GitHub App · Free for OSS · Pro for private repos
Every caller your PR just broke. Zero LLM calls.
The Repowise PR Bot reads your repository's history and call graph, then posts one comment: which contracts this PR changed and who calls them, what it should have touched and did not, and a Check Run that can gate the merge. No prompts, no hallucinations, no per-PR tokens.
- Silence rule: a green PR gets no comment
- Edit-don't-repost on re-pushes
- A public analysis page per PR, no sign-in
- No clone, no LLM, no token cost
✅ Health: 7.4 (unchanged)
⚠️ Change risk: moderate, riskier than 61% of this repo's commits.
📋 At a glance
1 file changed health · 2 hotspots touched · 7 new findings introduced · 4 co-change pairs left out · 1 dead-code finding · no tests touched.
📌 Before you merge
- ☐ Run 4 test files that import the changed files
- ☐ persistence/models.py changed together with pipeline/persist.py in 16 past commits and isn't in this PR
- ☐ ...and 3 more co-change partners not in this PR
🎯 Blast radius
mark_tombstone_pages signature changed. Called by 9 symbols outside this PR: _persist_full_update_async, test_a_renamed_file_is_dropped... (+6 more)
🤖 AI vs human
AI-authored: 2 files, avg health 8.0 · Human-authored: 3 files, avg health 3.8
▸ More signals (4)
What the Repowise PR Bot is
The Repowise PR Bot is a free GitHub App that reviews pull requests without calling a language model. It parses the base and head of a pull request, diffs the two at symbol level to find contracts whose signature changed, walks the call graph to list every caller outside the pull request, and reads git history for the files that usually change alongside the ones you touched. It posts one comment, edits that comment in place on every push, and publishes a Check Run that can gate the merge. Because there is no model in the path, the same diff always produces the same review, and no source code is sent to a third party.
It is free and uncapped for public repositories. Private repositories need the Pro plan.
The silence rule
A green PR gets no comment. Period.
Most PR bots are noise. This one stays silent unless something it measured is worth interrupting a reviewer for. Try both sides.
It speaks when net repo health degrades, a modified file's score drops, a hotspot is touched, a top co-change partner is missing, new dead code appears, a contract changed under callers outside the PR, or a file is on a declining trajectory. When it does speak, improvements are shown next to problems, so cleanup gets credit.
✅ Health: 7.4 (unchanged)
⚠️ Change risk: moderate, riskier than 61% of this repo's commits.
📌 Before you merge
☐ persistence/models.py changed together with pipeline/persist.py in 16 past commits and isn't in this PR
🎯 Blast radius
mark_tombstone_pages signature changed. Called by 9 symbols outside this PR.
What you get in the comment
The things that decide a review, first.
The comment is tiered, not a list. What can change your mind about merging is inline. Everything that is context rather than a decision is collapsed behind one fold, so the comment stays about seventeen rows whatever it finds.
The gate verdict
A Check Run that passes, warns, or fails, with its reasons. Advisory by default; configure it and it can block the merge. This is the only section that can stop a bad change on its own.
Before you merge
A checklist of what this PR should have touched and did not: the tests that import your changed files, and the files that changed alongside them in past commits but are missing here.
Blast radius
The symbols whose signature this PR changed, and every symbol outside the PR that calls them. Symbol level, not file level: importing a module says nothing about whether the function you changed is the one being called.
Change risk
Where this diff sits in your repository's own risk distribution, from its shape: lines added, files, scatter, and the author's history in the code it touches. Folded into the health headline, not a section of its own.
AI vs human
Which changed files were written by an agent and which by a person, from commit authorship, with the average health of each group. Renders only when the PR has agent-attributed commits.
Refactoring suggestions
Template strings keyed off the marker type. Nothing is generated by a model, so the same diff produces the same comment every time.
Collapsed behind "more signals"
Real signals, and none of them is why you would install this. A hotspot touch tells you the file is dangerous; the blast radius tells you what you broke. They live one fold down because that is what they are worth to a reviewer with thirty seconds.
And a page the comment links to
Markdown runs out. The comment shows three callers of a changed contract and says "+6 more"; the page shows all nine. It draws your repository as a map with this PR's files lit and everything an import reaches from them shaded behind, holds health before and after on one view, and opens a per-file drawer on click. It is public, needs no sign-in, and works on a repository the reader has never seen.
See a real oneHow it works
Three steps. ~5 seconds per PR.
01
Install
Click install, pick repos or a whole org. The bot indexes default branches through the existing pipeline, usually 3 to 10 minutes. Nothing is cloned onto a machine you do not control.
02
Open a PR
On opened, synchronize and reopened, the bot diffs the base parse against the head parse to find changed contracts, walks the call graph for their callers, re-runs the health analyzer over changed files, scores the diff's risk, reads co-change history, and decides whether any of it is worth interrupting you for.
03
Read the comment, or the page
One comment, edited in place on every push rather than reposted. A Check Run carries the gate verdict and annotates the specific added lines. Both link to a public analysis page for that PR that needs no sign-in.
What it cannot do
Read-only. No code execution. No model.
The bot never runs your code, never writes to your repository beyond a comment and a Check Run, and never sends a line of your source to a language model, because it does not call one at all.
That is a structural claim, not a policy one. The class of incident that leaked a competitor's GitHub App key, one holding write access to roughly a million repositories, needs a component that holds write credentials and executes untrusted input. There is nothing here to point a prompt injection at: the analysis is set arithmetic over a call graph and a git history. The same diff produces the same comment every time, and you can check that by pushing it twice.
Pricing
Free for OSS. Pro for private.
The bot is free forever for public/OSS repos — no LLM tokens, no PR cap. Private repos require the Pro plan (matches the rest of Repowise hosted). Private installs still index on connect, so the snapshot is ready the moment you upgrade.
See the full Repowise pricing →Frequently asked
Does the bot post on every PR?
No. Silence is the feature. A green PR with no findings gets no comment at all.
Does it cost anything?
Free forever for public and OSS repos, with no PR caps. Private repos require the Pro plan, matching the rest of Repowise hosted. Private installs still index when you connect, so the snapshot is ready the moment you upgrade.
Does the bot call an LLM?
Nowhere. Health scoring is deterministic (tree-sitter + NetworkX + the 12-marker scorer). Refactoring suggestions are template strings keyed off the marker type.
Will it spam multiple comments on the same PR?
No. The bot edits its existing comment when new commits land. If the silence rule fires after a previous comment, the old comment is deleted instead of left stale.
Can it block a merge?
Yes. The bot posts a Check Run carrying the gate verdict, with annotations on the specific lines the PR added. It is advisory by default, because a bot that fails your build on day one gets uninstalled on day one. Configure a gate rule and it becomes a required check like any other.
What is the blast radius section?
The symbols whose signature this PR changed, and every symbol outside the PR that calls them. It is symbol level rather than file level: importing a module says nothing about whether the function you changed is the one being called. Only breaking changes render, so a body-only edit stays quiet.
What permissions does it need?
Contents: Read · Pull requests: Write · Metadata: Read · Issues: Write (GitHub treats PR comments as issue comments).
Can I tune it per repo?
Yes, drop a .repowise/bot.yaml in the repo root to disable sections, change the comment threshold, configure the merge gate, or ignore paths like vendor/ and *.generated.*. The defaults are the product, so most repos never need it.
How does the bot relate to repowise.dev?
Same engine. Every PR comment links to a public analysis page for that PR at repowise.dev/pr/{owner}/{repo}/{number}, which needs no sign-in: the repository map with the PR lit up, every caller of the contracts it changed, and health before and after. From there the full dashboard carries the graph, ownership, decision archaeology and MCP for AI agents.
Install in 30 seconds.
Free for OSS, no credit card. Private repos require Pro. Uninstall any time from github.com/settings/installations.
Install on GitHubQuestions? Email hello@repowise.dev or join us on Discord.