product
Contributor Trust
Know who is behind the code before it merges.
customers
ubicloudevry healthdotenvxfirecrawlcapchasenangomastrapaperclip
why
on a busy repo the author is often someone you have never met. agents make more of those prs.
an npm-style takeover looks like a useful patch from a new account. the check is how you catch that before merge.
signals
risk scores
account history, cross-repo behavior, and how they contribute. one score per author on the pr.
github check
Contributor trust on every open and update. require it in branch protection if you want it to block merge.
history review
past patches can pull the score down when there is real risk. a clean history cannot raise it.
api
read a cached score or start an org-scoped scan from rest or mcp.
how it works
three steps
01 open a pull request. someone opens or updates one. you stay in github.
02 we check the author. who opened it, not what changed in the diff.
03 github gets the verdict. Contributor trust comes back verified, flagged for review, or inconclusive. require the check in branch protection to block merge.
get started
free for open source.
the whole suite, on any public repo. private repos are paid — contact us and we'll set you up.