Open source · Bring your own model
MergeWatch reviews every pull request with the model stack you choose — Claude, GPT-class models via LiteLLM, Gemini, Amazon Bedrock, or local models via Ollama. The review pipeline is open and inspectable, not a closed vendor box. Use the hosted SaaS and pay by PR, not by seat — or self-host the open-source version free and pay only your own model tokens. Your reviewer makes the final call.
v1.0 · Updated August 2026 · Actively maintained
Runs on AWS · GCP · Azure · Bare metal · Fly.io · Railway
17 stars on GitHub
Real numbers, not testimonials. The full pipeline is public — agent prompts, orchestrator, comment templates. Audit what runs on your code before you install it.
View the repo →
AGPL v3 · Self-host anywhere
Your code never has to leave your infrastructure. docker-compose up and point it at Anthropic, OpenAI via LiteLLM, Ollama for air-gapped, or Amazon Bedrock with IAM auth. No API keys leave your network.
SQL injection, XSS, secrets, OWASP Top 10
User input passed to exec() without sanitization
Null dereferences, off-by-ones, race conditions
Array index i+1 can exceed arr.length
Naming, dead code, missing types
Exported function has no return type annotation
PR intent, risk rating, scope
Adds rate limiting to /api/upload — medium risk
Architecture impact, Mermaid flowchart
Control flow diagram of changed paths
All agents run in parallel — including your custom ones. Total latency is bounded by the slowest agent, not the sum. Most reviews complete in under 60 seconds. Define custom agents in .mergewatch.yml with a name and a prompt.
Closed PR review bots ask you to trust their pipeline. MergeWatch lets you inspect and control all of it — prompts, agents, provider routing, deployment, and data path.
Route to frontier models through Anthropic, GPT-class models via LiteLLM, Gemini, or Amazon Bedrock — or run local models via Ollama for air-gapped environments. Swap providers with an env var; nothing hard-codes you to one vendor.
Every agent prompt, the orchestrator, and each comment template ship in the open under AGPL v3. Your security team can read exactly what runs on your code before a single PR is reviewed.
Self-host and your diffs never leave your network. MergeWatch the company has zero access to code, diffs, or review results in a self-hosted deployment — the reviewer works for you, not the other way around.
MergeWatch runs five parallel specialist agents on every pull request: security (OWASP Top 10, SQL and command injection, exposed secrets, path traversal), bugs (null dereferences, race conditions, off-by-one errors, resource leaks), style (naming, dead code, missing types, unused imports), summary (PR intent, scope, and risk rating), and architectural impact (a Mermaid diagram of changed control flow). All agents execute in parallel via Promise.all, so total latency is bounded by the slowest agent, not the sum — most reviews complete in under 60 seconds end-to-end. You can define additional custom agents in .mergewatch.yml with just a name and a prompt, which makes it easy to add framework-specific checks or team conventions. Findings are deduplicated, ranked by severity and confidence, and posted as a single upsert-style comment on the pull request.
MergeWatch is priced by pull request volume, not per developer seat. A five-person team and a hundred-person team merging the same number of PRs pay the same amount, so hiring engineers does not make your bill bigger. The self-hosted distribution is free forever under the GNU AGPL v3 license — you bring your own LLM provider and pay that provider directly, with no markup from MergeWatch on top. The managed SaaS gives the first five reviews free every month, then uses prepaid credits based on actual LLM cost plus a small platform fee. There is no credit card required to start, no seat minimum, and no annual commitment — you can cancel at any time from the dashboard. See mergewatch.ai/pricing for the full interactive breakdown and per-PR cost calculator.
Yes. MergeWatch ships as open-source software under the GNU AGPL v3 license, and the full source code — including every agent prompt, the orchestrator, and all comment templates — is available at github.com/mergewatch/mergewatch.ai. Self-hosting requires running docker-compose up, which starts an Express server backed by Postgres on any Docker-capable host. You supply your own GitHub App credentials, database URL, and LLM provider via environment variables, and the server auto-runs Drizzle migrations on startup. MergeWatch runs on AWS, GCP, Azure, bare metal, Fly.io, Railway, or any environment that can run a container. Your code never leaves your infrastructure, which makes the self-hosted distribution appropriate for regulated industries, air-gapped environments, and organizations with strict data residency or compliance requirements.
MergeWatch supports four LLM provider backends out of the box. Anthropic (direct Claude API) is the default for self-hosted installs and the fastest way to get started. Amazon Bedrock (IAM-authenticated Claude models) powers the managed SaaS and eliminates the need to manage API keys anywhere in your infrastructure. LiteLLM is an OpenAI-compatible proxy that gives access to 100+ providers including OpenAI, Google Gemini, Azure OpenAI, Groq, Together AI, Mistral, and Fireworks. Ollama supports local models like Llama 3 and Qwen for air-gapped or privacy-sensitive environments and is currently experimental. Self-hosted deployments select a provider via the LLM_PROVIDER environment variable. The ILLMProvider interface in @mergewatch/core is a single method, so contributing a new backend usually takes less than a hundred lines of code.
No. MergeWatch is open source under the GNU AGPL v3 license, and the entire review pipeline is inspectable: every agent prompt, the orchestrator that deduplicates and ranks findings, the provider routing, and each comment template live in the public repository at github.com/mergewatch/mergewatch.ai. Closed PR review bots ask you to trust a hosted pipeline you cannot see; MergeWatch lets your security team audit exactly what runs on your code before you install it, and lets your engineers fork or customize it. You also choose the model — Claude, GPT-class models via LiteLLM, Gemini, Amazon Bedrock, or local models via Ollama — so you are not locked into a single vendor's model or infrastructure. Human reviewers always keep final merge authority; MergeWatch surfaces flags, it does not gate your merges on a vendor's judgment.
Yes. MergeWatch for Open Source gives qualifying open-source projects free hosted access to the managed SaaS, because maintainers are about to face rising volumes of plausible-but-risky AI-generated pull requests and deserve frontier-model review on their side too. The program is for real, actively maintained public repositories, is approved manually with fair-use limits, and carries no SLA. In exchange we ask for honest product feedback and, only if MergeWatch proves useful, permission to list your project or logo as an early open-source user — never before you have used it. Maintainers are not paid for promotion and can stop at any time. You can apply at mergewatch.ai/open-source.
Already checked for you:
No secrets or tokens detected
Lock files look clean
847 lines scanned across 12 files, 40 known vulnerability patterns checked
Focus your energy on:
High risk — your attention here will matter most
Adds authentication middleware to admin routes. One bypass path detected in routes/admin.ts — may be intentional.
| Severity | Confidence | Location | Finding |
|---|---|---|---|
| critical | Likely | src/api/handler.ts:42 | Unsanitized input passed to exec() |
| high | Likely | routes/admin.ts:18 | Auth middleware bypassed on /health |
| warning | Worth checking | lib/db.ts:91 | Missing null check on optional user |
Before you approve, consider:
☐ Is the auth bypass in routes/admin.ts:18 intentional?
☐ Does the new retry logic handle network timeouts?
These are flags, not verdicts. You know this codebase.
Posted as inline review comments + a top-level summary. Re-triggers automatically when new commits are pushed.
Most review tools charge per developer per month. Every engineer you hire makes your bill bigger — the tool that’s supposed to help you scale penalizes growth. MergeWatch prices by PR volume, not headcount. A 5-person team and a 100-person team merging the same number of PRs pay the same.
AGPL v3. Not “source available.” Not a limited open-core wrapper around a closed engine. The full review pipeline — every agent prompt, every orchestrator, every comment template — is in the repo. Your security team can audit it. Your engineers can fork it.
Self-host with a single docker-compose up. Use Anthropic, OpenAI via LiteLLM, Ollama for air-gapped environments, or Amazon Bedrock with IAM-native auth — no API keys to manage. GCP, AWS, Azure, bare metal. If you can run Docker, you can run MergeWatch.
MergeWatch for Open Source
Maintain a real open-source project? We’ll give it free hosted access. AI-generated PRs are getting easier to produce and harder to inspect by hand — maintainers deserve frontier-model review on their side too. In exchange we ask for feedback and, if it helps, permission to list your project.
Apply for free OSS accessSet up in 2 minutes. No credit card required.