CrossCut turns code review findings into lessons your team approves, and hands them to Claude Code, Cursor and other assistants before they write code.
Developer task
Add an endpoint that receives a callback URL.
Context CrossCut adds
[RELEVANT LESSONS — do not repeat these mistakes]1. [a41f09c2] (area: api.ts) When building URLs from input data, check the protocol first: only http and https.2. [7be2d310] (area: panel-config) Every new Vite proxy route needs its location block in nginx.conf.[END LESSONS]1.00
recall and precision for the deterministic gate, on a corpus of 34 files. On a live corpus of 300 cases, the 95% Wilson lower bound is 0.975.
355
approved lessons. The team that builds CrossCut uses it itself, as of October 26, 2026.
Not measured
a reduction in repeated mistakes: that is not measured yet.
Each session starts from scratch, so the same mistake gets written again. Review finds it once more, but only after the code exists.
| Before writing | After it is written | |
|---|---|---|
| Human review | Does not act | Finds the mistake |
| PR bots | Does not act | Comment on the mistake |
| SonarQube | Does not act | Flags the mistake |
| CrossCut | Injects the lesson | Captures the finding |
One example mistake goes through the five stages. Pick one to see what it produces.
The finding comes in from where code is already reviewed.
Finding
The URL is built from input data without checking the protocol.
Illustrative example
A model turns the finding into a structured lesson.
Lesson Draft
Illustrative example
A person on the team decides what gets in.
Lesson
Accept only http and https, and encode special characters.
draft, approved, discarded or expired. Today: draft.
Illustrative example
The lesson reaches the assistant before it generates code.
[RELEVANT LESSONS — do not repeat these mistakes]1. [a41f09c2] (area: api.ts) When building URLs from input data, check the protocol first: only http and https.2. [7be2d310] (area: panel-config) Every new Vite proxy route needs its location block in nginx.conf.[END LESSONS]Illustrative example
What can be mechanized becomes a rule that runs on its own.
Rule url-without-protocol-check
Certified: blocks
It runs in pre-commit, in CI and in the plugin gate.
Illustrative example
We do not promise fewer repeated mistakes: that is not measured yet. The corpora of each layer are not comparable with each other.
The benchmark is versioned in the repository. Two layers performed well on small corpora, one is weak, and the test with an agent was inconclusive.
| Layer | What was measured | Result | Reading |
|---|---|---|---|
| Deterministic gate | 34 files: 17 with a mistake and 17 clean | Recall 1.00, precision 1.00 and 0.00 false denialsOn a live corpus of 300 cases, the 95% Wilson lower bound is 0.975. | Good on this corpus |
| Finding capture | Findings collected from the sources | Recall 1.00 and precision 1.00 | Good on this corpus |
| Lesson retrieval | Whether the right lesson lands in the top 3 | Precision@k 0.33 on 8 prompts. Recall@3 of 0.33 with 300 lessons and 0.24 with 1,000 | The weakest layer |
| Test with an agent | 120 runs with an assistant, with and without CrossCut | 0.333 without CrossCut and 0.333 with CrossCut | Inconclusive |
Today CrossCut is used by the team that builds it: 355 approved lessons and 832 drafts as of October 26, 2026.
“Mistakes avoided” in the panel is an estimate: injections minus recurrences. It does not measure whether the assistant used the lesson.
What is live is called live. What only has a sample configuration is called that too.
GitHub App Live
Inline comments and review summaries from bot accounts.
PR review bots Live
Generic: CodeRabbit comes in like any other bot.
SonarCloud Live
By webhook and by project connector, with an encrypted token.
SARIF Live
Ingestion through the API.
Review from the assistant Live
With the MCP tool capture_findings or a hook.
Claude Code Plugin
A hook on every prompt and a gate on Write and Edit.
Grok Plugin and rules
Lessons and rules inside the assistant.
OpenCode Plugin
With feature parity.
Cursor Rules and hooks
Installed with one command.
Codex, Gemini CLI and Continue Example
Sample MCP configuration only; not verified in production.
GitHub Action crosscut-gate Unpublished
It exists, but it is not published yet.
What leaves your machine, what is stored and who decides. No promises we cannot keep.
Read the privacy policyLessons from one project are not mixed with another’s. Only projects that turn it on take part in training: it is opt-in, revocable and audited.
With DeepSeek, already sanitized findings go to that provider. With the “none” option, nothing leaves.
Embeddings are computed on our own server; that text does not go to third parties. Prompts are kept for 90 days by default, configurable per project.
Every lesson goes through a person. Batch quarantine is reversible and deletes nothing.
JSON export, project deletion, user anonymization and a downloadable audit. The governance sheet carries a SHA-256 seal.
Prices and limits are decided at launch. Today you can request early access.
To try CrossCut with a small team before you decide.
Price at launch
Main plan
For teams that code with assistants every day.
Price at launch
For organizations with governance, provider or custom deployment requirements.
Price at launch
No. Review stays yours: human, with PR bots or with SonarQube. CrossCut takes what that review found and hands it to the assistant before it generates new code. It is not an IDE and does not replace the assistant.
With DeepSeek distillation, already sanitized findings leave: the client redacts secrets and paths, and the server sanitizes again, emails included. With the “none” provider nothing leaves. Prompts are turned into embeddings on our server. The providers are listed in the privacy policy.
We cannot claim that yet. The deterministic gate did very well on its corpus, but the test with an agent (120 runs) gave 0.333 with and without CrossCut, with no conclusion. The detail is in the evidence section.
Any project member can approve, edit or discard. The lead manages members, providers, retention and integrations, and can require double approval for rules.
It is an estimate: injections minus recurrences. It does not prove the assistant used the lesson. “Injected” only means it was in a run’s block.
Claude Code, Grok and OpenCode have a plugin; Cursor, rules and hooks. For Codex, Gemini CLI and Continue there are sample MCP configurations, not verified in production.
Each project has a monthly cap in USD. At 80% an alert goes up, and at 100% retrieval falls back to lexical search.
Prices are decided at launch. Meanwhile you can request early access.
There is no automatic sign-up yet. Early access works by request: a person on the team reviews each one, creates the project and invites the lead from the dashboard.
We will open early access soon. For now we are not taking requests.