A risk rating on every MR
Low, medium or high at a glance, so reviewers know where to look first and what can go quickly.
AI merge review
Every merge request reviewed in minutes
Pullwise reads each diff and posts one clear comment: a risk rating, the bugs and security issues worth fixing, and the questions a good reviewer would ask.
Free with your own AI key No credit card Set up in 5 minutes
Works with the tools you already use
- GitLab
- GitHub
- Bitbucket
- OpenAI
- Claude
- Gemini
- Ollama
- vLLM
How it works
Three steps to your first review
No agents to install and no CI pipeline to change. Pullwise listens for merge request events and does the rest.
Connect your repos
Sign up, then connect GitLab, GitHub or Bitbucket with a token. Pullwise gives you a webhook URL to paste in.
Pick a model
Use your own OpenAI, Claude or Gemini key, a model on your own hardware, or the hosted Pullwise model.
Open a merge request
Pullwise reviews the diff and posts one comment. Push again and it updates the same comment.
Why teams use Pullwise
Faster reviews without lowering the bar
Your reviewers stay in charge. Pullwise does the first pass so their time goes on design, intent and the hard calls.
One comment, not fifty
Summary, findings and questions in a single note that updates in place. No bot spam in your threads.
Feedback in minutes
Authors get a first review while the change is still fresh, long before a teammate is free.
Catches what people miss
Bugs, security issues, race conditions and missing tests, each with a file, line and severity.
Safe auto-approve
Optional. Only approves low-risk changes with no serious findings, and never merges.
Built for teams
Your own workspace address, Google or email sign-in, admin and reviewer roles.
Your code, your choice
Run the AI wherever you trust it
Pick the model per workspace and change it whenever you like.
- Bring your own key. OpenAI, Claude or Gemini. Your provider bills you, Pullwise is free.
- Self-hosted model. Any OpenAI-compatible endpoint, such as Ollama or vLLM. The diff stays on your network.
- Pullwise AI. No keys to manage. Pay per review with credits.
Security built in
- Secrets such as API keys and tokens are masked before any model sees the diff
- MR text is treated as data, so prompt-injection attempts are flagged
- Every workspace is isolated, with its own keys and webhook secrets
- We don't store your source code or train on it
Pricing
Free to start. Pay only for hosted AI.
No seats and no subscription. Bring your own model for free, or top up credits when you want us to run it.
FAQ
Questions teams ask first
What does Pullwise do?
Pullwise reviews merge requests and pull requests with AI. When an MR is opened or updated it reads the diff, then posts one comment with a summary, a risk rating (low, medium or high), specific findings with severity, and questions for the author. It updates that same comment on each push, so your MR never fills up with bot noise.
Is my code used to train AI models?
Not by Pullwise. The Pullwise-hosted model does not train on your code. If you bring your own key, your provider’s API terms apply; OpenAI, Anthropic and Google do not train on API traffic by default.
Do you store my source code?
No. Pullwise fetches the diff for each review, sends it to the model and posts the result. We keep a review log (repository, MR number, risk rating, outcome and the review summary) but not the diff or your source.
Is there a free plan?
Yes. With your own AI key Pullwise is free, with unlimited reviews and repositories. You pay your AI provider directly for the tokens you use.
Will Pullwise approve or merge code on its own?
No, not by default. Reviews are advisory. You can turn on auto-approve, and even then Pullwise only approves when the model recommends it, the diff was not truncated, the risk is below high and there are no blocker or high-severity findings. It never merges.
Get your first AI review in five minutes
Free with your own AI key. No credit card. Connect a repository and open a merge request.
Adds exponential backoff to the webhook handler. Logic is sound, but retries can double-credit a payment.
webhook.ts:42Retry runs before the event id is stored, so a retried delivery can credit twice.retry.ts:18No upper bound on attempts.Question for the author: should a 4xx from Stripe be retried at all?