Always-on code review,
with a daily Slack digest.
Mergehound watches every branch and diff on your GitHub pull requests around the clock — running OWASP-aligned security scans, style and complexity checks, and regression comparisons against your team's stable baseline — so bad merges don't reach standup.
- Free for public repos
- Inline CI annotations
- From $19 per repo / month
- Watching every branch & diff
- 24 / 7
- Security scans, ASVS-aligned
- OWASP
- Slack digest every business day
- 17:00
- CriticalHardcoded fallback secret branchsrc/auth/jwt.ts:42
- RegressionTax rounding re-introduced · was fixed in #1842src/checkout/totals.ts:118
- Merge-blockerBackwards-incompatible NOT NULL — merge-blockermigration 0048_user_scopes
- Style21 instance members · complexity 17src/ui/Banner.tsx
- OKBaseline regression check passedsrc/api/health/index.ts
- GitHub
- Slack
- OWASP ASVS
- SOC 2
- SAML SSO
- SCIM
- CI annotations
Three pieces, working together
One pipeline. Three surfaces for eng leads.
Continuous watches, inline annotations on the lines that matter, and a single end-of-day digest your lead will actually read.
Always-on review
Watches every branch and diff on GitHub — hourly polling against your stable baseline.
Inline comments
Posts severity-coded annotations on the lines that carry risk — Critical, Regression, Style.
Daily Slack digest
One message in #eng-review at 17:00 — new findings, regressions, stalled PRs.
Used by teams at…
Day-one install
Ship with Mergehound on day one
Install the GitHub App on one repo this afternoon, scope it tight, and your first digest lands in #eng-review tomorrow at 17:00.
What Mergehound actually does
Catch bad merges before standup.
Most code-review agents sit idle until a PR is opened. Mergehound is the opposite — it watches every push, runs continuous checks, and posts inline comments on the lines that actually carry risk.
OWASP-aligned security scans
Inline comments on hardcoded secrets, insecure auth fallbacks, SSRF and SQL injection sinks.
Regression comparison vs. your stable baseline
Diff-checked against a branch you pin once. Regressions re-appearing on HEAD are flagged with the original fixing PR quoted inline.
Style + complexity checks
Configurable thresholds per language. Add your team's own rule packs on Enterprise.
CI-annotation merge-blockers
Mergehound posts annotations in the format your existing CI already acts on — no second pipeline to wire up.
Hardcoded fallback secret branch reachable when NODE_ENV !== "production". OWASP ASVS V2.10. CWE-798.
const total = subtotal
// rounded to cents
return Math.round(total * 100) / 100
return roundCents(total, currency) // bank-grade
This regression was last fixed in #1842. Mergehound compared HEADagainst the team's stable baseline and flagged the divergence automatically.
How it works
From install to daily digest in four steps.
Mergehound is a GitHub App with read on PRs and write on issues. Source code stays in your repo — nothing is exfiltrated to train a model.
- 01
Install the GitHub App
One-click install on the org.
Mergehound requests read on PRs + write on issues. No source code leaves your repo.
- 02
Pin your baseline
Tag a stable branch once.
Every diff is compared against it. Regressions are diff-checked, not guessed.
- 03
We watch every PR
Inline comments on risky lines.
OWASP security scans, style + complexity checks, and baseline regression checks run on every push.
- 04
Slack digest at 17:00
Engineering leads stay informed.
New findings, regressions that reappeared, and PRs that stalled in review — all in one message.
The daily Slack digest
Engineering leads stay informed without forcing a second checklist.
At the end of every business day, Mergehound posts one message to your #eng-review channel: new findings, regressions that reappeared, and PRs that have stalled in review.
- Quiet hours respected — no digest on weekends or after 22:00.
- Each item links to the PR, the inline annotation, and the bot's suggested fix.
- Slack, Teams, or webhook — Enterprise honors your routing.
Daily digest · 4 findings, 1 merge-blocker, 1 stalled PR
Watched 14 PRs across 3 branches since yesterday. Compared every diff against your stable baseline at main@stable.
- 01MERGE-BLOCKER#2841
Hardcoded JWT fallback secret reachable in dev
OWASP ASVS V2.10 · CWE-798. Inline annotation posted · CI annotation active.
- 02REGRESSION#2844
Tax rounding re-introduced in checkout/totals.ts
Originally fixed in #1842 · re-appeared on HEAD. Suggested fix authored by bot.
- 03NEW#2847
5 style findings · 2 complexity warnings
Banner.tsx crosses the team threshold (cyclomatic 17 · 21 members).
- 04STALLED#2823
PR open for 6.5 days · awaiting a second reviewer
Owner: @mira · last activity: review comment from @ravi, 4d ago.
Pricing
Free for OSS. From $19 per repo per month for teams.
One click on public repositories. For private repos and monorepos at scale, the team and enterprise plans cover the audit-log + SLA surface area you'll need.
Maintainers of public repositories
OSS
- Unlimited PRs on public repos
- OWASP security scans
- Style + complexity checks
- Daily Slack digest
Small private teams
Team
- Everything in OSS
- Baseline regression detection
- CI annotations your existing CI acts on
- Slack + Teams digest destinations
- SOC2-friendly audit log export
Monorepos at scale
Enterprise
- Everything in Team
- SAML SSO + SCIM provisioning
- Custom rule packs and risk thresholds
- SLA-backed ingestion windows
- Dedicated review engineer
Security & compliance
Auditable by default.
- OWASP ASVS-aligned scans
- Code never leaves your GitHub
- SAML SSO + SCIM on Enterprise
- SOC2-friendly audit log export
- No LLM training on your diffs
Get started
Drop the second checklist. Watch the bar stay green.
Email us to install the GitHub App on your org, scope it to a single repo first, and see tomorrow's digest in your #eng-review channel by 17:00.