AI code review on every pull request
PRCheck inspects each pull request for bugs, security flaws, and style the moment it opens, giving small teams the consistent scrutiny of a dedicated review board.
From webhook to inline comment in three steps
A pull request opens or receives new commits. GitHub (or GitLab/Bitbucket) fires a webhook to PRCheck instantly.
AST-level analysis runs across the diff: bug patterns, OWASP security rules, style thresholds, and any custom YAML rules you have defined.
Review comments appear inline on the diff line, in the same GitHub review interface your team already uses. No new tools to check.
What PRCheck checks that your linter skips
Bug Detection
AST-level logic analysis, not just syntax. PRCheck understands execution paths, not just line diffs. It explains why a pattern introduces a bug, not just that it does.
- Null dereference and undefined variable paths
- Logic errors and unreachable branches
- Race conditions in async code
- Off-by-one and boundary condition errors
Security Scanner
Catches hardcoded secrets, OWASP Top 10 patterns, and SQL injection in dynamic query construction. Every finding lands as an inline comment with a HIGH or MEDIUM severity badge and a concrete remediation note. Not a separate report to chase down later.
Style Enforcement
Naming conventions, cyclomatic complexity thresholds, and cross-module import constraints. PRCheck is not a linter replacement: it enforces the architectural and structural rules that Prettier and ESLint cannot express.
Custom Rule Builder
Define rules in YAML and commit them alongside your code. PRCheck picks them up on the next scan with no configuration step. Rules support regex patterns for quick text checks and AST matchers for structural constraints your team has agreed on but no off-the-shelf tool enforces.
Read the docsOn code review, static analysis, and building in public
Semantic diff: what changes beyond the changed lines
Why a one-line change can break code five calls deep, and how PRCheck traces the semantic impact across the diff tree.
PR checklist fatigue: why checklists fail and what replaces them
Teams add checklists after incidents. Six months later nobody reads them. Here is why that happens and what automated review changes.
Async code review vs real-time PR checks: they are not the same job
Async review is a human judgment conversation. Real-time PR checks are a machine consistency pass. Conflating them causes both to fail.
Security:
HIGHjwt.decode()skips signature verification. This line accepts any token, including forged ones. Usejwt.verify()to validate the signature.