Private beta: now recruiting early teams

Nothing merges
unreviewed.

MergeCop is the AI reviewer on duty for every pull request. It reads your whole codebase, not just the diff. It flags what actually matters and writes the walkthrough. Minutes after the PR opens, before a teammate ever looks.

Get early access See how it works

two-minute install · reviews your next PR · free during beta

fix: refresh session on activity #482

feat/session-refresh → main

src/auth/session.ts

15  export function createSession(user: User) {16    return store.create({17      expiresAt: Date.now() + SESSION_TTL_MS,18    });·  ⋯38  export function getSession(id: string) {39    const session = store.get(id);40-   if (session.expiresAt > Date.now()) {40+   if (session.expiresAt > Date.now() / 1000) {41      return session;42    }43    return null;44  }

mergecop reviewed in 1m 42s · 3 findings · 9 nitpicks held

Critical · Correctness

expiresAt is stored in milliseconds when the session is created (createSession, session.ts:17). Dividing Date.now() by 1000 compares seconds to milliseconds, so every expired session now passes as valid.

Suggested fix

- if (session.expiresAt > Date.now() / 1000) {+ if (session.expiresAt > Date.now()) {

Commit fix Explain @mergecop why?

Walkthrough

Moves session-expiry checks into getSession and refreshes TTL on activity. Touches 3 files. Behaviour change: idle sessions now expire after 30 minutes instead of never.

On duty wherever you merge

GitHub at launch
GitLab next
Bitbucket next
Azure DevOps next

How it works

On the case in minutes

No pipelines to rewrite, no rulebooks to author. Install it, open a pull request, and the first review is already waiting.

Put it on the beat

Install the app and pick your repos. Two minutes, no YAML, no config files, no pipeline changes. Your next pull request is already covered.

$ mergecop install --repo your-org/api
✓ on duty · watching pull requests

Open a pull request

MergeCop reads the whole codebase, not just the diff, then posts a plain-English walkthrough and line-level comments, each tagged by severity. Usually inside two minutes.

› PR #482 opened
› reading repo graph… 3,214 files
✓ review posted · 1m 42s

Merge with confidence

Commit suggested fixes in one click, or reply on the thread to push back. Every new push gets an incremental review of just what changed.

$ @mergecop commit fix
✓ applied · threads resolved · clear to merge

Features

A full patrol, not a linter

Everything a great first-pass reviewer does, done in minutes on every pull request, without the fatigue.

Severity on every finding

Critical, major, minor: every comment is tagged so you can gate merges on what blocks and skim what whispers. Nothing is flagged without a reason you can act on.

Whole-repo context

Reviews are grounded in your repository graph: call sites, types, conventions, and the history of the file, not a lonely diff hunk. That's how it catches the cross-file bug.

Walkthroughs, written for humans

Every PR opens with a plain-English summary of what changed, what it touches, and how risky it is, so reviewers start oriented instead of archaeologizing.

Learns from every reply

Tell it “we do this on purpose” once and it remembers, for the whole team, forever. Reviews get quieter and sharper the longer MergeCop works your codebase.

One-click fixes

Findings come with committable suggestions. Apply them from the PR without touching your editor, or hand them to your coding agent to resolve.

Chat on the diff

Mention @mergecop on any thread: ask why, request an alternative, or have it draft the follow-up. It answers with the codebase in front of it, not from memory.

The no-noise policy

Trained to shut up

The fastest way to lose a developer's trust is twelve comments about whitespace. MergeCop drafts every finding, then interrogates its own work, and only posts what would survive a human reviewer's bar.

Style nits your formatter and linter already police are never posted. That's their job.
Low-confidence findings are held for the log, not dumped on the diff.
Push back once and it stands down on that pattern, across the whole team, permanently.

review.log · PR #482

$ mergecop review --pr 482
› reading repo graph… 3,214 files
› 12 findings drafted
› 9 held back
    · 6 style nits (eslint already enforces)
    · 2 restatements of the diff
    · 1 low-confidence guess
✓ 3 posted · 1 critical · 2 minor
✓ review complete in 1m 42s

Code is being written faster than it can be read. MergeCop is the reviewer that keeps up, so your human reviewers spend their attention where only humans can.

/* built for the age of AI-written code */

Security

The evidence stays sealed

A reviewer you can't trust with your code isn't a reviewer. Every architectural decision in MergeCop starts from that.

Ephemeral by design

Each review runs in an isolated, sandboxed environment that is destroyed when the review ends. Your code is never written to persistent storage.

Least-privilege access

MergeCop requests the narrowest scopes your platform allows: read code, write review comments. It never holds standing write access to your branches.

Never trained on your code

Your code is used to review your pull request. Full stop. It is not retained, resold, or used to train models, yours or anyone else's.

Full security architecture docs ship with the private beta.

FAQ

Routine questioning

What exactly does MergeCop do?

The moment a pull request opens, MergeCop reviews it: a plain-English walkthrough of the change, line-level comments tagged by severity, and committable fix suggestions, typically within a couple of minutes. Humans stay in charge of approval; MergeCop makes their first pass instant.

Will it bury my PRs in nitpicks?

No. That's the whole point. MergeCop drafts every finding, then holds back anything that isn't worth a human's attention: style nits your linter already enforces, restatements of the diff, and low-confidence guesses. You see the short list, not the transcript.

Does it replace human review?

It replaces the tedious first pass, not the reviewer. By the time a teammate opens the PR, the mechanical issues are already flagged or fixed, so human attention goes to design, intent, and the things only your team can judge.

Is my code safe?

Reviews run in ephemeral sandboxes with least-privilege access, code is never retained after a review completes, and it is never used for model training. Security details ship with the beta, and we'll publish the full architecture before general availability.

Which platforms are supported?

MergeCop launches on GitHub. GitLab, Bitbucket, and Azure DevOps are next on the beat. Join the early access list and tell us which one you need. It genuinely shapes the order.

When can I use it, and what does it cost?

We're onboarding early access teams from the waitlist now. Pricing isn't set yet. Early teams use MergeCop free during the beta and get a say in how it's priced.

Put MergeCop
on the case.

We're onboarding early access teams from the waitlist now. Free during the beta, and you'll help decide what it becomes.

Get early access

no credit card · no spam · just a badge number in the queue

Nothing merges unreviewed.