Launching today
pr-risk-score
Risk-score pull requests so only the risky ones need a human
3 followers
Risk-score pull requests so only the risky ones need a human
3 followers
Paste a GitHub PR URL, get a 0-100 risk score and a decision: AI review is enough, or a human must look. A deterministic baseline (auth, migrations, CI, secrets, test gaps) plus a bounded Claude review, every point traced to file:line. Free and open source.
Free
Launch Team
CloudflareYour next app belongs on Cloudflare Workers. Deploy for free
Promoted
Hi Product Hunt š I'm Masaaki, the maker of pr-risk-score.
AI code review is now cheap enough to run on every pull request. Human attention isn't. Reviewing everything burns people out on dependency bumps, and trusting AI with everything is a gamble on the PR that drops a column or weakens an auth check.
pr-risk-score answers one question with a number you can defend: does a human need to see this?
How it works:
ā¢ Deterministic baseline (0ā100): change size, sensitive paths (auth, payments, migrations, CI), 27 risky-pattern rules, leaked secrets, test gaps. Same diff, same score, so it's safe as a CI gate.
ā¢ Semantic review by Claude, bounded to Ā±20, where every point must cite file:line. A confirmed critical issue (for example, an endpoint that lets anyone wipe another user's password) escalates to a human even when the baseline is low.
ā¢ Hard floors a PR can't argue its way out of: leaked secrets, destructive migrations, first-time contributors editing CI, and prompt injection aimed at AI reviewers.
It ships as a Claude Code skill, a GitHub Action (no API key needed), and a single zero-dependency Python file. MIT licensed.
I'd love your feedback on two things:
1. Do the default weights match your sense of risk? What would you tune first?
2. Which signal should come next: CODEOWNERS coverage, author familiarity with the files, or revert history?
Thanks for taking a look!