Code review is the bottleneck nobody talks about. PRs sit for hours waiting for a human to say “LGTM.” Most are dependency updates, typo fixes, or small refactors — low risk, high friction. You need AI code review automation that actually works.
Paid tools like CodeRabbit and DeepSource charge $20-50 per user per month. But you don’t need them. You can build your own AI code review automation bot in 30 minutes with Vercel Eve and Claude Code. This AI code review automation approach changes everything.
Code Review Is the Bottleneck Nobody Talks About
Most PRs Are Low-Risk — Why Wait for Human Review?
Intercom proved this at scale: their AI-reviewed PRs move 5x faster and have lower revert rates than human-reviewed ones. The AI isn’t just faster — it’s more consistent. This is what AI code review automation can do for your team.
Paid SaaS Tools Cost $20-50/user/month
CodeRabbit: $24/user/month. DeepSource: custom pricing. For a 10-person team, that’s $2,400-6,000 a year. For what? Reading diffs and saying “looks good.”
Meet Merge Mommy: The Bot That Reviews PRs While You Sleep
What It Does
Claire Vo (ChatPRD) built “Merge Mommy” in one Codex session using Vercel Eve. Here’s the workflow:
- PR opens → CI checks run
- Bot waits for checks to pass
- Grades PR on 6 risk dimensions
- Below 24 points → Auto-approves with gray check
- 24-64 points → Posts review, pings Slack with “needs human eyes”
- Above 64 points → Blocks auto-review, escalates immediately
It doesn’t auto-merge. It posts a gray checkmark and sends a Slack message: “Risk score: 18. Low risk. Ready to approve and merge.” Human still clicks the button. Accountability preserved. This AI code review automation approach saves hours every week.
The Risk Model That Makes Auto-Approval Safe
| Dimension | Weight | Scoring Logic | Max Points |
|---|---|---|---|
| Change Size | 1x | Lines changed × 0.1 + Files touched × 2 | 20 |
| Blast Radius | 5x | Services/components affected × 5 | 20 |
| Reversibility | 1x | 20 – (migration? 10 : 0) – (database? 5 : 0) | 20 |
| Data & Security | 1x | PII? 15 : Secrets? 10 : Auth changes? 8 : 0 | 20 |
| Operational Impact | 1x | Downtime risk × 10 | 20 |
| CI Status | 1x | All passing? 0 : 20 | 20 |
Thresholds
- Low Risk (< 24): Auto-approve. Typical: typo fixes, dependency bumps, test additions, documentation updates.
- Medium Risk (24-64): Human review with context. Typical: feature changes, refactors, config changes.
- High Risk (> 64): Block auto-review. Typical: database migrations, auth changes, security patches, large refactors.
The exact numbers matter less than turning a vague judgment call into a repeatable system.
Why Vercel Eve? (Not Zapier, Not LangChain)
Markdown Instructions + TypeScript Skills
Eve is “Like Next.js for web apps, but for agents.” You write:
- Instructions (Markdown): What the agent does, when, how it decides
- Skills (TypeScript): Reusable capabilities — GitHub API, Slack API, etc.
Handles OAuth, Webhooks, Scheduling Automatically
Creating a GitHub App + Slack bot manually = hours of clicking scopes, managing tokens, configuring webhooks. Eve handles the plumbing. You write the logic. This is why AI code review automation with Eve is faster than building from scratch. See the Vercel Eve docs for details.
Durable by Default
Agents persist. They survive restarts. They retry failed tool calls. They maintain state. No infrastructure babysitting.
Step-by-Step: Build Your PR Review Bot
Prerequisites
- GitHub repo with CI checks configured
- Slack workspace (for notifications)
- Vercel account (free tier works)
- Claude Code access (for building)
1. Initialize Eve Project
npx create-eve@latest my-pr-bot
cd my-pr-bot2. Write Instructions.md (Risk Model)
# PR Review Agent Instructions
Trigger
On pull_request.checks_completed event
Risk Scoring
Score each dimension 0-20. Sum = total risk score.
Dimensions
- Change Size: Lines × 0.1 + Files × 2
- Blast Radius: Services affected × 5
- Reversibility: 20 - (migration? 10) - (database? 5)
- Data/Security: PII=15, Secrets=10, Auth=8, else 0
- Operational Impact: Downtime risk × 10
- CI Status: All pass=0, else 20
Thresholds
- < 24: Auto-approve (post gray check + Slack)
- 24-64: Post review + Slack "needs human review"
- > 64: Post "blocked from auto-review" + Slack alert
Output Format
Slack: "Risk score: {score}. {Low/Medium/High} risk. {Action}"
GitHub: Review comment with breakdownThis is the core of your AI code review automation — the risk model that makes it safe.
3. Write GitHub Skill (skills/github.ts)
import { Octokit } from "@octokit/rest";
export async function getPR(owner: string, repo: string, prNumber: number) {
const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
return octokit.pulls.get({ owner, repo, pull_number: prNumber });
}
export async function postReview(owner: string, repo: string, prNumber: number, body: string, event: "APPROVE" | "COMMENT" | "REQUEST_CHANGES") {
const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
return octokit.pulls.createReview({ owner, repo, pull_number: prNumber, body, event });
}
4. Write Slack Skill (skills/slack.ts)
import { WebClient } from "@slack/web-api";
export async function notifySlack(channel: string, text: string, blocks?: any[]) {
const slack = new WebClient(process.env.SLACK_BOT_TOKEN);
return slack.chat.postMessage({ channel, text, blocks });
}
5. Configure Trigger (eve.config.ts)
export default {
triggers: [
{
type: "github",
event: "pull_request.checks_completed",
handler: "reviewPR"
}
]
};6. Deploy and Test
eve deployEve handles GitHub App creation, OAuth, webhook registration, Slack bot setup. You click “authorize” and done.
Open a test PR. Watch the bot work.
Operational Design: Don’t Auto-Merge — Notify Instead
Gray Check + Slack Message = Human Accountability
Merge Mommy doesn’t merge. It posts a gray checkmark (GitHub’s “approved but not merged” state) and sends Slack: “Risk score: 18. Low risk. Ready to approve and merge.”
Human still clicks “Merge.” The bot did the reading. The human owns the decision.
Log Every Decision for SOC 2 / Audit Trail
Every review, every score, every decision — logged. Intercom does this: engineers grade AI reviews weekly. Same discipline as customer-facing AI.
Evals: Keep Your Bot Honest
Intercom’s Approach: Engineers Grade AI Reviews Weekly
They log every PR the bot reviews. An engineer checks: was the score right? Was the recommendation correct? Regression protection for internal agents.
Build Your Own Eval Loop
- Bot reviews PR → logs score + reasoning + decision
- Weekly: Sample 10 PRs, human grades them
- If accuracy drops below threshold → adjust risk model
- Repeat
The Verdict: 30 Minutes to Save Hours Every Week
Stop paying for code review SaaS. Build your own AI code review automation in 30 minutes. The risk model is the secret sauce — everything else is plumbing that Eve handles.
Your team ships faster. Your seniors review less noise. Your juniors get faster feedback. And you own the whole thing.
—
Related: How to build safe and trustworthy AI agents with Zapier | AI agents are everywhere, but nobody uses them | Best AI models for Zapier automation | How to connect AI agents to your apps for free
