Docs
Getting started with OpenRouting
Everything you need to connect a repository, run scans, and understand results and credits.
$ openrouting init ✓ sign in ✓ connect ✓ scan new workspaces start with 100 credits $
Quick start
Three steps to your first results:
- Sign in with Google or GitHub and connect your GitHub account.
- Pick a repository and a branch, then click Scan now.
- Review findings — each has an AI verdict, explanation, and suggested fix.
What gets scanned
OpenRouting runs Semgrep for code flaws, Gitleaks for secrets across git history, and Trivy for infrastructure misconfigurations. On a full scan it also detects and reviews any AI-agent setup.
Credits
Actions cost credits: a full scan is 20, a pull-request review is 10, an agentic review adds 10, an agent setup PR is 50, and a report is 10. New workspaces start with 100 free credits, and failed runs are refunded.
Common questions
How do I connect a repository?
Sign in with Google or GitHub, open the dashboard, and click Connect repository. Connect your GitHub account, then pick a repository from the list. OpenRouting reads the default branch automatically.
How do I run a scan?
On a repository page, choose a branch and click Scan now. The scan clones the repo, runs the scanners in a sandbox, and has Claude review each finding.
How do I review a pull request?
Open the Pull requests tab on a connected repository, expand a PR to see its changed files, and click Review. When it's done, you can post a summary comment back to GitHub.
How does the agent-setup review work?
A full scan detects any LLM-agent setup and, if found, Claude reviews it for prompt-injection, tool-safety, and secrets risks. Results appear on the Agent setup tab.
How do credits work?
Every workspace starts with 100 credits. A full scan costs 20, a PR review 10, an agentic review adds 10, an agent setup PR costs 50, and a report costs 10. Failed runs are refunded automatically.
What does OpenRouting do with my code?
It clones and reads your code in an isolated, network-less sandbox, never executes it, redacts secrets before AI review, and deletes the clone when the scan finishes.