DiffSight
Download

Stay in control
of every merge.

DiffSight is the local-first desktop client built around the engineer reviewing the code, not the model writing it.

AI writes faster than anyone can read. That gap is where the bugs ship. DiffSight is built to close it.

Reviewing AI code is a different jobmanifesto
Download nowRead the manifesto

Free for open source. On macOS today, Windows and Linux next.

DiffSight
DDiffSight
Pro
Multi-tenant storage rewriteOpen
Checks ok
Modifiedpackages/auth/src/session.ts+1−1
7 import { Database } from './db';
8 import { now } from './time';
9 import type { ScopeName } from './scopes';
10
11 export type Session = {
12 userId: string;
13− expiresAt: Date;
13+ expiresAt: Date | null;47
14 scopes: ScopeName[];
15 refreshToken: string;
16 };
17
18 export const SESSION_KEY = '__sess';
Blast radius 47+1 / −1 on Session.expiresAt · reaches 47 callers across 14 files.
Deep analysisBusiness logicCritical3 callers assume expiresAt is never null.
  • packages/auth/src/middleware.ts:62
  • packages/billing/src/checkout.ts:104
  • apps/web/src/middleware.ts:14
Blast radius 47·3 / 9 files reviewed
manifesto.mdDiffSight
1
2

The craft of reading code is dying.

3
4

More code is written by machines every day. Reviewed by no one. PRs pile up. Diffs scroll past. We click Approve because we trust the model. Or because we've stopped trying.

5
6

DiffSight is for engineers who want to keep ownership of the code they ship. Not code-review purists. Not process for its own sake. People who want the last call on a merge to stay theirs.

7
8
---
9
10

AI-assisted, not AI-replaced.

11
12

You write with AI. You ship with AI. Fine. Someone still has to look. That someone is you. We make it bearable. Fast, dense, keyboard-driven, local.

13
14
---
15
16

Every tool evolved. Except the one you review with.

17
18

Writing code got Copilot, agents, a dozen auto-reviewers. Reading it still runs on a diff view from a decade ago. The machine got faster. The reviewer got nothing.

19

Why a dedicated client

You already review code somewhere.
That's the problem.

Median PR review time is up 441% in the AI era. 96% of engineers don't fully trust AI-written code, yet only 48% always check it before it ships. The three tools you'd reach for weren't built to close that gap.

Faros AI 2026 · Sonar 2026

Auto-review
Copilot, CodeRabbit, Greptile

Helps. Doesn't replace you.

Bots catch the obvious and never get tired. Keep them, DiffSight works alongside them. But a second model's guess isn't a human deciding to merge, and someone accountable still has to read the code.

  • A model's suggestion, not an accountable decision
  • 96% of engineers still don't fully trust AI code

Security tax: in 2025, a single malicious PR turned CodeRabbit's cloud into remote code execution and write access to ~1M repositories (disclosed by Kudelski Security, responsibly fixed in days). Your code's reviewer is your code's attack surface, unless it runs on your machine.

The web UI
GitHub & GitLab

A browser tab, not a review tool.

The web diff has barely changed in a decade. It's where pull requests live, not where they get read.

  • Crawls on large PRs, loses your place on reload
  • No call graph, no blast radius, no cross-file context
  • No AI grounded in your own code
The IDE
VS Code, JetBrains

Built to write, not to review.

Your editor has no concept of a review. Reviewing in it means rebuilding the pull request by hand.

  • No threads, mentions, or read state
  • No pull-request lifecycle
  • Comments and context lost on every branch switch
DiffSight

The missing piece: a real review client on your machine that works with your bots and your Git host, instead of pretending to be them. It never asks for a key to your repos, because your code never leaves the machine.

What it is

A code review client. Nothing more. Nothing less.

Local-first. Code stays put.

SQLite, encrypted tokens, indexed repos, review history, all on your machine. A DiffSight account handles sign-in and licensing. Your code, diffs, and review history never reach it. The app pulls PRs straight from GitHub and GitLab.

Bring your own model.

Drop in your Anthropic or OpenAI key. Or wire up your Claude Code or Codex CLI. Your prompts go from your machine to your provider. No DiffSight gateway. No relay. No aggregation.

Deep reads, grounded in your code.

Target a file. DiffSight walks every change line by line, follows the call graph through the local index, and reports back: behavior shifts, security risks, missing tests, places the diff stops making sense.

GitHub and GitLab. One client.

Same UI. Same keyboard. Switch repos, switch providers, without ever opening a browser tab.

Flagship · Track-based review

A 47-file PR is not a wall of diff.
It's six chapters.

DiffSight slices the PR into themed tracks. Each one groups the hunks that belong together, with a one-paragraph narrative on why. Lockfiles and generated code collapse into a single track you can acknowledge once.

The problem was never you. It's the size of what you're handed. AI writes more code than anyone can read line by line, and the bigger the PR, the more slips through unread.

+154%

bigger pull requests where AI adoption runs highest

Faros AI · 2025

400 LOC

past this in one pass, reviewers stop finding the bugs

SmartBear / Cisco

+31%

more PRs now merge with no human review at all

Faros AI · 2026

BeforeWhat GitHub gives you for a 145-change PR
Filesevilcorp/atlas · #482
Files (47)21 / 47
Filter by path…P
  • config
  • tenants.go+331 −0
  • tenants_test.go+628 −0
  • config.go+12 −16
  • config_test.go+12 −12
  • internal/keystore
  • store.go+46 −38
  • store_test.go+92 −12
  • errors.go+14 −0
  • internal/storage
  • bucket.go+18 −5
  • bucket_test.go+41 −8
  • migration.go+167 −0
  • internal/server
  • router.go+28 −11
  • middleware.go+33 −4
  • tenant_resolver.go+78 −0
  • internal/billing
  • ledger.go+22 −17
  • invoice.go+9 −9
  • ledger_test.go+71 −12
  • internal/metrics
  • tenant_metrics.go+19 −0
  • dashboards.json+138 −12
  • cmd/atlas
  • main.go+6 −4
  • boot.go+17 −9
+ 22 more files
AfterWhat DiffSight does with the same PR
Tracksevilcorp/atlas · #482
Review complete0 / 6
  • 1
    Modeling tenants as first-class config0 / 5

    v1 baked one billing account and tenant id into env vars, so a single instance could only serve one tenant. The author starts by giving the server a registry of tenants so the rest of the change has something to look up.

    • tenants.go
      /config
      +331 −0
    • tenants_test.go
      /config
      +628 −0
    • config.go
      /config
      +12 −16
    • config_test.go
      /config
      +12 −12
    • types.go
      /internal/types
      +1 −0
    • All files read, chapter complete
  • 2
    Per-tenant key resolution0 / 5

    Each tenant now carries its own KeyConfig, so the keystore can no longer read keys from a single global env.

  • 3
    Re-pathing storage under {tenantId}0 / 8

    With keys scoped per tenant, the storage layout itself must isolate them.

  • 4
    Routing the tenant id through the request0 / 18

    Storage and keys are tenant-scoped. The request layer must extract the id and propagate it down to handlers.

  • 5
    Migrating v1 buckets in place0 / 6

    An existing v1 install upgrading to this build would silently lose every previously published asset without a migration.

  • 6
    Per-tenant metrics and dashboards0 / 4

    Multiple tenants publishing through the same Prometheus instance would have collided on metric names.

Group by intent. Hunks land on a track automatically. Each gets a one-paragraph narrative on what it does and why.
Mute the noise. Lockfiles, snapshots, generated code, collapsed into one track. Acknowledge or skip.
Resume mid-track. Close the app. Come back tomorrow. DiffSight remembers the line.

Killer features

Built for the PRs your AI just opened.

A small set of primitives, each one answering a specific way an AI-generated PR will quietly betray you. No carousel of icons, no feature flags pretending to be products.

Flagship

Blast radius.

Find the +1 / −0 that broke 30 things.

Every changed file gets an impact score from your local call graph. The shared-type edit your agent shipped with confidence stops hiding at the bottom of the file list and shows up at the top, with the exact symbols it'll ripple into.

  • File list sorted by radius. Dangerous edits first, not last.
  • One click expands the exact call sites a change reaches.
  • Tests covering the change are tagged. High-radius, zero-coverage edits glow.
PR #487 · filessorted by radius
types.go30+1−0
  • ↳User.Validateinternal/user/user.go:42
  • ↳RegisterHandlerinternal/api/register.go:17
  • ↳store.Insertinternal/db/store.go:88
  • ↳billing.Chargeinternal/billing/charge.go:120
  • ↳TestRegistertests/e2e/auth_test.go:88
  • + 25 more callsites
30
callsites
14
files
4
tests hit
PR-aware

Versioned reviews.

Re-read what changed. Not the rest.

Your agent pushed 8 more commits to the same PR. Move the base or head SHA and review only the slice. Threads, AI findings, and read state stay anchored.

  • Any base/head SHA inside the PR.
  • One click expands back to the full diff.
  • No more re-reading the whole PR every force-push.
PR #487 · feat: token rotationslice 3 / 5
a4f1c1rework session.ts
8b2e09add token rotation
base
fc4421fix race in rotate()
21a902test: rotation flow
head
d92011docs: README
3
commits
6
files
+218 −47
changed
AI

Vet AI code with AI you control.

Point at a file. Your Claude or Codex key reads every change against the local call graph, then returns a verdict on five axes (security, business logic, regression, tests, quality), with each finding pinned to the lines and files it touches.

Deep analysis
Claude · session.ts · 9 findings
  • SecuritySafe
  • Business logicCritical
    4
    L40-58Critical

    getSession now returns null for revoked tokens instead of throwing RevokedError. Two callers branch on that error to force re-auth, so they now read a revoked session as anonymous and fall through to the public route.

    Relatedauth/middleware.tsapi/guard.ts
  • Code qualityCareful
    1
  • RegressionCareful
    3
  • TestingPartial
    1

Threads, inline.

Reply and resolve where the code lives. No tab-flip to a browser.

MS

Should we fail closed here?

AK

Yes. Pushed in fixup.

resolved2 replies
Private

Review notes.

A private margin for the PR.

Think in Markdown as you read. Jot the question to raise, the TODO, the thing to double-check. Type @ to pin a note to a file. It's yours alone, and it stays on the PR, so you can reopen it months after merge and still know why.

  • Markdown, with live Write / Preview.
  • Type @ to reference any file in the diff.
  • Private to you. Still there long after the merge.
NotesPrivate to you
WritePreview
Token rotation · pass 2
  • Base moved past the force-push.
  • RevokedError fallthrough in auth/guard.ts?
  • Ask Marc: fail closed on the rotate() race?
types.go hits 30 callsites. Read that one first.
GitHub · GitLab

Works where your PRs live.

Cloud or self-hosted. Same review.

Point DiffSight at github.com, gitlab.com, or your own GitHub Enterprise and self-managed GitLab. The same pull and merge requests, reviewed on your machine, behind your firewall.

  • GitHub and GitLab, public or private repos.
  • Self-hosted too: GitHub Enterprise, GitLab self-managed and CE.
  • Bring your own token. It never leaves this machine.
Connectionsall linked
  • github.comCloud
  • gitlab.comCloud
  • ghe.acme-corp.devEnterprise
  • git.internal.corpSelf-hosted
Local-first. Your token and source stay on this machine.

Flow

Everything a keystroke away.

One command palette for every repo, branch, PR, file, and symbol you've indexed, all local. Comments, threads, and @mentions where the code lives, synced back to GitHub and GitLab. Shortcuts for everything, so review moves at the speed you think.

local index

One palette. Every repo, every branch.

Hit ⌘K and jump straight to a pull request, a branch, a file, or a symbol, across every repository you've added. No tab-hopping, no loading spinner.

rotate⌘K
  • Repoevilcorp/atlas
  • Repoevilcorp/ledger
  • Pull request#487 feat: token rotation
  • Branchfeat/multi-tenant
  • Filesession.ts
  • SymbolrotateKey
6 repos indexed↑↓to navigate

Comments, inline. Synced.

Reply, resolve, and @mention right on the line. Threads round-trip to GitHub and GitLab, so nothing lives only in your head.

Muscle memory.

Hands never leave the keyboard.

  • Next hunkJ
  • Previous hunkK
  • Comment on lineC
  • Reply in threadR
  • Mark file readM
  • Search everything⌘K

Security & privacy

Your code never leaves your machine.

No code in the cloud. No proxy. No prompt routed through us. Built for engineers who read threat models before they read pricing pages.

  • The backend never sees code.

    Sign-in, licensing, and updates run through a DiffSight backend. Your code does not. Diffs go straight from the desktop app to GitHub, GitLab, and your LLM provider.

  • Analytics never touch your code.

    We measure product usage to make DiffSight better. Your code, diffs, and prompts are never part of it and never reach us.

  • OS-native secret storage.

    OAuth tokens, PATs, and LLM API keys are encrypted at rest using the macOS Keychain via Electron safeStorage. Never plaintext, never logged.

  • Local SQLite, local index.

    Review history, comments-in-flight, repo index, and cached diffs live in a single SQLite file in your user data directory. Delete the file → DiffSight forgets everything.

  • Renderer is sandboxed.

    Strict process isolation: contextIsolation: true, no nodeIntegration. Every privileged operation goes through a typed IPC contract. The UI cannot touch your tokens.

  • BYOK LLM, no proxy.

    AI requests go from your machine straight to Anthropic / OpenAI / your local Claude Code or Codex CLI. DiffSight never sees, logs, or routes your prompts.

  • Open about what's sent.

    Every outbound network call is documented. For AI reviews, you see exactly which files and hunks get included in the prompt before sending.

  • Read-only agent surface.

    The review agent runs against a fixed set of tools: read_file, list_files, grep, read_pr_diff, list_pr_files, get_dep_graph. No shell. No write. No git push, no git commit, no arbitrary network. The agent can look, never act.

  • Scoped to the PR you opened.

    Every tool call is bound to the current repository and pull request. The agent can't read another repo, jump to another branch, or pull data outside the PR's scope.

  • Bounded by design.

    Per-review token and cost ceilings, configurable. Hard stop on tool-call count to prevent runaway loops. Streamed status with a visible kill switch. Interrupt mid-run, always.

  • Every step is on the record.

    Every tool call (which file, which range, which query) is shown in the UI, in order, with inputs and outputs. Nothing happens off-screen. Save the trace, share it, audit it.

  • Locked-down renderer.

    Strict Content-Security-Policy, no eval, no remote scripts. Even a compromised dependency cannot reach your tokens or open a back-channel to the network.

Pricing

Free for open source. Fair for everyone else.

If you review open source, you never pay. Go Pro to bring in your private work. Every paid plan starts with 14 days on us, no card needed.

MonthlyYearlySave 30%

Free

For open source work.

€0forever
Download DiffSight
  • Every open source repo you review, free for good
  • Themed tracks, blast radius, and versioned reviews
  • AI reviews with your own Anthropic, OpenAI, Claude Code or Codex key

Pro

14-day free trial

For your private repos.

€19.99per month

Or €169 a year and save 30%.

Start your free trial

No card for the trial. Cancel whenever.

  • Everything in Free
  • Your private repos, on GitHub and GitLab
  • One license, one Mac

You bring your own AI key on every plan, so you pay your provider straight for tokens and never us for the compute.

FAQ

Short answers. No fog.

The questions every engineer asks before installing a code review client. If yours is missing, email hello@diffsight.dev.

  • 01What is DiffSight?

    DiffSight is a local-first desktop client for reviewing pull and merge requests on GitHub and GitLab. It's built for engineers reviewing code their AI wrote: themed tracks, call-graph blast radius, and versioned reviews on top of fast keyboard-driven diffs.

  • 02How do I review an AI-generated pull request with DiffSight?

    Open the PR in DiffSight. The 47 files become 6 themed tracks, each with a one-paragraph narrative of what it does. Files sort by blast radius so the dangerous edits, like the +1/−0 in a shared type, surface first. Run a deep AI pass per file with your own key, then walk threads inline. Read state, AI findings, and comments persist locally.

  • 03What is blast radius in code review?

    Blast radius is an impact score DiffSight computes for every changed file from your local call graph. Files whose edits ripple into many other symbols rank high. It catches the failure mode AI-generated PRs ship most often: a one-line edit to a shared type or helper that silently shifts behavior in dozens of callers.

  • 04How is DiffSight different from reviewing on github.com or gitlab.com?

    It's a native desktop app, not a browser tab. Keyboard-driven, dense, sync'd-scroll diffs with whole-file context inline. A local repo index for definition jumps and references. Blast-radius scoring per file. Versioned reviews between any two SHAs in a PR. Deep AI analysis grounded in your code, with your own provider key. Your review state lives on your machine and survives restarts.

  • 05Does DiffSight upload my source code anywhere?

    No. DiffSight runs a backend for sign-in, licensing, and updates, never for your code. The app talks directly to GitHub or GitLab from your machine, and AI requests go straight to the provider you configured (Anthropic, OpenAI, Claude Code, Codex). Your code, diffs, and prompts never pass through our servers.

  • 06Which AI providers can I use?

    Bring your own key for Anthropic or OpenAI. Or wire up an existing Claude Code or Codex CLI. DiffSight never proxies, relays, or aggregates your prompts.

  • 07Which Git providers does it support?

    GitHub and GitLab, in the same UI. Switch between repos and providers without leaving the keyboard.

  • 08Which platforms are supported?

    macOS is ready now. Download it from the site and it keeps itself updated. Windows and Linux aren't out yet, so open the download section, leave your email for the one you want, and we'll write to you the day it ships. It also tells us which one to build first.

  • 09Is DiffSight free?

    If you review open source, it stays free for good. For your private repos, Pro is €14.99 a month or €99 a year, and it starts with a 14-day free trial that needs no card.

  • 10How are my tokens and API keys stored?

    OAuth tokens, personal access tokens, and LLM API keys are encrypted at rest using the macOS Keychain via Electron safeStorage. Never plaintext, never logged.

  • 11Does DiffSight collect telemetry?

    We collect product usage analytics so we can see what to fix and what to build next. It never includes your code, diffs, prompts, or file contents. It lives in PostHog on EU servers, and you can ask us to stop by emailing support@diffsight.dev.

  • 12Can the AI agent modify my code or push commits?

    No. The review agent is read-only by construction. It can read files, list files, grep, and inspect the PR. It cannot run a shell, write files, commit, push, or open arbitrary network connections.

  • 13When will DiffSight be available?

    macOS is available right now. Download it from the site and updates install on their own from there. Windows and Linux are next.

Download

Get DiffSight

Ready on macOS today. Windows and Linux are next, and you can tell us to hurry.

Which Mac do you have?

Most Macs from 2020 on are Apple Silicon. If yours is older, pick Intel.

Free for open source, with a 14-day Pro trial. It updates itself once installed.