Low-risk changes ship themselves.

Autopilot turns on GitHub auto-merge for the pull requests Koalr scores Low, follows each one through its production deploy, and opens a revert if the deploy breaks. Risky changes go the other way: to the people who know the code.

Start free See the live demo

Off by default · shadow mode first · never above a score of 39

PR #2854 · web/empty-states

Empty-state copy, dashboards

Low

13:58Scored 06auto-merge on
14:06Merged by GitHubCI and review passed
14:11Deployed to production
15:11Watch clear

PR #2860 · billing/proration-rounding

Round proration to the cent

Low

16:21Scored 17auto-merge on
16:34Merged by GitHubCI and review passed
16:40Deployed to production
16:55Watch breachedDatadog 5xx at 3.4× baseline

Revert opened#2861, fifteen minutes after deploy.

Example data.

Watch it in shadow before it touches anything.

In shadow mode Autopilot picks pull requests exactly as it would live and follows them to production, but never acts on GitHub. Your team merges as usual. The Autopilot page shows what it would have shipped, what it held and why, and how each of those deploys went.

Switch to live when the record convinces you. Every settings change is in the audit log with who made it, and so is every action Autopilot takes.

Autopilot · shadowpayments-service

PR	Score	Autopilot	What happened
#2871	04	Would merge	Deployed · clear
#2869	52	Held: score above 20	Deployed · clear
#2868	18	Would merge	Deployed · clear
#2866	14	Held: deploy freeze	Merged after freeze · clear
#2865	11	Held: path on deny list	Deployed · clear

People merged all five. Example data.

The rules it will not bend.

Autopilot works only through the Koalr GitHub App, never a person's token, and only inside these limits.

Never past the Low band: You set the ceiling (20 to start). It can go down, never above 39, the top of the Low band. Only scores computed from every lookup count; a partial score is never picked.; 020 start39 cap100
Your CI decides first: Autopilot uses GitHub’s own auto-merge, and only where the default branch requires a status check that is not Koalr’s, so GitHub still waits for your tests and required reviews. The repository needs “Allow auto-merge” switched on.
A new commit turns it off: A push, a base change, a reopen or a switch to draft turns auto-merge off before anything else happens. Only a fresh low score on the new commit turns it back on.
Some changes always wait for a person: Schema migrations, anything during a deploy-freeze window, any path on your deny list, and (if you choose) changes written with AI tools.
Only your team’s pull requests: Same-repository PRs to the default branch, by people with write access. Never bots, forks, drafts, Koalr’s own branches, or reverts.
Limits you set: Only the repositories you opt in. A daily cap on merges per repository (10 to start). One pause switch stops Autopilot everywhere and turns auto-merge off on every queued PR.

Risky changes go to the people who know the code.

When a pull request scores High or Critical (70 and up), Koalr ranks who should review it and requests the top one to four. It posts a review with notes pinned to the files that drove the score, and, with Slack connected, sends each reviewer a short brief there.

+3: per changed file they own in CODEOWNERS
+2: per recent merged PR they wrote that touched these files
+1: per review they gave on one
−1: per open review on their plate beyond the first three

Recent means the last 180 days. The author, bots and anyone already asked are never suggested. When nobody has history with these files, Koalr asks the most active reviewers of the last 30 days instead.

PR #2851 · auth/session-rotation

Session rotation refactor — 41 files

Critical

@maria-k
owns 4 changed files · wrote 3 recent changes to them
18
4×3 + 3×2
Review requested · Slack brief sent
@d-okafor
reviewed 6 recent changes · wrote 1
8
6×1 + 1×2
Review requested · Slack brief sent
@j-lindqvist
owns 2 changed files · reviewed 2 · 5 open reviews
6
2×3 + 2×1 − 2

Two reviewers requested, the default. Example data.

Every production deploy is watched.

For an hour after each production deploy (the window is yours to change), Koalr checks the service every five minutes. A breach alerts Slack, comments on the pull requests that shipped, fires your Deploy Failed automations, and teaches the risk model that this kind of change failed here.

A revert PR is one click away, or opens on its own if you turn that on. For changes Autopilot merged it opens automatically unless you switch that off. Koalr opens reverts; it never merges one.

What counts as a breach

Incident: A P1 or P2 declared on the service, or an org-wide P1 nobody mapped to a service.
Errors: Three or more new Sentry or Rollbar issues on the service.
Error rate: The Datadog 5xx rate at twice its pre-deploy baseline or more.
Deploy: The deployment reports a failure, or is rolled back.
Investigation: An incident investigation names this deploy as the probable cause.

Incidents come from PagerDuty, Opsgenie, incident.io, Rootly, FireHydrant or Jira Service Management.

The score at every step, from first diff to production.

Before the pull request
Coding agents check their own change through Koalr’s MCP server and get the steps that lower its score, such as which files to split out, before a PR exists.
Agent checks
At review
Approve pull requests scored at or below your ceiling (25 to start) automatically, so a teammate’s review goes to the changes that need one. A push that makes a PR riskier withdraws the approval. Off until you turn it on.
How PRs are scored
At deploy
Add Koalr as a GitHub deployment protection rule and it rejects a deploy when the change it carries scores 85 or more (your threshold), during a freeze window, or while incidents run hot. GitHub offers custom protection rules on public repositories, and on private ones with GitHub Enterprise.
The GitHub App

Autopilot, auto-approve, expert routing and the deployment gate act on the score Koalr posts as a check run, so they come with the Growth plan and above; every paid plan starts with a 14-day trial. The post-deploy watch runs on every plan, Free included. Compare plans

Run it in shadow on your own pull requests.

Connect GitHub, opt in one repository, and read what Autopilot would have shipped. Nothing touches GitHub until you switch it to live.

Start free What Koalr writes to GitHub