FOR IMMEDIATE RELEASE
OAKLAND, Calif., August 12, 2026 - MergeWatch today announced MergeWatch for Open Source, a free hosted access program that gives qualifying open-source projects access to frontier-model pull request review for cyber defense. MergeWatch said the program is intended to make advanced AI review available to maintainers of public repositories without requiring them to operate their own infrastructure or model-provider accounts.
The announcement comes as software supply-chain security has become a central concern for governments, enterprises, and the open-source community. Security researchers and industry experts have warned that AI coding tools can increase the volume and apparent quality of code changes, including changes that may be incomplete, unsafe, malicious, or difficult for maintainers to evaluate quickly. Open-source projects often sit at the foundation of mission-critical infrastructure, but many are reviewed by small maintainer teams with limited security budgets.
MergeWatch for Open Source is intended to give those maintainers access to stronger review resources. The project uses frontier-model review to examine pull requests, surface potential security and reliability issues, and support existing maintainer workflows. Merge authority, project judgment, and final approval remain with the repository maintainers.
"This is an emergency for the software ecosystem," said Yasha Spong, founder of MergeWatch. "We need to put every possible resource toward protecting the open-source infrastructure that powers our way of life. If frontier models can help generate more code, they also need to be available to help defend the projects that everyone depends on."
The free hosted program is available to real, actively maintained open-source projects on public repositories. Qualifying maintainers receive hosted MergeWatch access, help installing and configuring the GitHub App, an optional lightweight setup call, and a direct line to provide feedback on review behavior.
MergeWatch asks participating maintainers to use the product on real pull requests and provide product feedback. Maintainers may separately approve whether their project is listed publicly as an early open-source user. Public endorsement, quotes, and case studies are not required for participation.
The company says the program may point to a broader model for open-source security: giving maintainers access to advanced review resources before incidents occur, rather than expecting volunteer projects to absorb new AI-driven risk with the same tools and budgets they already have.
MergeWatch supports managed hosted use and free self-hosting under AGPL v3, giving teams a path to run their own infrastructure and model-provider accounts when they need more control. The project is designed around inspectable review behavior, human approval, and deployment flexibility.
For commercial and regulated engineering teams, MergeWatch is focused on controlled AI adoption in software delivery, including private deployment and review workflows that can operate in environments where ordinary cloud AI code-review tools may not be acceptable.
