What is MergeJudge?
MergeJudge (mergejudge.si) is an AI pull request reviewer with an open-source engine for GitHub. It reviews every pull request and sorts it into an auto, review or block lane: deterministic rules decide first, and the AI step can only make a lane stricter. Auto means low risk, not a guarantee. Branch protection and required checks still apply.
On each pull request it posts:
- one sticky summary comment (edited in place) with the lane, the reasons and rubric results;
- a
mergejudge/lanecheck:success= auto,neutral= review,failure= block. GitHub counts aneutralconclusion as a successful required status check, so a review lane does not stop a merge on its own; - at most 20 line comments on the exact diff lines.
The three lanes
| Lane | Meaning |
|---|---|
auto | Low risk, not a guarantee. Branch protection and required checks still apply. MergeJudge does not merge it. |
🟡 review | A human must look. |
🔴 block | Do not merge. |
Details: Lanes and rules.
Rules first, AI second
- Rules set a floor. Protected paths (
.github/**, deploy files, migrations, auth code,_headers,.env*and more), a coarse secret screen on added lines, removed safety guards (--match-head-commit,persist-credentials: false,set -e,--frozen-lockfile/npm ci), size limits and labels decide the minimum lane. - The AI can only raise it. The model reads the diff (and, in context or deep mode, related code), your policy files and rubrics. It adds a summary and findings, and it can move a lane up, never down. The one exception,
lanes.code_autofor small code changes, is off by default, and a pull request can't turn it on because config is read from the base branch. - The strictest result wins, first per file and then for the whole pull request.
PR content is fenced as untrusted data. Apart from that opt-in, instructions hidden in a pull request can't lower a lane. See How it works.
The repo owns the rules
.mergejudge.yml and policy files (REVIEW_POLICY.md, AGENTS.md, CLAUDE.md, APPROVAL_POLICY.md) are read from the base branch, so a pull request can't loosen its own review. Rules change through a pull request a human merges. A learning proposal can add protected paths or rubric notes and, only when learning.from_comments is on, a learned rubric criterion that raises to review. It can't remove a protection or loosen the rules.
Three ways to run it
| Where the AI step runs | Needs | |
|---|---|---|
| Hosted GitHub App | MergeJudge's hosted service calls your provider with your key | The App and a provider key saved in the panel |
| Runner on your machine | Your computer, with your Claude Code or Codex login or a GLM key | The App, Node 20+ and npx mergejudge-runner setup |
| GitHub Action | Your own GitHub Actions runner, with your own key | uses: gauravsharmaGG/mergejudge-runner@v1; no MergeJudge account |
All three share one review engine and read the same .mergejudge.yml. Review modes (diff, context, deep) decide how much of the repo the model sees. Deep mode runs on a runner or the GitHub Action; the hosted service does not run a hosted tool loop. See Review modes.
What MergeJudge is not
- Not a merge bot. It doesn't merge pull requests itself.
- Not a secret scanner. The secret check is a coarse screen on added lines.
- Not a guarantee. Auto is a low-risk lane, not a promise that a change is correct.
- Not fully open source. The engine, runner and Action are MIT; the hosted App and its backend aren't.
What our servers see
MergeJudge's servers read the pull request diff from GitHub to run the rules. The GitHub Action does not call those servers. When an AI provider is configured, the diff is sent to that provider. MergeJudge does not use your code to train models.
On the hosted GitHub App, that diff is processed to run the review and is not kept afterwards. A runner job holds the diff only until the review finishes, and it is deleted within about 48 hours. In deep-local mode the job carries no code, and the servers still read the diff for the rules and do not store it. Review results, which can quote short lines of code, are kept for up to 90 days. Details: Privacy and self-hosted GitHub Action.
FAQ
What is MergeJudge?
MergeJudge (mergejudge.si) is an AI pull request reviewer with an open-source engine for GitHub. It reviews every pull request and sorts it into an auto, review or block lane. Deterministic rules decide first, and the AI step can only make a lane stricter. Auto means low risk, not a guarantee.
Is MergeJudge a Shopify app or a hiring tool?
No. MergeJudge (mergejudge.si) is an AI pull request reviewer with an open-source engine for GitHub. It reviews pull requests. It is not a store app, and it is not a hiring or assessment product.
What do MergeJudge's servers see?
MergeJudge's servers read the pull request diff from GitHub to run the rules. The GitHub Action does not call those servers. When an AI provider is configured, the diff is sent to that provider. MergeJudge does not use your code to train models.
Does MergeJudge merge pull requests?
No. MergeJudge doesn't merge pull requests itself. If you turn on approval.mode: auto-merge-only, it asks GitHub to auto-merge auto-lane pull requests once your branch protection rules, such as required checks or reviews, are met. Approvals are off by default.
Is MergeJudge open source?
The review engine, the CLI runner and the GitHub Action are open source under the MIT licence in the gauravsharmaGG/mergejudge-runner repository. The hosted GitHub App and its backend are not open source.
Which AI models does MergeJudge use?
Your own. MergeJudge is bring-your-own-model: Anthropic, OpenAI, z.ai GLM or any OpenAI-compatible endpoint, with your own API key. The runner can also use your own Claude Code or Codex login. MergeJudge's own provider keys are never used for your reviews. With no model configured, a public repo on the GitHub App gets free AI reviews to start, on a model we run on Cloudflare Workers AI; otherwise it runs rules-only. See LLM providers.
Can a pull request change the rules that review it?
No. .mergejudge.yml and policy files such as AGENTS.md, CLAUDE.md and REVIEW_POLICY.md are always read from the base branch, so edits inside a pull request don't affect that pull request's own review.
What does the auto lane mean?
Auto means low risk, for example a small docs or style change under the size limit. It is not a guarantee, and it is not an approval or a merge. Branch protection and required checks still apply. Approvals are off by default. Code files go to review unless you opt in to lanes.code_auto and every low-risk rule for that opt-in holds.