PR Whisperer

CLI that generates AI-powered PR review summaries with risk assessment. Analyze pull requests or local diffs, get structured feedback with risk scores, breaking change detection, and security analysis.

Features

• Risk Assessment: 1-10 risk score with visual bar and severity level
• Breaking Change Detection: Identifies potential breaking changes
• Security Scanning: Flags security concerns in diffs
• Performance Notes: Spots performance implications
• Auto-Comment: Posts analysis directly as PR comment
• Multiple Formats: Terminal (rich), Markdown (for PR comments), JSON (for automation)
• Local Diff: Analyze uncommitted changes without a PR

Installation

npm install -g pr-whisperer

Setup

Set your API keys:

# Via environment variables
export GITHUB_TOKEN=ghp_xxx
export OPENAI_API_KEY=sk-xxx

# Or via config command
prw config --github-token ghp_xxx --openai-key sk-xxx

Usage

# Analyze a PR by URL
prw review https://github.com/owner/repo/pull/123

# Shorthand (URL as first arg)
prw https://github.com/owner/repo/pull/123

# Analyze local git diff
prw --diff

# Output as markdown
prw review https://github.com/owner/repo/pull/123 -f markdown

# Output as JSON (for CI pipelines)
prw review https://github.com/owner/repo/pull/123 -f json

# Post analysis as PR comment
prw review https://github.com/owner/repo/pull/123 --comment

# Use a specific model
prw review https://github.com/owner/repo/pull/123 -m gpt-4o

# View config
prw config --show

Configuration

Config is stored in ~/.prw.json:

{
  "github_token": "ghp_xxx",
  "openai_api_key": "sk-xxx",
  "model": "gpt-4o-mini",
  "max_tokens": 4096,
  "default_format": "terminal"
}

Environment variables override file config: GITHUB_TOKEN, OPENAI_API_KEY, PRW_MODEL.

Output Example

=== PR Whisperer Analysis ===
  feat: add user authentication

Summary
  Adds JWT-based authentication with login, register, and token refresh endpoints.

Risk Assessment
  Score: [######    ] 6/10 [HIGH]

Recommendation
  REQUEST_CHANGES - Missing rate limiting on auth endpoints

Breaking Changes
  X POST /api/login response schema changed (token field renamed)

Security Concerns
  ! JWT secret hardcoded in config.ts line 12
  ! No rate limiting on login endpoint

Questions for Author
  1. Should we add brute-force protection on the login endpoint?
  2. Is the token expiry of 7 days intentional?

CI Integration

Use JSON output in GitHub Actions:

- name: PR Review
  run: |
    RESULT=$(prw review ${{ github.event.pull_request.html_url }} -f json)
    RISK=$(echo $RESULT | jq '.risk_score')
    if [ "$RISK" -gt 7 ]; then
      echo "::warning::High risk PR (score: $RISK)"
    fi

License

MIT