Open source
AI Code Review.

curl -fsSL https://www.prhero.dev/install.sh | bash

Standalone binary for macOS & Linux · Zero external dependencies

View on GitHub
pr-hero
→pr-herogit:(main)$

Supported runtimes & providers

  • Claude Code
  • GitHub Actions
  • Codexcommon.soon
  • OpenCodecommon.soon
  • Grokcommon.soon
  • OpenRoutercommon.soon
  • Ollamacommon.soon
  • Geminicommon.soon

Demo / Watch it run

From flagged to fixed, in one run.

One pass over a live pull request — the review flags a lifecycle bug, triage fixes it, and the branch ships. Just over a minute.

Local-first / Privacy by design

Your checkout stays on your machine.

The review runs locally or in your CI. There is no PR Hero server in the path — we cannot see, store, or train on your code.

  • Runs on your machine

    Checkout, diff, and reviewers stay where you work.

  • No servers of ours

    Nothing uploads to PR Hero. There is no backend of ours to receive it.

  • We never see the code

    We do not store it, train on it, or look at it. We cannot.

Findings / Evidence you can open

Every finding comes with evidence.

Not a style nit. Every claim points to a file and line in your tree — plus a severity tier decided by code.

  1. 01

    Cited in the tree

    Every claim points to code you visited — not a generic paragraph.

  2. 02

    Path and line

    The finding lives in a file and line you can open in your editor.

  3. 03

    Severity in code

    Blocking or advisory is decided by code. The model does not vote severity.

validate-session-timeout

Open

feat(auth): validate session timeout on refresh · #458

src/auth/session.ts34-42
34export function isSessionValid(session: Session, now = Date.now()) {
35 const { expiresAt, userId } = session;
36- if (expiresAt < now) {
37- return false;
38- }
39+ if (expiresAt <= now) {
40+ return false;
41+ }
42 return Boolean(userId);
High

Session may remain valid 1ms past expiration

Using <= allows treating the session as valid when expiresAt === now, extending access beyond the intended TTL.

Why this matters

OWASP Session Management Cheat Sheet §2.2 — Expiration

“Sessions should expire at the intended time. Implementations must ensure that expiration checks do not allow a session to remain valid past expiry.”

Illustrative finding. Same shape as a real report: evidence, location, severity.

Measured / Lab

Same PRs. More bugs caught.

15 live pull requests. Two reviewers. Real findings — not a demo.

Same 15 live PRs · identical diffs

PR Hero

Catches what others miss.

41

findings caught

Live diff · sampled

src/auth/session.ts
export async function revokeSession(id: string) {
const session = await db.session.findUnique({ where: { id } });
if (!session) return null;
await db.session.update({ where: { id }, data: { revoked: true } });
await cache.del(`session:${id}`);
return session.userId;
}
 
export function isExpired(session: Session, now = Date.now()) {
return session.expiresAt <= now;
}
+22 more findings in this PR set
  • 28 only PR Hero28
  • 13 both flagged13

13% false positive rate on triaged blocking findings.

Greptile

Same diffs. Fewer flags.

24

findings caught

Live diff · sampled

src/auth/session.ts
export async function revokeSession(id: string) {
const session = await db.session.findUnique({ where: { id } });
if (!session) return null;
await db.session.update({ where: { id }, data: { revoked: true } });
await cache.del(`session:${id}`);
return session.userId;
}
 
export function isExpired(session: Session, now = Date.now()) {
return session.expiresAt <= now;
}
+9 more · lines above went unchecked
  • 11 only Greptile11
  • 13 both flagged13

28 bugs Greptile missed — caught by PR Hero alone

15 live PRs, blocking findings triaged by hand. Overlap comparison — not a ranking. PR Hero and Greptile optimise for different things.

How it works / One pipeline

Four reviewers. One pipeline.

Four specialists read the same diff in parallel. Duplicates merge mechanically. A second pass challenges every serious finding. Severity is decided by code — not the model.

Pipeline schematic

Pull request

Your diff

opt-in

scout

parallel

same diff · four lenses

  • 01

    Reliability

    Correctness bugs: stuck loading, broken invariants, the defect that looks fine.

  • 02

    Resilience

    Failure paths: recovery, retries, stalls that never resolve.

  • 03

    Parity

    Same behavior across surfaces. Runs only when the diff hits its paths.

  • 04

    Lifecycle

    Effects, latches, missing cleanups, re-entrancy, timers that never die.

Merge & verify

  1. 01CODE

    dedupe

    Mechanical merge — no duplicate noise

  2. 02LLM

    refuter

    Second pass challenges every serious claim

  3. 03CODE

    severity

    Severity decided by code, not the model

  4. 04

    comment

    Structured output on the pull request

Review comment

Evidence-backed findings on your PR

Setup / Getting started

Three commands and you're reviewing.

After the install script there is nothing to configure by hand: the wizard walks you through onboarding, init scaffolds the repo, and review needs no flags once it is. Running pr-hero on its own opens the TUI whenever you want it.

session

$ pr-hero setup

interactive onboarding wizard · one time, per machine

$ pr-hero init

scaffolds .prhero/ in your repo · config.json + gotchas.md

$ pr-hero review

zero flags inside a configured repo · runs on your machine

Roadmap / What's next

The engine is live. The ecosystem expands.

Today you can review PRs via interactive TUI, CLI, launchd watcher, and GitHub Actions. Upcoming phases bring multi-runtime support, incremental in-thread judges, and team dashboards.

  1. Today · v1.0

    Isolated worktree reviews, interactive TUI, background watcher, and official GitHub Actions CI.

  2. Next

    Soon

    Multi-runtime engine (OpenCode, Codex, Gemini, OpenRouter) and per-push in-thread judge.

  3. Horizon

    Custom repository hunter packs, web metrics dashboard, and enterprise policy rules.

  1. Trigger

    CLI · TUI · Watch · CI

  2. Review

    4 Hunters · Dedupe · Refuter

  3. Surface

    PR Comment · TUI

  4. Next push

    In-thread Judge

    Soon · Soon

FAQ / Questions

Common questions