Now live as a GitHub App · Free forever

Your PR gets reviewed
like a senior DevOps engineer.

DevDoctor automatically scans every pull request for infrastructure issues — and writes the fix for you. No setup. No configuration. No missed mistakes.

Start scanning PRs in 30 seconds → View on GitHub
✓ Works with any GitHub repo ✓ Zero configuration ✓ AI-powered fixes ✓ Free to use
devdoctor scan ./api-service
$ devdoctor scan .
🔍 Scanning /api-service — found Dockerfile, docker-compose.yml
📄 Dockerfile Score: 40/100
──────────────────────────────────
❌ ERROR  HARDCODED_SECRET (line 3)
ENV API_KEY=sk-prod-abc... detected in image layer
Fix → Remove from Dockerfile, inject at runtime: docker run -e API_KEY=$KEY
⚠ WARNING  NO_USER
Container runs as root — reduces attack surface
Fix → RUN useradd -r -s /bin/false appuser && USER appuser
⚠ WARNING  NO_DOCKERIGNORE
Build context contains .env, .git, node_modules
🤖 AI Summary — Fix secrets + USER first. Critical security issues.
❌ Overall: 40/100 ████░░░░░░
🔌 Works with any GitHub repo
⚡ Triggers on every PR automatically
🔒 No code leaves your repo
🤖 Powered by Gemini 2.5 Flash
🆓 Free to use
// The problem

Infrastructure bugs reach production because nobody reviews Dockerfiles.

Code reviewers focus on logic. DevOps issues slip through. DevDoctor fills that gap automatically.

✗ Without DevDoctor
😰
Manual, inconsistent reviewsDockerfile checks depend on reviewer experience. Easy to miss on busy PRs.
🔑
Secrets baked into imagesAPI keys in ENV or ARG get committed, layered, and exposed in image history.
🚢
Issues reach productionRunning containers as root. No healthchecks. Bloated images. All avoidable.
⏱
Slowdown during incidentsHours debugging issues that a 30-second scan would have caught at PR time.
✓ With DevDoctor
🤖
Automated PR-level scanningEvery PR with infrastructure changes gets a full analysis. Zero manual effort.
🛡️
Secrets caught before mergeHardcoded secrets flagged at line level with exact remediation steps.
✅
AI writes the fix for youNot just "this is wrong" — specific, copy-pasteable fixes generated by AI.
📊
Health score per PRTrack infrastructure quality over time. Block merges below a threshold with CI mode.
// How it works

Three steps.
Zero configuration.

Install once, forget about it. DevDoctor runs silently in the background on every relevant PR.

01
🔌
Install the GitHub App

One-click install from the GitHub Marketplace. Select which repos to monitor. Takes under 30 seconds. No YAML config, no token setup.

02
🔀
Open a pull request

Any PR that modifies a Dockerfile, docker-compose.yml, or Kubernetes manifest automatically triggers a DevDoctor scan.

03
💊
Get the diagnosis

DevDoctor posts a structured comment with a health score, issue table, severity levels, and AI-generated fix for every problem found.

// Features

Not a linter.
A DevOps co-pilot.

DevDoctor doesn't just detect problems. It understands context and writes the fix — like pairing with a senior engineer on every PR.

🐳
Deep Dockerfile Analysis

9 rules covering security, performance, and reliability. Catches hardcoded secrets, root execution, unpinned images, layer bloat, and missing runtime safety nets.

secretssecurityperformance9 rules
🤖
AI Fix Suggestions

Powered by Gemini 2.5 Flash. Every issue includes a specific, copy-pasteable fix — not generic advice. Context-aware suggestions that understand your actual file.

Gemini 2.5 Flashcontext-awareactionable
📦
Multi-layer Infrastructure Scanning

Analyzes Dockerfiles and docker-compose together. Catches cross-service issues like unpinned service images, open port bindings, and missing healthchecks.

docker-composenetworking5 rules
⚡
Zero Configuration Setup

No YAML files, no tokens, no CLI setup required for teams. Install the GitHub App once and every eligible PR gets scanned automatically. It just works.

plug-and-playGitHub App30 second setup
// What your team sees

A full DevOps report,
right inside the PR.

No dashboards to check. No tools to run. DevDoctor posts directly to GitHub — exactly where your team already works.

DD
devdoctor-io bot 2 minutes ago
🩺 DevDoctor Report
Overall: 40/100 ⚠️

📄 Dockerfile — 40/100
SeverityRuleIssue
❌ ErrorHARDCODED_SECRETAPI key found in ENV instruction (line 3)
⚠ WarningNO_USERContainer executes as root
⚠ WarningNO_DOCKERIGNORESensitive files included in build context
ℹ InfoNO_HEALTHCHECKDocker cannot detect unhealthy container
🤖 AI Summary: This Dockerfile has two critical security vulnerabilities. The hardcoded secret will be permanently embedded in image layer history, and root execution increases the blast radius of any container escape. Resolve both before merging to any non-local environment.
Powered by DevDoctor — AI-powered DevOps health checker devdoctor-io ✓
9+
Dockerfile rules
5+
Compose rules
30s
Setup time
∞
Repos supported
// Roadmap

Actively built.
Rapidly expanding.

DevDoctor ships weekly. Here's what's live and what's coming next.

✓
✓ SHIPPED
Dockerfile Analyzer

9 rules — secrets, pinned images, USER, HEALTHCHECK, layer optimization, .dockerignore.

✓
✓ SHIPPED
GitHub App

Automatic PR scanning with inline comment reports and commit status checks.

✓
✓ SHIPPED
Gemini AI Fixes

Context-aware fix suggestions for every issue. Specific, not generic.

→ IN PROGRESS
Kubernetes Analyzer

Resource limits, liveness probes, security contexts, namespace enforcement.

→ COMING SOON
GitHub Actions Checker

Pinned action versions, secret exposure, missing job timeouts, runner security.

◦ PLANNED
CI Mode + HTML Reports

Exit with code 1 below score threshold. Shareable HTML report export with --report flag.

// Get started

Catch infra issues before
they reach production.

Install the GitHub App in 30 seconds. Your next PR gets a full infrastructure health report — automatically.

→ github.com/apps/devdoctor-io/installations/new
Install GitHub App — Free → View Source on GitHub
Aryan Shaw
// About the builder

Aryan Shaw

Backend engineer building developer tools and AI-powered products.

Currently working at TCS. Previously at DailyPe (YC W23). I build things that solve real developer problems — DevDoctor is one of them.

LinkedIn GitHub X / Twitter