Skip to content
MergeHarbor
Log inStart free

Configure

Configure reviews

Control when MergeHarbor reviews, what it comments on, how strict it is, and how results gate merges — for the organization, per repository, and in .mergeharbor.yml.

How settings combine

Settings are layered. Each layer overrides only the fields it sets:

  1. Defaults provided by MergeHarbor.
  2. Organization settings — console, Settings → Code review.
  3. Repository overrides — console, Repositories → a repository → Settings.
  4. .mergeharbor.yml in the repository, read from the pull request’s merge base.

Because the file is read from the merge base, a pull request cannot change how it is reviewed; edits take effect after they merge. The console’s Effective settings view shows each value and where it came from.

Problems in .mergeharbor.yml never block a review. Invalid keys or values are ignored and listed at the end of the review summary.

.mergeharbor.yml reference

version: 1
review:
  # When automatic reviews run: never | opened | pushes | all
  #   opened - pull request opened, reopened, or marked ready for review
  #   pushes - opened, plus every new commit
  #   all    - pushes, plus title, description, and label edits
  trigger: all
  review_drafts: false

  # Review only pull requests that match ALL conditions of ANY rule.
  # field: author | label | base_branch | head_branch | path | title
  # op: include | exclude. Branch and path values are globs.
  filters:
    - conditions:
        - { field: author, op: exclude, values: ["dependabot[bot]", "renovate[bot]"] }
        - { field: path, op: exclude, values: ["docs/**", "*.md"] }

  depth: standard # quick | standard | deep
  strictness: medium # low | medium | high
  instructions: |
    Every database query must filter by org_id.
  categories: [correctness, security, concurrency, performance, error_handling, api_contract, data_integrity, maintainability, testing] # add style to receive style comments
  min_severity: minor # critical | major | minor | nit
  max_comments: 25 # inline comments; additional findings go to the summary
  ignore_paths: ["gen/**", "**/*.pb.go"]
  verify_findings: true # a second pass that tries to disprove each finding

  summary:
    include_summary: true
    include_confidence: true
    include_findings: true
    include_sequence_diagram: false
    collapsible: true
    update_description: false

  comments:
    header: ""
    include_fix_prompt: true # a collapsed prompt for coding agents
  coding_agents: [claude_code, cursor]

  status_check:
    enabled: true
    min_confidence_to_pass: 0 # fail when the score is below this value (0 disables)
    fail_on_severity: null # critical | major
    post_error_comments: true

  auto_approve:
    enabled: false # approve pull requests that score 5 with nothing above a nit

Keys can also be written at the top level, without review:.

Other files MergeHarbor reads

CLAUDE.md, AGENTS.md, .cursorrules, .github/copilot-instructions.md, and .cursor/rules/* are read from the merge base and treated as team guidance.

Commands in pull requests

Comment Effect
@mergeharbor review Review the pull request again at its current head
@mergeharbor remember <rule> Add a rule for this repository (see Rules and learning)