A maintainer for your open source repositories
Clara is a background agent that reviews and fixes pull requests, triages issues, answers questions about your code, and handles security alerts.
What it does
Routine maintenance, handled
Clara runs in the background and works through GitHub. When a pull request, issue, comment, or alert arrives, it does what a maintainer would, and stays quiet otherwise.
- Reviews pull requests
- Runs Claude Code's /code-review on every pull request, Dependabot's included, and sorts what it finds into blocking problems and minor notes.
- Fixes what the review finds
- Fixes each finding that's within the pull request's scope, runs your checks, pushes one commit to the branch, and approves once nothing blocking is left.
- Cleans up after review bots
- Fixes what CodeRabbit and Codex flag when it's worth fixing, says why when it isn't, resolves every thread, and answers the nitpicks in one comment.
- Triages issues
- Finds the code an issue is about, likely duplicates, and what the reporter left out, then applies the labels that fit and posts a short triage comment.
- Answers questions
- Say “clara” in a comment and it reads the code, then answers with links to the lines it's based on. Ask for a review and it runs one again.
- Fixes code scanning alerts
- Opens a pull request with the smallest fix for a real vulnerability, and dismisses false positives and test-only findings with an explanation.
- Updates vulnerable dependencies
- Waits for Dependabot's own pull request and reviews it. If none arrives, updates the dependency with your package manager and opens one itself.
- Triages leaked secrets
- Resolves secrets that are inactive, test fixtures, or placeholders. Leaves real ones open, since only their owner can rotate them.
- Checks private vulnerability reports
- Checks a private report against the code and, if it holds up, accepts it as a draft advisory with a severity. It never mentions one in public.
What it won't do
It never merges
Clara reads text written by strangers, so it's built to limit what a misled model can do. Its strongest signal is an approval, and that means a change is ready for a human to merge.
- Merge or delete anything
- An approval or a fix pull request is as far as it goes. Merging stays with you.
- Hold broad tokens
- Each GitHub token is minted for one repository, with only the permissions that call needs.
- Run your code with credentials
- Reviews and fixes run in a sandbox that never holds a GitHub token and only reaches GitHub and AI Gateway.
- Leave the call to a model
- Approving, dismissing, and resolving are decided by code from structured results, not by a model reading free text.
- Touch your workflows
- No fix can change files under .github/, and Clara won't approve a change to your workflows or actions.