-
Landing Page
-
Landing Page
-
-
Default State of the App
-
Insights on a PR from my agent
-
Git Diff Visualisation from my agent
-
Chat System to understand more about the PR
Inspiration
Every developer knows the pain of waiting hours for a PR review, only to get back a handful of nitpicks while real bugs slip through. Code review is one of the most valuable — and most inconsistently done — parts of any engineering workflow. We wanted to ask: what if a senior engineer was always available, reviewed every PR instantly, and never missed a security vulnerability or a broken edge case? That question became DiffWatch.
What it does
DiffWatch is an AI-powered PR review agent that gives developers instant, senior-engineer-quality code reviews directly inside their GitHub workflow.
Paste a GitHub PR URL and DiffWatch:
- Fetches the full diff, changed files, and PR description in parallel
- Pulls CI/CD check results so the review knows whether tests are passing
- Detects linked issues (e.g. "Fixes #123") and verifies the code actually solves the problem
- Scans newly added dependencies against the OSV.dev vulnerability database for known CVEs
- Finds similar merged PRs that touched the same files for historical context
- Generates a structured review with a summary, per-line comments tagged by severity (critical, warning, suggestion, praise), a final verdict, and a diff heatmap
- Posts the review back to GitHub as a real PR review with inline comments
- Notifies your team via Slack or Discord webhook
- Exports the full review as a markdown file or shareable badge
How we built it
The stack is entirely TypeScript, built around Next.js 15 with the App Router.
The core review pipeline uses the Vercel AI SDK's streamObject with Gemini 1.5 Flash (free tier) to generate structured JSON that streams into the UI in real time — so comments appear as they're generated rather than after a long wait. The schema is defined with Zod and shared between the server route and the React client hook, which eliminates type mismatches entirely.
Data enrichment happens in a parallel Promise.all across five GitHub API endpoints — the PR diff, CI check runs, linked issue details, contributor history, and a search for similar merged PRs. The OSV.dev vulnerability scan parses package.json or requirements.txt from the diff and batch-queries the open-source advisory database.
The frontend is a Next.js app with a history sidebar persisted in localStorage, real-time severity filters, metric cards, a recharts diff heatmap, and a "Post to GitHub" button that submits the AI review as an actual GitHub review with inline comments on the right lines.
APIs used — all free tier: GitHub REST API, Gemini 1.5 Flash via Google AI Studio, OSV.dev, Slack Incoming Webhooks, Discord Webhooks, Shields.io.
Challenges we ran into
Getting structured streaming to work correctly was the trickiest part. The Vercel AI SDK's streamObject and useObject hook moved significantly between versions — ai/react was removed in v4+ and the schema inference approach changed entirely. We had to pin the right package versions and share the Zod schema between server and client to keep types consistent.
Staying within token budgets while feeding the AI five sources of context simultaneously required careful truncation logic — the diff alone can be hundreds of kilobytes on large PRs, so we slice it intelligently while preserving the most changed sections.
The OSV vulnerability scanner needed careful handling of different package file formats across ecosystems (npm, PyPI) and rate-limiting the batch queries gracefully.
Posting inline comments back to GitHub via the Reviews API requires exact line numbers that match the diff position — computing those correctly from the AI-generated line references took several iterations.
Accomplishments that we're proud of
The end-to-end pipeline — from pasting a URL to seeing a structured review with severity-tagged inline comments posted directly back to GitHub — works in under 15 seconds on average, including all five parallel data fetches.
The AI prompt is context-aware in ways most review tools aren't: it knows if CI is failing, it knows if this is a first-time contributor (and adjusts its tone accordingly), it cross-references the linked issue to check if the fix actually addresses the root cause, and it flags vulnerable dependencies by name.
Building the entire thing solo over a weekend while learning the Vercel AI SDK, structured streaming, and the GitHub Reviews API simultaneously was genuinely challenging — and it all works.
What we learned
Structured output streaming is a fundamentally better pattern than asking an LLM to return JSON — the schema acts as a contract between the model and the UI, and partial results streaming in real time makes the product feel dramatically more alive than a spinner followed by a wall of text.
Multi-source context injection dramatically improves AI review quality. A model that only sees the diff gives generic advice. A model that also sees failing CI runs, the issue the PR claims to fix, and the vulnerability scan gives advice that's actually actionable.
The Zod schema isn't just for validation — sharing it between the AI route and the React hook is what makes TypeScript end-to-end type safety possible in a streaming AI app without any manual type juggling.
What's next for DiffWatch
- GitHub App installation so teams can get DiffWatch reviews automatically on every PR without pasting a URL
- Persistent review history in a database (Postgres via Neon or Supabase, both free tier) instead of localStorage
- Review diff between two versions — re-run after a push and highlight what changed since the last review
- Support for GitLab and Bitbucket PR URLs
- Custom review rules per repository — teams can define their own coding standards that the agent enforces on every PR
- A weekly digest: every Monday, summarize all PRs merged that week, common issues flagged, and team-level patterns
