Description
Agents can open a dozen pull requests overnight, and code nobody has read ends up on the main branch. AI Guard puts a gate in front of the merge button: a real person has to sign off first.
It is a GitHub App running on Cloudflare Workers. When a PR opens, a Human Attestation check appears and starts out red. To turn it green, someone signs in with GitHub, passes a Cloudflare Turnstile challenge and ticks a short statement such as "I have read and understood all agent-written code in this PR".
One attestation per PR: Once confirmed, later pushes to the same PR stay green, so nobody has to click again.
Collaborators skip it: PRs from human collaborators with write access pass straight through, while bot accounts never do.
Stateless, no database: Who confirmed which statement at which commit is recorded in the check details and a PR comment, and the Worker stores nothing itself.
Block merges with a required check: Add it as a required status check in branch protection and any PR nobody has attested cannot merge.
It is a GitHub App running on Cloudflare Workers. When a PR opens, a Human Attestation check appears and starts out red. To turn it green, someone signs in with GitHub, passes a Cloudflare Turnstile challenge and ticks a short statement such as "I have read and understood all agent-written code in this PR".
Features
One attestation per PR: Once confirmed, later pushes to the same PR stay green, so nobody has to click again.
Collaborators skip it: PRs from human collaborators with write access pass straight through, while bot accounts never do.
Stateless, no database: Who confirmed which statement at which commit is recorded in the check details and a PR comment, and the Worker stores nothing itself.
Block merges with a required check: Add it as a required status check in branch protection and any PR nobody has attested cannot merge.
