canonical: https://jentic.com/apis/lgtm.com/lgtm

# LGTM API

The LGTM API runs automated code analysis and CodeQL queries across your projects and returns the security alerts they surface. It lists and adds projects, requests analysis of a specific commit, runs code review on a patch, submits CodeQL query jobs over many projects at once, and reports the status of long-running operations.

## For AI agents

Run code analysis and CodeQL queries across projects, request code reviews on patches, and read the alerts and operation status they produce.

## Scope

Does not host source code, run CI pipelines, or manage pull requests. Use for code analysis, CodeQL queries, and the alerts they produce only.

## Capabilities

- Run analysis of a specific commit on a project
- Request a code review for a patch and read its results
- Submit a CodeQL query job across one or more projects
- Read detailed security alerts surfaced by an analysis
- Add a project to LGTM and manage its analysis configuration

## Use cases

### Agent-driven code review through Jentic

An AI agent reviewing a pull request can submit the patch for automated code review and read back the alerts it raises. Through Jentic the agent discovers the review operation by intent and loads its input schema, so it can gate a change on the results without hand-wiring the LGTM endpoints.

Example prompt: Search Jentic for 'run a code review', submit a patch for a project, and read the resulting alerts.

### Commit analysis in a CI gate

Trigger analysis of a specific commit and poll the operation until it completes, then read the alerts to decide whether to block a merge. LGTM ties each analysis to a project and commit, so results map cleanly onto the change under review.

Example prompt: Request analysis of a commit, poll the operation status until done, and read the alerts for that analysis.

### Fleet-wide CodeQL query

Run a single CodeQL query across many projects at once to find a vulnerability pattern fleet-wide, then fetch per-project results. Query jobs run asynchronously and report progress through the operations endpoint.

Example prompt: Create a CodeQL query job over several projects, then fetch the results overview and per-project results once it finishes.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/projects` | List projects |
| POST | `/projects` | Add a project to LGTM |
| POST | `/analyses/{project-id}` | Run analysis of a specific commit |
| GET | `/analyses/{analysis-id}/alerts` | Get detailed alert information |
| POST | `/codereviews/{project-id}` | Run code review for a patch |
| POST | `/queryjobs` | Run a CodeQL query on one or more projects |
| GET | `/operations/{operation-id}` | Get operation status |

## Key resources

- **Projects** — Repositories added to LGTM for analysis
- **Analyses and alerts** — Analysis runs and the security alerts they surface
- **Query jobs** — CodeQL queries run across one or more projects

## Why Jentic

- **Setup:** Wiring LGTM by hand means creating an access token, handling its asynchronous analysis and query jobs, and polling operation status yourself. Through Jentic you install once, import LGTM from the API Directory, store the token once, and your agent calls it.
- **Permission scoping:** LGTM puts the project id in the URL path, so a rule can pin your agent to one project. You choose the operations it may call, such as running analysis and reading alerts, so deleting a project is not included unless you add it.
- **Credential handling:** Your LGTM access token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'run a code review' or 'run a CodeQL query', and Jentic returns the matching LGTM operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Snyk** — Developer security for code, dependencies, and containers
- **SonarCloud** — Static analysis for code quality and security
- **GitHub API** — Repositories, pull requests, and code hosting

## FAQ

### What authentication does the LGTM API use?

The LGTM API accepts a bearer access token per its OpenAPI spec: create a token in your account settings and send it in the Authorization header. Some read operations are available without a token, while enterprise use and query submission need one. Through Jentic the token is stored encrypted by your own Jentic One instance and injected at request time.

### Is there a LGTM API MCP server?

You don't need an MCP server to give your agent the LGTM API. Jentic connects it directly from the API Directory: import it, store your credential once, and your agent calls it on demand without loading another server's tool definitions into its context.

### Can I run a CodeQL query across projects with the LGTM API?

Yes. Submit a query job over one or more projects, then fetch the results overview and the per-project results once the job completes. Progress is reported through the operations endpoint.

### What are the rate limits for the LGTM API?

The OpenAPI spec does not specify rate limits. Check the LGTM documentation at https://lgtm.com/help/lgtm/api for current limits before submitting large query jobs.

### Can I limit what my agent is allowed to do with the LGTM API?

Yes. LGTM puts the project id in the URL path, so a rule can pin your agent to one project and the read and analysis operations it needs, while withholding project deletion unless you add it. Every call it makes is logged.

### How do I run a code review with the LGTM API through Jentic?

Search Jentic for 'run a code review', load the code-review operation, and pass the project id and patch. Jentic injects your access token and returns the review results. To run it on your own infrastructure, install Jentic One from its GitHub repo.