Vo — Build an AI code review bot in 30 minutes (Merge Mommy)
TL;DR
Claire Vo built Merge Mommy, a pull-request review agent, to solve the bottleneck that appears once AI writes most of the code: review capacity, not authoring capacity, becomes the constraint. The build is the point — one Codex session, one prompt plus “a few steering turns,” on Vercel Eve, which she calls “the simplest framework I’ve found for deploying AI agents in Slack and GitHub.” Chrome browser automation handled the Slack-bot and GitHub-app configuration. She argues the result is SOC 2-compatible because “the process is auditable, queryable, and in your risk policy” — the audit trail is a byproduct of the agent writing down its score.
The loop, in four steps:
- Read each PR once its CI checks pass
- Score it across six risk dimensions
- Auto-approve the low-risk band
- Escalate medium and high risk to Slack for a human decision (two clicks to merge)
The six risk dimensions — the transferable artifact here, and the reason this page exists:
| Dimension | What it asks |
|---|---|
| Blast radius | How much of the system does this touch if it’s wrong? |
| Reversibility | Can this be rolled back cleanly? |
| Data security | Does it touch secrets, PII, or access boundaries? |
| Ops impact | Does it change runtime, deploy, or infrastructure behaviour? |
| Verification gap | How much of this change is not covered by the tests that just passed? |
| Change surface | How large and how diffuse is the diff? |
Two of these — reversibility and blast radius — are the same axes that 2026-05-14-pochampally-assistant-or-actor-delegation-regret finds empirically drive users to withdraw trust from an agent, and that 2026-01-22-imda-model-ai-governance-framework-for-agentic-ai prescribes as the basis for placing human checkpoints. Verification gap is the most interesting of the six because it is the only one that treats the passing test suite itself as incomplete evidence — the exact failure mode 2026-05-20-zhao-specbench-reward-hacking-long-horizon-coding-agents measures as the reward-hacking gap.
Outcomes claimed: cleared Vo’s PR backlog on deployment. She cites Intercom as a comparison point — “5x’d PR approval speed and reduced revert rates” after putting AI into their review process.
The counterpart gate. Ryan Carson’s Land PR playbook — described to Vo in the episode two weeks later — solves the same bottleneck by the opposite route: instead of a scored risk band, it runs a fresh agent review with up to two loops and then produces a narrated video walkthrough the human watches before approving the merge. Scored triage and mandatory preview are two answers to one question, and neither auto-merges everything.
Dynamic-capabilities reading
digital-seizing/rapid-prototyping— the headline claim is 30 minutes from idea to a deployed, production-facing governance agent, in one Codex session. The build cost being near zero is what makes a bespoke risk policy viable at all.digital-transforming/redesigning-internal-structures— this is a review policy encoded as software: the decision of which changes need a human is moved out of team norms and into a scored, auditable pipeline.contextual/internal-enablers— the SOC 2 argument is the enabling condition: the bot is adoptable in a regulated shop precisely because its reasoning is written down and queryable.
Linked entities and concepts
- Entities: Claire Vo, How-I-AI, Lenny’s Podcast, OpenAI, GitHub
- Concepts: agentic-pull-requests, agent-oversight-and-delegation, agent-fleet-management, agentic-engineering
Scope and reliability
A build log by its author, published on her own show’s newsletter. No evaluation of the scorer’s accuracy: nothing here reports how often Merge Mommy auto-approves a change that later reverts, which is the only number that would establish whether the low-risk band is actually low-risk. The Intercom figure is second-hand and uncited. The six dimensions are worth adopting as a checklist; the auto-approve threshold is not worth adopting without measuring your own false-approve rate against it — particularly given that 2026-04-13-branco-lgtm-auto-merged-llm-agentic-prs finds mature repositories systematically declining auto-merge policies.