Heimdall

Code Guardian. Heimdall reviews every pull request with skeptical eyes - trust nothing, verify everything. Security scanning, style enforcement, test adequacy analysis, and your team's own engineering standards, all enforced automatically.

What Heimdall Does

Heimdall is an automated PR reviewer that posts a structured review comment on every pull request. It runs 18 analysis layers in parallel - from OWASP security scanning to MCI call-graph analysis to your team's PRINCIPLE and DECISION atoms - and produces a single risk-rated comment with actionable concerns, a test checklist, and governance advisories.

Unlike a linter or SAST tool, Heimdall combines deterministic pattern matching with LLM reasoning. Regex catches the obvious patterns; the LLM eliminates false positives, verifies intent, and assesses whether the test checklist actually covers the changed code paths.

Zero Setup Required

Every capability below works from the first PR with no configuration files, no CI changes, and no tooling installation. Connect the GitHub App, open a PR, and Heimdall comments within seconds.

Optional configuration via .heimdall.yml unlocks additional features (design system enforcement, architecture boundaries, custom blocked patterns) but is never required.

Review Capabilities

Always On (zero config)

Opt-in (via .heimdall.yml)

Risk Levels

Risk escalation is deterministic and post-LLM. The LLM assigns an initial risk, then hard rules override upward: 3+ MCI gaps forces HIGH, any CRITICAL security finding forces HIGH, any style HIGH finding forces HIGH. The LLM cannot downgrade risk set by deterministic rules.

Engineering Standards from Knowledge Graph

Heimdall automatically enforces your team's engineering standards. Create PRINCIPLE and DECISION atoms in your Momental workspace:

// These atoms are free to create (v1 MCP, pure DB operations)
await momental_node_create({
  statement: "All database queries must use Drizzle ORM. No raw SQL except migrations.",
  nodeType: "PRINCIPLE",
  status: "ACTIVE"
});

await momental_node_create({
  statement: "We use zod for all API input validation. No manual JSON.parse.",
  nodeType: "DECISION",
  status: "ACTIVE"
});

await momental_node_create({
  statement: "Every external API call must have explicit timeout + circuit-breaker.",
  nodeType: "PRINCIPLE",
  status: "ACTIVE"
});

Heimdall recalls up to 10 PRINCIPLE/DECISION atoms before every review and injects them into the LLM prompt with a strict enforcement instruction. A PR that violates a team principle gets it flagged as a concern - not just a note.

Security Scan Categories

22 regex patterns run on every diff, then an LLM pass eliminates false positives. Teams can add custom patterns via .heimdall.yml.

Setup

1. Subscribe - Visit the Heimdall page and subscribe ($49/mo).
2. Connect GitHub - Click "Connect GitHub" on the Heimdall settings page. Install the GitHub App on your org.
3. (Optional) Index your code - Run npx @momentalos/cli index for MCI-powered blast radius and caller completeness analysis.
4. Open a PR - Heimdall posts a review comment automatically within seconds.

.heimdall.yml Configuration

Place at your repo root. All keys are optional. Fetched at review time and cached for 1 hour.

# Opt-in: flag hardcoded colors and unapproved HTML elements
design_system: true

# Opt-in: enforce import boundaries between layers
architecture: true

# Block specific patterns in additions (regex)
blocked_patterns:
  - pattern: "console\\.log"
    message: "Remove debug logging before merge"
  - pattern: "process\\.env\\.SECRET"
    message: "Do not commit secrets"

# Add extra patterns to the security scan
security:
  extra_patterns:
    - "eval\\("
    - "document\\.write\\("

# Require test files for specific paths
test_coverage:
  require_tests_for:
    - "src/services/**"
    - "src/utils/**"

# Tell Heimdall which dirs contain browser/frontend code
# Default: .tsx files + common dirs (components/, pages/, app/, etc.)
frontend_paths:
  - "src/client/"
  - "packages/webapp/"

# Playwright E2E (requires frontend_qa_enabled flag)
playwright:
  webapp_start_cmd: "pnpm dev:webapp"
  webapp_ready_path: "/health"
  visual_regression: true

Per-Team Toggles

Two time-intensive features can be toggled on/off from the Heimdall settings page at /apps/heimdall. Both default to ON.

Ask Heimdall

Mention @heimdall in any PR review comment to ask a question:

@heimdall why is the token refreshed here instead of at the call site?

Heimdall replies in-thread using the diff_hunk as local context. For full-PR questions, mention Heimdall in a top-level review body and it fetches the entire diff before answering.

Self-Improvement Loop

Heimdall learns from its own history. Before each review, it recalls past CI/CD atoms tagged with ci-cd, code-review, and regression. After a deploy, the quality judge scores post-deploy scenarios. If a regression is detected on code Heimdall previously rated LOW, it creates a LEARNING atom that feeds into future reviews.

Combined with engineering standards enforcement, this creates a flywheel: team decisions become PRINCIPLE atoms, Heimdall enforces them, post-deploy outcomes create LEARNING atoms, and those learnings make the next review smarter.

Pricing

$49/month per workspace. Includes unlimited PR reviews for all repos connected via the GitHub App. No per-seat or per-review charges.