GitHub as the source of truth
OAuth with repo, read:user, and read:org. GraphQL walks repositories you own, collaborate on, or inherit through an org, then lists open pull requests — not a personal subset, the ones you can actually review.
PR intelligence for mixed human / agent diffs
Hatterdash — for what's top of mind
Open pull requests arrive faster than review bandwidth, and a growing share of the felt is machine-stitched. Hatterdash authorizes against GitHub, lays every open PR you can access on the bench, and scores the change against main: volume, likely AI assistance, test-bed confidence, coverage, CVE records from cve.org, and residual security risk. Approve, comment, or close without leaving the last.
Finding the grain of the diff
The process never pretends to understand a patch. It ships the unified diff, checks runs, and commit trailers to an analyzer that returns structured scores the dashboard can defend in a staff meeting.
Actions that write back
Approve via the Pulls review API, comment on the issue thread, or close the PR. Hatterdash is a visor, not a fork of GitHub's permission model.
How a change is dressed
Two processes, one bench. The diagram is the runtime, not a metaphor for later.
What each dashboard answers
- Lines versus main. Additions, deletions, net, files, and hunks from the GitHub comparison against the base branch.
- AI-declared lines. Every added line is traced by git blame to the commit that last wrote it. Lines from commits with an AI author or co-author (Claude Code, Aider, Cursor) count; undeclared use is never guessed into the number.
- Confidence vs the current test bed. CI results, coverage of the added lines, test changes, and outstanding risk, folded into a score out of 100 with every point shown: is this the change you would ship? Anything Hatterdash couldn't read counts as unknown, never as clean.
- Coverage on the new code. Measured on the added lines from the coverage reports your CI uploads (lcov, Cobertura, or Istanbul, merged across shards); Codecov's patch figure when that's all there is; otherwise it says no report was found rather than inventing a number.
- CVEs. The exact dependency versions the change introduces, read from lockfiles at the merge base and the head, checked against OSV, linked to cve.org, and shown with the version that fixes them.
- Risk beyond CVEs. Secrets, eval, string-built SQL, unsafe YAML, weak crypto, over-broad permissions.