// privacy-first & self-hosted

Keep your token. We only need the diff.

For teams whose security policy won't allow a vendor to store an SCM credential. In every mode on this page, GitLab tokens, webhook secrets and comment publishing stay inside your infrastructure — CodeGuards Cloud receives only the review bundle (diff, changed files, metadata). The review is identical to the managed setup.

Looking for the fastest setup or a developer-local tool instead? See all connection options — or jump to managed cloud and the local CLI.

Three privacy-first modes

⚙️

CI runner

Minimal footprint. Your pipeline sends the diff to CodeGuards and posts the verdict using credentials that never leave CI. Best when you only want review on pipeline runs.

🔁

CI runner + realtime relay

A small Docker service receives GitLab Note events and returns CodeGuards' answer to the thread — realtime replies, with credentials still local.

🐳

Compute instance

One long-running worker in your network owns the webhooks and the SCM token end-to-end. Maximum control; a single container to run.

What leaves your network

CodeGuards Cloud receives only what it needs to produce the review: the MR diff, changed-file metadata, commit/MR metadata, the requested products, and discussion text when a developer asks a follow-up.

GitLab tokens, webhook secrets, project webhooks, SCM API calls and comment publishing stay on your side. CodeGuards Cloud never holds a standing repository token in these modes.

Before you start

  • Generate a CodeGuards CI API key in Integrations (also copies your organization slug and repository connection id).
  • Create a GitLab project access token with api scope for the projects you'll publish to.
  • Generate one long random webhook secret; use the same value in GitLab and CODEGUARDS_GITLAB_WEBHOOK_SECRET.

Start CI runner, relay and compute setups from the generated snippet in Integrations after selecting a repository — it pre-fills the ids so nobody has to hunt for them.

Install paths

Composer package for CI runner & relay

Use this inside PHP projects / CI where the repository already has a composer.json.

composer config repositories.codeguards composer https://codeguards.io/dist/composer
composer require codeguards/ci-runner

vendor/bin/codeguards-review
vendor/bin/codeguards-gitlab-relay serve

Docker relay for realtime replies

docker pull ghcr.io/codeguards/ci-runner:latest
curl -fsSLO https://codeguards.io/dist/self-hosted/docker-compose.relay.yml
curl -fsSLo .env.relay https://codeguards.io/dist/self-hosted/relay.env.example
# edit .env.relay: API key, organization slug, repository connection id, GitLab token, webhook secret
docker compose -f docker-compose.relay.yml up -d
curl -fsS http://localhost:8080/healthz

Docker image for the compute instance

docker pull ghcr.io/codeguards/compute-instance:latest
curl -fsSLO https://codeguards.io/dist/self-hosted/docker-compose.compute.yml
curl -fsSLo .env.compute https://codeguards.io/dist/self-hosted/compute.env.example
# edit .env.compute: API key, organization slug, repository connection id, GitLab token, webhook secret
docker run --rm --env-file .env.compute ghcr.io/codeguards/compute-instance:latest doctor
docker compose -f docker-compose.compute.yml up -d

Webhook & operational checks

For the compute instance, add a GitLab project or group webhook pointing to https://compute.example.com/gitlab_webhooks. Enable Merge request events and Comments events, using the same secret as CODEGUARDS_GITLAB_WEBHOOK_SECRET.

  • GET /healthz — liveness probe.
  • GET /readyz — readiness, including config and writable local state.
  • doctor — validates environment variables before the webhook goes live.
  • JSON logs include event, request id, result and finding counts — never tokens.
Ready for the privacy-first setup? Grab a CI API key and your repository ids from Integrations, then start from the generated snippet.
Start free trial
Read more: All connection options · Local CLI · Connection modes · Pricing