OHCAYGOMERGE PROOF

HOSTED MERGE PROOF

Evidence for the code that landed.

Connect checks, approvals and repository rules to the exact merge candidate. See what changed, what landed, and what the evidence cannot establish.

Inspect an example receipt

Examples use fixed synthetic data, not customer results. No login or repository access.

VALUE BEFORE AUTHORIZATION

Inspect the evidence before granting access.

Compare evaluated and landed content in the synthetic examples, including the facts Merge Proof could not establish.

Browse all example outcomes

Free CLI · point-in-time verification

Run or replay evidence yourself when you choose. Local use is free.

Use the free CLI →

Hosted · $29/month per observed active developer

After the trial, hosted Merge Proof observes selected repositories, tracks PR evidence and currentness, reconciles provider history, observes supported landings, and retains proof receipts.

SAFE TO TRY

TRY IT ON A REAL PR

7 days free. No card.

Merge Proof observes and reports without blocking your merges. Early Access currently reports what happened rather than enabling a required merge policy during the trial.

You'll need a GitHub account, a repository you can authorize, and an open PR for your first live proof. If none is open, we watch for the next one.

CONNECT GITHUB

SECURITY & ACCESS

Don't trust Merge Proof more than necessary.

See exactly what authority you grant before connecting.

Can Merge Proof access source?

Yes. Contents read is real source access. Workflow text, API patch text and exact Git objects may reach the server to bind identities and reconstruct supported tree facts.

Do you store my source?

Receipts store normalized evidence, paths, hashes and proof facts—not incidental patch or decoded workflow text. A private partial bare mirror retains exact Git objects and receipt refs for replay.

Does my source go to AI?

No. Source contents are not sent to an LLM or AI provider, and no AI model decides the verdict.

Can Merge Proof change my code?

Not through the standard connection. It has no Contents write authority and cannot push commits or modify repository files.

What can Merge Proof write?

Checks read/write lets it publish or update its receipt Check on the PR. That does not grant repository-file write authority.

FULL PERMISSION & DATA-HANDLING DETAILS

Don't trust Merge Proof more than necessary. See the exact authority before connecting.

Standard GitHub App repository access

  • Read: Actions, Administration, Commit statuses, Contents, Merge queues, Pull requests, and GitHub's mandatory Metadata permission. These reads collect workflow/check evidence, repository rules, Git identities, merge-queue state, PR state, and landed content identifiers.
  • Checks: read and write. Read check results and publish or update the Merge Proof receipt Check on the PR. That write can create or update this App's Check Run output; it cannot change repository files.
  • Organization members: read. Verify that the signed-in billing user is an organization owner.

GitHub sign-in: the OAuth request adds no extra OAuth scopes. The short-lived user token is kept in process memory while Merge Proof checks your identity, App installations, authorized repositories, and organization-owner status.

Technical access and processing: Contents read is real source access. GitHub API responses can include workflow text and diff patches, and reconstruction fetches exact Git objects into a private partial bare mirror. Merge Proof uses these inputs to bind identifiers, inspect workflow action references, and deterministically reconstruct trees; it does not execute customer code.

Persistence and AI boundary: receipts retain normalized evidence, identifiers, paths, hashes, rules, checks, reviews, actors, workflow provenance, and reconstructed Git facts. Exact Git objects and receipt references are retained for replay. Incidental API patch text and decoded workflow text are not written into receipts. No source contents are sent to an LLM or AI provider; no AI model decides the verdict.

Write authority: this standard grant does not include Contents write, Secrets, Workflows write, or organization administration. It cannot push commits, change branches or files, merge or close PRs, post PR comments, alter repository settings, edit branch protection/rulesets, or modify Actions workflows. A separate optional Enhanced Policy Proof companion, if explicitly enabled later, has repository Administration write authority but is constrained by Merge Proof to policy reads; it is not part of this standard connection.

After uninstall or revocation: new collection stops and hosted access fails closed because current installation/repository access is rechecked. Historical receipts, evidence, retained Git objects, account records, and operational backups are not automatically erased; current code defines durable retention, not a customer-selectable deletion deadline.

Install and authorize once. Merge Proof finds open PRs and starts proving automatically. Choose an account or repository only where needed. “Prove it now” is optional; provider, permission and capacity limits can require attention.

Continue afterward for $29/month per observed active developer. Otherwise new hosted proofs, re-proofs and scans pause without an automatic charge; existing receipts remain available with current authorization, subject to retention and capacity limits. New enforcing gates require paid Pro.

What starts the trial?

A successful proof means evidence collection completed for the current observed state: a CURRENT, collection-complete VERIFIED or NOT_PROVEN hosted receipt. NOT_PROVEN can mean missing, ambiguous, unsupported or unavailable evidence; it does not mean your code is broken. FAIL, unavailable or stale collection does not start your trial. Connecting GitHub, installing the App, authorizing repositories and historical scans do not start it either. One 7-day trial starts exactly once per paying account.

Checking your GitHub connection…