Deterministic code audits · No LLM
Know what needs fixing before you ship.
MergeSafe checks your code with predefined rules, without a language model. Get a clear verdict and a prioritized fix plan across eight audit dimensions.
Free during early access. No credit card required.
Also works inside Claude Code and Cursor. Explore AI tools · MCPRelease verdict
Don't ship yet
6.8/ 10
Overall score
Two security gaps need fixing before launch. Start with the blockers below.
Fix first
- 1Remove the exposed API keyCritical
- 2Protect the admin routeCritical
Each finding includes a ready-to-use fix prompt.
No LLM
used in the audit
8
audit dimensions
20+
languages analyzed
Plain English
verdicts, zero jargon
How the audit earns your trust
Clear rules. Traceable findings.
Deterministic means the same analysis logic applies on every run. Checks and scoring rules determine the verdict. No language model makes that decision.
Defined checks
Static analyzers such as Semgrep and Trivy check your code against explicit rules and known vulnerabilities. Findings point to what triggered the check.
Calculated scores
Your score and priorities follow defined rules and weights. The report explains what was found, why it matters and what to do next.
No LLM in the audit
The analysis, explanations and fix prompts use rules and templates. MergeSafe does not send your source code to an AI model to produce the audit.
How it works
From codebase to a clear next step
- 01
Upload your code
Drop your ZIP or connect your repository.
- 02
Review the verdict
See the findings across eight audit dimensions.
- 03
Work through the fixes
Follow the priorities and copy the fix prompts.
Product tour
See exactly what you're shipping.
This is what MergeSafe looks like in use — no signup needed to peek.
The verdict
A verdict, not a wall of warnings.
Every analysis ends with one clear call: Ready to ship, Ship carefully, or Don't ship. Blockers are counted, explained, and separated from nice-to-haves — so you know exactly where you stand.
Release verdict with blocker count and overall score.
Don't ship yet
Two security gaps need fixing before launch — an exposed API key and an unprotected admin route. Everything else is in good shape.
Plain-language findings
Every finding comes with the fix.
No jargon, no CVE soup. Each finding explains what's wrong, what it means for your business, and what the fix will actually do — then hands you a ready-made prompt. Copy it, paste it into Cursor or Claude, done.
One click copies a fix prompt written for your AI assistant.
Your admin API is open to anyone
Anyone who finds the URL can read — and delete — your users' data. No login is required.
The fix: adds a login check to this route — real users won't notice a thing.
Nothing protects your payment flow
There are no tests around checkout — a future change could break it without anyone noticing.
Show all 23 findings
Full audit, fast
Eight dimensions in one pass.
Security, quality, performance, dependencies, architecture, testing, documentation, and scalability — scanned in one go. Most projects take about a minute; large codebases a couple more. Re-run after every fix and watch your score climb.
Live analysis progress, then a score history across runs.
Analyzing my-saas-project.zip…
my-saas-project
6.1 → 8.6
+2.5 across 4 runs
MCP integration
Or never leave your editor.
MergeSafe plugs into Cursor and Claude Code through MCP. Ask “is this safe to ship?” mid-session and get the full audit back where you're already working.
The MergeSafe MCP tool, called straight from your AI editor.
Don't ship yet — 6.8/10, 2 blockers found.
An exposed API key and an unprotected admin route. Both are quick fixes — want the prompts?
Fix prompts
An audit that ends with a library of fixes.
Every finding ships with a ready-made prompt for Cursor, Claude Code or Lovable. You don't write the fix — you copy it.
Written like a spec, not a hint
Every prompt states the task, the constraints (“don’t touch anything else”), and how to verify the fix worked — so your AI assistant can’t wander off and break something unrelated.
Adapted to your stack
The same finding gets a different prompt for a Python API than for a Next.js app — down to the starter files it tells your AI to create.
One paste fixes them all
The same issue in 12 places? You get one prompt that lists every location. Copy every prompt for a file in one click, paste once, done.
Secret written in the code
Paste this into Cursor, Claude Code or Lovable — your AI assistant makes the change, then tells you what it did.
AI tools · MCP
Build with AI. Review your code in the same conversation.
Connect MergeSafe to Claude Code, Cursor or your preferred AI tool. Ask it to audit a GitHub repository, explain the findings and help you fix what matters.
MergeSafe runs the same deterministic checks. Your assistant receives the findings and fix prompts to help you act on them.
Don't ship yet — 6.8/10, 2 blockers found.
An exposed API key and an unprotected admin route. Both are quick fixes — want the prompts?
Guided setup for your AI tool
Choose your tool and follow its connection steps. MCP lets your AI assistant use MergeSafe to review your code.
Audit without leaving the chat
Share a GitHub repository URL and ask for an audit. Get a clear verdict, the blockers and fix prompts in the conversation.
Triage from where you work
False alarm? Dismiss it from the chat and your score recomputes instantly. Confirm real issues so they stay blockers until fixed.
Choose your tool. Follow the setup. Run your first audit.
Your reports stay available in your MergeSafe workspace.
What we check
Eight dimensions. One verdict.
A complete view of your codebase health — in plain language.
Security
Exposed secrets, SQL injections, missing auth checks — one gap can expose all your users' data.
Code Quality
Complexity, duplication, naming — the messier the code, the more bugs slip through unnoticed.
Performance
N+1 queries and blocking calls — what runs fine for 10 users can collapse at 10,000.
Dependencies
Known CVEs and risky licenses — you inherit every bug in every package you import.
Architecture
Circular imports and hidden coupling — poor structure means one change breaks ten other things.
Testing
Coverage and test quality — without tests, every new feature risks silently breaking existing ones.
Documentation
README, docstrings, API docs — undocumented code is impossible to hand over or debug months later.
Scalability
In-memory sessions, local files, SQLite in prod — things that work on your laptop and break with real traffic.
Built for the AI coding stack
Native MCP integration with Cursor & Claude. Works with any codebase — including Lovable-generated projects.
The problem
You built it in a weekend. Do you know what you shipped?
10,000 lines you've never read
Lovable, Bolt, and Cursor ship features fast — and generate code nobody on your team has actually reviewed.
It works on your machine — that's all you know
The demo runs. But is the auth solid? Are secrets exposed? Will it survive real traffic? A working app is not a safe app.
One exposed key away from a bad launch day
A single hardcoded API key or open admin route can leak your users' data — and vibe-coded apps skip these checks routinely.
MergeSafe reads it so you don't have to.
The numbers
Everyone ships AI code. Almost nobody audits it.
Independent research from the last two years — every source linked.
75%
of new code at Google is now AI-generated — with every line still reviewed and approved by engineers before it ships.
95%
AI-generated: the share of the codebase for a quarter of Y Combinator's Winter 2025 startups.
45%
of AI-generated code samples fail security tests — and two years of newer models haven't moved that number.
+40%
more secret leaks: repositories using an AI coding assistant expose API keys and credentials more often than average.
1 in 10
vibe-coded apps in a 2025 scan exposed user data to anyone on the internet — no password required.
46%
of developers actively distrust the accuracy of AI-generated code — more than the 33% who trust it.
In a Stanford controlled study, developers using an AI assistant wrote less secure code on four of five tasks — and were more confident it was secure.
More code, shipped faster, reviewed less. That's the gap MergeSafe closes.
Trust & data
Your code stays yours.
MergeSafe reads your code the way an auditor reads a document: carefully, once — then hands it back.
Deleted after analysis
Your code is analyzed, then erased — the uploaded copy is removed the moment the audit finishes. We keep your report (scores and findings), never your codebase.
No LLM in the analysis
MergeSafe uses static analyzers and predefined rules. We do not send your source code to an AI model to perform the audit, and we do not use it to train one. Connecting your own AI assistant through MCP is optional.
We can read, never write
The GitHub App only reads the repositories you pick — it has no way to change your code, and you can revoke its access in one click, anytime.
Hosted in the EU
Everything runs on our servers in Stockholm, Sweden (AWS), under EU data-protection law. Delete your account and every audit goes with it — a real delete, with a full JSON export available first.
We're early-stage and would rather be straight with you: no compliance badges yet. Our guarantee is simpler — your code is deleted after every analysis, so there's nothing of yours to breach. Read how we handle your code, or email us directly.
FAQ
Questions founders actually ask
Does MergeSafe use a language model to audit my code?
No. MergeSafe uses static analyzers, predefined checks and scoring rules. Findings, explanations and fix prompts are produced with rules and templates. No LLM decides what is a problem or calculates your score, and your source code is not sent to an AI model to perform the audit.
What does deterministic mean? Can my results change?
Deterministic means checks and scores follow defined rules. Results can change when your code, audit scope, settings, scanner versions or rules change, or when vulnerability databases and external verification results are updated. This makes the basis for an audit explicit; it does not mean an automated audit can find every issue.
How does that work with Claude Code or Cursor?
MCP lets your assistant call MergeSafe's rule-based audit. MergeSafe returns findings and fix prompts to that assistant, which can then help you interpret and resolve them. The audit engine does not use an LLM. Using the web dashboard does not require an AI assistant.
Do you store my code?
No. Your code is analyzed, then deleted — the uploaded archive is removed as soon as the analysis finishes. We store only the audit report (scores and findings) so you can track progress over time, never your source code.
Do I need to know how to code?
No. Verdicts and findings are written in plain English with the business impact spelled out. And every fix comes as a ready-made prompt you paste into your AI assistant — Cursor, Claude, Lovable — which does the actual fixing.
What languages do you support?
20+ languages, including TypeScript, JavaScript, Python, Go, Java, and PHP — and whatever your AI tool exported. If Lovable, Bolt, or Cursor generated it, MergeSafe can audit it.
How do I get my code in?
Three ways: upload a ZIP of your project, connect your GitHub repository, or call MergeSafe directly from Cursor or Claude Code through the MCP integration.
How long does a report take?
It depends on the size of your project: around 30 seconds for a small app, one to two minutes for most projects, a bit longer for very large codebases. All eight dimensions are scanned in a single pass.
Will my code be used to train an AI?
MergeSafe does not use your code to train AI models, and does not send it to a model to run the audit. If you connect an AI assistant through MCP or paste a fix prompt into one, the information you share with that assistant is subject to its provider's data policies.
Can MergeSafe change my code?
No. Access is read-only by design — MergeSafe flags problems and writes the fix prompts; only you (or your AI assistant, on your command) touch the code.
Is it free?
Yes — MergeSafe is 100% free during early access, with no analysis limits and no credit card required.
What happens when early access ends?
Paid plans will arrive as we grow, and we'll announce them clearly before anything changes — no surprise charges, ever. Your reports and history stay yours either way.
Ready to review your code?
Free during early access. No credit card required.