Docs

Last updated 2 October 2026.

What is MergeSafe?

MergeSafe is an AI code reviewer for GitHub pull requests: it reviews each commit, comments on the lines where the bugs are, and scores how ready the pull request is to merge, for a plain dollar price per review.

Everything you need to start reviewing pull requests with MergeSafe, one question per page. New here? Start with Getting started. Also see who MergeSafe is for and the glossary.

Start

• Getting started

  Sign up with GitHub, install the GitHub App, choose whose pull requests are reviewed and at which level, and read your first AI code review.

• How a review works

  Step by step, from the push that starts a review to the summary, inline comments and check run MergeSafe posts on your GitHub pull request.

• Review levels

  Budget, Strong and Ultra: what each review level adds, what it costs per review, its measured results, and how to pick one per repository.

• Expert add-ons

  Two add-ons for any level: a deeper security review (+$0.45) and a deeper correctness and logic review (+$0.75). Choose both on Strong and you pay the Ultra price.

• Supported languages

  MergeSafe reviews pull requests in any language, with extra security checks for Go and Ruby and run-to-prove checks for Python, JavaScript and TypeScript.

Reading a review

• Severity P0 to P3

  What P0 Critical, P1 High, P2 Medium and P3 Low mean, with examples, and why only P0 and P1 findings block a merge and fail the check run.

• Merge readiness score

  The 1 to 5 score on every review: how P0, P1 and P2 findings set it, what 4.5/5 means, and when a pull request counts as merge ready.

• Replying to a finding

  Dispute a finding and it is judged again with your reasoning: withdrawn, or downgraded so it no longer blocks. Say it is fixed and it is re-checked.

• The mergesafe-review check

  The check run on every reviewed commit fails while a P0 or P1 finding is open. Make it required in branch protection so blocking bugs can't merge.

• @mergesafe commands

  Every command you can post in a pull request comment, who can use it, and what it costs, generated from MergeSafe's own code.

• Security checks

  What the security review on every level checks, from injection and access control to secrets, SSRF and XSS, and what it does not check.

• Cross-repo clusters

  Link 2 to 8 repositories that share database tables, APIs, events or code, and check whether a pull request in one breaks the others.

• Fix findings from your editor

  Connect your coding agent to MergeSafe from your editor: it reads each finding and its fix prompt, fixes it locally, replies on the thread and asks for a re-review.

Controlling reviews

• When reviews run

  The three trigger modes, on open and every commit, on open only, and manual only, plus the optional commit limit and the hourly cap per pull request.

• Manual-only mode

  Review nothing automatically: start a review with an @mergesafe review comment, the Review now button, or the API from your own tooling.

• Whose pull requests are reviewed

  Review every author's pull requests or only selected people's; everyone else is skipped with no comment and no charge. Bots are left out unless you add them.

• Large pull requests

  Over 2,000 hand-written lines MergeSafe asks first and reviews at 1.5 times the price; over 5,000 lines or more than 60 files it suggests a split instead of a shallow pass.

• Half-price follow-ups

  Small follow-up commits on a pull request are reviewed at half price automatically, with only the new change reviewed. Add-ons stay full price.

• API keys and API reviews

  Create an API key and start a review with one POST request from CI or a script, optionally at a different level for that review only.

Billing and limits

• How reviews are charged

  Per-review pricing from a prepaid dollar balance, with no seats or minimums: what each level costs, the $10 free start, and which reviews are free.

• Spending limits and caps

  Daily, weekly and monthly spending limits ($20 a day and $300 a month by default), per-repository and per-author caps, and what happens when one is reached.

Your organization

• Org roles: Admin and Member Rolling out

  Admins and Members: the person who installed the App is the first Admin, Admins change settings and see billing, Members see reviews but not billing.

• Joining an org Rolling out

  Your team already uses MergeSafe? Sign in with GitHub, press Request to join, and an Admin approves you as an Admin or a Member.

• Repo visibility

  Members see reviews only for repositories their own GitHub account can access; Admins see every repository. What happens when GitHub can't be checked.

• Recommendations

  Seven GitHub security settings checked per repository: Dependabot, secret scanning, CodeQL, branch protection, CODEOWNERS and missing workflow secrets.

• Sentry integration

  Turn new and regressed Sentry issues into labelled GitHub issues in a repository you choose, or just list them in the app. Optional root-cause analysis, 20¢ per analyzed issue.

Data and trust

• Data retention and encryption

  How long MergeSafe keeps code-derived data (most of it 30 days after last use), per-repository encryption keys, deletion on uninstall, and who processes your code.

• Security and compliance

  The security practices we run, and where SOC 2 stands: an audit has not yet started.

• Subprocessors

  Who processes data on our behalf, what each receives, and where.

• FAQ

  Short answers to the questions people ask most: price, seats, languages, code retention, SOC 2, GitHub only, and whether it replaces human review.

Guides

• Choosing an AI code reviewer

  A vendor-neutral checklist: the criteria that matter, the questions to ask any vendor, how to run a fair trial on your own pull requests, and where MergeSafe fits.

• Benchmarks

  How many labelled bugs each review level finds, and how many of its findings are real, with the method and sample sizes.

• Changelog

  What changed in MergeSafe, release by release, in plain language, newest first.