GitHub AppInstall in 30 seconds · Free for open source

Every PR tells youwhat breaks.

Arbor builds your call graph and tells you exactly which symbols break, which production paths are at risk, and what to test — posted directly on every PR. Graph-native. Deterministic. Never wrong.

Install on GitHub — Free See how it works

—★ stars

14languages

<30sper PR

100%deterministic

graph-nativeanalysis

scroll

▲process_payment — HIGH — 8 callers — 2 production entry points reached·▲validate_token — HIGH — centrality 94% — affects POST /api/auth·▲DatabasePool.query — HIGH — centrality 89% — 22 callers in blast radius·◆UserService.create — MEDIUM — 3 direct callers — POST /users reached·●formatCurrency — LOW — 0 upstream callers — isolated utility·—Graph-native · Zero false positives · 14 languages · Sub-30s per PR·▲process_payment — HIGH — 8 callers — 2 production entry points reached·▲validate_token — HIGH — centrality 94% — affects POST /api/auth·▲DatabasePool.query — HIGH — centrality 89% — 22 callers in blast radius·◆UserService.create — MEDIUM — 3 direct callers — POST /users reached·●formatCurrency — LOW — 0 upstream callers — isolated utility·—Graph-native · Zero false positives · 14 languages · Sub-30s per PR·

How it works

Three steps. Zero config.

From install to your first blast-radius report in under a minute.

Install in 30 seconds

Click Install on GitHub and select your repositories. Arbor immediately starts monitoring new PRs. Zero configuration required.

Works with public and private repos

Graph built automatically

Every PR triggers a shallow clone and full parse using Tree-sitter. Arbor builds a live dependency graph with cross-file edge resolution in under 30 seconds.

Rust · TypeScript · Python · Go · Java · C/C++ · C# · Dart · and more

Blast radius in your PR

A structured Markdown report appears in your PR: every changed file ranked by risk, high-centrality symbols called out, and the exact production entry points — HTTP handlers, jobs, CLI commands — that can reach your changed code.

Entry points named explicitly · High-centrality nodes flagged · Sorted by blast radius

Live preview

This is what lands in your PR.

Structured. Sorted by risk. Posted automatically on every commit.

arbor-cloudbot commented just now

👍🚀👀❤️

Why Arbor

LLMs guess. Arbor knows.

Every other tool uses an LLM to approximate blast radius. Arbor uses the actual dependency graph — which means the answer is provably correct.

CapabilityArborLLM tools

Can it tell you which functions call what you changed?

Arbor traces the actual call graph. LLM tools guess based on embeddings.

Zero false positives on blast radius?

Deterministic graph traversal is provably correct. LLMs can hallucinate callers that don't exist.

Works without sending your code to an AI model?

Pure static analysis. No LLM in the impact path — just Tree-sitter + graph math.

Names the exact production entry points affected?

Arbor walks the call graph upstream to find HTTP handlers, jobs, and CLI commands that can reach your changed code. LLMs can only guess.

Tells you what to do before merging?

Arbor generates specific actions: which entry points to manually verify, which callers to check, which tests to write.

Works on a 500k-line codebase?

Arbor's graph scales linearly. LLM context windows hit limits on large repos.

Compared against CodeRabbit, Greptile, and similar LLM-based PR review tools.

Features

What makes Arbor different

SonarQube finds bugs. Snyk finds CVEs. Arbor tells you what breaks.

Core Engine

Graph-native analysis

Arbor builds a real dependency graph via Tree-sitter AST parsing — function calls, imports, class hierarchies. Not pattern matching.

Impact

Production path analysis

Every report shows exactly which HTTP handlers, jobs, and CLI commands are reachable from the changed code — not just caller counts, but named entry points.

Coverage

14 languages

Rust, TypeScript, JavaScript, Python, Go, Java, C, C++, C#, Dart, Kotlin, Swift, Ruby, PHP. Same deterministic graph engine for all of them.

Transparency

Confidence explanations

Every report includes a confidence level and plain-English reasoning — so you always know when to trust the analysis and when the graph may be incomplete.

Deterministic

Zero hallucinations

No LLM in the risk path. The graph tells you exactly what has edges to the changed code — nothing more, nothing less. Fully deterministic.

Dashboard

Dashboard & history

Every analysis is saved. Track architectural health over time, spot high-risk patterns, and see which PRs are consistently dangerous.

Graph-native analysis · Zero hallucinations · 14 languages · Production path analysis · Tree-sitter AST · Deterministic · Zero config · Open source engine · Test-aware PageRank · Sub-30s analysis · Named entry points · No AI in the risk path · Graph-native analysis · Zero hallucinations · 14 languages · Production path analysis · Tree-sitter AST · Deterministic · Zero config · Open source engine · Test-aware PageRank · Sub-30s analysis · Named entry points · No AI in the risk path · Graph-native analysis · Zero hallucinations · 14 languages · Production path analysis · Tree-sitter AST · Deterministic · Zero config · Open source engine · Test-aware PageRank · Sub-30s analysis · Named entry points · No AI in the risk path ·

Pricing

Simple, honest pricing

Start free. Upgrade when your team needs more.

Free

$0forever

For open source projects and solo devs.

1 repository
Unlimited PR analyses
Public repos only
PR comment reports
7-day history
Community support
—Private repos
—Dashboard access
—Team seats

Know when we ship.

We email you when we release major features. No spam. Unsubscribe any time.