Heimdall

Code Guardian. Heimdall reviews every pull request with skeptical eyes - trust nothing, verify everything. Security scanning, style enforcement, test adequacy analysis, and your team's own engineering standards, all enforced automatically.

What Heimdall Does

Heimdall is an automated PR reviewer that posts a structured review comment on every pull request. It runs multiple analysis layers in parallel - from OWASP security scanning to call-graph analysis to your team's PRINCIPLE and DECISION atoms - and produces a single risk-rated comment with actionable concerns, a test checklist, and governance advisories.

Unlike a linter or SAST tool, Heimdall combines pattern matching with AI reasoning to minimize false positives, verify intent, and assess whether the test checklist actually covers the changed code paths.

Zero Setup Required

Every capability below works from the first PR with no configuration files, no CI changes, and no tooling installation. Connect the GitHub App, open a PR, and Heimdall comments within seconds.

Optional configuration via .heimdall.yml unlocks additional features (design system enforcement, architecture boundaries, custom blocked patterns) but is never required.

Review Capabilities

Always On (zero config)

Opt-in (via .heimdall.yml)

Risk Levels

Risk levels are enforced consistently - certain findings always result in elevated risk regardless of other factors.

Engineering Standards from Knowledge Graph

Heimdall automatically enforces your team's engineering standards. Create PRINCIPLE and DECISION atoms in your Momental workspace:

// These atoms are free to create (v1 MCP, pure DB operations)
await momental_node_create({
  statement: "All database queries must use Drizzle ORM. No raw SQL except migrations.",
  nodeType: "PRINCIPLE",
  status: "ACTIVE"
});

await momental_node_create({
  statement: "We use zod for all API input validation. No manual JSON.parse.",
  nodeType: "DECISION",
  status: "ACTIVE"
});

await momental_node_create({
  statement: "Every external API call must have explicit timeout + circuit-breaker.",
  nodeType: "PRINCIPLE",
  status: "ACTIVE"
});

Heimdall recalls your team's PRINCIPLE and DECISION atoms before every review and enforces them. A PR that violates a team principle gets it flagged as a concern - not just a note.

Security Scan Categories

Heimdall scans every diff for known vulnerability patterns. Teams can add custom patterns via .heimdall.yml.

Security & Data Isolation

Heimdall reads your pull request diffs via the GitHub API using a per-team installation token. Your code is never stored, cached, or shared with other customers.

• Per-team GitHub tokens - Installation tokens are generated on-demand with 1-hour expiry and never stored in our database.
• No code storage - Diffs and file contents are fetched at review time and discarded after analysis. Nothing is persisted.
• No cross-team access - Database-level security policies and application-level team filtering ensure one team's reviews are invisible to another.
• Zero training policy - Your code is never used to train AI models. Our AI providers operate under enterprise agreements that enforce automatic deletion within 30 days.
• Immutable audit log - Every review decision is logged to an immutable audit store for compliance (logical access control, system monitoring).

See our Security page for the complete data protection framework.

Setup

1. Subscribe - Visit the Heimdall page and subscribe ($49/mo).
2. Connect GitHub - Click "Connect GitHub" on the Heimdall settings page. Install the GitHub App on your org.
3. (Optional) Index your code - Run npm i -g @momentalos/cli && momental-indexer --dir . for MCI-powered blast radius and caller completeness analysis. All features (call graph, test mapping, co-change) auto-detect.
4. Open a PR - Heimdall posts a review comment automatically within seconds.

.heimdall.yml Configuration

Place at your repo root. All keys are optional. Fetched at review time and cached for 1 hour.

# Opt-in: flag hardcoded colors and unapproved HTML elements
design_system: true

# Opt-in: enforce import boundaries between layers
architecture: true

# Block specific patterns in additions (regex)
blocked_patterns:
  - pattern: "console\\.log"
    message: "Remove debug logging before merge"
  - pattern: "process\\.env\\.SECRET"
    message: "Do not commit secrets"

# Add extra patterns to the security scan
security:
  extra_patterns:
    - "eval\\("
    - "document\\.write\\("

# Require test files for specific paths
test_coverage:
  require_tests_for:
    - "src/services/**"
    - "src/utils/**"

# Tell Heimdall which dirs contain browser/frontend code
# Default: .tsx files + common dirs (components/, pages/, app/, etc.)
frontend_paths:
  - "src/client/"
  - "packages/webapp/"

# Playwright E2E (requires frontend_qa_enabled flag)
playwright:
  webapp_start_cmd: "pnpm dev:webapp"
  webapp_ready_path: "/health"
  visual_regression: true

Per-Team Toggles

Two time-intensive features can be toggled on/off from the Heimdall settings page at /apps/heimdall. Both default to ON.

Ask Heimdall

Mention @heimdall in any PR review comment to ask a question:

@heimdall why is the token refreshed here instead of at the call site?

Heimdall replies in-thread using the diff_hunk as local context. For full-PR questions, mention Heimdall in a top-level review body and it fetches the entire diff before answering.

Gets Smarter Over Time

Heimdall improves with use. Each review is informed by your team's engineering standards and past outcomes. The more your team documents decisions as PRINCIPLE and DECISION atoms, the more precisely Heimdall enforces them.

Pricing

$49/month per workspace. Includes unlimited PR reviews for all repos connected via the GitHub App. No per-seat or per-review charges.