Image: GitHub
Why it mattersThe person who clicks merge needs a map of what the diff can reach. Farol produces that map by walking the call chain.
The reviewer who clicks merge on a 40-file pull request needs to know which three files call the billing service. Reading every diff line in order rarely answers that question in time.
Farol launched on Show HN on 25 October 2026. It is an open-source CLI and GitHub Action from the team at Winnin. The repository has 47 stars and 24 points on Hacker News, two hours after the post went up. It is MIT-licensed and needs Node.js 22 or newer.
What it does
Farol scores a pull request from 0 to 100 and marks it fast track, quick review or careful review. It ranks the changed files by risk. For each one it lists every route, API operation, job and script the change can reach. It also prints the call chain, so the reviewer can see why the file was flagged. It supports TypeScript and React, Go, and Python.
The static analysis uses the TypeScript compiler API, go/types and Python's ast module. No code is executed. No request leaves the machine. The author says the same pull request always produces the same report.
What else goes into the score
The reachability map is the headline output. Four other checks feed the score alongside it. Diff coverage shows which changed lines have no test. Contract-break detection reads GraphQL schemas, HTTP handler types and FastAPI parameters. Security rules look for XSS patterns, eval calls and leaked secrets. Audit output from npm audit, govulncheck and pip-audit is folded in too.
Where it stops
Farol only sees code it can walk statically. Values built at runtime, dynamic imports in Python, and reflection in Go are left out. The report marks these as unknown rather than guessing. The route adapters are narrow: TypeScript routes work for React Router, Next.js and TanStack Router. Remix, Vue and Svelte are left out. Django REST Framework routers are left out in Python.
The report comes out as a GitHub comment, an HTML page, a Markdown file or a JSON file. Datadog traffic data is an optional input, which lets the ranking push files that handle live traffic higher. Suggested reviewers come from git blame on the changed lines.
The approver is downstream of two agents now
Pull request reviewers in many shops now sit downstream of two AI reviewers: the agent that wrote the diff, and the agent that reads it before a person does. The project's own case against relying only on an AI reviewer is in the README: an AI reviewer gives a probabilistic guess, while Farol produces a report that cites its call chain. A reviewer who can point at the call chain can defend the merge if it breaks something.
Source
winnin/farol on GitHub. Show HN thread: news.ycombinator.com/item?id=50231349.
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.