Features
Everything you need to plan work worth shipping.
The complete catalog — what ships today, what's next, and the thinking behind each piece.
Planning & context
| Code-grounded plans | Steps resolve to real paths and symbols you can click straight into. |
|---|---|
| Workspace-scoped retrieval | Corvi picks the relevant files automatically, through the security broker. |
| Signature-level grounding (LSP) | Opt in to language-server grounding — real signatures and cross-file references for Swift, TypeScript, Python, Go, Rust, Java, and Kotlin. |
| Plan types with intent | Feature, bugfix, refactor, migration — each shapes how the engine structures the work. |
| Tests-first structure | Plans break work into milestones, concrete changes, and tests-first steps. |
| Cross-file blast radius | A plan surfaces the files a change ripples into — the callers and dependents of what it edits, not just the edited set. |
| Repo memory | Corvi learns your repo's conventions over runs and applies them to the next plan. Review what it has learned, and forget any of it. |
| Plan-approval gate | A plan is the contract: it must be approved before it runs or opens a PR — and re-approved if you edit it after sign-off. The plan outranks the reviewer. |
| Plan refresh | Re-ground a plan at any time as the code evolves. |
Review engine
| Multi-model pipeline | One model drafts, a second reviews independently, a third synthesises the result. |
|---|---|
| Independent review | A second model challenges claims and surfaces gaps like a senior engineer. |
| Conflict synthesis | Disagreements between models are de-conflicted into one coherent plan. |
| Model presets | Presets tuned for quality, value, or fully on-device — defaults backed by a standing model benchmark, or choose the model behind each pass yourself. |
| Honest cost estimates | A p50–p90 cost range shows before every run ($0 on-device). A running ledger reconciles estimate against actual. |
| Per-run spending cap | Set a max dollar ceiling per run; it stops cleanly at the limit instead of spending past it — no paid call funded once the cap is hit. |
| Bring your own keys | Calls go straight to the provider; swap models to balance cost and rigor. |
| Local models | Run fully offline with a local model and on-device embeddings. |
Trust & egress
| Local-first by default | Nothing leaves your machine without your say. |
|---|---|
| Security broker | A trust boundary that decides exactly what the engine may see. |
| Opt-in egress | Every outbound integration is opt-in, per server. |
| Fetch budgets | Caps stop runaway outbound calls before they happen. |
| Egress audit | Every call logged with arguments hashed — know exactly what left the machine. |
| Untrusted-content wrapping | External content is wrapped before it reaches a model. |
Native app & editor
| Native macOS app | A real Mac app — Apple silicon & Intel, macOS 15+ — not a browser tab. |
|---|---|
| Live-preview Markdown | Syntax-aware preview with code, headings, and lists. |
| Safe streaming | Model output flows into a read-only buffer — never over the text you're editing. |
| Keyboard-driven | Snappy and fast, built to work with your repo, not around it. |
Workflow & integrations
| Run the agent in a worktree | Execute the plan on an isolated worktree and see the diff — your build / test / lint, your machine. |
|---|---|
| Watch the run live | A running plan shows live elapsed time and flags when the agent has gone quiet; a finished run shows what it took, start to end. |
| Cross-model self-review | A different model grades the work and renders a plan-conformance verdict — the one that wrote it doesn't grade it. |
| Open the PR | Open the pull request with a plan-tied description and track its checks. |
| Claude Code plugin | Pull any plan into Claude Code with a one-command plugin and run it there. |
| MCP servers & skills | Discover and route to your own tools per run, behind the egress gate. |
| Autofix & comment handlingIn development | Findings become fixes, and reviewer & CI comments get resolved in context. |
Planning, running, and cross-model review ship today. Autofix and PR-comment handling are building now.