Repository-specific AI PR reviews.
Less noise than generic AI reviewers, more relevant findings, and security feedback before you merge.
For teams shipping on GitHub who want configurable security review, without slowing down their workflow.
signalmergeReview complete — 3 issues to address before merging:
signalmergeUser input concatenated without escaping — SQL injection risk. Use a parameterized query.
Generic AI reviewers comment on everything. Yours understands your rules.
One agent per repository, with your rules, your severity and your scope: less noise, useful comments, and security risks surfaced earlier.
# Your reviewer, your rules name: security-strict focus: - owasp_top_10 - secrets_detection - auth_flows severity_threshold: medium tone: direct scope: "src/api/**"
A review that looks like your team.
Start from a template or write your rules from scratch. Pick the model, the severity level, the tone and the scope. Assign a different agent per repo — strict on the API, relaxed on prototypes.
Built for GitHub, end to end.
Not a diluted multi-platform plugin. A native GitHub App that listens to your webhooks, comments inline on your PRs, and understands the context of the whole repository — not just the diff.
- Triggered automatically on every pull request
- Full repo context, not just the changed lines
- Security findings posted right on the offending line
{
"agent": "security-strict",
"pr": "#128 feat/auth-refactor",
"files": 12,
"findings": [
{ "severity": "high", "rule": "OWASP-A03" },
{ "severity": "medium", "rule": "no-hardcoded-secret" },
{ "severity": "low", "rule": "missing-null-check" }
],
"status": "review_posted ✓"
}From config to delivery, inside GitHub.
Everything you need to configure the review, catch what matters, and deliver the feedback right inside the PR.
1. Configure
- One agent per repository
- Fully custom rules
- Adjustable severity and tone
- Ready-made templates
2. Detect
- OWASP Top 10
- Hard-coded secrets
- Bugs and edge cases
- Risky patterns
3. Deliver
- Inline comments
- Per-PR summary
- Native GitHub App
- Review in seconds
How SignalMerge compares
An honest look at where SignalMerge fits next to other GitHub AI reviewers. Our focus: repository-specific agents, security-first review, and less noise per repo. Others offer strong, broader code-quality platforms — this table is about fit, not winners.
| Criterion | SignalMerge | CodeRabbit | Qodo | Ellipsis |
|---|---|---|---|---|
| Repository-specific rules | Yes — core | Yes — config | Yes — rules | Via style guide |
| Multiple agents per repo | Yes — core | Not core | Partial | Not core |
| GitHub-native workflow | Yes | Yes | Yes | Yes |
| Security-first review focus | Yes — core | Partial | Not core | Not core |
| Inline PR comments | Yes | Yes | Yes | Yes |
| Suggested fixes | Yes | Yes | Yes | Yes |
| Transparent pricing | Yes | Public tiers | Public tiers | Partial |
| Start in a few clicks | Yes | Yes | Yes | Yes |
Yes = supported · Partial = via config or limited · Not core = not the product’s primary focus. Comparison reflects public positioning.
We take security seriously.
We touch your source code, so trust comes first. Only what’s true today — nothing oversold.
Access you control
Connected through the GitHub App, with access limited to the repositories you select — and revocable anytime from GitHub.
Encrypted in transit
Your code is encrypted in transit over HTTPS for the entire duration of the review.
No training on your code
Your code is used only to produce your pull request review — never to train models.