Free
$0 forever
Public repositories
GitHub App checks on every public PR, plus the browser extension for any public PR you visit. Architecture diagrams, risk findings, and AI review notes.
More code isn't more product.
Your team merges more code every week than anyone can read, and every risky change routes to the one person who can judge it. Striff is architecture review for every GitHub pull request. It checks each change against the architecture you documented and reports back as one check, so approving a merge stops being a judgment call only your most senior engineer can make.
apache/fineract PR #6063 Java 2 HIGH · 2 MEDIUM
Striff / architectural-review
Scroll to zoom · Drag to pan
Architecture diagram of this PR
For whoever has to approve it
Your reviewers stop guessing whether it's safe to merge.
Passing tests tell your team the code works today. They say nothing about whether this change made the system harder to work in tomorrow. Striff answers that on the pull request, names the exact class at fault and quotes the rule it broke, so any reviewer on your team can approve with the confidence your staff engineer would.
apache/fineract PR #6063 Checks tab 13 checks · 4 flagged
Striff / architectural-review
Striff / architectural-review
Successful in 26s
Green because Striff reports, it doesn't gate. The findings below are advice your reviewer can act on, not a blocked merge. Mark the check required when you want it to hold the merge button.
Review Summary
This PR moves command-handling responsibility into command.implementation: DefaultCommandHandlerManager is added there, and the command package now depends on it. That dependency direction did not exist between these two packages before.
Top Review Items
-
📄 Doc Conflict Handler placed outside the documented package
DefaultCommandHandlerManagersits inimplementation.REFACTORING.mdrequires command handlers inhandler.Fix Move it, or update the doc.
-
🎯 Structural Regression
commandnow depends on its own implementation packageFirst edge in this direction. The manager gained a dependent (AC 1 → 2) while reaching into
core.exception(EC 8 → 17), so the abstraction points at the dispatcher.Fix Invert it: expose the manager as an interface from
command, wire the concrete class in config.
Documented Rules
Extracted from this repository's own docs and checked against the dependencies this PR adds. Pass means this change added no violation, not that the codebase is clean.
- Command handlers live in the
command.handlerpackageREFACTORING.md Fail -
core.exceptionmust not depend on command internalsARCHITECTURE.md Pass
Advisory: striff's reading, not a check
- Each command resolves to exactly one handlerREFACTORING.md may be affected
- Command handling must not block the request threadARCHITECTURE.md nothing stood out
Structural Checks
- Boundary crossings1 flagged
- Complexity growth1 flagged
- Coupling stability1 flagged
- Package cyclesclean
- Cycle seedsclean
- Module boundariesclean
- Layer integrityclean
- Production → test edgesclean
- Public contract stabilityclean
- Interface downgradesclean
- Encapsulationclean
- Hub formationclean
Thirteen results in all: twelve structural checks, plus the documented-rules check that reads your own docs. Every one reports on every PR, clean or not. Advisory rows are never given a pass: striff cannot prove an intention from structure.
The problem
Your architecture is eroding one merge at a time.
Your team merges more AI-written code every week than anyone can read. Left unchecked, each merge piles on coupling and cycles until every change takes twice as long and nobody wants to touch the core. Striff catches that structural drift on every pull request, while it's still a one-line fix.
Why AI makes this worse, not betterReal pull requests, real findings
The riskiest changes look safe in a file diff.
These are real public pull requests. Each one looked routine file-by-file. Striff read the structure underneath (a core engine reaching into a plugin, drivers rewired into the platform layer, query internals one step from a namespace cycle) and posted the findings before merge.
1 in 3 refactor PRs moves the architecture. See the evidence- Live public PRs: open any of them and verify
- Findings posted on the PR before merge
- Findings you can trace back to the diagram
7 findings posted on the live PR
0 prior edges from
core.util into the Avro plugin 24 dependents on
AvroUtils, the contract this PR touches 
Scroll to zoom · Drag to pan
Striff
reads the structure
0
prior dependencies from Pinot's core into the Avro plugin packageNew directional boundary crossing
SegmentProcessorAvroUtils in core.util now calls directly into plugin.inputformat.avro. Plugin boundaries exist so the core never depends on a plugin; this edge reverses that direction for the first time, and skips a layer on the way. HIGH
New directional boundary crossing New dependency from
org.apache.pinot.core.util to org.apache.pinot.plugin.inputformat.avro, with no prior edge in this direction. HIGH
Stable contract modified: 24 dependents
AvroUtils has afferent coupling of 24. Changes to this component impact at least 24 dependents in the parsed scope. MED
Layer skip on the new edge The new core-to-plugin edge jumps from
core.util (layer 1) to plugin.inputformat.avro (layer 3), skipping a layer. Striff flagged the inverted plugin boundary before merge, with the first core-to-plugin edge named in the check.
More findings from major OSS repos 4 findings posted on the live PR
2 brand-new dependency directions from the smoke suite
3 layers skipped by the deepest new edge
Scroll to zoom · Drag to pan
Striff
reads the structure
3
layers skipped by the new edge from the smoke suite intocelery.utils New directional boundary crossing
t.smoke.tests now depends on celery.utils and celery.worker.consumer directly, with no prior edge in either direction. Smoke suites coupled to internals break every time the internals move. HIGH
New directional boundary crossing New dependency from
t.smoke.tests to celery.utils, with no prior edge in this direction. HIGH
New directional boundary crossing New dependency from
t.smoke.tests to celery.worker.consumer, with no prior edge in this direction. MED
Layer skip: 3 layers The new edge from
t.smoke.tests (layer 0) to celery.utils (layer 4) skips 3 layers of the codebase's layering. Striff flagged both new boundary crossings and the 3-layer skip before merge.
More findings from major OSS repos 4 findings posted on the live PR
2 new driver-to-platform boundary crossings
3 layer each new edge skips on the way to
src.platform 
Scroll to zoom · Drag to pan
Striff
reads the structure
2
brand-new dependency directions introduced by this PRDrivers rewired into src.platform
ReactNativeDriver and ExpoDriver now load their modules through PlatformTools. Convenient, but it points the driver layer at the platform layer for the first time, and both new edges skip an intermediate layer on the way. HIGH
New directional boundary crossing New dependency from
src.driver.react-native to src.platform, with no prior edge in this direction. HIGH
New directional boundary crossing New dependency from
src.driver.expo to src.platform, with no prior edge in this direction. MED
Layer skip on both new edges Both edges jump from the driver layer (layer 1) straight to
src.platform (layer 3), bypassing the intermediate layer. Striff flagged both new driver-to-platform crossings and the layer skip on each of them, before merge.
More findings from major OSS repos 8 findings posted on the live PR
3 layers skipped by the new upward edge
1 near-cycle left across the query namespaces
Scroll to zoom · Drag to pan
Striff
reads the structure
3
layers skipped by the new edge fromQuery.Internal to the root namespace New directional boundary crossing
SplitQueryResultCoordinator now depends on the root Microsoft.EntityFrameworkCore namespace, with no prior edge in this direction. Combined with the existing path from the root through Query into Query.Internal, the namespaces are one step from a full cycle. HIGH
New directional boundary crossing New dependency from
Microsoft.EntityFrameworkCore.Query.Internal to Microsoft.EntityFrameworkCore, with no prior edge in this direction. MED
Layer skip: 3 layers The new edge jumps from
Query.Internal (layer 8) straight to the root namespace (layer 12), skipping 3 layers. INFO
Cyclic dependency seed The new edge, combined with the existing path from the root through
Query to Query.Internal, almost creates a namespace cycle. Striff flagged the new upward edge, the 3-layer skip, and the near-cycle it left behind, before merge.
More findings from major OSS reposFor engineering managers
Writing code was never the hard part.
Keeping a system coherent while a dozen people change it every day is the hard part, and it's the part nobody owns. Striff checks every pull request against the architecture you've already documented, then rolls the results into a view of your team's repos, so the system your team is building stays the system you designed.
HIGH
Package structure violation
DefaultCommandHandlerManager sits in implementation, but REFACTORING.md requires command handlers to live in handler.
Last 6 monthsFebruary 2026 to July 2026
Regressions flaggedA high-severity structural break Striff traced directly to this PR -- a new dependency cycle, a one-way boundary crossing, a stable component's contract shifting, or a sharp complexity jump. Deliberately rare: most PRs show zero.
30
Hotspots flaggedA lower-severity or anomaly-only finding worth a second look -- coupling or churn signals that don't rise to a confirmed structural regression. Usually zero or one per PR.
54
Clean PR rateShare of analyzed pull requests with zero regressions or hotspots flagged, over the last 6 months.
75%
High-risk PR rateShare of analyzed pull requests with at least one regression flagged, the more severe finding type, over the last 6 months.
7%
PRs analyzedTotal pull requests Striff reviewed for architecture across every active repo in this installation.
425
CoverageShare of GitHub PR-check webhook events (opened, updated, reopened) that completed analysis, over the last 6 months. Below 100% may mean PRs were skipped -- check billing status or repo connection.
93%
Flagged repos over timeEvery repo that has cracked the top-flagged list at any point in the last 6 months, tracked month by month. A repo can show a lower or zero count in months it wasn't flagged enough to be in that month's own top list -- more than one repo commonly appears here as the top spot reshuffles across months.
Recently flagged PRsThe 10 most recent pull requests this month with a structural regression or review hotspot -- click through to see exactly what was flagged.
Jul 2026
- acme-corp/core-api #4121 regression
Merge auth and billing request pipelines
- acme-corp/billing-service #4111 hotspot
Add retry backoff to invoice webhook consumer
- acme-corp/web-app #4101 hotspot
Refactor onboarding wizard step components
- acme-corp/core-api #4091 regression
Introduce direct DB call from the notifications module
- acme-corp/billing-service #4081 hotspot
Bump Stripe SDK to v18
- acme-corp/web-app #4071 hotspot
Extract shared form validation hook
- acme-corp/core-api #4061 regression
Collapse billing and shipping address models
- acme-corp/billing-service #4051 hotspot
Add idempotency key support to charge endpoint
- acme-corp/web-app #4041 hotspot
Move auth token refresh into shared context provider
- acme-corp/core-api #4031 regression
Route webhook fan-out through billing-service directly
Add token-bucket rate limiter to gateway middleware #1842
Conversation 12 Commits 6 Checks 4 Files changed 9
All checks have passed
4 successful checks
continuous-integration / build 44s Details
continuous-integration / test (312) 1m 12s Details
lint 18s Details
Striff / architecture
26s Details All 12 structural checks passed. 2 documented rules checked, no new violation. Rate limiter stays inside gateway/middleware, as ARCHITECTURE.md requires.
Free Chrome extension
See what any GitHub PR really touches.
Reviewing an unfamiliar change means holding somebody else's dependency graph in your head. Striff draws it for you, in a tab right beside Files changed, so you see what a change touches before you approve it. You never leave GitHub.
- Interactive dependency diagrams on any PR
- Comment straight from the diagram
- AI findings pinned to the graph
- No backend, and your token stays local
Get started
Start with public repos. Scale to your team.
Nothing to learn and no workflow to change: Striff shows up as one more check on the PRs your team already opens. Start free on public repos, add private repos when you're ready.
Starter
$29 /mo · 5 repos
One team's private repos
GitHub App checks on every private PR. Automated architecture review with the full detector suite and risk scoring.
Enterprise
Talk to us
Self-hosted & 50+ repos
Private deployment, SSO, and audit workflows for organizations that need full control.
FAQ
Common questions
Does Striff replace my AI code reviewer (CodeRabbit, Copilot, Claude)?
No, it works alongside them. Striff reviews one layer: the dependency graph your change produces. It reports new cycles, boundary violations, coupling spikes, and god classes forming, and checks the whole thing against the architecture your repo already documents. Line-level bugs, style, and logic stay with your existing review, human or AI.
How does Striff know what my architecture is supposed to look like?
Two ways. Out of the box, twelve deterministic checks run on every PR and flag structural regressions that are almost never intentional: new dependency cycles, first-ever dependency directions between packages, layer skips, and sharp complexity or coupling growth. No configuration needed, and every one of the twelve is listed in the Check with its own result, whether it fired or not. On top of that, if your repo contains architecture docs (an ARCHITECTURE.md, ADRs, or design notes), Striff reads them and checks the dependencies your PR adds against what your team wrote down, quoting the document it came from.
What languages does Striff support?
Java, TypeScript, Python, and C#. Go support is coming soon. Striff parses source code into a full structural model using its own parser, not regex or text matching, so references, inheritance, and coupling are resolved the way a compiler sees them.
Is it just an LLM wrapper?
No. The findings come from deterministic structural analysis of your dependency graph, backed by a model trained on well-architected codebases to tell risky changes from normal ones. The AI layer explains and ranks what the analysis already established, and decides which of those facts are worth your attention; it can never originate a finding of its own. It also writes a short account of what the PR did structurally, which is why a clean PR still gets an explanation rather than a bare verdict.
Will it slow down or block my pull requests?
No. Striff runs as a GitHub Check next to your CI and posts its results when the analysis finishes, typically within a few minutes. It never blocks a merge unless you choose to make the check required.
What do I need to set up?
Just install the GitHub App: it works on public and private repos alike and posts checks automatically on every PR, with no per-developer setup. Plans start at $29/month, based on how many repos actually get reviewed each month, not how many you connect. Separately, there's a free browser extension: a standalone tool that analyzes any public PR directly in GitHub's UI, a handy way to try Striff on open-source code without installing anything on the repo (bring a free GitHub token; it stays in your browser).
Is my source code sent to a third party or stored?
Your code is parsed on Striff's servers in memory and not persisted. The AI explanation layer works from the structural model (component names, relationships, metrics, and doc excerpts), not your raw source files. For teams that need full control, self-hosted deployment is available on the Enterprise plan.
Code is cheap now. Changing it isn't.
Every unchecked merge makes the next change a little more expensive. It compounds quietly, and nobody can point at the day it started. Striff starts checking on your next pull request.