Self-hosted and source-visible by design. Repositories, credentials, logs, and task history stay on your infrastructure, and the Apache 2.0 codebase is yours to read, audit, and adapt.
You can read the full operating model before granting repository access. Run it close to the codebase, with Apache 2.0 source access, Docker images, visible workers, local logs, and an explicit connection to the agents you choose.
External systems have clear roles. GitHub remains the review system. Claude Code, Codex, Antigravity CLI, Mistral Vibe, OpenCode, or direct provider APIs receive model requests when you route work to them. The ProPR database, task history, queue, repository clones, and settings remain inspectable on infrastructure you control.
Verify it yourself: read the source, inspect public PR #1642, or open the live demo.
Repository clones, indexing state, task files, and logs live in the ProPR stack you operate, using the Docker-based setup described in self-hosting. GitHub access uses scoped permissions through an App you own or through the hosted ProPR Connect relay. In relay mode, your stack holds a revocable relay credential and no GitHub App private key.
Each implementation gets its own Git worktree, branch, and Docker workspace. The optional outbound allowlist is off by default and requires elevated container privileges; supported deployments can restrict traffic to approved services by following the isolation model. ProPR owns branch creation, commits, pushes, and pull-request creation.
You configure GitHub access, provider credentials, subscription-backed agent access, and direct API access in your deployment.
The agent you select for a plan or follow-up receives the prompt and relevant context. With MCP, your chat host and its model service also receive the context returned to the conversation; the optional Connect gateway processes that traffic on the hosted route. Agent routing makes that choice per phase.
Generated code arrives for review through branches, pull requests, comments, checks, and merge decisions that already belong in GitHub.
Every change lands as Git objects and GitHub records: branch, commits, PR conversation, and review scores. The ProPR web UI and CLI show the plan, prompt, logs, model, tokens, and cost. Clone, grep, and diff the Git history with the tools you already run.
Plans, task history, logs, usage, and settings stay in your deployment. Each external system receives only what its role requires.
ReceivesRepository access, branches, pull requests, review comments, status updates, and completion comments.
Kept in ProPRPlans, task history, logs, usage records, worker state, and operational settings.
ReceivesThe prompt and code context needed for the selected plan, implementation, review, or follow-up.
Kept in ProPRUnrelated repositories, full task history, unused credentials, queue state, and local settings.
Runs hereDocker workloads, storage, database state, repository clones, Git worktrees, logs, and worker capacity.
Kept in ProPRThe application, queue, indexes, isolated runs, and audit trail.
ReceivesImage pulls for ProPR and supported agent runtimes.
Kept in ProPRRepositories, task contents, credentials, logs, and review history.
Authenticated MCP adds scoped chat access. Direct MCP connects your chat host to your instance and bypasses Connect. The optional hosted route sends tool arguments and results through Connect and a managed Cloudflare tunnel. Those payloads can include prompts, source code, context, diffs, and artifacts. Connect processes that traffic; the gateway provides no end-to-end encryption through Connect.
Agents, repository clones, execution, and durable task records remain self-hosted. Requested results also reach the chat host and its model service. Their data policies apply to the material you expose in conversation.
Connect clears webhook payloads after successful delivery and caches failed deliveries for up to 24 hours. Payload-free delivery statistics, including repository name, target username, status, and timing, have a 30-day retention window. These retention windows apply only to webhooks.
The gateway forwards MCP requests and results without an intentional application payload store or replay cache. Connect stores OAuth client and pending-consent data, instance registration, grant identity and repository/scope restrictions, token/session hashes, proof-replay records, and encrypted GitHub credentials separately. Revocation clears the grant’s encrypted credential; scheduled cleanup clears expired credentials and removes grant metadata and associated hashes 30 days after expiry or revocation. Registration records follow a separate lifecycle.
The gateway returns generated request IDs and fixed diagnostic errors; scheduled cleanup logs a fixed failure message. These source-level limits do not guarantee zero logging or retention by Cloudflare, operator infrastructure, the chat host, or its model service. Cleanup depends on the configured maintenance job. Read the public core/Connect contract.
OAuth grants scoped access through browser consent. Every MCP action also checks current user and repository permissions. Connected apps supports grant revocation; new invocations are denied after revocation is validated. Already accepted work may continue. Secrets belong in browser authentication and setup.
The Secure VPS Deployment guide takes the same stack to a hardened server, layering network, identity, and authorization controls in front of an already isolated runtime.
Who can trigger agent runs? Which repositories are connected? Which agents are allowed? Which comments should start follow-up changes? What model usage is acceptable for routine changes versus high-value changes?
ProPR treats those as product settings and operating decisions, putting them next to GitHub comment control, cost visibility, and task history.
AI coding uses external model providers unless you configure a local provider path. GitHub has the repository and PR conversation. Self-hosting keeps the delivery layer, credentials, logs, and settings visible while GitHub and model providers perform their defined roles.
For leadership-level rollout concerns, engineering leads ties this security model to adoption, governance, and cost control.