auth/callback.tshighOpen redirect
returnTo goes straight to a redirect with no allow-list. Anyone can send users somewhere you didn’t intend.
Suggested: Allow only your own origins, then redirect.
Why us
GitHub is where you ship together. MergeGuard is the extra set of eyes.
You already open pull requests. MergeGuard comments on them with a score, the issue, and a suggested fix - so nobody has to LGTM a 40-file diff at the end of the day. GitLab and VS Code work the same way.
No credit card · 100 reviews/mo during your 14-day Pro trial
Prefer a walkthrough first? Watch a 2-min demo · See features
The last comment is usually “LGTM”
That’s fine when the change is small. It’s how bugs slip through when it isn’t.
Without MergeGuard
LGTM 👍
Someone glanced at the files they know. The auth change, the lockfile bump, and the missing null check wait until staging - or a customer.
With MergeGuard
- High - Missing check before we decode the token
- Medium - Known CVE in a package you just pulled in
- Fix ready - Ask for a fix in the thread and the patch lands on the branch
You still merge. You just see the risk first.
What GitHub already does — and what we add
GitHub is the home for your code. MergeGuard doesn’t replace it. It reads the PR your team already opened.
People still review the PR
GitHubGitHub native reviews: supported
MergeGuardMergeGuard: supported
Someone reads every pull request
If a reviewer has time
GitHubGitHub native reviews: partial
MergeGuardMergeGuard: supported
Catches security issues in the diff
GitHubGitHub native reviews: not included
MergeGuardMergeGuard: supported
Suggests a fix you can apply
GitHubGitHub native reviews: not included
MergeGuardMergeGuard: supported
Gives a risk score
GitHubGitHub native reviews: not included
MergeGuardMergeGuard: supported
Holds up on large PRs
People skip lines
GitHubGitHub native reviews: partial
MergeGuardMergeGuard: supported
Same bar for every teammate
Depends who looks
GitHubGitHub native reviews: partial
MergeGuardMergeGuard: supported
Comments stay on GitHub
GitHubGitHub native reviews: supported
MergeGuardMergeGuard: supported
On GitLab it’s the same review on the merge request. In VS Code, Cursor, and Windsurf you can catch the issue before you even open a PR. See how it fits together.
This is what your reviewers actually see
Not a new dashboard. A comment on the pull request, next to the lines that matter.
The review on the PR
A fix on the same thread
How teams start
No new workflow. Connect, open a PR, read the comment.
Step 1
Connect GitHub or GitLab
Pick the repos you care about. That’s it - nothing extra to set up.
Step 2
Open a pull request like usual
Same branches, same reviewers. MergeGuard wakes up when the PR opens or you push again.
Step 3
Read the comment, then merge
Fix what matters, ignore what doesn’t. You still own the merge button.
We only see what you let us see
Teams should ask this before any AI touches production code. Fair.
You pick the repos
The GitHub App (or GitLab connect) is scoped to projects you choose - not the whole company by default.
We read the diff for the review
A job runs when a PR opens or updates. We are not scraping your entire org “just in case.”
The trail stays on the PR
Findings live in the comment your team already uses. Useful later, when someone asks what you caught.
The kind of thing it catches
Real shapes of findings — wording on your repo will differ. The point is: specific, not “please review.”
components/Form.tsxmediumDouble submit
The handler sets pending, but the button still works. Two clicks, two records.
Suggested: Disable the button while it’s saving.
package.jsonlowDead dependency
axios is in the lockfile. The code uses fetch. Extra surface for no reason.
Suggested: Remove it and refresh the lockfile.
What changes for your team
Not magic. Just the same pass on every PR - including the ones a senior didn’t have time to read.
Faster first look
The review is usually on the PR within a minute of opening it.
Same bar for everyone
Interns and staff get the same checklist. No more “hope Alex saw it.”
Bugs before merge
Fix it on the branch. That’s cheaper than a hotfix on Friday.
Humans keep the hard part
You still judge product intent. MergeGuard hunts the foot-guns.
Frequently asked questions
Why add MergeGuard if we already use GitHub?
GitHub is where you host code and talk about it. MergeGuard is a second set of eyes on every pull request — it names the risk, the issue, and a suggested fix, then gets out of the way. You still decide what merges.
Does MergeGuard review large PRs?
Yes. Big diffs are where people skip lines. MergeGuard still reads them and flags the risky files so you know where to start.
Does MergeGuard support GitLab?
Yes. Same idea on merge requests: comments on the diff, a suggested fix, one account shared with GitHub.
How does MergeGuard compare to CodeRabbit?
Both review GitHub pull requests with AI. MergeGuard is built around a risk score, security in the same comment, and a one-reply fix. For a side-by-side, see MergeGuard vs CodeRabbit.
Try it on your next pull request
Sign up free — 100 reviews for two weeks. No credit card.