How I Built 'Merge Mommy': My AI Bot for Auto-Reviewing Pull Requests with Vercel Eve

Everybody is drowning in AI-created PRs. If you're an engineering leader or a developer at a company embracing AI, you know this feeling. The promise of AI-assisted coding was to speed everything up, but it often just moves the bottleneck from writing code to reviewing it. When anyone can generate code and open a pull request, you end up with a massive queue waiting for human eyes.

But what if I told you that you don't have to review every single one of those PRs? What if the answer to too much AI code is… more AI? In this episode, I'm showing you exactly how to build your own PR review bot that scores risk, automatically approves the simple stuff, and frees you up to focus on the complex changes that truly need your expertise.

This whole idea was heavily inspired by some brilliant work from our friends at Intercom and the team behind the Rewind bot. They proved that not only can you ship code much faster with AI-approved PRs (Intercom saw a 5x speedup!), but the code can actually be safer and higher quality. They even made it work within strict compliance frameworks like SOC 2, proving that as long as your process is auditable and defensible, you can automate safely. I knew I needed this for our work on ChatPRD, and it turned out to be surprisingly straightforward to build.

Workflow: Building 'Merge Mommy', the AI PR Review Bot

We had a lot of low-risk PRs for ChatPRD, especially documentation updates, that were just sitting in the queue. It was the perfect use case to build an agent, and it gave me a chance to work with a framework I'm really excited about: Vercel's Eve.

The Toolkit: Vercel Eve and OpenAI Codex

I'm a little obsessed with Eve. It has become the simplest way I've found to deploy AI agents that connect to enterprise tools like Slack and GitHub. Why? Because Vercel has solved all the painful parts. An Eve agent is basically just a directory of instructions and skills. Vercel's managed connectors let you hook up your accounts with a simple wizard, handling all the authentication and refresh tokens that are usually a nightmare.

Eve is built on the open-source Vercel AI SDK, which is fantastic for building any kind of chatbot. But bundled into the Eve framework, it makes standing up an internal agent incredibly fast. I used OpenAI Codex to do the actual building, and the combination was perfect.

Step 1: Prompting the Agent into Existence

I didn't start with a complex architectural diagram. I started with a simple, typo-filled prompt in Codex:

I wanna make an internal GitHub bot/app that reviews PRs after all cchecks are green and grades low, medium, high risk and approves the low rish... Approves the low risk PRs automatically.

Then, I just nudged it in the right direction:

We could design it as a Vercel Eve agent if you want.

And that was it. Codex was off to the races, scaffolding the agent structure for me.

Step 2: The Configuration Hack with Chrome Browser Use

One of the most tedious parts of building something like this is setting up the GitHub App and Slack bot. You have to click through endless configuration screens, set permissions, and generate keys. It's a drag.

So, I used one of my favorite tricks: I had Codex's Chrome browser use feature do it for me. I literally told the agent what to do, and watched as it navigated the GitHub and Slack UIs, filled out the forms, and selected the right permissions. I just had to step in for 2FA and to double-check its work. This is a huge time-saver for any project that involves configuring third-party SaaS tools.

Step 3: The Agent's Architecture and Technical Flow

The agent itself is pretty simple. Within the Eve framework, it’s just a few files: instructions, skills, and tools. The instructions are written in plain markdown, which is so easy to work with.

Here's how the technical flow works from start to finish:

1. A developer opens a PR in our GitHub repo.
2. After all the continuous integration (CI) checks pass, a GitHub event is fired.
3. The Vercel GitHub integration detects this event and triggers our Eve agent.
4. Vercel spins up a secure sandbox, checks out the PR's code branch, and inspects the diff.
5. The agent executes its reviewPR skill, which uses tools to read the files and run its risk-scoring logic.
6. Based on the score, the agent posts a comment on the PR, either with an approval or a note that it needs human review.
7. Finally, it sends a notification to our team's Slack channel with the result.

Step 4: Defining the Risk Score

The core of the agent is its ability to score risk. I didn't give it super detailed instructions; Codex came up with a great starting point based on best practices. It looks at six main factors:

• Change Surface & Blast Radius: How many files are changed? How large is the potential impact?
• Reversibility: How easy would it be to roll back this change if something goes wrong? (A big data migration is hard to reverse; a doc change is easy.)
• Data Security: Does this PR touch sensitive data, authentication, or security-critical code?
• Operational Impact: Does it change anything about how we deploy or run our services?
• Verification Gap: Are the tests sufficient for the change? Did all CI checks pass?
• Repo-Specific Logic: It also understands our own rules, like knowing docs changes are low-risk, while changes to authentication or billing are high-risk.

It calculates a score, and anything below 24 points is considered low risk. From 25-64 is medium risk, and 65+ is high risk. Only low-risk PRs get the automatic green light.

Step 5: Putting It All to Work: Merge Mommy in Action

I call our bot "Merge Mommy," because internal tools should be fun! Let's see how she handles a few different PRs.

Low-Risk Auto-Approval

Here’s a simple documentation update. Merge Mommy ran, assessed it was a minor docs change, and gave it a risk score of 7 out of 100. It's low risk, so she automatically approved it.

She then sends a message to our Slack channel telling us the PR has been reviewed and is ready to merge. It’s a clean, automated flow.

Blocked PR

Here's another docs change, but this one has merge conflicts. Merge Mommy correctly identifies that it's low risk (6 out of 100), but she blocks the approval because a PR with conflicts can't be merged. This prevents broken code from moving forward.

Medium-Risk Escalation

This last one was a much bigger PR to deprecate an old API. It involved deleting 35 files. As you can see, Merge Mommy flagged this as medium risk with a score of 45/100. The reason? It was a large change surface and it altered server API behavior. The bot correctly decided this change was too significant to approve automatically and escalated it for human review.

The Final Piece: Human-in-the-Loop and Continuous Improvement

You might notice that Merge Mommy doesn't actually merge the code. She gives an approval, but a human still has to press the final merge button. We designed it this way intentionally. Our repository rules, for SOC 2 compliance, require a final human approval. The bot's checkmark is a strong signal to our team that the PR is safe to merge without a deep review, but the final action remains in human hands. It’s a perfect hybrid approach.

The other critical piece is improvement. Just like you'd use evals to improve a customer-facing AI product, you should do the same for internal agents. Every time Merge Mommy runs, we log the result. An engineer can then quickly check: Did the agent get it right? Was the score appropriate? This feedback loop is essential for tuning the agent and building trust in its decisions over time.

Get Ready to Clear Your PR Queue

Building this agent was something I was honestly intimidated by, but with modern frameworks like Vercel Eve and agentic coding tools like OpenAI Codex, it was surprisingly simple. This is a perfect example of putting AI to work for you, not the other way around. The agent does the tedious review, and then it puts me to work with a simple Slack notification for a final two-click action.

So what do you think? Is this the future of code review, or is it just crazy? I'd love to hear what factors you would put into your own risk-scoring model. Give it a try—you might just find that your PR queue has never been cleaner.

Thank you to our sponsor!

This episode is brought to you by WorkOS. AI has already changed how we work. Tools are helping teams write better code, analyze customer data, and even handle support tickets automatically. But there's a catch. These tools only work well when they have deep access to company systems. Your copilot needs to see your entire code base. Your chatbot needs to search across internal docs. And for enterprise buyers, that raises serious security concerns. That's why these apps face intense IT scrutiny from day one. To pass, they need secure authentication, access controls, audit logs, the whole suite of enterprise features. Building all that from scratch, it's a massive lift. That's where WorkOS comes in. WorkOS gives you drop-in APIs for enterprise features so your app can become enterprise-ready and scale up market faster. Think of it like Stripe for enterprise features. OpenAI, Perplexity, and Cursor are already using WorkOS to move faster and meet enterprise demands. Join them and hundreds of other industry leaders at workos.com. Start building today.