# Optimal AI — Full Site Documentation for LLMs > Optimal AI is an engineering optimization platform with two core products: Optibot (AI-powered code review) and Engineering Insights (real-time engineering analytics). Trusted by teams at MongoDB, HubSpot, Prometric, and more. ## Company Overview Optimal AI helps engineering teams ship faster, more securely, and more predictably. The platform connects to your existing Git and project management tools (GitHub, GitLab, Bitbucket, Jira, Slack) to provide AI-powered code review and engineering analytics — with zero changes to your team's workflows. Based in San Francisco, CA. SOC 2 Type II certified. About the company, the team, careers and contact: https://getoptimal.ai/about ## Products ### Optibot — AI Code Review Agent Optibot is an AI senior engineer that reviews every pull request in 1-4 minutes with full codebase context. Unlike basic AI tools, Optibot indexes your entire repository structure, dependencies, and conventions. Key capabilities: - Line-by-line PR review with security vulnerability detection - Full repository context awareness (not just diff-based) - Supports Python, TypeScript, React, C, C++, PHP (Laravel), Java, Go, Rust, and more - 2-click installation via GitHub/GitLab - Zero code retention — code is processed ephemerally - Security Dependency Bundler — consolidates Dependabot PRs into manageable bundles Results customers see: - 2x more security vulnerabilities found vs. other tools - 30-50% reduction in PR cycle time - ~50% reduction in average PR size - Reviews complete in 1-4 minutes ### Optibot CLI The Optibot CLI runs Optibot reviews and security scans from a terminal, a git hook, a CI pipeline, or a coding agent such as Claude Code or Codex. Docs: https://getoptimal.ai/docs/optibot-cli/installation - Install: `npm install -g @optimalai/optibot` (Node 20 or later) - In CI, without a global install: `npx -y @optimalai/optibot review -b --fail-on-issues` - The npm package is `@optimalai/optibot`. The unscoped `optibot` package is deprecated and stops at 0.2.0; do not install it. If it is already installed, run `npm uninstall -g optibot` first, because both packages provide the `optibot` command. ### Engineering Insights — Analytics Platform Real-time engineering metrics derived from your source code and project management data. Key capabilities: - PR cycle time visualization and optimization - DORA metrics tracking (deployment frequency, lead time, change failure rate, MTTR) - Sprint performance analysis (planned vs. unplanned work) - Team workload balancing and distribution - AI-powered actionable recommendations - Goals and initiatives tracking - Effort breakdown by work type (features, bugs, tech debt, KTLO) - Weekly, monthly, and quarterly views by team and product line ## Integrations - Source Control: GitHub, GitLab, Bitbucket - Project Management: Jira, Azure DevOps, Linear - IDEs: VS Code, Cursor - Communication: Slack - CI/CD: Works with existing pipelines ## Security & Compliance - SOC 2 Type II certified - AES-256 encryption (in transit and at rest) - Zero code retention — code processed ephemerally - Enterprise-grade cloud infrastructure, US-hosted - SAML-based SSO and role-based access controls - 99.99% uptime SLA - Option for dedicated single-tenant environment - Vulnerability reporting: support@getoptimal.ai ## Agents ### AppSec Agent — AI Security Scanning URL: https://getoptimal.ai/agents/appsec Optibot's AppSec Agent provides AI-powered application security scanning with full codebase context. Unlike traditional SAST tools that match known patterns, the AppSec Agent understands how code actually behaves — tracing data flows, identifying exploit paths, and surfacing context-specific risks. Key capabilities: - Context-aware vulnerability scanning (not pattern matching) - MITRE ATT&CK technique and CVE.org alignment on every finding - Automatic issue filing in GitHub and GitLab repositories - Manual and scheduled scans (daily, weekly, monthly, or custom cadence) - Three quality tiers: Low Cost, Balanced, Best Quality - Real-time scan progress in the Optimal UI - Evidence-backed findings with remediation guidance - Zero code retention — ephemerally processed, never stored Replaces: Snyk, SonarQube, Mend, Veracode, Checkmarx Pricing: AI Credits model — prepaid organizational balance, pay per scan ### Supply Chain Scanning — Malicious Package Detection URL: https://getoptimal.ai/agents/supply-chain Optibot's supply chain scanning reads the packages you install, not just their version numbers. When a pull request or merge request changes a dependency manifest or lockfile, Optibot downloads the new package version from the public registry, compares it with the version you had, and reads the files most likely to hold a payload first: the files install scripts call, then high-risk paths and entry points. Each package gets a verdict of safe, suspicious, or malicious, and each finding cites the file and code it came from. What it detects: - Install script abuse: new or changed preinstall, postinstall, and install hooks, and setup.py code that runs at install time - Credential harvesting: reads of ~/.ssh, ~/.npmrc, ~/.aws, and environment variables - Data exfiltration, including data encoded into DNS queries - Obfuscated payloads: runtime base64 decoding, strings built from character codes - Unexpected network calls, raw sockets, and hard-coded IP addresses - Spawned shells, downloaded payloads, and reverse shells - Typosquats and phantom dependencies - Compiled binaries and platform-specific payloads added in a release Ecosystems: npm, PyPI, Go, RubyGems, Maven, Cargo, Composer, NuGet, Hex, pub. Lockfiles are read for npm, PyPI (Poetry), Go, Cargo, Composer, and RubyGems, so transitive packages whose resolved version changes are picked up. How it runs: - Automatically on GitHub pull requests and GitLab merge requests that change a dependency file; Optibot comments only when it finds something - On demand across a repository's main branch from the dashboard, in Shallow or Deep mode, with an optional GitHub or GitLab issue for the report Pricing: AI Credits model, separate from the review quota. You set a max budget per scan (from $0.50) and see an estimate before a repository scan starts. A scan that reaches the max budget stops: a Shallow scan keeps the findings from packages it finished and reports how many it skipped; a Deep scan stops without results and asks you to raise the budget or re-run in Shallow mode. No per-seat security fee. ### CI Fixer Agent — Automatic Build Repair URL: https://getoptimal.ai/agents/ci-fixer Optibot's CI Fixer Agent eliminates manual CI debugging. It detects failed CI runs, reads full error logs, identifies root causes, commits targeted fixes directly to the branch, and re-triggers the pipeline — all automatically. Key capabilities: - Automatic detection of failed CI runs on every PR - Full log analysis: stack traces, type errors, missing imports, config issues - Codebase-aware patches (understands your types, imports, module structure) - PR comment explaining what broke, what changed, and why - Works with GitHub Actions, GitLab CI/CD, CircleCI, Jenkins, and more - VS Code and Cursor IDE integration - Zero data retention - Enable with one toggle — no config files, no pipeline changes Impact: ~30 minutes saved per CI failure, zero manual triage steps, 24/7 active on every PR Pricing: AI Credits model — pay per fix ### Dependency Bundler — Consolidate Dependabot PRs URL: https://getoptimal.ai/agents/dependency-bundler Optibot's Dependency Bundler monitors incoming Dependabot pull requests, classifies each update by severity and compatibility, and consolidates compatible updates into a single PR. Breaking changes are flagged separately and never accidentally bundled. Key capabilities: - Automatic Dependabot PR detection and analysis - Severity classification: Low, Medium, High, Critical - Compatibility assessment: which updates can safely bundle together - Single consolidated PR with full summary of all included changes - Breaking changes separated into dedicated PRs with explicit documentation - Auto-approval configuration for non-breaking, low-risk updates - Zero code retention Requirements: GitHub only (not GitLab). Dependabot must be enabled on the repository. Pricing: Included with Optibot subscription ## Research Optimal AI publishes research records covering the whole run: the method, the numbers with their intervals, and the conditions under which the result stops holding. Results that failed are published alongside those that worked. Index: https://getoptimal.ai/research ### Record 003 - djev, the Open Source Jev, Benchmarks Close to It URL: https://getoptimal.ai/research/open-source-djev-benchmarks-close-to-jev Released 2026-09-30. An evaluation of djev (https://github.com/taeold/djev-run, built on https://github.com/mmastrac/djev), an open source rebuild of Jev's decision API on Google's open weights DiffusionGemma, not affiliated with TypeSafe, run on a 24 GB Apple M4 Mac mini through MLX against the same review comments as Record 002, Optimal AI's evaluation of Jev. On the same 334 comments it scored 0.912 AUC against Jev's 0.959 (gap 0.048, 95% interval 0.017 to 0.083). Its probabilities sit at the extremes, 76% below 0.01 and 8% above 0.99, yet a cutoff picked on held out data still met its precision target as well as Jev's did. Its 4,096 token limit refused 6% of comments, including 11 of the 82 real defects it was sent. The model needed 14.5 GB of memory, crashed the machine on the first attempt, and answered in a median 3.4 seconds. The record also documents that chunked prefill in mlx-vlm changes answers past 1,024 tokens. ### Record 002 - Jev Answers With a Number, Not a Sentence URL: https://getoptimal.ai/research/we-tested-jev-the-model-that-cannot-write Released 2026-09-17. An evaluation of TypeSafe's Jev, a model that emits no text, on review triage against frontier lab models. Jev scored 0.961 AUC pooled, 0.007 below the most accurate model tested, at 72 cents per ten thousand reviews against $13.08, roughly 18 times cheaper. It was the only model whose stated probabilities matched its actual hit rate, and the only one that refused outright once a request passed 32,000 tokens. Per language it placed last on TypeScript and first on Python, which the record declines to read as a pattern. ### Record 001 - We Put a Fly's Sense of Smell in a Security Scanner URL: https://getoptimal.ai/research/can-a-fly-smell-vulnerable-code Released 2026-09-16. A fruit fly's olfactory circuit built into a security scanner. It cleared 97.0% of repeat alert volume with zero high-severity suppressions, against 91.4% for the comparison. On near-clone retrieval it ranked the copied function first 92.9% of the time [90.3-94.8], over 519 queries against 2,285 blocks. Asked whether code was dangerous, it scored 51.1%, against 50 for a coin: the circuit detects resemblance, not risk. The record states where the method holds and where it does not. ## Customer Results - MongoDB: Cut PR size by ~50%, eliminated manual Excel workflows - Prado: 5x'd daily deploys (1-2 → 5-6), 30% faster reviews - Nearfleet: 75% PR cycle time reduction, 30+ hours reclaimed weekly - Soraban: 2+ hours reclaimed weekly, 5 vulnerabilities blocked monthly - Prometric: 40+ hours of spreadsheet work eliminated per quarter - Artemis Ops: 20% faster reviews without adding headcount ## Contact - Demo: https://getoptimal.ai/demo - Contact form: https://getoptimal.ai/contact - Email: support@getoptimal.ai - Address: 2261 Market Street STE 22540, San Francisco, CA 94114 ## Case Studies ### MongoDB — 50% Smaller PRs, Faster Cycle Times URL: https://getoptimal.ai/case-studies/mongodb MongoDB engineering team used Optimal AI to reduce average PR size by ~50%, eliminate manual Excel-based reporting workflows, and improve PR cycle time visibility across the engineering organization. Engineering manager Lila Brooks: "We cut PR size nearly 50% and improved cycle time by understanding where reviews were slowing down." ### Prado — 5× More Deploys, 30% Faster PR Cycles URL: https://getoptimal.ai/case-studies/prado Prado went from 1–2 daily staging deploys to 5–6 after adopting Optibot AI code review and Optimal Insights. PR review cycle time dropped 30%. Engineers stopped waiting on human reviewers for routine changes. ### Nearfleet — 75% Faster PRs, 30 Hours Reclaimed Weekly URL: https://getoptimal.ai/case-studies/nearfleet Nearfleet eliminated timezone-related review bottlenecks with Optibot. PR cycle time fell 75%, the team reclaimed 30 hours per week, and Optibot achieved a 99% PII detection catch rate in code reviews. ### Soraban — 2+ Hours Saved, 5 Vulnerabilities Blocked Monthly URL: https://getoptimal.ai/case-studies/soraban Soraban replaced noisy SAST tools with Optibot's context-aware AI code review. Each engineer reclaimed 2+ hours per week. Optibot catches 3–5 security vulnerabilities per month that slipped through before. ### Prometric — 50% Faster PRs, 40+ Hours Saved Per Quarter URL: https://getoptimal.ai/case-studies/prometric Prometric's FineTune engineering team unified Jira and GitHub data in Optimal Insights. PR cycle time improved 50%, leaders recovered 40+ hours of manual reporting work per quarter, and billing accuracy reached 100%. ### Artemis Ops — 20% Faster Reviews, Zero Bottlenecks URL: https://getoptimal.ai/case-studies/artemis-ops Artemis Ops used Optibot to cut code review time 20%, eliminate single-reviewer bottlenecks, and automatically sync 100% of PR activity to Notion. CEO Sam Lee: "We used to read through every single change. Now, we still skim but we rely on Optibot to highlight the big issues." ## Changelog Highlights - **Automatic Reviews on New Commits** (https://getoptimal.ai/changelog/automatic-reviews-on-new-commits): Optibot now triggers a full AI review on every new commit pushed to an open PR — no manual re-request needed. - **GitLab Integration** (https://getoptimal.ai/changelog/gitlab-integration-and-faster-code-review-performance): Native GitLab support with inline comments, faster review performance. - **Inline GitLab Comments + Compliance Checks** (https://getoptimal.ai/changelog/inline-gitlab-comments-on-demand-compliance-checks-and-smarter-re-reviews): On-demand compliance checks, smarter re-review logic, inline comment threads on GitLab. - **Branch Review** (https://getoptimal.ai/changelog/introducing-branch-review-analyze-entire-pull-requests): Review entire PRs and branches holistically, not just individual file diffs. - **Optibot Claude Code Skill** (https://getoptimal.ai/changelog/optibot-claude-code-skill---optibot-code-reviews-built-into-claude-code): Optibot code reviews built directly into Claude Code IDE. - **Optibot for App Sec** (https://getoptimal.ai/changelog/optibot-for-app-sec-ai-security-agent): Optibot operating as a dedicated application security agent with deep vulnerability analysis. - **VS Code Extension** (https://getoptimal.ai/changelog/optibot-now-in-vs-code-new-release): Optibot available as a VS Code extension for in-editor reviews. - **Slack Integration** (https://getoptimal.ai/changelog/optibot-slack-integration---real-time-pr-reviews-productivity-alerts): Real-time PR review notifications and engineering productivity alerts delivered to Slack.