Loading…

Live nowMergeGuardAgent · AI code review in VS Code, Cursor, and Windsurf — install from the MarketplaceInstall →Docs Demo

Catch Bugs Before They Reach Production

AI-powered code reviews for GitHub and GitLab—parallel agents, risk scores, OSV + Trivy scans, and @mergeguards fix commits on every pull request.

Parallel agents
Risk scores
OSV + Trivy scans
Auto-fix commits

No card required · 100 reviews/mo · Deep Scan · Intelligence

9K
Files reviewed
14K
Bugs reported
7K
Bugs fixed

2-click setup
Sign up free
14-day Pro trial included
Private repos

MergeGuardAgent

Review Code Without Leaving VS Code

Most competitors focus on pull requests.

MergeGuard helps developers catch issues while they're coding.

How it works in your editor

Developer Writing Code
MergeGuardAgent

Choose your workflow

Two Ways to Use MergeGuard

Review in your editor while you code, or gate changes on pull requests—same AI engine, same account.

Option 1

IDE Reviews

MergeGuardAgent

Get feedback while coding.

Best for

Individual developers
Fast iteration
AI-generated code validation

Install MergeGuardAgent Setup guide →

Option 2

PR Reviews

One roof · parallel agents

Stop paying for a stack of pricey AI tools

Many teams bolt on different models and vendors for review, security, and dependencies—each with its own bill. MergeGuard runs specialized agents in parallel, merges the signal, and posts one native review with the strongest scans on every pull request.

Compare plans →

acme/api-service · PR #482

Parallel agents

Code review✓
OSV lockfile✓
Trivy security✓

Merge risk

/ 100 · ~2 min review

Conversation · Files changed

mergeguard

bot · just now

Medium

Potential issue — missing null check before decode() on the authorization header.

@@ src/auth/middleware.ts @@

− if (!token) decode(token);

+ if (!token) return unauthorized(res);

Reply @mergeguards fix for an auto-commit

Security · merged findings

3 signals · 1 comment

OSV
lodash@4.17.20 · CVE-2021-23337
Trivy
AWS key pattern in .env.example
AI
Missing null guard before decode()

Security scanning · now built in

Security scans are live in every review

Open-source security scanners are built into your AI code review—no separate tool to install. OSV dependency CVEs, Trivy filesystem scans, and async container image scanning on Dockerfile PRs are live on Pro+.

Container scan docs →

$mergeguard scan --pr 482Scanning

Scanning 6 targets in the diff

OSVpackage-lock.jsonscanning…
AI reviewsrc/auth/middleware.tsqueued
Trivy.env.localqueued
TrivyDockerfilequeued
Trivyinfra/main.tfqueued
AI reviewsrc/api/users.tsqueued

Findings

CVEs

Secrets

Misconfig

Code

Merge risk

—/ 100

merging findings…

OSVLive now

Dependency CVEs from your npm lockfiles, on every pull request.

Known CVEs in package-lock.json

How it works

Stays in GitHub. You stay in flow.

One pipeline from push to protected merge—AI review, security scans, and PR commands inline on your diff. Install once; no separate dashboard.

Install the GitHub App or connect GitLab once. Every opened, synced, or reopened pull request triggers MergeGuard automatically—no CI YAML to maintain.

4 tabs · context switching

Review portalSSO loginEmail digestStatus page

Leave GitHub to view findings in an external dashboard.

!!!

Context lost · extra clicks · slower merges

acme/api-service · PR #482

Files changed

@@ src/auth/middleware.ts @@

- const token = req.headers.authorization;

+ const token = req.headers.authorization?.trim();

+ if (!token) return unauthorized(res);

Line 14 · MergeGuard

Missing null guard before decode()

Line 22 · MergeGuard

OSV: lodash@4.17.20 — CVE-2021-23337

@mergeguards fix

→ auto-commit pushed to branch

Webhook

pull_request.opened

Engines

AI review

OSV deps

Trivy scan

Merge risk

—

2 high · 1 medium

Secrets & credentialsDependency CVEs (OSV)Injection & auth logic

PR commands

Drive follow-ups from the same thread

After the review lands, reply with commands—no context switch to another tool.

GitHub & GitLab demos →Command reference →

@mergeguards fixAll plans

Reply on an inline finding to generate a patch and commit it to the PR.

@mergeguard-followupPaid

Re-run AI review on the current PR after new commits or discussion.

@mergeguards deep-scanPaid

Deeper pass for security and architectural risk—ideal before merging large changes.

Read the full pipeline → · Security & scanners →

Sample review

See what lands on your PR or MR

Real review shape: risk score, severities, and inline findings—before you install anything.

acme/api-service #482

GitHub pull request with MergeGuard AI review summary and inline security finding

MergeGuard summary

Risk score 35 / 100

Medium merge risk. Auth middleware change touches request path—verify session handling on edge cases.

HighMissing null check before token decode
MediumNew env var not documented in README
LowPrefer const for immutable binding

Reply @mergeguards fix on an inline thread to push a patch commit.

OpenAI
Anthropic
GitHub
GitLab
Railway

Customer stories

Why teams prefer MergeGuard

It flagged a subtle async bug on a PR I was about to approve—the kind of thing we used to find in staging. Happy we have it on every pull request now.

Inline comments and @mergeguards fix save hours—I apply patches from the PR instead of hunting issues after merge.

MergeGuard caught a leaked env pattern and a vulnerable dependency in the same PR—both fixed before merge. Reviews feel consistent.

The risk score helps us focus on high-impact bugs first. Issues that used to slip through on busy review days get caught early.

It flagged a subtle async bug on a PR I was about to approve—the kind of thing we used to find in staging. Happy we have it on every pull request now.

Inline comments and @mergeguards fix save hours—I apply patches from the PR instead of hunting issues after merge.

MergeGuard caught a leaked env pattern and a vulnerable dependency in the same PR—both fixed before merge. Reviews feel consistent.

The risk score helps us focus on high-impact bugs first. Issues that used to slip through on busy review days get caught early.

Self-serve setup

Get your first review in minutes

No scheduled demo—we walk you through install with short videos and docs. Most teams are live on their first pull request the same day.

1
Connect GitHub or GitLab
Sign in with the provider that owns your repos—no MergeGuard password.
Connect account →
2
Install or link repos
GitHub App install or pick GitLab projects from your dashboard.
Setup guides →
3
Open a PR or MR
Your first AI review usually lands within a minute on the diff.
How it works →