Hosted service

MergeJudge's hosted service is a Cloudflare Worker and a GitHub App that we run, so there is no workflow file to add and no server to run. Install the App, save your own provider key in the panel, and reviews run on the hosted service, which calls your provider. Your code is processed briefly to run the review and not kept.

Managed hosted AI, where we provide the model (for example automatic model selection), is planned.

The open-source runner connects to this service and does the AI step on your own machine. It needs an enrollment code from the MergeJudge panel. See the runner guide and the runner source.

Set up

1. Install the App on your account or org and pick the repositories.
2. Open the manager panel (app.mergejudge.si/app) and sign in with GitHub. You see only installations you administer.
3. Choose a model. Add a provider key in the panel (stored encrypted, shown as name + last 4 only), and set provider.type and provider.model in .mergejudge.yml. See LLM providers.
4. Pick a mode per repo: diff or context. (Deep mode with a hosted code index is not offered; a runner can do deep.)
5. Open a pull request. You get the sticky summary, the mergejudge/lane check and line comments.

If a repo also has the MergeJudge Action workflow, remove it, or both will post.

The manager panel

• Link or unlink repositories.
• Set a per-repo review mode override (diff, context, deep). It wins over review.mode in .mergejudge.yml.
• Add, rotate or remove provider keys.
• See usage (tokens per review, split by part) and the audit log.
• Run the learning proposal for a repo now (rate-limited).

What the App can do

Permission	Why
Pull requests: write	Summary comment, line comments, optional approvals
Checks: write	The mergejudge/lane check run
Issues: write	Feedback and /mergejudge learn comments
Contents: write	Only the mergejudge-learning branch and mergejudge/proposal-* PRs, enforced in code
Metadata: read	Required by GitHub

MergeJudge never merges a pull request and never writes to your default, main, master or release branches. Config is always read from the base branch. See the security model.

Data

• Code index (deep mode, index.policy: stored): snapshots in R2 and embeddings in Vectorize, keyed by installation and repo. Only the last 3 snapshots per repo are kept. Set index.policy: none to keep nothing.
• Usage: tokens, model and timing per review. Prompts and replies are not stored.
• Lessons: in your repository, on the mergejudge-learning branch, not in our database.
• A daily retention job deletes settings, usage and index data of repos unlinked or removed for more than 7 days, and of deleted installations. Content in your repos (such as lessons) is never touched.

Prefer to keep the AI step on your machine?

The open-source runner runs the model step on your own machine, with your own Claude Code, Codex or GLM login. It connects to the hosted service with an enrollment code from the panel.