Analyze code changes. Detect engineering risks. Improve software before it reaches production.
PRISM is an open-source developer tool designed to analyze GitHub pull requests and provide actionable engineering feedback.
Instead of treating code review as a simple pass/fail process, PRISM evaluates changes across multiple dimensions:
- 🧹 Code quality
- 🔐 Security
- 🧪 Testing
- ⚡ Complexity
- 🏗️ Maintainability
- 📊 Engineering risk
The long-term goal is to help developers identify problems before they reach production.
PRISM is currently under active development. Features marked as planned are not yet available.
Modern development teams move quickly, but fast development can introduce:
- hidden bugs
- weak error handling
- missing tests
- security risks
- unnecessary complexity
- duplicated logic
- maintainability problems
Traditional linters are useful, but they often focus on isolated rules.
PRISM aims to provide a broader engineering view of a pull request.
PRISM analyzes a pull request and converts its findings into an understandable engineering report.
GitHub Pull Request
│
▼
Change Detection
│
▼
┌───────────────────┐
│ PRISM Engine │
├───────────────────┤
│ Code Quality │
│ Security │
│ Testing │
│ Complexity │
│ Maintainability │
└───────────────────┘
│
▼
Risk & Quality Score
│
▼
Actionable Report
In development
- Repository analysis
- Changed-file detection
- Code quality analysis
- Basic security checks
- Complexity analysis
- Test-related checks
- Engineering score
- Structured analysis report
- Unit tests
- CI pipeline
Planned
- GitHub App
- GitHub API integration
- Pull request webhooks
- Automatic PR analysis
- PR review comments
- Repository configuration
Planned
- AI-assisted reasoning
- Repository context
- Intelligent recommendations
- Finding prioritization
- Explainable analysis
- Historical quality tracking
Planned
- Web dashboard
- Docker deployment
- Production monitoring
- Sentry integration
- CI/CD quality gates
- Public project analytics
The project is designed around a modular analysis pipeline.
Repository
│
▼
Discovery
│
▼
File Analysis
│
├── Code Quality
├── Security
├── Testing
└── Complexity
│
▼
Finding Aggregation
│
▼
Risk Scoring
│
▼
Report Generation
The architecture is intentionally modular so additional analyzers can be introduced without rewriting the entire system.
| Layer | Technology |
|---|---|
| Frontend | Next.js |
| Language | TypeScript |
| AI / Analysis Services | Python |
| API | FastAPI |
| Database | PostgreSQL / Supabase |
| GitHub Integration | GitHub API |
| Testing | Vitest / Pytest |
| CI/CD | GitHub Actions |
| Monitoring | Sentry |
| Deployment | Docker |
The stack may evolve during development as engineering requirements become clearer.
A future PRISM report may look like:
PRISM ANALYSIS
──────────────────────────────
Overall Score 84 / 100
Code Quality 88
Security 91
Testing 72
Complexity 81
Maintainability 86
Findings
──────────────────────────────
⚠ Medium
Missing test coverage for payment failure path.
⚠ Medium
Function complexity exceeds configured threshold.
ℹ Low
Error response could provide more structured information.
Recommended Actions
──────────────────────────────
1. Add failure-path tests.
2. Simplify the complex function.
3. Standardize API error handling.
Example output only. Scores shown above are illustrative and are not generated by the current implementation.
PRISM follows several principles:
Every finding should be connected to observable code or repository information.
Where a reliable static rule can identify an issue, PRISM should prefer deterministic analysis over unnecessary AI calls.
AI should help explain, prioritize, and reason about findings — not blindly replace deterministic checks.
A finding should ideally explain:
- What was detected
- Why it matters
- Where it occurs
- How it can be improved
PRISM is an engineering assistant, not an authority.
Developers should verify important findings before making production changes.
Security is a core design goal.
PRISM should:
- avoid exposing repository secrets
- never log API keys
- validate external input
- apply least-privilege GitHub permissions
- avoid executing untrusted repository code by default
- document security-sensitive behavior
See SECURITY.md for the security policy.
Testing is part of the project architecture rather than an afterthought.
Planned testing layers:
Unit Tests
↓
Integration Tests
↓
GitHub API Tests
↓
End-to-End Tests
Every major analyzer should have automated tests covering both valid and problematic inputs.
PRISM will track measurable engineering metrics as the project develops.
Examples:
- test coverage
- analysis duration
- analyzer reliability
- false-positive rate
- API response time
- CI success rate
Metrics will only be published when they are measured from actual project runs.
- Repository initialization
- Analyzer architecture
- Basic quality rules
- Test framework
- CI
- Security checks
- Complexity checks
- Test analysis
- Scoring engine
- Report generation
- GitHub App
- Webhooks
- Pull request analysis
- Review comments
- AI reasoning
- Repository context
- Recommendations
- Historical analysis
- Dashboard
- Monitoring
- Docker
- Documentation
- Open-source contribution workflow
Contributions are welcome.
Before submitting a pull request:
- Read the contribution guidelines.
- Create a focused branch.
- Add or update tests.
- Run the project's checks locally.
- Explain the reason for the change.
- Keep pull requests focused.
See CONTRIBUTING.md.
Documentation will be expanded as the project develops.
Planned documentation:
- Architecture
- API
- Analyzer rules
- Scoring system
- GitHub App setup
- Security model
- Development guide
- Deployment guide
This project is licensed under the MIT License.
See LICENSE for details.
PRISM aims to become an open-source engineering intelligence layer for GitHub workflows.
The vision is simple:
Make software quality visible before software reaches production.
ai
artificial-intelligence
code-review
github-app
github-api
pull-request
developer-tools
code-quality
static-analysis
security
devsecops
software-engineering
typescript
python
fastapi
nextjs
open-source
Om Harde
Building PRISM as an open-source project focused on AI-assisted software engineering, developer tooling, and production-quality development.
⭐ If PRISM becomes useful to you, consider starring the repository and contributing ideas, issues, or improvements.