Home · Product
The platformNRD Sight reads the work, grades the artifact, and hands people the next prompt. Same analysis underneath. Two views on top.
A written, plain-English read on team health, wins, risks, and what to do next. Regenerated as the work changes, ready before you open it.
A principal-engineer pass on GitHub or Bitbucket Cloud, within minutes: material findings with tradeoffs, never style nitpicks. Posted inline on the exact lines, re-checked on every push, and closed automatically once fixed.
Per-person quality, business impact, trajectory, and growth — with the evidence, so 1:1s write themselves.
Did the change do what the ticket asked? Linked automatically from branches and commits, even when nobody tagged the issue.
A recurring whole-repository read: layering, debt hotspots, dependency rot, security architecture — with a health score you can track.
Every weakness becomes a hands-on program generated from that developer's real pull requests. Prompt steps teach how to brief an agent, not just type the fix.
Standing instructions for each repo, and a scoped prompt on every ticket: problem, acceptance, files to read, tests to add, what not to invent.
Team-level rollups for leads, and a deliberate rule: praise is public, comparison is private. Members never see a leaderboard.
Continuous scanning of code, secrets, CI and infrastructure, ranked by whether an attacker could really reach it. Each finding gets an owner, a deadline, and a fix verified against current code. When someone says it is fixed, AI checks the claim before it closes.
Every lockfile checked against OSV.dev across npm, PyPI, Go, Maven, Cargo and more. AI checks whether your code really uses each high or critical package, and a PR that adds a vulnerable version is flagged on the line.
Who fixed what and how — by hand, by re-check, by a push to the default branch, or by a reviewed claim — plus regressions and who still owns what is open. A credential removed from code but still in git history becomes one rotate-credentials item per repository, reopened if it comes back.
A built-in assistant that answers from your own analysis — who knows this service, what regressed last month, which risks are still open. It reads Sight's scores and findings, not your repository on demand.
A sentence about what you sell — or your website, which we read. Reviews weigh findings against your priorities, not a generic app.
Paste a public GitHub pull request URL and get one real review back, no repo access required. Or explore a full sample team in about two minutes.
A short weekly email, Monday by default, so the story reaches you even in the weeks nobody opens a dashboard.
No per-PR charges. Every plan includes a monthly AI allowance. If you use it up, pull request reviews and checks keep going (see below); other AI analysis waits for your next period unless you add credits. Overage is never charged unless you opt in.
A read-only API for your own dashboards, and an MCP server so your AI tools can read the NRD Sight data you permit. With get_pr_review, a coding agent pushes, waits for the review of that exact commit, fixes the critical and important findings, and pushes again. Works with Claude Code, Codex, Cursor and VS Code, with setup and agent instructions for each.
Single sign-on through your identity provider (SAML or OIDC), one-click compliance CSV exports, and reviews that check code against your own policy documents.
Export an evidence package mapped to SOC 2, ISO 27001, PCI DSS and HIPAA controls, and get security questionnaires drafted from your own evidence and policies, every answer with its sources.
One Data Processing Agreement for every plan, with the EU Standard Contractual Clauses and the UK Addendum. An owner reads it at /dpa, accepts it on the Billing page in about a minute, and can save a signed PDF.
Alongside the AI review, deterministic checks read the lines each pull request adds. They run on every PR, whether or not any AI allowance is left.
pull_request_target misuse, unpinned actions, curl | bash, static AWS keys in workflows, and Bitbucket Pipelines, GitLab CI, CircleCI or Jenkins pipelines that deploy with long-lived cloud keys from repository variables instead of OIDC.If your workspace uses its monthly AI allowance, PR reviews continue as usual from a reserve of 32% of the allowance; after that, the checks keep running on their own. You are never charged overage unless you opt in.
Off until you turn it on. An owner or manager sets it for the whole organization, a team, a repository, or one developer, and picks how firm it is.
Nothing is held. A shadow report shows what the gate would have blocked, so you see the effect before you enforce anything.
The pull request waits until each blocking finding is resolved or acknowledged.
The pull request waits until each blocking finding is fixed — verified on the next push — or someone records a reason.
/nrd wont-fix, /nrd false-positive, /nrd ack, /nrd override, and /nrd refresh, each recorded with who did it.Install the GitHub App or connect Bitbucket Cloud, and choose exactly which repositories to analyze. We never push code or change branches. If you turn it on, we post the review on the PR itself. Nothing is analyzed until you enable a repo. Revoke anytime. Optionally connect Linear or Jira to tie code to the roadmap.
A sentence about your company — or just your website, which it will read for you. Every review afterwards weighs findings against what actually matters to your business, not a generic app.
Executives land on the plain-English brief. Engineering leaders land on the full instrument. Switch anytime from your profile menu — same data underneath.
About five minutes after you enable a repository, First Look shows real reviews, scores and security findings from your own code. New pull requests are reviewed as they open, and your history fills in behind it.
Nothing analyzed until you enable a repo · cancel anytime