Pull-request native
ShipCheck lives where code actually gets merged. GitHub events automatically create scans for connected repositories.
Your AI wrote the code.
ShipCheck decides if it's ready.
Connect GitHub. ShipCheck reviews every pull request for security, reliability, quality, accessibility, and testing risk — then gives you the findings, fixes, regression tests, and confidence to merge.
GitHub-nativeAutomatic PR scans/shipcheck rerunsSafe fix applicationRegression tests
app.shipcheck.dev/dashboard/scans/8b7f
acme-inc/customer-portalfeature/checkout-retry
Ship report
Checkout retry + subscription changes
PR #42 · 31 files checked · 18 seconds ago
Not ready to ship
Ship Score
72/ 100
High risk
Critical
2Blocks shipping
Warnings
4Needs review
Passed
31Checks successful
Findings
Prioritized by shipping risk
Security 2Reliability 2Testing 2
Ownership check removed from subscription route
app/api/subscriptions/[id]/route.ts
Checkout response changed without updating its caller
app/api/checkout/route.ts
New failure path is not covered by tests
tests/checkout.test.ts
The problem changed
Writing code got faster.
Reviewing it didn't.
AI can generate a valid-looking implementation in seconds.
It can also remove a safeguard, misunderstand a repository contract, skip a failure state, or quietly introduce behavior nobody tested.
ShipCheck is the verification layer after the generation layer.
It is designed to inspect what changed, understand why it matters, prioritize risk, help repair it, and verify the next revision.
One scan. Multiple layers.
Don't ask one model
one vague question.
ShipCheck breaks shipping risk into concrete categories instead of returning one giant stream of AI comments.
Security checks
Catch dangerous changes before they become incidents.
ShipCheck combines deterministic checks with repository-aware review to surface credentials, unsafe APIs, missing authorization, injection risks, insecure configuration, and other security regressions.
Evaluated against the pull request and repository
Scan findings
PR #42 · current revision
Ownership validation removed from delete route
criticalThe endpoint still authenticates the request, but no longer verifies that the resource belongs to the signed-in user.
app/api/projects/[id]/route.ts
Live provider credential detected
criticalA newly added literal matches the structure of a production credential rather than an obvious placeholder.
lib/payments/client.ts
Protected dashboard remains authenticated
passedExisting authentication boundaries remain intact after the pull request.
middleware.ts
Critical
1
Warning
1
Passed
1
The shipping loop
From pull request
to verified repair.
01
Open or update a pull request
ShipCheck receives the GitHub event and queues the exact PR revision for analysis.
02
Scan the change in repository context
Deterministic rules and AI review analyze the changed code, surrounding contracts, and relevant repository context.
03
Get one clear ship report
See severity, categories, risk, concrete findings, suggested fixes, and an overall Ship Score.
04
Fix it or generate a regression test
Apply a guarded repair or generate a focused test designed to prevent that exact bug from returning.
05
Run /shipcheck again
Push the repair or comment /shipcheck and verify the current revision before merging.
One comment.
Fresh ship check.
Fixed a finding? Changed the implementation? Comment /shipcheck on the pull request and run another review of the latest revision.
No dashboard detour required
Works inside the GitHub pull-request workflow
Re-check after fixes before you merge
github.com/acme/customer-portal/pull/42
sarah-devcommented now
/shipcheck
shipcheck-ai
botShipCheck queued for the latest revision.
Scan statuscompleted
94/ 100 Ship Score
Previous critical findings no longer appear in the current PR revision.
Interactive example — no GitHub action is performed here.
The full product
Not just another
AI comment bot.
ShipCheck combines multiple pieces that normally live across different tools into one pre-merge workflow.
Repository-aware AI review
Review changed behavior against surrounding code instead of judging isolated lines with no understanding of the project.
Deterministic security checks
Catch known credential formats, private keys, credentialed connection strings, high-entropy secrets, and other high-signal problems without relying entirely on AI.
Ship Score + risk level
Turn a wall of feedback into a clear readiness signal with structured counts by severity and category.
Apply Fix
For safe machine-applicable findings, ShipCheck can commit exact fixes directly to the current PR branch.
Regression-test generation
Generate one focused test for one concrete finding using the repository's detected framework and existing testing style.
/shipcheck
Need another opinion after a change? Comment /shipcheck on the pull request to trigger another scan.
Per-repository controls
Enable or disable Security, Reliability, Quality, Accessibility, Testing, AI review, ignored paths, and ignored rules per repository.
Durable scan execution
Scans are queued and claimed by workers with retry handling and stale leases instead of depending on a fragile request staying alive.
Don't stop at detection
Find it.
Fix it. Prove it.
A review comment is useful. A repaired pull request with a regression test is better. ShipCheck can move from diagnosis to remediation while keeping the developer in control.
Critical finding
Authorization guard removed from delete route
The pull request still verifies that the caller is authenticated, but no longer checks that the requested project belongs to that user.
Exact target text must still exist
Current PR head must match scanned commit
Repair plan is bounded by edits and files
Unsafe paths are rejected server-side
Multi-file repairs commit atomically
01Validate revision
02Apply patch
03Re-check
app/api/projects/[id]/route.ts
proposed repair27const user = await requireUser();
28
29+ const project = await getProject(id);
30+ if (project.userId !== user.id) {
31+ return Response.json({ error: "Forbidden" }, { status: 403 });
32+ }
33
34await deleteProject(id);
Ready to validate repair
ShipCheck will verify the target revision before changing any code.
Per-repository settings
Your repositories
are not identical.
Tune ShipCheck per project. Enable the categories that matter, turn AI review on or off, ignore generated directories, and silence rules that do not fit a repository.
Security
Reliability
Quality
Accessibility
Testing
AI review
Ignored paths
Ignored rules
Repository settings
acme-inc/customer-portal
AI review
Use repository-aware AI analysis during scans.
Scan categories
Security
Reliability
Quality
Accessibility
Testing
Ignored paths
generated/**
public/vendor/**
public/vendor/**
Ignored rules
accessibility-icon-label
quality-large-file
quality-large-file
Try the toggles — this is an interactive homepage preview.
Where ShipCheck fits
Code review tells you what it saw.
ShipCheck asks if you should ship.
GitHub Copilot, CodeRabbit, and Qodo are capable review tools. ShipCheck is designed around a narrower question: what changed, what could break, what needs fixing, and what must be proven before merge?
ShipCheck
GitHub
CodeRabbit
Qodo
Primary workflow
Pre-merge ship decision
Built around finding, fixing, testing, and re-checking risk.
GitHub-native review
Copilot review plus GitHub's broader security toolset.
AI code review
Automated review and developer feedback workflow.
AI code review
Multi-agent PR review with rules and suggestions.
PR analysis
Automatic + /shipcheck
Scan automatically or rerun from the pull request.
Automatic / requested
Copilot can be assigned or configured for automatic reviews.
Automatic
Reviews PRs and updates feedback as commits change.
Automatic
Reviews connected pull requests automatically.
Deterministic checks
Part of the same scan
Fast deterministic rules run beside AI analysis.
Separate security stack
Code scanning and secret scanning complement Copilot review.
AI-review oriented
Broad contextual review is the core workflow.
AI-review oriented
Multi-agent analysis and rule enforcement are central.
Finding output
Severity + category + risk
Structured findings feed one scan-level ship report.
Review comments
Feedback appears primarily through review suggestions/comments.
Review findings
Actionable comments and PR review summaries.
Review findings
Prioritized issues and rule violations.
Readiness signal
Ship Score
A single 0–100 view of how risky the current revision is.
Review feedback
Review comments are evaluated alongside the rest of GitHub.
Review feedback
Review output guides the merge decision.
Review feedback
Findings and rules guide the merge decision.
Fixing findings
Exact guarded repair plan
Apply bounded edits directly to the exact PR revision.
Suggested changes / agent
Suggestions can be applied or handed to Copilot.
Autofix
Can implement unresolved review feedback.
Code suggestions
Provides committable improvement suggestions.
Regression protection
Generate from the finding
Create a focused test designed to reproduce the detected bug.
General coding workflow
Testing is not the core output of Copilot PR review.
Unit-test generation
Can generate tests through finishing-touch commands.
Test generation
Can generate tests for selected changed components.
Repository controls
Per-repository settings
Toggle categories and ignore paths or individual rules.
Custom instructions
Repository and path-level review instructions are supported.
Repository config
Review behavior can be customized per project.
Rules + configuration
Organization and repository standards can guide reviews.
Positioning comparison, not a benchmark. Competitor capabilities evolve over time and can vary by plan, configuration, platform, and product surface.
Questions
Before you
install it.
ShipCheck is intentionally opinionated about the moment right before merge: find risk, resolve it, and verify the next revision.
No. AI review is one layer. ShipCheck combines repository-aware AI analysis with deterministic scanning, structured severity and category summaries, a Ship Score, safe fixes, regression-tests generation, repository controls, and repeatable PR scans.
Comment /shipcheck on a connected pull request and ShipCheck can queue another review of the current PR revision. It gives developers an explicit way to re-check a change after fixing findings.
Not blindly. A finding must contain a machine-applicable repair plan before Apply Fix is available. The backend validates edit count, file count, paths, exact search targets, the PR state, and the exact scanned commit before writing.
ShipCheck treats old results as stale for write operations. Before applying a fix it checks that the current pull-request head still matches the commit that was scanned, so an old repair is not silently applied to new code.
Yes. Repository settings support category toggles for Security, Reliability, Quality, Accessibility, and Testing, plus AI review, ignored paths, and ignored rule IDs.
Fixing a bug once is not enough. ShipCheck can turn a specific finding into a focused test that demonstrates the broken behavior, follows the repository's test framework, and helps prevent the same regression from coming back.