mergemind

MergeMind is a CI-integrated merge request analyzer aimed at teams that must show audit evidence around code changes. It runs as a GitHub Action or a GitLab CI job, inspects the diff of a pull/merge request, and posts a structured assessment back to the request as a comment or note. ## What it produces For each pull request the tool generates: - a structured PR title and summary - a risk level rating (Low / Medium / High) - a compliance mapping against SOX, SOC2 and ISO 27001 controls (the README example cites SOX CC6.1, SOC2 CC6.1 and ISO 27001 A.9.4 for an authentication change) - control gap analysis - remediation recommendations The README illustrates the difference with a vague "updated some files and fixed bugs" description replaced by a titled summary, a risk level, a control mapping, an identified gap (MFA enforcement not covered by tests) and a suggested action before merging to main. ## How it runs GitHub Actions: you add a workflow that triggers on `pull_request` (opened, synchronize, reopened), checks out with `fetch-depth: 0` so the diff range resolves, and calls `gusinfosec/mergemind@v1`. Required secret is `OPENAI_API_KEY`; a license key secret is optional. The action needs `contents: read` and `pull-requests: write` permissions, and the comment is created on the first push and updated in place afterwards. GitLab CI: the README states the GitLab path is still copy-paste — you copy `examples/gitlab-ci.yml` into your repo (or merge the job), which clones MergeMind into `.mergemind` and runs the analysis there. Required CI/CD variables are `OPENAI_API_KEY` and a `MERGEMIND_GITLAB_TOKEN` personal access token with `api` scope for posting MR notes; `MERGEMIND_GITLAB_HOST` covers self-managed instances and defaults to gitlab.com. The one-line action packaging is GitHub Actions-only. ## Licensing and limits The free tier covers the PR title and summary plus a risk level. Compliance mapping, control gap analysis, remediation recommendations and full-diff analysis without a token limit are listed as license-only features. The license is described as a one-time $29 purchase through Stripe, with a license key stored as a repository/CI secret; the README also claims a free tier that works without the key. Note that the repository badge indicates an MIT license while several core features are gated behind that paid key. ## Security posture as described Processing happens inside your own CI runner, API keys are held as CI secrets, and the README states that no code is stored externally. The diffs are nonetheless sent to the OpenAI API for analysis, which is worth confirming against your own data-handling requirements. ## Practical considerations Before adopting it, budget for an OpenAI API key and per-run model costs, decide whether sending diffs to an external model provider is acceptable for the repositories in scope, and treat the control mappings as reviewer prompts rather than as an audit opinion. The project is published by Cyber Global Technologies LLC with support contact team@mergemind.dev; enterprise inquiries go to info@cyberglobal.ai.