Graphbit PRFlow - AI code reviewer that catches what others miss
by•
Your AI teammate that reviews every pull request before it ships.
Tested on 10 real projects, PRFlow found 7 critical security issues where competitors found zero.
Learns your team's standards over time. Pay per review, not per seat.


Replies
GraphBit
Thanks everyone, I'm Musa, founder of GraphBit.
We built PRFlow after getting frustrated with AI code reviewers that flood your PR with noise, miss the issues that actually matter, and feel different every time they run.
The market has options. We know that. We built PRFlow anyway because none of them solved the core problem: consistency and cross-file context in a single pass.
PRFlow is a deterministic baseline reviewer that lives inside GitHub. Open a PR and a structured review posts in minutes, every time, with the same output. It traces the exact function that changed across cross-file dependencies, not just the diff lines. That is how it caught 14 security issues on a PR where another tool found zero.
We benchmarked PRFlow on 10 real public pull requests. Rated 4.3/5 on average. Every review is live on GitHub and readable right now.
PRFlow handles the baseline so your team focuses on architecture, intent, and edge cases. Not repeated first-pass checks.
There are other tools. Try PRFlow on a real repo and see the difference yourself. We read every comment.
DiffSense
@musa_molla Yes. Very noizy. You need a master PR reviewer jsut to review the AI reviewers 😅.... Is graphbit free for public repos? id love to try it on one particular public repo thats launching soon on PH https://github.com/eoncode/runner-bar/
GraphBit
@conduit_design Haha exactly, reviewing the AI reviewer is a real problem 😄
Not free for public repos, but we have a launch offer running right now first 2,000 users get 200,000 tokens and 20 free tracings. That's more than enough to put it through its paces on runner-bar.
Sign up at platform.graphbit.ai and give it a proper test. Would love to hear what it catches
DiffSense
@musa_molla I do 300 commits a day. It would last me 45min 😅 this is the agentic age. we do 10x the work now. Quality PR Review is great. but in the agentic age. it would cost too much. Do you have some sort of plans to address this tension?
GraphBit
@conduit_design 300 commits a day! okay that's a different scale entirely 😄
You're pointing at something real. The coin model works for standard team velocity but agentic pipelines change the math completely.
We're thinking about smarter triggering, reviewing at meaningful checkpoints like pre-merge or when specific file types change, rather than every single commit. That's the direction that makes sense for this use case.
Would love to understand your workflow better. The agentic scale problem is one we want to solve properly
Earth.fm
Really like the direction here. Most teams already have code review processes in place, but review fatigue and repetitive comments still slow things down a lot.
What stood out to me about PRFlow is that it seems focused on improving reviewer focus instead of trying to fully replace human reviews. That balance is important for engineering teams.
Curious to see how teams integrate this into their existing PR workflow over time. Congrats on the launch 👏
GraphBit
@1mirul Exactly the balance we were going for. PRFlow handles the repetitive stuff so the senior devs can focus on what actually needs their eyes. Thanks for getting it
GraphBit
Thanks, @1mirul. That’s very much the design philosophy behind PRFlow. We’re not trying to replace human review, but to automate the repetitive process so engineers can focus on architectural decisions, business logic, and edge cases. The goal is to make review workflows more consistent inside GitHub while keeping humans in control of the final judgment.
Wion - Audio Dating
GraphBit
@tanjum That's exactly the balance we were going for, baseline handled automatically so engineers stay focused on what needs human judgment.
On larger PRs and multi-file changes: PRFlow traces the exact function that changed and follows its dependencies across files in the same PR. Token budget is managed so larger PRs don't get shallow reviews. The depth stays consistent regardless of PR size
GraphBit
@tanjum Thanks. For bigger PRs, PRFlow builds context in layers using our own context engine. It extracts structured context from each changed file, enriches that with cross-file dependencies, and then reviews the PR as a whole rather than one file at a time. For very large PRs, it also uses token budgeting and file prioritization so the review stays focused and useful.
the 'deterministic baseline' part is what caught my eye. usually ai reviewers feel like a coin toss one day it’s strict, the next it’s lazy. having a consistent output makes it much easier to integrate into a real team's workflow without the senior devs getting annoyed. support on the ship @musa_molla
Scarlett.
Really happy to be the hunter for PRFlow today.
The team spent serious time building an AI-native code review agent focused on consistent code review at scale, cross-file context, and detecting security vulnerabilities in pull requests before they ship.
For teams dealing with PR review bottlenecks, this is a product that genuinely deserves a closer look.
GraphBit
@byalexai Thank you for supporting us today, means a lot to the whole team 🙏
Triforce Todos
Love the baseline approach.
@musa_molla , Congrats on the launch! Can it run on every push or just on PR open?
GraphBit
@abod_rehman Yes, it can run on every push to an open PR, not just when the PR is first opened. Right now PRFlow triggers on PR open, on new commits pushed to the branch, and when a draft is moved to ready for review.
GraphBit
@abod_rehman Thank you! PRFlow triggers on PR open and every push to an open PR, so automated pull request review happens continuously throughout the lifecycle, not just at the start. Every new commit gets a fresh pass. No gaps in coverage
Congrats guys, looks exciting because most AI reviewers just skim the diff and miss the bigger picture. The cross-file dependency mapping is the real unlock, and 14 issues caught where another tool found zero is a serious proof point. Excited to see this grow!
GraphBit
@campritchard That's exactly it, the diff is just the entry point. The bug lives in what the change touches downstream. Glad that landed clearly 🙏
GraphBit
@campritchard Exactly. The diff is usually just the starting point, not the full problem surface. A lot of the real issues only show up once you trace what the change affects across related files. Glad that part came through clearly.
Badge
Congratulations on the launch. I am a solo dev building Badge, I will definitely try this for my repo as an AI reviewer. One question - you said you save cross file context in a single pass, one obvious questions comes - how do you deal with loss in the middle, because that directly translates to misses in review.
GraphBit
@lokesh_motwani1 Great question and glad you're going to try it on Badge.
The single pass doesn't mean one giant context window. PRFlow extracts only the relevant function scope and its cross-file dependencies before sending to the model, so the actual input is tight and focused, not a full repo dump. That's what keeps the middle from getting lost.
Token budgeting handles the rest, larger PRs get prioritized by semantic significance rather than being truncated blindly.
Important thing is, no system is perfect on very large PRs, but the extraction step before the model call is what keeps the signal-to-noise ratio high
Badge
@musa_molla Loved your approach on this. Thank you for sharing details.
GraphBit
@lokesh_motwani1 Good question. We try to reduce that risk before the model call, not after it. PRFlow does structured context extraction first, adds cross-file dependency context, then applies per-file token budgets and memory budgets so one large file does not crowd out the rest of the PR.
If the PR is too large, we prioritize the reviewable files instead of pretending nothing gets lost. So the approach is basically controlled compression plus prioritization, not “throw the full diff into one prompt and hope for the best.”
the cross-file context piece is what gets me - most reviewers treat a PR as a flat list of diffs and miss the connective tissue entirely. curious how you handle PRs where the meaningful change is in what didn't get updated, like a call site that should have changed but wasn't touched?
GraphBit
@liviu_chita hat's one of the sharpest questions we've gotten today.
Right now PRFlow follows what changed and traces its dependencies within the PR. A missing update at a call site that was never touched, that's a gap we don't fully close yet, because we work within the scope of what the diff includes.
What partially helps, cross-file dependency tracing sometimes surfaces the call site in context even if it wasn't edited, depending on how tightly the functions are linked. But I won't overstate it — detecting what should have changed but didn't is a harder problem and one we're thinking about seriously.
Good thing to keep pushing on
GraphBit
@liviu_chita That’s exactly one of the cases we try to catch. PRFlow enriches the changed code with cross-file references and can look up related functions or patterns outside the diff, so it can flag “this call site should have been updated too” even when the missed file was untouched.
The practical constraint is that the comment still has to anchor to a changed line in the PR, so the issue gets attached to the nearest relevant changed code rather than the untouched file itself.
Curious what enterprise agent workload made you reach for Rust over staying in Python. Most agent frameworks bottleneck on LLM inference, not framework speed.
GraphBit
@ebazan33 The bottleneck for us wasn't inference speed, you're right that LLM latency dominates. The reason we reached for Rust was deterministic routing. We needed the orchestration layer to be predictable and auditable, not probabilistic. When PRFlow makes a decision about what context to include or how to route a review, that decision has to be the same every time. Python frameworks gave us flexibility but not that guarantee
@musa_molla That makes sense. "Deterministic and auditable" is actually a bigger enterprise sell than "fast." Auditors care more about repeatability than throughput. Worth leaning into that in positioning. Good luck with the launch.
GraphBit
@ebazan33 Good question. It was not about making the LLM itself faster. The reason for Rust was the orchestration layer around enterprise agent workloads, things like concurrency, runtime stability, lower overhead in tool and memory flows, and more predictable performance under load, while keeping Python as the developer-facing layer.
@rupak_chandra_bhowmick The "Python facing the developer, Rust handling the load" architecture is the right call. Same playbook polars and pydantic used. Solid choice for a long-term framework. Good luck.