PR risk scoring and auto-approval tools compared
Several tools now score how risky a pull request is, and some can approve the low-risk ones. They differ in where the score comes from (an LLM reading the diff, or measurements from git history and the dependency graph), whether they can approve and merge, and whether your code leaves your CI. This page was written by the opendrs maintainers from each project’s public documentation in October 2026. If something here is out of date, please open an issue.
| Tool | How it scores | Auto-approve or merge | Runs where |
|---|---|---|---|
| opendrs | Logistic model over git-history, dependency-graph, size and test signals, calibrated on your repository; optional LLM judge that can only raise the score | Yes: approves green PRs after your AI review passes, then auto-merge or merge queue | Your CI or machine; no service or API key needed |
| Cursor approval agents | Policy rules, ownership and history signals, findings from Cursor’s review agents, and LLM analysis | Approves low-risk PRs and routes the rest to reviewers; does not merge | Cursor’s cloud; team and enterprise plans |
| PR-Agent | An LLM reviews the PR and estimates review effort (1-5) | Optional: approves PRs below an effort threshold, or with no findings (enable_auto_approval) |
GitHub App, Action or CLI; needs an LLM key |
| MergeShield Risk Check | Claude reads the change and scores six dimensions, 0-100 | No: passes or fails a check against a threshold | Calls the MergeShield API; needs an account and API key |
| Merge Steward | Gemini scores six dimensions 0-3, including blast radius | Yes: approves low-risk changes and can request auto-merge | GitHub Action; needs a Gemini API key |
| Blast-Radius | Dependency graph from the TypeScript AST plus an AI summary | No: analysis for reviewers | Hosted web app |
| DRS-OSS | Fine-tuned Llama 3.1 8B classifier over the diff and commit message | Flags risky diffs in CI | Self-hosted model service with a REST API |
| Meta’s Diff Risk Score | Models trained on Meta’s own incidents | Gates code at Meta | Internal to Meta; described in papers, not released |
Choosing
- You want a gate that approves or merges low-risk PRs, and your code must stay in your CI:
opendrs. The score is measured on your own history (
opendrs backtest), a PR cannot change the config it is judged by, and an LLM is optional. - You already use Cursor on a team plan: its approval agents approve low-risk PRs inside Cursor’s cloud. opendrs gives you a score you can backtest and keep in your own CI, and it can merge or queue what it approves.
- You want an LLM’s judgment of each PR as the gate: PR-Agent, Merge Steward or MergeShield Risk Check. They read the change like a reviewer would. opendrs’s optional LLM judge does the same, but it can only raise the score, so a diff that talks the model into “safe” gains nothing.
- You want a picture of what a change touches: Blast-Radius draws the dependency graph.
opendrs explain <file>gives the same facts as text. - You want code review comments: use an AI reviewer such as PR-Agent, CodeRabbit or Claude Code. opendrs is designed to run after one of them and can require that its check passed before it approves anything.