Open source · For code and for office documents
Changes pile up faster than anyone can read them: pull requests written with AI assistants, budgets and contracts edited by many hands. Probe compares each new version with the one you last trusted, puts the few modifications that need your judgment in front of you, and shows why.
Latest v0.5.1 · Findings come from fixed rules, not from a model · AI optional.
Both tools start from the version you last reviewed, flag the risky modifications with fixed, explainable rules, and keep a record of what was checked. An AI model can help explain a finding; it never decides what is flagged, and nothing leaves your machine unless you choose it.
For developers, tech leads and CI pipelines.
For finance, legal, sales and operations teams, and anyone who shares files.
| Probe for code | Probe Desktop | |
|---|---|---|
| You are | A developer, a reviewer, a platform team | A controller, a lawyer, a manager, an assistant |
| What changes | Source code, in Git commits and pull requests | Word, Excel and PowerPoint files, in OneDrive or Google Drive |
| The reference | The base branch of the pull request | The last version someone marked as reviewed |
| What it looks for | Security-sensitive code, removed validation, API and dependency changes, failing or missing tests | Hard-coded formulas, shrunk ranges, changed amounts, dates and obligations, hidden sheets or slides, macros |
| Evidence | Checks run in a sandbox, reproduced issues, a JSON and Markdown report | The before and the after of each flagged change, and who saved it last |
| How it runs | A command-line tool in your terminal or CI, or the Hub for a whole account | An application in the taskbar or the menu bar, watching in the background |
A budget passed between five people, a contract reworked by the other party, a board deck updated the night before. Nobody re-reads everything, and nobody should have to. Probe Desktop watches the folders your team already uses and shows you the modifications that change a number, a commitment or a calculation, with the before and the after.
=SUM(A1:A3)
=SUM(A1:A2)
=A2*2
400
The supplier shall deliver before 15/03/2026.
The supplier may deliver before 15/03/2026.
The price is set at €12,000 excluding VAT.
The price is set at €15,000 excluding VAT.
AI assistants write large pull requests fast. Probe tells you which lines to read first: it maps the diff to risk signals, runs your checks in disposable containers, tries to reproduce issues with differential tests, and hands you a focused review plan with traceable evidence. A command-line tool for Windows, Linux and macOS, and a Docker hub for a whole GitHub or GitLab account. Try it in 2 minutes →
AI-written code gets predictable when the agent announces its work first. Probe measures the risk of the plan before any code is written, then checks that the change did exactly what was announced. A change that follows a low-risk plan and passes its checks can merge without a human reading the diff; everything else goes to review, with the reasons.
probe plan has the agent simulate the change read-only. Fixed rules, not the model, flag critical paths, public API and dependency changes, widely used or untested code. A flagged plan goes to a human before any code is written.
The plan becomes a contract: the files, symbols and dependencies the agent may touch. It implements that, and only that.
probe review --plan re-assesses the plan, runs the checks in the sandbox and compares the diff with the contract: every unplanned file, unannounced API change, critical path or dependency is reported.
Conforming change, low-risk plan, checks passed, nothing else flagged: no human review required, exit 0, the pipeline merges. Otherwise exit 2: a human reviews the pull request, starting from the listed reasons.
# 1. before coding: plan, and let a human validate a flagged plan
probe plan --intent-file task.md --ci
# 2. the agent implements .probe/PLAN.json
# 3-4. in CI: conformance, checks and the gate (exit 0 = merge, 2 = review)
probe review --base origin/main --plan .probe/PLAN.json --ci
Plan conformance: conforming; 0 high, 0 medium, 0 low differences from the plan.
Plan gate: no human review required (low-risk plan, conforming change, checks passed, nothing else requests review).The gate is a process decision, not a proof of correctness: your trusted policy decides what is critical and which tests run, and any doubt sends the change to a human. How the gate decides.
Tests, vet, build and coverage all passed on this change. It also dropped the refund amount validation and let the support role issue refunds. Probe put both at the top of the review plan, among 19 flagged lines out of 125.
The expensive part of reviewing an AI-assisted pull request is not the risky lines. It is finding them among the helpers, tests and docs around them, then working out whether a suspicion is real. Probe does that sorting and gathers the evidence before you open the diff.
payment/refund.go, where the report shows the removed validation.A deduplicated review surface counted in real changed lines, so large generated changes shrink to the parts that touch authentication, payments, validation, dependencies or public APIs.
Your test, typecheck, build and coverage commands run in disposable, network-less containers. Nothing of the candidate executes on your machine.
Unverified areas and incomplete checks are listed explicitly, and --ci turns them into an exit code. You know what was covered and what still needs your judgment.
Excerpt of .probe/CONFIDENCE_REPORT.md, produced by probe review HEAD~1..HEAD --reviewer=false --ci (v0.3.0) on a small shop repository. The commit added catalog helpers with tests, reworked refunds and touched authorization. No AI provider was used.
## Change Summary
120 additions / 5 deletions · 5 files changed
Exit code: 2. No confidence percentage is assigned.
## Automated Checks1
- PASS test (check-1; exit 0; 5982 ms)
- PASS typecheck (check-2; exit 0; 4866 ms)
- PASS build (check-3; exit 0; 2835 ms)
- PASS coverage (check-4; exit 0; 6416 ms)
## Reproduced Issues2
No issue was reproduced by a passing baseline
and failing candidate experiment.
## Suggested Human Review3
- high auth/auth.go:7 (new): Authentication or
authorization function body changed
- high payment/refund.go:21–22 (new): Payment-sensitive
function body changed
- high payment/refund.go:25–26 (new): Exported Go
declaration added; Payment-sensitive function body changed
- high payment/refund.go:21 (old): Configured sensitive
path changed; No nearby test file changed;
Possible input validation removed
- medium catalog/format.go:9 (new): Exported Go
declaration added
… 11 more medium signals in catalog/
## Review Surface4
Focused review: 19 / 125 changed lines.
## Changed-line Execution5
Of 67 added Go lines, 44 were executed at least once,
0 were not executed, 23 are not inside any
instrumented block.Both refs resolve to commit IDs. Renames, deletions, binaries and merge-base semantics are handled; only committed files are reviewed, so local edits never leak into the result.
Go AST comparison, labelled lexical heuristics and sensitive-path rules flag authentication, payments, dependencies, removed validation, unsafe constructs and missing tests in Go, TypeScript/JavaScript, Python and Rust.
Your test, typecheck and build commands run as argv arrays in disposable, non-root, network-less containers with CPU, memory, PID and time limits.
An optional reviewer writes temporary tests. A test that passes on the baseline and fails on the candidate supports a reproduced issue; anything else stays UNVERIFIED.
Try it on your last commit with no configuration, no Docker and no API key. When you adopt it, commit a policy to your base branch: it is read from the base, so a pull request cannot loosen its own rules.
# try it: compare with the previous commit
probe lint HEAD~1..HEAD
# adopt it: once, in your repository
probe init
git add .probe.json && git commit -m "Add review policy"
# on every pull request
probe review --base main --ciThe hub is the companion Docker image. Run one container, sign in with GitHub or GitLab, and every repository still missing a .probe.json gets a policy proposed in one click, previewed before it is committed to the default branch.
Repositories that have a policy can be watched: each new commit is analyzed and its report opens on its own. A severity slider filters the alerts from low to critical, and clicking one unfolds every modification it concerns, with the flagged lines highlighted in the diff.
One Docker container, no database, no external service — so a company can deploy it internally against its own GitHub Enterprise or GitLab instance. In its default mode it never executes the analyzed code.
Hosted at app.probe.technology — the same image you can run on your own network.
# one container, on your own network
$ docker run -p 8080:8080 \
-e PROBE_HUB_BASE_URL=https://hub.example.com \
-e PROBE_HUB_GITHUB_CLIENT_ID=... \
-e PROBE_HUB_GITHUB_CLIENT_SECRET=... \
-v hub-data:/var/lib/probe-hub \
gvinsot/probe-hub
Sign in · bootstrap the missing policies · watch pushes
Reports open by themselves, filtered by severity.Deduplicated review ranges with old and new coordinates, counted in actual changed lines, ranked by severity.
Generated tests run on baseline and candidate in fresh environments. Go execution is verified from structured test events.
Optionally measure which added Go lines a recorded run executed — reported as an observation, never as proof of testing.
A static index of Go, TypeScript/JavaScript, Python and Rust lists the unchanged callers of each changed function and the existing tests that reach it.
Impacted and changed baseline tests, differential fuzzing and mutation of added lines run on base and candidate, recorded as evidence, never as a verdict.
probe plan assesses an agent's plan before any code exists; --plan then flags every file or exported API the change touched without announcing it.
Bring any OpenAI-compatible provider. Tools are bounded: redacted file reads, search and test runs. No shell, no URL fetcher.
A reusable GitHub Actions workflow, meaningful exit codes, JSON reports with commit IDs, evidence and artifact hashes, plus SARIF and a PR comment holding only evidence-backed findings.
Coding agents run lint and review before handing work over, and report what was reproduced and what remains open.
A review tool earns trust by being precise about its limits. Probe assigns no confidence percentages and never approves a change on a model's word. For code, it lifts human review only through the plan gate, when a low-risk plan was followed and every automated check came back clean. For documents, a person always decides.
Open source, AGPL-3.0 licensed. A command-line tool for code, an application for documents, both published with every release.