In development

High precision
AI Code Review.

Local-first. Open source. Evidence-backed.

View on GitHub
brew install pr-hero

In development. Install ships at launch.

We never see your code.

Claude Code today · other runtimes later

  • Claude Code
  • CodexSoon
  • OpenCodeSoon
  • GrokSoon
  • OpenRouterSoon
  • GitHub ActionsSoon
  • OllamaSoon
  • GeminiSoon

Local-first / Privacy by design

Your checkout stays on your machine.

The review runs locally. There is no PR Hero server in the path — we cannot see, store, or train on your code.

  • Runs on your machine

    Checkout, diff, and reviewers stay where you work.

  • No servers of ours

    Nothing uploads to PR Hero. There is no backend of ours to receive it.

  • We never see the code

    We do not store it, train on it, or look at it. We cannot.

In scope

  • Lifecycle and state-machine defects
  • Evidence with path, line, and a code-assigned severity
  • One assistant comment on the PR
  • Local: we never see the repo

Out of scope

  • Style, nits, convention
  • Security scanner / CVE hunter
  • A required check that blocks merge
  • Autofix / a fixer loop

Findings / Evidence you can open

Every finding comes with evidence.

Not a style nit. Every claim points to a file and line in your tree — plus a severity tier decided by code.

  1. 01

    Cited in the tree

    Every claim points to code you visited — not a generic paragraph.

  2. 02

    Path and line

    The finding lives in a file and line you can open in your editor.

  3. 03

    Severity in code

    Blocking or advisory is decided by code. The model does not vote severity.

validate-session-timeout

Open

feat(auth): validate session timeout on refresh · #458

src/auth/session.ts34-42
34export function isSessionValid(session: Session, now = Date.now()) {
35 const { expiresAt, userId } = session;
36- if (expiresAt < now) {
37- return false;
38- }
39+ if (expiresAt <= now) {
40+ return false;
41+ }
42 return Boolean(userId);
High

Session may remain valid 1ms past expiration

Using <= allows treating the session as valid when expiresAt === now, extending access beyond the intended TTL.

Why this matters

OWASP Session Management Cheat Sheet §2.2 — Expiration

“Sessions should expire at the intended time. Implementations must ensure that expiration checks do not allow a session to remain valid past expiry.”

Illustrative finding. Same shape as a real report: evidence, location, severity.

Measured / Lab

Same PRs. More bugs caught.

15 live pull requests. Two reviewers. Real findings — not a demo.

Same 15 live PRs · identical diffs

PR Hero

Catches what others miss.

41

findings caught

Live diff · sampled

src/auth/session.ts
export async function revokeSession(id: string) {
const session = await db.session.findUnique({ where: { id } });
if (!session) return null;
await db.session.update({ where: { id }, data: { revoked: true } });
await cache.del(`session:${id}`);
return session.userId;
}
 
export function isExpired(session: Session, now = Date.now()) {
return session.expiresAt <= now;
}
+22 more findings in this PR set
  • 28 only PR Hero28
  • 13 both flagged13

13% false positive rate on triaged blocking findings.

Greptile

Same diffs. Fewer flags.

24

findings caught

Live diff · sampled

src/auth/session.ts
export async function revokeSession(id: string) {
const session = await db.session.findUnique({ where: { id } });
if (!session) return null;
await db.session.update({ where: { id }, data: { revoked: true } });
await cache.del(`session:${id}`);
return session.userId;
}
 
export function isExpired(session: Session, now = Date.now()) {
return session.expiresAt <= now;
}
+9 more · lines above went unchecked
  • 11 only Greptile11
  • 13 both flagged13

28 bugs Greptile missed — caught by PR Hero alone

15 live PRs, blocking findings triaged by hand. Overlap comparison — not a ranking. PR Hero and Greptile optimise for different things.

How it works / One pipeline

Four reviewers. One pipeline.

Four specialists read the same diff in parallel. Duplicates merge mechanically. A second pass challenges every serious finding. Severity is decided by code — not the model.

Pipeline schematic

Pull request

Your diff

opt-in

scout

parallel

same diff · four lenses

  • 01

    Reliability

    Correctness bugs: stuck loading, broken invariants, the defect that looks fine.

  • 02

    Resilience

    Failure paths: recovery, retries, stalls that never resolve.

  • 03

    Parity

    Same behavior across surfaces. Runs only when the diff hits its paths.

  • 04

    Lifecycle

    Effects, latches, missing cleanups, re-entrancy, timers that never die.

Merge & verify

  1. 01CODE

    dedupe

    Mechanical merge — no duplicate noise

  2. 02LLM

    refuter

    Second pass challenges every serious claim

  3. 03CODE

    severity

    Severity decided by code, not the model

  4. 04

    comment

    Structured output on the pull request

Review comment

Evidence-backed findings on your PR

CLI / How you run it

Init. Preview. Review.

Three commands on your machine. Nothing uploads to a server of ours. Automatic watch exists — and spends only if you turn it on.

session

$ pr-hero init

wrote .prhero/gotchas.md # required — empty fails loud

$ pr-hero review --dry-run

plan · cost band · $0 · nothing spawned

$ pr-hero review --pr --post

worktree · hunters · one marked comment

$ pr-hero watch install

opt-in automatic spend

Roadmap / What's next

The engine works today. Launch widens the install surface.

Today you can review a PR from the CLI. Launch adds npm, a TUI, a GitHub Action, and re-review on push. The rest is visible — not sold as shipping.

  1. Today

    Review a PR from the CLI. Post one comment. Watch locally if you opt in.

  2. Launch

    Soon

    Install on any machine: npm, a TUI, a GitHub Action, and a second push that re-reviews.

  3. After

    Named recipes, more hunters, a dashboard, other models. Visible, not sold as shipping.

  1. Trigger

    CLI or watch

    Soon · Action

  2. Review

    The pipeline

  3. Surface

    One PR comment

    Soon · TUI

  4. Next push

    You push again

    Soon · Re-review

FAQ / Questions

Common questions