature before anything runs - Fully private, or hybrid: use CoderHelm's GitHub App and event relay, and see every event in and out on the Deliveries page - One organization per install: nobody signs up on their own, and admins can require two factor sign in - [Open the install guide](https://docs.coderhelm.com/self-host/install/) - [More about self-hosting](https://coderhelm.com/self-host/) The guide talks to AWS, GitHub and your own install, and counts anonymous page views with Google Analytics. Nothing you type and nothing about your install is sent to CoderHelm or Google. Moving from CoderHelm cloud? [Talk to us](mailto:support@coderhelm.com?subject=Moving%20to%20self-hosted%20CoderHelm) and we'll help move your settings and data. *Screenshot: The Setup page of a self hosted install: each check passing, or saying what is wrong and how to fix it. Example data.* ## Questions teams ask first. ### What is CoderHelm? CoderHelm is an AI coding agent for GitHub and Jira. Assign it an issue or a ticket and it opens a pull request in your repository, then it stays on the code: it answers review comments, fixes its own failing CI, reviews your team's pull requests and turns production alerts into fixes that a person approves. Teams can also ask it about their code and documents in Chat, and run it hosted or in their own AWS account. ### How do I start a run? On GitHub, assign the issue to CoderHelm, add the `coderhelm` label, or comment `/coderhelm` or `@coderhelm`. On Jira, assign the ticket to CoderHelm or add the `coderhelm` label (your admin can change the label). ### Does CoderHelm push to my main branch? No. It writes every change on its own `coderhelm/` branch and opens a pull request. Merging is your call; the optional auto merge for reviewed pull requests waits for a person's approval and green checks. ### What happens after the pull request is merged? CoderHelm stays on the code. It answers questions and review comments, reviews new pull requests that get the review label, turns routed alerts into fixes, keeps flaky tests from blocking builds and, with auto merge on, checks the deploy after the merge and reports only new failures. ### Which languages does it support? It works on the repository as text and runs your own build and tests, so it is not tied to one language or framework. ### Which AI models does it use? Claude models from Anthropic, through your team's own Anthropic API key. A self-hosted install can use Amazon Bedrock in its own AWS account instead. Admins can choose the models and set monthly token limits. ### Can we run it ourselves? Yes. CoderHelm runs entirely in your own AWS account, installed from your browser with the [install guide](https://docs.coderhelm.com/self-host/install/). It is licensed under FSL-1.1-ALv2: you can run it, change it and self-host it for your own company, and each release becomes Apache 2.0 two years after it ships. See [self-hosting](https://coderhelm.com/self-host/). ### How much does it cost? CoderHelm is in open beta. Each team brings its own Anthropic API key, so model usage is billed to your Anthropic account, and admins can cap it with a monthly token limit. ### Can it change data in my database? No. Lookups are read only, enforced in code at several independent points: the query is checked, the transaction is read only and rolled back, and the database user cannot write. --- Source: https://coderhelm.com/ · Markdown: https://coderhelm.com/index.md · Updated 2026-11-05 · Get started: https://app.coderhelm.com --- # From a GitHub issue or Jira ticket to a pull request. > Assign the ticket to CoderHelm or add a label. It reads the repository, plans the change, writes it, runs your build and tests, reviews its own work and opens a pull request your team can review like any other. *Product view: A run in the CoderHelm dashboard: each stage from triage to the opened pull request, with the files it changed.* ## Start a run from the tools you already use | Where | How to start a run | | --- | --- | | GitHub issue | Assign it to CoderHelm, add the `coderhelm` label, or comment `/coderhelm` or `@coderhelm`. | | Jira ticket | Assign it to CoderHelm or add the `coderhelm` label. Your admin can change the label. | | CoderHelm dashboard | Describe the work in a plan and approve it; each task becomes an issue and a run. | | Monitoring alert | Route a CloudWatch alarm to CoderHelm and a matching rule starts a run. See [alerts](https://coderhelm.com/alerts/). | ## What happens during a run 1. **Triage and plan.** It reads the ticket, the repository's conventions and your AGENTS.md, then writes a plan with the files it will touch. 2. **Implement and test.** It writes the change on a `coderhelm/` branch and runs your real build, lint and tests in a sandbox that holds no credentials. 3. **Review and open.** It reviews its own work (up to three fix rounds), runs a security check, resolves conflicts with the base branch and opens the pull request. Pull requests open as drafts while the work is in progress, and are marked ready for review when CoderHelm is done. ## Plans: describe the work, get ordered tickets In the dashboard, describe what you want to build. CoderHelm streams a plan as it reasons, searching your code and the MCP servers you connected for the details. Approve it and each task becomes a GitHub issue and a run, in order. ## FAQ ### Can CoderHelm read screenshots attached to a ticket? Yes, images attached to the ticket are read along with its text. ### Will the pull request follow our conventions? It reads AGENTS.md, CLAUDE.md, copilot instructions and .cursorrules from the repository, plus the guardrails, custom instructions and team voice your admins set. ### What if CI fails on the pull request? It reads the failing check's logs, fixes the cause and pushes again. It stops when the same failure happens twice, so it never loops on a problem it cannot fix. See [maintenance](https://coderhelm.com/maintenance/). ## Related - [AI that fixes failing CI and answers review comments](https://coderhelm.com/maintenance.md): CoderHelm stays on the code after the pull request: it answers review comments, fixes failing CI on its pull requests, resolves merge conflicts, checks deploys after merge and writes release notes. - [AI code review for GitHub pull requests](https://coderhelm.com/reviewer.md): Add a label to any GitHub pull request and CoderHelm reviews it with the context of the whole repository, comments on exact lines with suggested fixes, rates risk and reviews again on every push. - [Team skills, agent briefs and MCP servers](https://coderhelm.com/skills.md): CoderHelm works your way: it reads your AGENTS.md, the skills and agent briefs your team keeps in a repository, the MCP servers you connect and what it learned on past runs. --- Source: https://coderhelm.com/pull-requests/ · Markdown: https://coderhelm.com/pull-requests.md · Updated 2026-11-05 · Get started: https://app.coderhelm.com --- # AI code review on every GitHub pull request. > Turn the reviewer on for a repository and add the review label (`ch-review` by default) to any pull request. CoderHelm reviews it like an engineer who knows the codebase, and keeps reviewing as you push. *Product view: A CoderHelm review on GitHub: a risk level with the reason, a line comment with a suggested fix, and earlier comments resolved after they were fixed.* ## What a review includes - Context beyond the diff: a code graph of definitions and callers shows what a change reaches - Comments on the exact lines, with GitHub suggestions you can apply - A risk level of low, medium or high; migrations, auth, secrets and payments always rate high - A new review on every push, and its own comments resolved once they are fixed - Answers in the thread: `@coderhelm` with a question, `@coderhelm re-review`, or the Re-request review button - Draft pull requests are skipped until they are marked ready ## Options a repository can turn on - **Auto merge, only when safe:** Off by default. Merges only the exact commit it reviewed, after a person approves and every check is green. - **Runs the right CI:** Adds the labels your CI listens for, such as which end to end suites to run or a staging deploy, based on what the pull request changes. It uses the labels your repository already describes. - **Holds the line on tests:** Sends back pull requests that change behavior without new or updated tests, and says what to test and where. - **Release tags:** Tags a release after merges, grouping merges that land close together (within 15 minutes by default). - **Deploy check:** With auto merge on, it waits for the deploy checks after the merge and reports only failures that are new. It never rolls back a shared branch. - **Learns from your team:** Rate a review and add a note. Later reviews on that repository follow the feedback, on top of AGENTS.md and your review instructions. ## FAQ ### Does it review pull requests written by people? Yes. Any pull request with the review label is reviewed, whoever wrote it. ### Can it merge on its own? Only if you turn on auto merge for the repository, and even then only the exact commit it reviewed, after a person approves and every check passes. ### Where do I see past reviews? The Reviewer page in the dashboard lists every review with its ratings, and lets you review a pull request on demand. ## Related - [AI that fixes failing CI and answers review comments](https://coderhelm.com/maintenance.md): CoderHelm stays on the code after the pull request: it answers review comments, fixes failing CI on its pull requests, resolves merge conflicts, checks deploys after merge and writes release notes. - [Flaky test detection and quarantine](https://coderhelm.com/tests.md): CoderHelm reads the end to end results your CI produces, tells flaky tests from broken ones, keeps flaky tests from failing builds and opens fix pull requests that must pass twenty runs in a row. - [GitHub issue and Jira ticket to pull request](https://coderhelm.com/pull-requests.md): Assign a GitHub issue or Jira ticket to CoderHelm and it plans the change, writes it on its own branch, runs your build and tests, reviews its own work and opens a pull request. --- Source: https://coderhelm.com/reviewer/ · Markdown: https://coderhelm.com/reviewer.md · Updated 2026-11-05 · Get started: https://app.coderhelm.com --- # It doesn't hand off. It stays on the code. > Opening a pull request is where most AI tools stop. CoderHelm keeps working on it until it is merged, and keeps watching the code after that. *Product view: The timeline of one CoderHelm pull request: a check it fixed, a review comment it answered, the merge and the deploy check after it.* ## Until the pull request is merged - **Answers review comments:** Request changes or ask a question on its pull request. It replies, pushes the fix and says what changed. - **Fixes failing CI:** When a check fails on its pull request, it reads the logs, fixes the cause and pushes again. It stops when the same failure repeats, and caps automatic pushes at eight. When only [quarantined tests](https://coderhelm.com/tests/) failed, it treats the run as passing instead. - **Keeps the branch current:** Resolves merge conflicts with the base branch before it works on feedback, so a pull request does not go stale while it waits. - **Tells your failures from its own:** When an end to end test fails for a reason the pull request did not cause, it runs it once more and says so, with the evidence. ## After the merge - **Checks the deploy:** With auto merge on, it waits until the deploy checks finish and reports only failures that are new compared with before the merge. It never rolls back a shared branch. - **[Turns alerts into fixes](https://coderhelm.com/alerts/):** Production alarms routed to CoderHelm become analyzed pull requests in the right repository. - **[Keeps tests healthy](https://coderhelm.com/tests/):** Flaky tests stop blocking builds, broken ones are never hidden, and fix pull requests come with proof. - **Writes release notes:** Tags releases after merges and writes notes your team can read, published to the GitHub release, Confluence or email. ## FAQ ### Does CoderHelm fix CI on pull requests it did not write? It fixes failures on its own pull requests. On your team's pull requests the reviewer explains failures, and for end to end tests it says whether a failure is known flaky, a bad run or likely caused by the change. ### Can it loop forever on a failing check? No. It stops when the same failure happens twice and caps automatic pushes, then reports what it found. ## Related - [CloudWatch alarm to pull request](https://coderhelm.com/alerts.md): Route CloudWatch alarms and EventBridge events to CoderHelm through SNS. Matching alerts become analyzed pull requests in the right repository, and recoveries are paired with the alert that raised them. - [Flaky test detection and quarantine](https://coderhelm.com/tests.md): CoderHelm reads the end to end results your CI produces, tells flaky tests from broken ones, keeps flaky tests from failing builds and opens fix pull requests that must pass twenty runs in a row. - [AI code review for GitHub pull requests](https://coderhelm.com/reviewer.md): Add a label to any GitHub pull request and CoderHelm reviews it with the context of the whole repository, comments on exact lines with suggested fixes, rates risk and reviews again on every push. --- Source: https://coderhelm.com/maintenance/ · Markdown: https://coderhelm.com/maintenance.md · Updated 2026-11-05 · Get started: https://app.coderhelm.com --- # From a CloudWatch alarm to a pull request. > Subscribe CoderHelm to the SNS topic that carries your alerts and add rules. An alert a rule takes becomes a run in that rule's repository: CoderHelm analyzes it, makes the change and opens a pull request your team reviews. *Product view: An alarm routed to a repository, the pull request CoderHelm opened for it, and the recovery paired with the original alert.* ## How alert routing works 1. **Send alerts to SNS.** CloudWatch alarm notifications, AWS Chatbot messages, EventBridge events or plain messages, on a topic in an AWS account your team connected. 2. **Add rules.** Each rule names the alarms or alert text it takes, the repository to fix them in and how to act. 3. **Review the fix.** The pull request goes through normal review. A pull request CoderHelm wrote never merges without a person's approval. ## Alerts and recoveries, paired When an alarm returns to OK, CoderHelm matches the recovery to the alert that raised it and posts a linked resolved card in Microsoft Teams, so the channel shows what is still open. Alerts no rule takes are posted to Teams only. ## Built to stay calm - Every message must carry a valid SNS signature, from a topic in an AWS account your team connected - Alert text is treated as data, never as instructions - Repeats of the same alert are collapsed into one - Each rule has a daily run cap, and alert runs stop for the day at your team's alert token budget ## Log findings, every six hours Connect AWS with a CloudFormation stack that creates a read only role, and CoderHelm scans the CloudWatch log groups you choose every six hours. Each finding has a severity, a summary and a suggested action, and becomes a plan with one click. ## Related - [AI that fixes failing CI and answers review comments](https://coderhelm.com/maintenance.md): CoderHelm stays on the code after the pull request: it answers review comments, fixes failing CI on its pull requests, resolves merge conflicts, checks deploys after merge and writes release notes. - [Read only data sources for an AI coding agent](https://coderhelm.com/data-sources.md): CoderHelm checks your GraphQL API, CloudWatch Logs, PostgreSQL and Redshift while it plans, writes and reviews, with every lookup read only, enforced in code and recorded. - [Security and data handling](https://coderhelm.com/security.md): How CoderHelm handles your code and data: changes on its own branch, builds in a sandbox with no credentials, read only data access, KMS encrypted secrets, signed webhooks and team roles. --- Source: https://coderhelm.com/alerts/ · Markdown: https://coderhelm.com/alerts.md · Updated 2026-11-05 · Get started: https://app.coderhelm.com --- # Flaky tests stop blocking you. Broken ones never hide. > CoderHelm reads every end to end run your CI already produces, tells a flaky test from a broken one, and acts on it. *Product view: The Tests page: each test's history run by run, flaky and broken tests told apart, and the quarantine list.* ## Flaky, broken or a bad run - **Told apart:** A test that passed and failed on the same commit is flaky. One that fails almost every time is broken. A run where many tests fail together is a bad run, not many flaky tests. - **"Is this failure mine?":** Each failing test on a pull request gets one line in the review: known flaky with its history, a bad run, or likely caused by the files this pull request changed. - **Quarantine, never for broken tests:** When your team turns it on, flaky tests keep running and being recorded but stop failing the build. A broken test is never quarantined. Owners get a ticket after two days by default; each team picks between 1 and 30. - **Quarantined failures don't block:** When the only failing tests in a run are quarantined ones, CoderHelm treats the run as passing: it does not start a CI fix, armed auto merge goes ahead, and a note on the pull request names the tests. - **Fix pull requests with proof:** CoderHelm reproduces the flake, fixes it, and marks the pull request ready only after twenty green runs in a row. - **Tests you are missing:** Uncovered changes and bug fixes without tests become suggested tests, each proposed only after it passes ten repeat runs. - **Every run on one page:** Runs, each test's history, failures grouped by cause, the slowest tests and the quarantine list. - **Fits your CI:** Quarantined tests still run in your CI. The Tests page shows the workflow step that keeps them from failing the build itself. ## Reports it reads Playwright (JSON or HTML), JUnit XML and Cucumber JSON. Results that never reach GitHub, such as a device farm, can be uploaded with a GitHub Actions token, so there is no secret to store. ## Related - [AI that fixes failing CI and answers review comments](https://coderhelm.com/maintenance.md): CoderHelm stays on the code after the pull request: it answers review comments, fixes failing CI on its pull requests, resolves merge conflicts, checks deploys after merge and writes release notes. - [AI code review for GitHub pull requests](https://coderhelm.com/reviewer.md): Add a label to any GitHub pull request and CoderHelm reviews it with the context of the whole repository, comments on exact lines with suggested fixes, rates risk and reviews again on every push. - [GitHub issue and Jira ticket to pull request](https://coderhelm.com/pull-requests.md): Assign a GitHub issue or Jira ticket to CoderHelm and it plans the change, writes it on its own branch, runs your build and tests, reviews its own work and opens a pull request. --- Source: https://coderhelm.com/tests/ · Markdown: https://coderhelm.com/tests.md · Updated 2026-11-05 · Get started: https://app.coderhelm.com --- # It looks before it guesses. Read only. > Connect your API, logs and databases. While CoderHelm plans, writes code and reviews, it checks what the running system really has: whether a field exists, what a setting is, what the service logged. *Product view: A bug ticket investigated with a database lookup and a log search, both read only and recorded, before any code is planned.* ## What it can look up - Your GraphQL API, your CloudWatch Logs, your PostgreSQL databases and your Redshift warehouse - Bug tickets come with evidence: the record, the error and the code that raised it - Reviews confirm a field or table really exists before flagging it - Setup takes minutes: paste one script into AWS CloudShell - Your own tools: named lookups your engineers write once, run only after a second admin approves each exact version ## Read only, enforced in code at every step Not a promise in a prompt. Each lock below stops a write on its own. - **One read at a time:** Each lookup is checked before it is sent: one SELECT, one GraphQL query or one log search. Anything that could change data is refused. - **Rolled back, every time:** Database lookups run in a read only transaction that is always rolled back. - **A user that can only read:** CoderHelm signs in as a database user that cannot change any table, checked when you connect and again before use. - **A role tied to your team:** Access goes through a role in your AWS account that only works with your team's external ID. Delete the role and access ends. - **Hidden stays hidden:** Fields you hide are refused wherever they appear. Secrets, email addresses and card numbers are scrubbed from results, and only the log groups you choose can be searched. - **Every lookup on the record:** Each lookup is logged with who asked, what they asked and for which pull request. Follow it live, and switch any source off. ## Related - [Security and data handling](https://coderhelm.com/security.md): How CoderHelm handles your code and data: changes on its own branch, builds in a sandbox with no credentials, read only data access, KMS encrypted secrets, signed webhooks and team roles. - [CloudWatch alarm to pull request](https://coderhelm.com/alerts.md): Route CloudWatch alarms and EventBridge events to CoderHelm through SNS. Matching alerts become analyzed pull requests in the right repository, and recoveries are paired with the alert that raised them. - [Team skills, agent briefs and MCP servers](https://coderhelm.com/skills.md): CoderHelm works your way: it reads your AGENTS.md, the skills and agent briefs your team keeps in a repository, the MCP servers you connect and what it learned on past runs. --- Source: https://coderhelm.com/data-sources/ · Markdown: https://coderhelm.com/data-sources.md · Updated 2026-11-05 · Get started: https://app.coderhelm.com --- # It runs on your skills, your rules and your tools. > Keep your team's skills and agent briefs in a repository and CoderHelm reads the ones that fit the work. Connect the MCP servers you use and it pulls context from them while it plans and builds. *Product view: A connected skills repository: each skill and agent brief, its switch, and how often the agents read it.* ## Skills kept in a repository - Skills from `skills//SKILL.md` or `.claude/skills//SKILL.md`, with the text files next to them - Agent briefs from `agents/.md` and command steps from `commands/.md` - Read from the default branch only, so only merged, reviewed text is used, and synced after every merge - Text only: nothing from a skills repository is ever run, and every guard stays in place - Each item has a switch, and you can see how often each agent read it ## Your rules CoderHelm reads AGENTS.md, CLAUDE.md, copilot instructions and .cursorrules from each repository. Admins add guardrails, custom instructions and a team voice for pull request descriptions. ## MCP servers Connect any of 17 MCP servers and CoderHelm can use them while it plans and implements: Figma, Sentry, Linear, Notion, Vercel, Stripe, PostHog, GitLab, Neon, Turso, Snyk, LaunchDarkly, MongoDB Atlas, Grafana, Redis, Upstash and Sanity. Credentials are stored encrypted with AWS KMS. ## Memory you can see CoderHelm remembers what it learns on each repository, kept per team and per repository. Each agent has a profile showing what it knows and where it learned it, and you can pin, edit, forget or teach it something new. ## Related - [GitHub issue and Jira ticket to pull request](https://coderhelm.com/pull-requests.md): Assign a GitHub issue or Jira ticket to CoderHelm and it plans the change, writes it on its own branch, runs your build and tests, reviews its own work and opens a pull request. - [Read only data sources for an AI coding agent](https://coderhelm.com/data-sources.md): CoderHelm checks your GraphQL API, CloudWatch Logs, PostgreSQL and Redshift while it plans, writes and reviews, with every lookup read only, enforced in code and recorded. - [AI code review for GitHub pull requests](https://coderhelm.com/reviewer.md): Add a label to any GitHub pull request and CoderHelm reviews it with the context of the whole repository, comments on exact lines with suggested fixes, rates risk and reviews again on every push. --- Source: https://coderhelm.com/skills/ · Markdown: https://coderhelm.com/skills.md · Updated 2026-11-05 · Get started: https://app.coderhelm.com --- # Ask about your code. Every claim comes with its source. > Chat answers questions about your team's work from your own sources: your repositories, your knowledge, connected apps, memories, data sources and skills. It does the reading itself and shows exactly where each answer came from. ## It opens the code, like a teammate would Chat looks a repository over (its README, its folders, manifests such as `package.json` and agent notes such as `AGENTS.md`), searches the code, reads files by line range and checks the code graph, over as many steps as the question needs. Every read is pinned to one commit. It never asks you to open or paste a file it can read; an answer that does is sent back before you see it. *Screenshot: One quiet line says what Chat read; open it to see each step. The answer cites files by number. Example data.* ## Asking - **It picks what to read:** Every question can use everything you can see. Name a repository in the question and Chat reads that one. - **@ to narrow:** Type @ to point a question at one repository or knowledge collection. Nothing is narrowed unless you choose it. - **Numbered citations:** Hover or tap a number to see the source: the file path and lines with a link to them on GitHub at that commit, or the knowledge page and its date. - **No guessing:** When nothing in your sources supports an answer, Chat says so instead of making one up. - **Private until shared:** Your chats are yours. Share one and teammates can read it; only you ask in it. - **Metered and capped:** Chat's model calls show under their own name on the usage page and count toward your token limits. ## Knowledge that stays in sync A knowledge base holds pages from the apps your team writes in, next to files you upload. Pick what to bring in once and CoderHelm keeps it current, removes what is deleted and cites each page with a link back to where it lives. Agents can search a base too, so a plan can follow your runbook instead of guessing. | Source | What it brings in | | --- | --- | | Notion | Pages and databases | | Confluence | Spaces or page trees | | Google Drive | Folders or files: Docs, Sheets, Slides, PDF, Word, Excel and more | | Sanity | Published documents. Sign in with Sanity, or use an API token for instant updates | | GitHub | Markdown and text files on the default branch | | Websites | Public pages or a sitemap | | Files | PDF, Word, Markdown, text, CSV, Excel and HTML uploads | *Screenshot: A knowledge base fed by several apps, each card showing whether it is up to date. Example data.* CoderHelm only ever reads from these apps: nothing is changed, created or deleted there. ## Related - [GitHub issue and Jira ticket to pull request](https://coderhelm.com/pull-requests.md): Assign a GitHub issue or Jira ticket to CoderHelm and it plans the change, writes it on its own branch, runs your build and tests, reviews its own work and opens a pull request. - [Team skills, agent briefs and MCP servers](https://coderhelm.com/skills.md): CoderHelm works your way: it reads your AGENTS.md, the skills and agent briefs your team keeps in a repository, the MCP servers you connect and what it learned on past runs. - [Security and data handling](https://coderhelm.com/security.md): How CoderHelm handles your code and data: changes on its own branch, builds in a sandbox with no credentials, read only data access, KMS encrypted secrets, signed webhooks and team roles. --- Source: https://coderhelm.com/chat/ · Markdown: https://coderhelm.com/chat.md · Updated 2026-11-05 · Get started: https://app.coderhelm.com --- # All of CoderHelm, in your own AWS account. > Your code, tickets, logs and model calls never pass through CoderHelm's account. The install guide sets it up from your browser, and the install keeps checking itself after that. ## Installed from your browser 1. **AWS.** Enter your email and pick a region. One click opens AWS on a quick create page with every value filled in. CoderHelm deploys inside your account in about 20 minutes, with live progress in the guide. 2. **GitHub and models.** Create your own GitHub App in one click; its keys go straight to your install. Your install then checks that Claude answers on Amazon Bedrock and opens the right page if access is missing. 3. **Domain and the rest.** Keep the AWS address or add your own domain: in Route 53 it is set up for you, anywhere else you copy two DNS records and the guide checks them live. Then pick from the optional setup list. - [Open the install guide](https://docs.coderhelm.com/self-host/install/) - [Read the self-hosting docs](https://docs.coderhelm.com/self-host/) The guide talks to AWS, GitHub and your own install, and counts anonymous page views with Google Analytics. Nothing you type and nothing about your install is sent to CoderHelm or Google. Releases are published on [GitHub](https://github.com/CoderHelm/coderhelm-platform/releases). ## Moving from CoderHelm cloud? We'll help you plan the move and bring your settings and data over to your own AWS account. Tell us about your team and a person from CoderHelm will work through it with you. - [Talk to us about moving](mailto:support@coderhelm.com?subject=Moving%20to%20self-hosted%20CoderHelm) ## It keeps checking itself The same install checks run in three places: the install guide, the `doctor` command on your machine and the Setup page in the dashboard. Each failing check says what is wrong, why it matters and how to fix it. *Screenshot: The Setup page of a self hosted install. Example data.* ## Running it - **Updates from the app:** Apply a new release in one click from Settings, or let it install in your maintenance window. Choose Stable, or Beta for nightly builds. Admins get an email only when they need to act or something went wrong, plus an optional weekly what's new. - **Your models:** Amazon Bedrock in your account, with no API key anywhere, or each team's own Anthropic API key. - **Serverless on AWS:** Lambda, API Gateway, SQS, DynamoDB, S3, CloudFront, Cognito and SES. No servers to patch, and no Rust or Docker needed to install. - **Prefer a terminal?:** The installer asks a few questions, deploys the release and creates your GitHub App: `npx -y github:CoderHelm/coderhelm-platform init`, then `deploy`. ## License - CoderHelm is licensed under FSL-1.1-ALv2, the Functional Source License with Apache 2.0 as the future license - You can run it, change it and self-host it for your own company - You can't offer it, or something built from it, as a competing hosted product - Each release becomes Apache 2.0 two years after it ships The full terms are in the [license](https://github.com/CoderHelm/coderhelm/blob/main/LICENSE.md). ## Related - [Security and data handling](https://coderhelm.com/security.md): How CoderHelm handles your code and data: changes on its own branch, builds in a sandbox with no credentials, read only data access, KMS encrypted secrets, signed webhooks and team roles. - [Chat that reads your code and cites it](https://coderhelm.com/chat.md): Ask CoderHelm about your team's repositories and knowledge. Chat opens the code itself, searches it, follows the code graph and cites every claim with the real file path and lines. - [GitHub issue and Jira ticket to pull request](https://coderhelm.com/pull-requests.md): Assign a GitHub issue or Jira ticket to CoderHelm and it plans the change, writes it on its own branch, runs your build and tests, reviews its own work and opens a pull request. --- Source: https://coderhelm.com/self-host/ · Markdown: https://coderhelm.com/self-host.md · Updated 2026-11-05 · Get started: https://app.coderhelm.com --- # Guarded in code, not in a prompt. > Every guard on this page is enforced by the platform itself, so it holds whatever the model writes. ## Your code - CoderHelm reads your repository through the GitHub App, only on the repositories you install it on - It does not git clone your repository; source is fetched when a run needs it - Your build, lint and tests run in a separate container that holds no credentials; the copy of the source it uses is deleted after the build (one day at most) - The code graph keeps symbol names and references, not your source files - Every change goes on a `coderhelm/` branch and arrives as a pull request; a pull request CoderHelm wrote never merges without a person's approval ## Access and secrets - **Encrypted with AWS KMS:** Stored tokens, keys and connection details are encrypted with AWS KMS. Data source secrets carry your team in the encryption context, so they cannot be read for another team. - **Signed webhooks:** GitHub webhooks are checked with HMAC and SNS messages by signature before anything runs. - **Team scoped:** Every request is scoped to your team, and roles (owner, admin, billing, member, viewer) decide who can change what. - **Two-factor sign-in:** Each person has one second factor, asked for after a password, Google or GitHub alike. A team's admins can require it: people without one see only a setup screen until they set it up. - **[Read only data sources](https://coderhelm.com/data-sources/):** Database, API and log lookups are read only, enforced at several independent points. ## What is stored Model calls go to Anthropic through your team's own API key. The [privacy policy](https://coderhelm.com/privacy/) lists every sub processor, what it receives and how long each kind of data is kept. Report a vulnerability to security@coderhelm.com. ## Related - [Read only data sources for an AI coding agent](https://coderhelm.com/data-sources.md): CoderHelm checks your GraphQL API, CloudWatch Logs, PostgreSQL and Redshift while it plans, writes and reviews, with every lookup read only, enforced in code and recorded. - [CloudWatch alarm to pull request](https://coderhelm.com/alerts.md): Route CloudWatch alarms and EventBridge events to CoderHelm through SNS. Matching alerts become analyzed pull requests in the right repository, and recoveries are paired with the alert that raised them. - [GitHub issue and Jira ticket to pull request](https://coderhelm.com/pull-requests.md): Assign a GitHub issue or Jira ticket to CoderHelm and it plans the change, writes it on its own branch, runs your build and tests, reviews its own work and opens a pull request. --- Source: https://coderhelm.com/security/ · Markdown: https://coderhelm.com/security.md · Updated 2026-11-05 · Get started: https://app.coderhelm.com --- # Contact Us Have questions, feedback, or need help? We'd love to hear from you. ## General Support For product questions, bug reports, or account help: [support@coderhelm.com](mailto:support@coderhelm.com) ## Legal & Privacy For legal inquiries, data requests, or privacy-related questions: [legal@coderhelm.com](mailto:legal@coderhelm.com) For privacy-specific requests (data access, correction, deletion): [privacy@coderhelm.com](mailto:privacy@coderhelm.com) ## Security To report a vulnerability or security concern: [security@coderhelm.com](mailto:security@coderhelm.com) ## Abuse To report abuse, policy violations, or DMCA takedown notices: [abuserequest@coderhelm.com](mailto:abuserequest@coderhelm.com) ## Response Times We aim to respond to all inquiries within 2 business days. Privacy and data rights requests will be addressed within 30 days as required by applicable law. --- Source: https://coderhelm.com/contact/ · Updated 2026-11-05 --- # Privacy Policy **Effective date:** July 14, 2025 **Last updated:** October 27, 2026 Coderhelm ("we", "us", "our") operates the coderhelm.com website and the Coderhelm GitHub App (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this policy carefully. By using the Service, you acknowledge the practices described herein. ## 1. Information We Collect ### 1.1 Account & Authentication Data When you install the Coderhelm GitHub App, we receive the following via the GitHub API: - GitHub username and associated email address - GitHub user ID and avatar URL - Organization name (if installed on an organization) - GitHub App installation ID - Repository names, default branches, and visibility settings for repos you grant access to We store your installation ID, organization name, and user identifiers in our database to manage your tenant and authenticate dashboard sessions. ### 1.2 Source Code & Repository Content When Coderhelm processes a GitHub issue, it reads repository files, directory structures, and CI configurations via the GitHub API to understand your codebase. **Source code is processed entirely in-memory and is never persisted** — it is not written to databases, object storage, log files, or any durable medium. Once a run completes, all in-memory code data is discarded. ### 1.3 Run & Usage Metadata For each run, we record: - Run ID, status, and timestamps - Issue/PR identifiers and titles - Token counts (input/output) and estimated cost - Number of files modified and pass durations - Branch names and PR URLs This metadata powers the dashboard and usage tracking. It does not include source code content. ### 1.4 Jira Integration Data If you connect a Jira workspace to Coderhelm, we receive the following via the Atlassian API: - Jira OAuth access and refresh tokens (stored encrypted) - Jira Cloud site ID and site URL - Project keys, issue keys, and issue metadata (titles, descriptions, status) - Atlassian account ID of the authorizing user Jira tokens are used solely to read and create issues on your behalf. They are stored encrypted at rest and can be revoked at any time from your Jira settings. ### 1.6 Google Authentication Data If you sign in with Google, we receive the following via Google OAuth: - Email address and email verification status - Display name and profile picture URL We use this information solely to create and authenticate your dashboard account. Signing in with Google does not give Coderhelm access to your Google Drive, Gmail, Calendar, or any other Google service. Google Drive is only accessed if a team admin separately connects it as a knowledge source (see 1.8). ### 1.7 MCP Tool Integrations Coderhelm supports user-configured Model Context Protocol (MCP) tool servers. When you configure an MCP server, the AI agent may send contextual data (such as file paths, code snippets, or issue metadata) to that server during a run. MCP servers are configured and controlled by you, and data is sent only at your direction. We do not operate or control third-party MCP servers, and their use is subject to their own privacy policies. ### 1.8 Knowledge Sources (Google Drive, Notion, Confluence) A team admin can connect Google Drive, Notion or Confluence as a knowledge source. Each is a separate sign-in with that provider, and you choose what to share: - **Google Drive:** we request the read-only scope `https://www.googleapis.com/auth/drive.readonly`. We list and read only the files inside the folders the admin selects, so that files added or changed there later stay in sync. We never create, edit, share or delete files. - **Notion:** read-only access to the pages and databases you pick on Notion's consent screen. - **Confluence:** read-only access to the spaces and pages you choose. We store the provider's access and refresh tokens encrypted, and we store the text of the selected files and pages indexed in your team's workspace. That content is used only to answer your team's questions in Chat and to give Coderhelm context when it works on your team's tickets, each time with a citation to the source. It is never shared with other customers, never sold, never used for advertising, and never used to train AI models. Disconnecting a source stops syncing and deletes its indexed content and tokens; you can also revoke access at any time from your Google, Notion or Atlassian account settings. **Google API Services User Data Policy.** Coderhelm's use and transfer of information received from Google APIs to any other app will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Specifically: we use Google user data only to provide the knowledge-source features described above; we do not transfer it to others except as needed to provide those features (the AI model provider in Section 5 processes it for inference only, without training), to comply with law, or as part of a merger or acquisition with notice; we do not use it for advertising; and no human reads it unless you give us permission for a specific support request, it is needed for security purposes such as investigating abuse, or to comply with law. ### 1.9 Automatically Collected Data When you visit coderhelm.com, we may automatically collect: - IP address and approximate geographic location - Browser type, operating system, and device information - Pages visited, referral URLs, and time spent on pages ## 2. How We Use Your Information We use the information we collect to: - Provide, operate, and maintain the Service - Process GitHub webhook events and perform the coding tasks you request - Authenticate you and manage your dashboard sessions - Display run history, usage statistics, and billing information - Send transactional emails (run completions, billing receipts, security alerts) - Enforce rate limits and prevent abuse - Respond to support requests and communicate with you about the Service - Improve and optimize the Service's performance and user experience - Comply with legal obligations ## 3. Legal Bases for Processing (GDPR) If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data on the following legal bases: - **Performance of a contract:** Processing necessary to deliver the Service you signed up for (Article 6(1)(b) GDPR) - **Legitimate interests:** Processing necessary for our legitimate business interests, such as fraud prevention, security, and improving the Service, where these interests are not overridden by your rights (Article 6(1)(f) GDPR) - **Consent:** Where you have given consent for specific processing activities, such as marketing communications (Article 6(1)(a) GDPR) - **Legal obligation:** Processing necessary to comply with applicable laws (Article 6(1)(c) GDPR) ## 4. Disclosure & Sharing of Information We do not sell, rent, or trade your personal data. We may share information only in the following circumstances: - **Service providers:** With third-party vendors who assist in operating the Service (see Section 5), bound by data processing agreements - **Legal requirements:** When required by law, regulation, legal process, or governmental request - **Safety & security:** To protect the rights, property, or safety of Coderhelm, our users, or the public - **Business transfers:** In connection with a merger, acquisition, or sale of all or a portion of our assets, with notice to affected users ## 5. Sub-Processors & Third-Party Services We use the following third-party services to operate the Service: | Provider | Purpose | Data Processed | | --- | --- | --- | | Amazon Web Services (AWS) | Infrastructure hosting, compute, data storage, and transactional email delivery | All service data | | Anthropic | AI model inference for code generation and analysis | Source code (in-memory only), issue metadata | | GitHub | Authentication, repository access, webhook delivery | Account data, repository metadata | | Google (OAuth) | User authentication via Google Sign-In | Email, display name, profile picture | | Google (Drive API) | Knowledge source, only if a team admin connects it | Read-only file listing and contents of the selected folders | | Notion | Knowledge source, only if connected | Read-only content of the pages you pick | | Atlassian (Jira) | Issue tracking integration | Jira OAuth tokens, project/issue metadata | Each sub-processor operates under its own privacy policy and is bound by data processing agreements where applicable. **User-configured MCP servers:** If you configure third-party MCP tool servers, data may be sent to those servers at your direction during runs. These are not Coderhelm sub-processors — you are responsible for evaluating their privacy practices. ## 6. International Data Transfers Our Service infrastructure is located in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States. We ensure appropriate safeguards are in place for international transfers, including: - Standard Contractual Clauses (SCCs) approved by the European Commission - Data processing agreements with all sub-processors - Encryption of data in transit and at rest ## 7. Data Retention - **Run metadata:** Retained for 90 days, then automatically deleted - **Account/tenant data:** Retained while your GitHub App installation is active. Upon uninstallation, tenant records are deactivated and all associated data is deleted within 30 days - **Billing records:** Retained as required by tax and accounting laws (typically 7 years for financial records) - **Source code:** Never persisted — discarded from memory immediately after each run ## 8. Data Breach Notification In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users without undue delay and no later than 72 hours after becoming aware of the breach, as required by applicable law. Notification will be sent to the email address associated with your account and will include: the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address the breach. ## 9. Data Security We implement industry-standard technical and organizational measures to protect your data, including: - All data in transit encrypted via TLS 1.2+ - All data at rest encrypted using AES-256 - Secrets (API keys, webhook secrets, private keys) stored in a managed secrets vault - Infrastructure access restricted via IAM policies and least-privilege principles - Web Application Firewall (WAF) protecting all public endpoints - Regular security reviews of application code and dependencies No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. ## 10. Cookies & Tracking The coderhelm.com website uses a session cookie (`coderhelm_session`) to maintain your authenticated dashboard session. This is a strictly necessary cookie and does not require consent under ePrivacy regulations. We do not use advertising cookies, third-party tracking pixels, or analytics services that track you across other websites. We do not participate in ad networks or cross-site tracking. ## 11. AI & Automated Processing Coderhelm uses large language models (LLMs) to analyze code and generate pull requests. This processing is automated and occurs on your behalf when you assign an issue. Key points: - Your source code is sent to an AI model provider for inference only — it is not used for model training - No human reviews your source code during normal operation of the Service - You retain full control over whether to merge any AI-generated changes - You may request information about how automated decisions affect your data by contacting us ## 12. Your Rights Depending on your location, you may have the following rights: ### All Users - **Access:** Request a copy of the personal data we hold about you - **Correction:** Request correction of inaccurate personal data - **Deletion:** Request deletion of your personal data - **Uninstall:** Revoke all repository access at any time by uninstalling the GitHub App ### EEA / UK / Swiss Residents (GDPR) - **Restriction:** Request restriction of processing in certain circumstances - **Portability:** Receive your data in a structured, machine-readable format - **Objection:** Object to processing based on legitimate interests - **Withdraw consent:** Where processing is based on consent, withdraw it at any time without affecting prior processing - **Lodge a complaint:** File a complaint with your local data protection authority ### California Residents (CCPA / CPRA) - **Right to know:** Request the categories and specific pieces of personal information collected about you - **Right to delete:** Request deletion of personal information - **Right to correct:** Request correction of inaccurate personal information - **Right to opt-out of sale:** We do not sell personal information. No opt-out is necessary - **Non-discrimination:** We will not discriminate against you for exercising your CCPA rights To exercise any of these rights, email us at [privacy@coderhelm.com](mailto:privacy@coderhelm.com). We will respond within 30 days (or as required by applicable law). ## 13. Children's Privacy The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete such information promptly. ## 14. Do Not Track We do not track users across third-party websites and therefore do not respond to Do Not Track (DNT) signals. As noted in Section 10, we do not use third-party tracking technologies. ## 15. Changes to This Policy We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where required by law, notify you by email or through the Service. Your continued use of the Service after any changes constitutes acceptance of the updated policy. ## 16. Contact Us If you have questions or concerns about this Privacy Policy or our data practices: - Email: [privacy@coderhelm.com](mailto:privacy@coderhelm.com) - General support: [support@coderhelm.com](mailto:support@coderhelm.com) --- Source: https://coderhelm.com/privacy/ · Updated 2026-11-05 --- # Terms of Service **Effective date:** July 14, 2025 **Last updated:** March 28, 2026 These Terms of Service ("Terms") constitute a legally binding agreement between you (individually or on behalf of an entity, "you" or "your") and Coderhelm ("we", "us", "our") governing your use of the Coderhelm website at coderhelm.com, the Coderhelm GitHub App, the Coderhelm dashboard, and all related services (collectively, the "Service"). By installing the GitHub App, accessing the dashboard, or otherwise using the Service, you agree to be bound by these Terms. If you do not agree to these Terms, do not install or use the Service. ## 1. Eligibility You must be at least 16 years of age to use the Service. If you are using the Service on behalf of an organization, you represent and warrant that you have the authority to bind that organization to these Terms. By installing the GitHub App on an organization account, you confirm that you have the necessary administrative permissions. ## 2. Description of Service Coderhelm is an autonomous AI coding agent delivered as a GitHub App. When you assign a GitHub issue to Coderhelm or apply a designated label, the Service: - Reads your repository files and structure to understand context - Analyzes the issue and generates a plan for code changes - Implements the changes across one or more files - Self-reviews the changes through multiple automated passes - Opens a draft pull request for your review - Optionally detects and fixes CI failures on its branch The Service also includes: - **Jira integration:** You may connect a Jira workspace to sync issues and trigger runs from Jira tickets - **Google OAuth login:** You may authenticate to the dashboard using your Google account - **MCP tool servers:** You may configure Model Context Protocol (MCP) tool servers that the AI agent can invoke during runs. Third-party MCP servers are operated by you or third parties and are not part of the Service - **AI-powered plans:** The Service uses large language models to generate implementation plans and code changes The Service is provided on an "as is" and "as available" basis. We do not guarantee that the Service will be uninterrupted, error-free, or available at all times. ## 3. Account & Access Access to the Service is managed through your GitHub account and the Coderhelm GitHub App installation. You are responsible for: - Maintaining the security of your GitHub account credentials - All activity that occurs under your installation, whether authorized by you or not - Promptly notifying us of any unauthorized use of the Service We reserve the right to suspend or disable access if we reasonably believe your account has been compromised. ## 4. Your Responsibilities - You are solely responsible for reviewing all code changes made by Coderhelm before merging them into any branch - You must not use the Service to generate malicious code, malware, or code that violates any applicable law or third-party rights - You must comply with GitHub's Terms of Service and Acceptable Use Policies - You must comply with our [Acceptable Use Policy](https://coderhelm.com/acceptable-use) - You are responsible for any consequences of merging coderhelm-generated code into your repositories, including but not limited to bugs, security vulnerabilities, data loss, or service outages - You acknowledge that AI-generated code may contain errors and should be treated as a draft requiring human review ## 5. Intellectual Property ### 5.1 Your Code Code generated by Coderhelm for your repositories belongs to you. We claim no ownership of your code, your repositories, the input you provide (issue descriptions, comments), or the output produced by the Service on your behalf. ### 5.2 Open-Source Compliance AI-generated code may inadvertently resemble existing open-source code. You are solely responsible for ensuring that any code you merge complies with applicable open-source licenses and does not infringe third-party intellectual property rights. ### 5.3 Our Service The Service itself — including its name, branding, logos, underlying technology, algorithms, user interface, documentation, and all related intellectual property — remains our exclusive property. Nothing in these Terms grants you any right, title, or interest in the Service beyond the limited right to use it as described herein. ### 5.4 Feedback If you provide feedback, suggestions, or ideas about the Service, you grant us a non-exclusive, royalty-free, worldwide, perpetual license to use and incorporate such feedback without obligation to you. ## 6. Usage & Fair Use ### 6.1 Service Tiers The Service is currently offered free of charge. Usage limits (such as token budgets) may apply and are displayed in your dashboard settings. ### 6.2 Future Pricing We reserve the right to introduce paid plans in the future. If we do, we will provide at least 30 days' prior notice. Existing free-tier access will not be retroactively charged. ## 7. Service Availability & Modifications We may modify, suspend, or discontinue any part of the Service at any time, with or without notice. We will make reasonable efforts to provide advance notice of material changes. We are not liable for any modification, suspension, or discontinuation of the Service. ## 8. Data & Privacy Your use of the Service is also governed by our [Privacy Policy](https://coderhelm.com/privacy), which describes how we collect, use, and protect your data. By using the Service, you acknowledge that you have read and understood the Privacy Policy. ## 9. Confidentiality We treat your source code and repository content as confidential information. Source code is processed in-memory only and is never persisted to durable storage. We will not access your repositories for any purpose other than providing the Service as you have directed. ## 10. Disclaimer of Warranties THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WITHOUT LIMITING THE FOREGOING, WE DO NOT WARRANT THAT: - THE CODE GENERATED BY THE SERVICE WILL BE ERROR-FREE, SECURE, COMPLETE, OR SUITABLE FOR ANY PARTICULAR PURPOSE - THE SERVICE WILL MEET YOUR REQUIREMENTS OR EXPECTATIONS - THE SERVICE WILL BE UNINTERRUPTED, TIMELY, OR FREE FROM ERRORS OR HARMFUL COMPONENTS - ANY ERRORS IN THE SERVICE WILL BE CORRECTED YOU ACKNOWLEDGE THAT AI-GENERATED CODE MAY CONTAIN BUGS, SECURITY VULNERABILITIES, OR OTHER DEFECTS, AND THAT YOU ARE SOLELY RESPONSIBLE FOR TESTING AND REVIEWING ALL OUTPUT BEFORE USE IN PRODUCTION. ## 11. Limitation of Liability TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW: - Coderhelm SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, LOSS OF DATA, LOSS OF GOODWILL, BUSINESS INTERRUPTION, OR COST OF SUBSTITUTE SERVICES, ARISING OUT OF OR RELATING TO YOUR USE OF OR INABILITY TO USE THE SERVICE, REGARDLESS OF THE THEORY OF LIABILITY (CONTRACT, TORT, STRICT LIABILITY, OR OTHERWISE), EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES - OUR TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE SHALL NOT EXCEED THE GREATER OF (A) THE AMOUNT YOU PAID US IN THE 12 MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE HUNDRED DOLLARS ($100) SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF CERTAIN DAMAGES. IN SUCH JURISDICTIONS, OUR LIABILITY IS LIMITED TO THE MAXIMUM EXTENT PERMITTED BY LAW. ## 12. Indemnification To the extent permitted by applicable law, you agree to indemnify, defend, and hold harmless Coderhelm and its officers, directors, employees, agents, and affiliates from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to: - Your use of the Service - Code generated by the Service that you choose to merge, deploy, or distribute - Your violation of these Terms or any applicable law - Your violation of any third-party rights - Any claim by a third party related to code produced by the Service on your behalf ## 13. Termination ### 13.1 By You You may terminate your use of the Service at any time by uninstalling the Coderhelm GitHub App. If you have a paid subscription, cancellation terms in Section 6.4 apply. ### 13.2 By Us We may suspend or terminate your access to the Service immediately if: - You violate these Terms or the Acceptable Use Policy - Your use poses a security risk to the Service or other users - Required by law or legal process - Your account has been inactive for more than 12 months We will make reasonable efforts to notify you before or promptly after suspension or termination, unless doing so would compromise security or violate the law. ### 13.3 Effect of Termination Upon termination, your right to use the Service ceases immediately. Sections that by their nature should survive termination will survive, including but not limited to Intellectual Property, Disclaimer of Warranties, Limitation of Liability, Indemnification, and Governing Law. ## 14. Governing Law & Dispute Resolution ### 14.1 Governing Law These Terms are governed by and construed in accordance with the laws of the State of New York, United States, without regard to its conflict of law provisions. ### 14.2 Dispute Resolution Any dispute arising out of or relating to these Terms or the Service shall first be attempted to be resolved through good-faith negotiation. If the dispute is not resolved within 30 days, either party may bring a claim in the state or federal courts located in New York County, New York, and you consent to the exclusive jurisdiction and venue of such courts. ### 14.3 Class Action Waiver TO THE EXTENT PERMITTED BY LAW, ALL CLAIMS MUST BE BROUGHT IN THE PARTIES' INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS, COLLECTIVE, OR REPRESENTATIVE ACTION. ## 15. Export Controls You may not use the Service in violation of any applicable export control or sanctions laws, including those of the United States and the European Union. You represent that you are not located in, or a national or resident of, any country subject to comprehensive U.S. sanctions, and that you are not on any U.S. government denied-party list. ## 16. General Provisions - **Entire Agreement:** These Terms, together with the Privacy Policy and Acceptable Use Policy, constitute the entire agreement between you and Coderhelm regarding the Service - **Severability:** If any provision of these Terms is found to be unenforceable, the remaining provisions will continue in full force and effect - **Waiver:** Our failure to enforce any right or provision of these Terms will not be deemed a waiver of such right or provision - **Assignment:** You may not assign or transfer these Terms without our prior written consent. We may assign these Terms in connection with a merger, acquisition, or sale of assets - **Force Majeure:** We are not liable for any failure or delay in performance due to causes beyond our reasonable control, including natural disasters, war, terrorism, pandemics, strikes, government actions, or internet or infrastructure failures ## 17. Changes to These Terms We may modify these Terms at any time. When we make material changes, we will update the "Last updated" date and notify you by email or through the Service at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the revised Terms. If you do not agree to the revised Terms, you must stop using the Service. ## 18. Contact If you have questions about these Terms, contact us at: - Legal inquiries: [legal@coderhelm.com](mailto:legal@coderhelm.com) - General support: [support@coderhelm.com](mailto:support@coderhelm.com) --- Source: https://coderhelm.com/terms/ · Updated 2026-11-05 --- # Acceptable Use Policy **Effective date:** July 14, 2025 **Last updated:** March 28, 2026 This Acceptable Use Policy ("AUP") is part of your agreement with Coderhelm and applies to all users of the Coderhelm website, GitHub App, and dashboard (the "Service"). This AUP describes prohibited and restricted uses of the Service. Violations may result in immediate suspension or permanent termination of your access without prior notice. ## 1. Prohibited Uses You may not use the Service to: ### 1.1 Malicious & Harmful Code - Generate malware, viruses, ransomware, trojans, worms, or any other malicious software - Generate code that facilitates unauthorized access to computer systems, networks, or data - Generate exploit code, vulnerability scanners, or tools designed to attack systems - Generate code designed to harass, threaten, stalk, or harm individuals - Generate code that collects personal data without proper consent ### 1.2 Security & Integrity - Bypass, circumvent, or test security controls, authentication mechanisms, or access restrictions of the Service or any third-party system - Attempt to reverse-engineer, decompile, disassemble, or extract the Service's underlying models, algorithms, prompts, or training data - Probe, scan, or test the vulnerability of the Service without prior written authorization (see Section 4.1 for authorized security research) - Introduce viruses, worms, or other harmful code into the Service - Interfere with or disrupt the integrity or performance of the Service ### 1.3 Intellectual Property & Legal - Infringe on intellectual property rights, including using the Service to reproduce copyrighted code, proprietary algorithms, or trade secrets without authorization - Generate code that violates any applicable local, state, national, or international law or regulation - Use the Service in connection with illegal activities, fraud, or money laundering - Misrepresent AI-generated code as entirely human-written in contexts where disclosure is required (e.g., certain open-source contributions) ### 1.4 Abuse & Fair Usage - Abuse the Service through automated means, including creating fake or duplicate issues to artificially consume runs - Share, sell, resell, sublicense, or transfer your account, installation credentials, or access tokens to unauthorized parties - Use the Service in a way that degrades performance, availability, or quality for other users - Create multiple free-tier accounts to circumvent usage limits - Use the Service to benchmark or create a competing product ## 2. Rate Limits & Usage Caps We enforce per-tenant usage limits to ensure fair access for all users: - **Free tier:** 5 runs per calendar month - **Pro plan:** 100 runs per calendar month Runs reset on the first day of each calendar month (UTC). Unused runs do not carry over. If you reach your monthly limit, additional runs will be queued until the next billing cycle, or you may upgrade your plan. In addition to monthly caps, we may apply per-hour and per-day rate limits to prevent abuse patterns. Pro plan users receive priority queue placement over free-tier users during periods of high demand. We reserve the right to throttle or temporarily suspend accounts exhibiting usage patterns that significantly deviate from normal development workflows, even if within stated limits. ## 3. Content Standards While Coderhelm generates code based on your issue descriptions and codebase, you are responsible for ensuring that your inputs (issue titles, descriptions, comments, and repository content) do not: - Contain content that is unlawful, defamatory, obscene, or otherwise objectionable - Attempt to manipulate the AI model into producing prohibited output through prompt injection or adversarial inputs - Include sensitive credentials, secrets, or personally identifiable information in issue descriptions (use environment variables and secret management instead) ## 4. Reporting Violations If you become aware of any violation of this AUP, please report it promptly to [abuserequest@coderhelm.com](mailto:abuserequest@coderhelm.com). Include as much detail as possible, including the nature of the violation and any supporting evidence. We will investigate all credible reports and take appropriate action. ### 4.1 Responsible Disclosure & Security Research We welcome good-faith security research. If you discover a vulnerability in the Service, please report it responsibly to [security@coderhelm.com](mailto:security@coderhelm.com) before disclosing it publicly. Authorized security researchers acting in good faith will not be subject to enforcement action under this AUP, provided they: - Do not access, modify, or delete other users' data - Do not degrade the availability of the Service for other users - Report findings promptly and privately - Allow reasonable time for remediation before any disclosure ### 4.2 Copyright & DMCA Takedown If you believe that content generated through the Service infringes your copyright, you may submit a takedown notice to our designated DMCA agent: - Email: [legal@coderhelm.com](mailto:legal@coderhelm.com) - Subject line: "DMCA Takedown Notice" Your notice must include: identification of the copyrighted work, the infringing material and its location, your contact information, a statement of good faith belief, and a statement under penalty of perjury that the information is accurate and you are authorized to act on behalf of the copyright owner. We will respond to valid DMCA notices in accordance with applicable law. ## 5. Monitoring & Enforcement We reserve the right to monitor usage of the Service for compliance with this AUP. We may investigate suspected violations and take any action we deem appropriate, including but not limited to: - Issuing a warning to the account holder - Temporarily suspending access to the Service - Permanently terminating the account and revoking the GitHub App installation - Reporting illegal activity to appropriate law enforcement authorities - Pursuing legal remedies for damages caused by the violation We will make reasonable efforts to notify affected users before or promptly after taking action, unless doing so would compromise security, enable further abuse, or violate applicable law. ### 5.1 Appeal Process If your account is suspended or terminated under this AUP and you believe the action was taken in error, you may submit an appeal to [appeals@coderhelm.com](mailto:appeals@coderhelm.com) within 30 days of the enforcement action. Include your account details and an explanation of why you believe the action was unwarranted. We will review appeals in good faith and respond within 14 business days. ## 6. Consequences of Violation If your account is terminated for violation of this AUP: - All access to the Service is revoked immediately - Any prepaid subscription fees for the remaining billing period are forfeited - You may be prohibited from creating new accounts or installations - We may retain records of the violation for security and legal purposes ## 7. Changes to This Policy We may update this AUP at any time. When we make material changes, we will update the "Last updated" date at the top of this page and notify you by email or through the Service at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the revised AUP. If you do not agree to the revised AUP, you must stop using the Service. ## 8. Contact Questions about this Acceptable Use Policy? Contact us at: - Abuse reports: [abuserequest@coderhelm.com](mailto:abuserequest@coderhelm.com) - General inquiries: [support@coderhelm.com](mailto:support@coderhelm.com) --- Source: https://coderhelm.com/acceptable-use/ · Updated 2026-11-05