A review gate for agent-speed development
AI review that can
block a merge.
Postil reviews every non-draft pull request in repositories you enable as a real CI check. It comments only when a finding could change the merge decision, and it stays silent on clean PRs.
Apache-2.0 CLI · free on public repos · no self-host license cost
01 — The noise problem
Review noise makes trust harder.
36%
of comments in an independent 28-PR audit of the category leader were noise or nitpicking: 15% rated useless, another 21% pure style nits.
30%
of Greptile's comments were addressed by developers before it retuned its defaults, according to Greptile's published numbers.
571
agent-driven pull requests one developer publicly documented pushing in 30 days. At that volume, every unnecessary comment is multiplied by hundreds.
A Postil finding ships only when it cites a diff location, clears a confidence threshold, and could change the merge decision. Everything below that bar stays silent, and the silence rate itself is measured and published on every dashboard.
Sources: the 28-PR audit is LycheeOrg's public review of CodeRabbit; the 30% comments-addressed figure is from Greptile's v4 release notes; the 571-PR month is publicly documented. See the sourced breakdown on Why Postil.
02 — The gate
Two check-runs: one blocks, one advises.
postil/gate
Fails only on gate-level findings (default: severity error). Require it in branch protection and nothing below the threshold can block a merge. Fails closed on operational errors by default: the gate never marks an unreviewed head as passing. Repos can opt into gate.onError: advisory to fail open on provider outages only.
postil/review
Advisory findings as inline comments in a single batched review: warnings, escalations to accountable humans, guardrail candidates. Informative, never required.
clean PR
Both checks complete green. No comment, no summary, no LGTM filler. The check-run is the entire conversation.
A neutral grey check reads as not-failed, and critical findings merge right past it. Postil's gate is a real CI check with real semantics: it fails on what matters and passes on what doesn't, separately from advisory commentary.
None of the reviewers on our comparison pages ships this exact separation; teams otherwise rebuild it from raw check statuses.
03 — On the pull request
What the two checks look like on a failing PR.
Close TOCTOU races in review completion and org creation
fix/review-watchdog-race-and-org-integrity → main · 10 files, +1,438 −49
Some checks were not successful
- postil/gateFailing1 gate-level finding (severity error)
- postil/reviewCompleted1 error annotation
Add deduplication before unique index migrationconfidence 0.85 · kind: riskThe new `CREATE UNIQUE INDEX` on `organizations.github_org_id` will fail if the database already contains duplicate non-null values. The PR description explicitly states that concurrent installation webhooks could have created duplicate organization rows for the same GitHub org before this fix. Run `SELECT github_org_id, COUNT(*) FROM organizations WHERE github_org_id IS NOT NULL GROUP BY github_org_id HAVING COUNT(*) > 1;` against the production database; if any rows are returned, merge the duplicates and update referencing foreign keys before this migration is applied.
On GitHub, Postil shows up as exactly two check-runs plus, when warranted, batched inline comments. The gate fails on a finding it can stand behind (here a missing idempotency key on a refund path) while advisory commentary stays out of the blocking lane.
- →Every finding cites a file and line, and carries a confidence score you can threshold on.
- →Require
postil/gatein branch protection to make the verdict binding. - →A clean PR shows two green checks and no comments at all.
04 — One engine everywhere
The same binary runs locally, in CI, and behind the hosted app.
repository postil-dev/postil
pull request #275
commit 4d08309409e3
changes 10 files, 1,438 added lines
model moonshotai/kimi-k2.6
error drizzle/0001_org_indexes_and_constraints.sql:3
Add deduplication before unique index migration
1 finding
gate: failing (failOn: error)postil review works on your staged changes, against any base ref, on a saved diff, or on a remote PR. The GitHub Action and the hosted worker shell out to the same pinned binary, so there is no second review engine to drift.
- →Exit codes carry the verdict: 0 clean, 1 gate-failing, 2 operational error.
- →
--output-jsonemits the full envelope for tooling. - →Fails closed: ungrounded model output becomes a synthetic error finding, never a silent pass.
05 — Provable restraint
We measure how often we say nothing.
Silence rate
n = 126y: findings shipped · x: finding confidence
finding confidence
57 shipped findings across 126 recently merged public pull requests, June 2026 — 23 at 0.6–0.8 confidence, 34 at 0.8–1.0. None below 0.6.
Every Postil dashboard leads with the silence rate: the share of pull requests where we had nothing merge-relevant to say and said nothing. Next to it, the confidence distribution of every finding we did ship.
GitHub published a one-off category figure: Copilot code review stayed silent on roughly 29% of reviews. Postil makes this an ongoing per-organization dashboard metric.
06 — Known limits
What Postil cannot do.
It reasons about your diff, not your repository.
The CLI reviews the changed lines and the context around them, not a full checkout, your test suite, or runtime behavior. A bug that only manifests three call sites away, outside the diff, can be missed.
It does not execute code.
Findings come from reading the diff; nothing is compiled or run. Pair the gate with your test suite and type checker: it is a review layer on top of them, and it replaces neither.
An LLM can be talked into a plausible clean review.
A sufficiently convincing diff, or a PR description written to steer the model, can produce a false pass. Confidence thresholds and the gate/advisory split reduce how often that matters, but they do not make the model unpersuadable. This limit belongs to the model family and applies to every LLM reviewer.
Ungrounded findings fail closed.
Every finding must ground to a real diff location or it is dropped before you see it. Findings about the PR title or description, which have no diff line of their own, ground against a reserved synthetic anchor, and a run whose findings were all dropped fails closed rather than reading as a silent pass.
07 — Pricing
Pricing follows active private-PR authors.
Free
Public-repository App reviews are free with your model provider. The local CLI is Apache-2.0.
BYOK $6 / author / mo
Use your provider and models. Provider usage is billed directly to you.
Hosted $15 / author / mo
Start with 30 days free and no card. Review volume is not a billing unit.
Self-hosted
Apache-2.0 with no seat fees or license cost. One Compose file, with named-field configuration errors at startup.
An active author is a person, bot, or service identity whose private pull request Postil reviews that month. Repositories are not billed.
Put a real gate on your next PR.
Install the GitHub App with your model provider, or run the CLI on your next diff. If we have nothing to say, you will hear nothing.