One independent check on every pull request — including the flood your AI agents open.

GitAlert is a check that runs on your pull requests. Whenever someone — a teammate or an AI coding agent — opens or updates a PR, GitAlert reads the changes and posts one plain-English label: Looks solid, Worth a closer look, or Likely needs attention. It helps you decide which pull requests to review carefully first.

Install GitAlert on your repositories and it reads every pull request automatically — human or AI-agent — the moment it opens or updates. It posts one neutral label (Looks solid, Worth a closer look, or Likely needs attention) so your reviewers can tell at a glance which few PRs actually need a careful read, instead of trying to review all of them. It never blocks a merge; it just tells your team where to look first.

Yes. GitAlert runs as a GitHub check that posts an informational, always-neutral status on every pull request — it never turns into a red X, never fails your build, and never becomes a required check that stops a merge. You and your reviewers stay fully in control of what ships.

No. GitAlert only posts a neutral, informational check. It never fails your build, never forces a red X that blocks merging, and never leaves comments on your PR. You and your reviewers always stay in control of what gets merged.

All of them. GitAlert checks the pull request itself, so it covers PRs opened by Copilot, Cursor, Claude Code, Codex, Devin, and any other agent — as well as your human teammates. It even labels each PR by whether it was opened by an AI agent or a person. Because GitAlert is independent of the tool that wrote the code, the check is the same no matter which agent or IDE produced the change.

The three mistakes AI-written code makes most often: tests that were quietly weakened or disabled just to pass, dependencies that do not actually exist on the package registry, and changes to sensitive files such as CI config, secrets, or authentication code. Every flag points to the exact file and line.

When a pull request adds a new package to a manifest like requirements.txt or package.json, GitAlert checks that package name against the real registry (PyPI for Python, npm for JavaScript). If the package does not exist, it is flagged — because AI agents frequently hallucinate package names, and attackers register those fake names to slip malware into builds ("slopsquatting"). Every flag points to the exact file and line.

GitAlert flags changes to a fixed set of high-risk files so a quiet edit never slips through unreviewed: secret and credential files (.env, .pem, id_rsa, credentials, secrets.yml), CI and pipeline config (.github/workflows, .gitlab-ci.yml, Jenkinsfile), container config (Dockerfile, docker-compose.yml), and infrastructure variables (terraform .tfvars). It surfaces the change as an informational note — it never blocks the merge.

GitAlert reads pull-request metadata (title, author, branch) and the PR diff. The diff is analysed in memory to produce the label and is not stored — GitAlert keeps only the pull-request metadata and the resulting verdict (the label and the file:line reasons behind it). On the free plan it never runs your code; on paid plans, optional sandbox runs build and test your project in an isolated, throwaway environment with no access to your secrets. See our Privacy & Security page for the full detail.

On the free plan, no — triage is based purely on reading the diff. On paid plans you can turn on sandbox runs, where we build your project and run its tests inside an isolated, throwaway environment that has no access to your secrets and is fully separated from our own systems.

GitAlert is fully independent. It is not built by the agent that wrote the code and it is not tied to any single IDE or provider — it runs as a check on the pull request itself, so it gives the same neutral, deterministic signal no matter which tool or person opened the PR.

Yes. Triage on public repositories is free forever, with no credit card required. Paid plans add private repositories, sandbox test runs, and higher monthly limits.

GitAlert works with GitHub today. GitLab and Bitbucket run on the same engine and are next, so you get the same consistent result wherever your code lives.

Sign in with your Git provider, install the GitAlert app on the repositories you choose, then open or update a pull request. You will see your first triage check within seconds.