ShipCheck

ShipCheck is a GitHub-native code review tool currently in beta that focuses on behavioral memory rather than line-by-line diff analysis. Instead of asking whether changed code looks correct, it asks whether a pull request changed something the software was already supposed to keep doing — catching authorization regressions, removed safeguards, and broken contracts that can look harmless in a diff.

What It Is

ShipCheck sits in the AI-assisted code review category but takes a distinct approach: it builds a persistent model of what a repository is expected to do, called Behavior Guards, and evaluates every future pull request against that model. The core workflow covers Behavior Discovery, Behavior Guards, Behavioral Diff, Behavior History, and Historical Origin Tracing — all available on every plan, including the free tier.

How the Behavioral Memory Workflow Works

The product operates in four connected stages:

• Behavior Discovery — ShipCheck scans implementation code, tests, authorization logic, validation, callers, schemas, and error handling to surface candidate behaviors the repository already depends on. Developers review candidates and choose which to protect.
• Behavior Guards — A protected behavior becomes a persistent expectation (e.g., "Only subscription owners may cancel subscriptions") that future pull requests are verified against, complete with supporting evidence, origin commit, and confidence score.
• Behavioral Diff — Instead of a line diff, ShipCheck produces a behavioral summary of a pull request: which behaviors were preserved, intentionally changed, violated, newly introduced, or restored.
• Behavior History — Each Guard accumulates a lifecycle timeline (Introduced → Preserved → Changed intentionally → Violated → Restored) across commits and pull requests, separate from raw Git history.

Historical origin tracing extends this further: ShipCheck mines Git history across related implementation and test files to identify the commit where a protected behavior first became true, attaching a confidence score and cross-file evidence.

GitHub-Native Integration

ShipCheck connects through a GitHub App and requires no configuration files in the repository. Key integration points include:

• Automatic pull-request scanning triggered by GitHub webhook events
• The /shipcheck pull-request comment command, which queues a scan of the current revision without leaving GitHub
• Scan results published back as GitHub comments with verdict, score, and findings
• Machine-applicable fix plans and regression tests delivered as focused commits via the GitHub integration

Only users with write, push, maintain, or admin permission on a repository can trigger /shipcheck scans, preventing read-only users from consuming scan capacity.

What ShipCheck Analyzes

ShipCheck combines deterministic checks with repository-aware AI reasoning across five finding categories: Security (authorization regressions, removed access checks, unsafe APIs), Reliability (broken error handling, null assumptions, state cleanup failures), Quality/Contracts (broken API contracts, incomplete refactors, caller mismatches), Accessibility (keyboard regressions, missing accessible names, semantic regressions), and Testing (changed behavior without tests, missing edge-case coverage, untested failure paths). Findings carry severity levels — Critical, Warning, Info, and Passed — and are fingerprinted across rescans so the same issue can be tracked as New, Still Present, Resolved, or Reopened.

Repairs and Regression Tests

Eligible findings can generate bounded code repairs (Apply Fix) and focused regression tests. The repair system is intentionally scoped: machine-applicable plans are limited to a small number of related files and edits rather than allowing unrestricted repository rewrites. Applying an already-generated fix does not consume another AI analysis allowance. Regression-test generation is metered separately by plan.

Current Status: Beta

ShipCheck is currently in public beta. The free tier receives expanded beta limits — three repositories, 30 behavioral AI analyses, and 10 regression-test generations per month — specifically so developers can fully test the behavioral-memory workflow before deciding whether it belongs in their process. Paid plans (Pro, Max, Team) are listed as "coming soon" on the pricing page, indicating they are not yet available for purchase. The product compares itself directly against Greptile, Qodo, CodeRabbit, Cursor BugBot, and Graphite on dedicated comparison pages.