Merge + attest — the name is the method
Every AI pull request, on the record.
MergeAttest is the control layer around AI coding agents: it attributes every pull request to the agent that wrote it, scores risk deterministically, flags missing tests, enforces repository rules, records human approvals, and exports audit-ready evidence — all where your team already works.
GitHub-native · no pipeline changes · no credit card
Attestation record
№ 0482
- Repository
- acme/api-gateway
- Pull request
- Add retry logic to payment webhook #482 · +218 −34 · 6 files
- Attributed to
- claude-code · confidence 95%evidence: commit trailer, bot account
- Risk score
- 72/100 · High — deterministic, reproducible
- Findings
- 2 test gaps detected1 rule violationSensitive paths touched
- Disposition
- Held for human review — approval will be recorded with reviewer, role, and timestamp.
Exportable
JSON · CSV · retained per plan
The problem, stated plainly
Review didn’t scale with generation.
¶ 01
Generation outran review.
Coding agents multiplied pull request volume, and careful human review did not multiply with it. Changes merge on momentum.
¶ 02
Authorship became a guess.
Six months from now, nobody on the team can say which agent wrote the change that broke payments — or which human accepted the risk.
¶ 03
Now someone is asking for proof.
EU AI Act human-oversight expectations and SOC2 reviews are starting to ask for AI-authorship evidence. A guess is not evidence. A record is.
What goes on the record
Eight signals, inspected on every diff.
Risk scoring is rule-based, not model-generated. Every entry below is written to the record with the exact reason behind it — the same diff always produces the same score.
No model guesswork · fully reproducible
The register, live
Entries are written as traffic arrives.
This is the product surface, not an illustration: the pull request monitor sequences every inbound AI-assisted change — identified, scored, and cleared or held for a recorded human sign-off.
merge board · inbound pull requests
sample traffic
holds require recorded human sign-off before merge
2 held · 2 cleared · 1 scoring
Procedure
From install to evidence, in four clauses.
§01
Connect GitHub
Install the MergeAttest GitHub App and sync the repositories you want to govern.
§02
Score every AI PR
New and updated pull requests are scored for risk and scanned for missing test coverage.
§03
Review and approve
Reviewers work a prioritized queue, apply repository rules, and record decisions.
§04
Keep an audit trail
Every decision is logged and retained, ready to export the moment compliance asks.
Per-agent accountability
The ledger reads by agent.
Built-in detection attributes each pull request to the agent behind it, with a confidence score and the evidence — commit trailers, bot accounts, emails, branch prefixes.
sample attribution confidence · your own conventions can be mapped in the identity registry
Attribute every PR to an agent
Built-in detection works out of the box; map your own bot accounts, branch prefixes, and commit trailers when your team has its own conventions.
Per-agent trust scorecard
See which agent ships the riskiest code: high-risk rate, test gaps, rule hits, reverts, and merges without sign-off — every deduction shown.
AI-authorship ledger
Track what share of your codebase AI wrote, and how much of it carried a human attestation before it shipped.
Compliance evidence on demand
Export a review packet that supports EU AI Act human-oversight and SOC2 reviews — the record, not a certification.
Refusals, for the record
What it will not do.
N-01
It will not send your code to a model.
Scoring, attribution, and rule checks run without any language model. An advisory AI layer exists, uses your own OpenRouter key, and is off unless you turn it on.
N-02
It will not generate an opinion and call it a score.
Every score decomposes into the exact signals that produced it. If you disagree with a number, you can point at the rule that made it.
N-03
It will not store your source files.
It works from pull request metadata: changed paths, risk signals, approvals, audit events. Your code stays on GitHub.
N-04
It will not hold your evidence hostage.
Export audit records and reports whenever you want. Disconnect the GitHub App at any time. Leaving is a button, not a negotiation.
Evidence & compliance
Exportable the day the auditor asks.
Track what share of your codebase AI wrote and how much of it carried a human sign-off. Export a review packet that supports EU AI Act human-oversight and SOC2 reviews — the record, not a certification.
Every approval is written down the moment it happens: who signed off, in what role, on which evidence. Nothing is reconstructed after the fact.
Evidence packet · contents
- attestations.csvper-PR authorship + risk record
- approvals.jsonwho signed off, and when
- agent-scorecards.csvper-agent trust history
- audit-log.jsonevery governance event, retained
Questions
Asked and answered.
What MergeAttest does, what it touches, and what it costs — no fine print.
support@mergeattest.com- Do I need to change my CI pipeline?
- No. MergeAttest installs as a GitHub App and reads pull requests through the GitHub API. There are no required workflow or pipeline changes — connect a repository and scoring starts on the next pull request.
- How does it decide a pull request is risky?
- Risk scoring is deterministic, not AI-generated. It inspects signals like diff size, sensitive paths, missing test coverage, dependency and migration changes, and secret patterns, then shows the exact reasons behind every score — so the same diff always scores the same.
- Does MergeAttest use AI to review my code?
- Risk scoring, agent attribution, and rule checks are all rule-based and run without any language model. An advisory AI review layer is built in and uses your own OpenRouter key, but model execution is turned off during early access — nothing is sent to a model provider unless you enable it.
- Which coding agents can it attribute?
- Built-in detection covers Claude Code, GitHub Copilot, Cursor, OpenAI Codex, and Devin, using commit trailers, bot accounts, emails, and branch prefixes — each with a confidence score and the evidence behind it. You can map your own signals in the agent identity registry when your team has its own conventions.
- Is it built for teams?
- Yes. Invite your team with roles, assign reviewers, leave review notes, and record who approved each risky change — every decision is kept in the audit trail.
- What does it cost?
- MergeAttest is free during early access, with no credit card required. The free plan covers up to 3 connected repositories, 200 PR checks per month, and 7 days of audit history. Paid plans for higher limits are planned for later.
- What happens to my source code?
- MergeAttest works from pull request metadata — changed file paths, risk signals, approvals, and audit events. It does not store your full source files. Customer-provided credentials, such as an OpenRouter key, are encrypted before storage.
- Can I export my data or leave?
- Yes. Export audit evidence and compliance reports whenever you need them, and disconnect the GitHub App at any time. Contact support to request deletion of your workspace data.
Put your merges on the record.
Connect a repository and the register opens on your next pull request. Free during early access.
3 repositories · 200 PR checks/month · no credit card