HOSTED MERGE PROOF

Your checks passed.
But did that exact code land?

GitHub, CI, and review evaluate one candidate. Merge Proof follows that evidence through landing and shows whether that exact content became merge truth.

SEE AN EXAMPLE PROOF

Public examples require no login, GitHub connection, App installation, private information, or CLI command.

VALUE BEFORE AUTHORIZATION

See VERIFIED, FAIL, and NOT_PROVEN first.

Inspect realistic outcomes in the real buyer presentation before deciding whether to grant GitHub access.

EXPLORE ALL THREE OUTCOMES

Free CLI · point-in-time verification

Run or replay evidence yourself when you choose. Local use is free.

Use the free CLI →

Hosted · $29/month per observed active developer

After the trial, hosted Merge Proof observes selected repositories, tracks PR evidence and currentness, reconciles provider history, observes supported landings, and retains proof receipts.

SAFE TO TRY

TRY IT ON A REAL PR

7 days free. No card.

Merge Proof observes and reports without blocking your merges. Early Access currently reports what happened rather than enabling a required merge policy during the trial.

You'll need a GitHub account, a repository you can authorize, and an open PR for your first live proof. If none is open, we watch for the next one.

CONNECT GITHUB

SECURITY & ACCESS

Don't trust Merge Proof more than necessary.

See exactly what authority you grant before connecting.

Can Merge Proof access source?

Yes. Contents read is real source access. Workflow text, API patch text and exact Git objects may reach the server to bind identities and reconstruct supported tree facts.

Do you store my source?

Receipts store normalized evidence, paths, hashes and proof facts—not incidental patch or decoded workflow text. A private partial bare mirror retains exact Git objects and receipt refs for replay.

Does my source go to AI?

No. Source contents are not sent to an LLM or AI provider, and no AI model decides the verdict.

Can Merge Proof change my code?

Not through the standard connection. It has no Contents write authority and cannot push commits or modify repository files.

What can Merge Proof write?

Checks read/write lets it publish or update its receipt Check on the PR. That does not grant repository-file write authority.

FULL PERMISSION & DATA-HANDLING DETAILS

Don't trust Merge Proof more than necessary. See the exact authority before connecting.

Standard GitHub App repository access

Read: Actions, Administration, Commit statuses, Contents, Merge queues, Pull requests, and GitHub's mandatory Metadata permission. These reads collect workflow/check evidence, repository rules, Git identities, merge-queue state, PR state, and landed content identifiers.
Checks: read and write. Read check results and publish or update the Merge Proof receipt Check on the PR. That write can create or update this App's Check Run output; it cannot change repository files.
Organization members: read. Verify that the signed-in billing user is an organization owner.

GitHub sign-in: the OAuth request adds no extra OAuth scopes. The short-lived user token is kept in process memory while Merge Proof checks your identity, App installations, authorized repositories, and organization-owner status.

Technical access and processing: Contents read is real source access. GitHub API responses can include workflow text and diff patches, and reconstruction fetches exact Git objects into a private partial bare mirror. Merge Proof uses these inputs to bind identifiers, inspect workflow action references, and deterministically reconstruct trees; it does not execute customer code.

Persistence and AI boundary: receipts retain normalized evidence, identifiers, paths, hashes, rules, checks, reviews, actors, workflow provenance, and reconstructed Git facts. Exact Git objects and receipt references are retained for replay. Incidental API patch text and decoded workflow text are not written into receipts. No source contents are sent to an LLM or AI provider; no AI model decides the verdict.

Write authority: this standard grant does not include Contents write, Secrets, Workflows write, or organization administration. It cannot push commits, change branches or files, merge or close PRs, post PR comments, alter repository settings, edit branch protection/rulesets, or modify Actions workflows. A separate optional Enhanced Policy Proof companion, if explicitly enabled later, has repository Administration write authority but is constrained by Merge Proof to policy reads; it is not part of this standard connection.

After uninstall or revocation: new collection stops and hosted access fails closed because current installation/repository access is rechecked. Historical receipts, evidence, retained Git objects, account records, and operational backups are not automatically erased; current code defines durable retention, not a customer-selectable deletion deadline.

Install and authorize once. Merge Proof finds open PRs and starts proving automatically. Choose an account or repository only where needed. “Prove it now” is optional; provider, permission and capacity limits can require attention.

Continue afterward for $29/month per observed active developer. Otherwise new hosted proofs, re-proofs and scans pause without an automatic charge; existing receipts remain available with current authorization, subject to retention and capacity limits. New enforcing gates require paid Pro.

What starts the trial?

A successful proof means evidence collection completed for the current observed state: a CURRENT, collection-complete VERIFIED or NOT_PROVEN hosted receipt. NOT_PROVEN can mean missing, ambiguous, unsupported or unavailable evidence; it does not mean your code is broken. FAIL, unavailable or stale collection does not start your trial. Connecting GitHub, installing the App, authorizing repositories and historical scans do not start it either. One 7-day trial starts exactly once per paying account.

Checking your GitHub connection…

Latest proof observations

Merge Proof runs in the background. You can close this page. We will automatically check authorized PR activity.

This page stays still while you read. Use “Refresh account information” under Optional manual recovery to see newer observations. GitHub Checks are the outside-page result surface. Provider access, delivery and evidence limits can require attention. Signing out of this website does not uninstall the App or delete tracked work.

Checking automatic proof status

Latest only — expand each card to inspect its history

Optional manual recovery

These controls are not required for normal background operation. Refresh reads account information; “Prove it now” collects a new observation. Neither fixes unchanged evidence limits or permissions.

Open pull request

Optional Enhanced Policy Proof

The Standard App uses Administration Read. Some GitHub workflow execution-policy details require Administration Write to read. Optional Enhanced Policy Proof uses a separately authorized, repository-bound policy reader for those reads only; it does not change repository administration.

This is a powerful GitHub grant: a stolen credential still has Write authority. The isolated reader rejects administration mutations. If this optional reader is unavailable, or GitHub cannot provide a needed policy detail, the affected policy or coverage claim remains NOT_PROVEN.

Select a repository to check this optional capability.

I authorize the separate companion App to read execution policies for this repository with Administration Write.

Turning this off stops enhanced reads and rechecks dependent claims; it does not uninstall the companion. Remove its repository access in GitHub to revoke the provider grant. Historical receipts stay unchanged.

Require Merge Proof before merge

Merge Proof defaults to report-only. Installing it does not configure a required GitHub gate. New enforcing policies require paid Pro and a repository administrator; GitHub must separately require the correct Merge Proof Check. Merge Proof never edits branch protection or rulesets. A passing policy Check is not necessarily a VERIFIED receipt.

Select a repository to see whether Merge Proof is required.

How to require it in GitHub

What should Merge Proof's check do?

Merge Proof never edits your branch protection or rulesets. Changing this setting needs repository admin.

Merge records

Pre-merge evidence held when the merge event arrived. When GitHub content can be bound, the record connects that receipt to landed content; exact decision-time currentness is still reported as unavailable. These records are kept as they were; later evidence does not rewrite them.

Filter

Optional free historical scan

See how Merge Proof evaluates evidence from recent merges in this repository.

One free scan: up to 5 merged PRs from the 30 most recently updated closed PRs. Squash/rebase history is unsupported; current rules cannot prove historical approvals. This does not start your trial clock.

Pro — $29/month per active developer

Hosted proofs and automatic re-proofs are included. We count distinct human GitHub IDs opening covered PRs or pushing covered commits during the subscription month. Bots are excluded; human attribution requires GitHub evidence. Initial count uses the last 30 days of observed covered activity.

Why is this developer counted as active?

Pro continues after verified payment. No automatic charge at trial expiry. Quantity increases require your confirmation; no proration. Decreases apply at renewal.