Jasper + GitHub: an AI first review on your pull requests
Install the Jasper GitHub App and pull requests in the repositories you choose get an AI review, with a summary and inline comments, before a senior developer looks.
What you can do
- Get a first review on pull requests in your client repositories, so seniors spend their time on the hard parts.
- Let juniors ask "@jasper explain" or "/jasper security" on a pull request instead of waiting for a lead.
- Review each client repository with its own review instructions, plus its AGENTS.md once Jasper has loaded it.
- On team plans, add a quality gate check and push the same branch protection to every repository.
- Paste a pull request, issue or commit link from a connected repository in Jasper chat and see a card for it, with check results for pull requests and commits.
What syncs
| Data | Direction | When |
|---|---|---|
| Pull request title, author and changes | GitHub → Jasper | When a pull request is opened and on each new push. |
| Review summary and inline comments | Jasper → GitHub | After each review. |
| Comments that mention @jasper or @hey-jasper, use /jasper, or ask a question in a review thread Jasper is part of, and Jasper's replies | GitHub ↔ Jasper | When the comment is posted. |
| Check runs: a supply-chain security check, plus the quality gate, naming and deployment checks you turn on | Jasper → GitHub | On pull request events. The security check runs on every reviewed push. |
| Files a push adds or changes, on any branch | GitHub → Jasper | On each push, scanned for secrets and malicious build files. |
| Build files on every branch | GitHub → Jasper | Every 4 hours, scanned for malicious code. |
| Repository list | GitHub → Jasper | On install, when you add or remove repositories, and daily. |
| Commits and member activity | GitHub → Jasper | Daily. |
| Organisation members | GitHub → Jasper | On install, and when you sync from the team page. |
| Branch protection rules and rulesets | Jasper → GitHub | When you save them in Jasper. |
Set up in 4 steps
Who can do this: Someone GitHub allows to install apps on your organisation or account, usually an organisation owner.
- Click Install on GitHub, or install the Hey Jasper app from GitHub.
- Choose the organisation or account, then all repositories or only the ones you pick.
- GitHub sends you back to Jasper. Jasper creates a workspace for that organisation or account, or reconnects the one it already has for it.
- Open a pull request. Jasper reviews it and comments on GitHub.
Permissions we ask for, and why
These are the permissions the Hey Jasper GitHub App holds today, exactly as GitHub lists them. Several are not used by any feature yet; we list them so you know what you grant. The app can read your code but not change it.
| Permission | Why Jasper needs it |
|---|---|
Pull requests: read and write |
Read pull requests, and post reviews with inline comments. |
Issues: read and write |
Post the review summary and replies as pull request comments. |
Checks: read and write |
Post check runs such as the quality gate, and show check results in chat link cards. |
Contents: read |
Read changes and files so the AI can review them in context. Jasper cannot push commits. |
Metadata: read |
List the repositories you give the app. GitHub requires it for every app. |
Members: read |
Sync your organisation's members into Jasper. |
Administration: read and write |
Only for branch protection and rulesets, if you manage them from Jasper. Reviews don't use it. |
Deployments: read |
List deployments for the project assistant, when you turn that source on. |
Workflows: read and write |
Meant for installing the Jasper review workflow. That doesn't work today, because it also needs write access to contents and to Actions secrets, which the app doesn't have. |
Commit statuses: read |
Not used by a Jasper feature today. |
Discussions: read and write |
Not used by a Jasper feature today. |
Dependabot alerts: read |
Not used by a Jasper feature today. |
Repository security advisories: read |
Not used by a Jasper feature today. |
Repository webhooks: read and write |
Not used by a Jasper feature today. |
Organisation administration: read and write |
Not used by a Jasper feature today. |
Organisation webhooks: read and write |
Not used by a Jasper feature today. |
Your data
- Jasper keeps a copy of the default branch of each repository it has reviewed on its servers, so the AI can read the files around a change. The copy is refreshed before a review when it is more than an hour old.
- That copy is deleted when you remove the repository from the app or uninstall it.
- Each review keeps its comments, the full instructions sent to the AI (which include the changes) and the AI's full reply.
- Reviews run on Anthropic's Claude. The AI sees the changes, the pull request title and author, your review instructions and any file in the copy it chooses to read.
- Jasper keeps the GitHub events it receives, such as pull request, comment and push events, in its logs.
Our privacy policy covers what we store, where, and for how long.
Limits and what is not synced
- GitHub only. There is no GitLab, Bitbucket or Azure DevOps support.
- Jasper can't commit to your repositories, so applying a suggested fix and installing the review workflow from Jasper don't work today.
- A review is skipped when your workspace has no reviews left, when automatic reviews are off for that repository, when that commit was already reviewed, or for a push within 5 minutes of a finished review. If the security check finds malicious code, Jasper requests changes instead of reviewing.
- Each push that is reviewed uses AI credits, more for a bigger change, and so does each reply from Jasper. Every workspace gets 250 free AI credits a month; talk to us when you need more.
- Jasper answers comments that mention @jasper or @hey-jasper, use /jasper followed by a command, or ask a question in a review thread Jasper is part of.
Common questions
Can Jasper change my code?
No. The app can read your code but not write to it, so it cannot push commits. It writes reviews, comments, check runs and, if you manage them from Jasper, branch protection rules and rulesets.
Which pull requests are reviewed?
Every pull request opened in a repository the app can see, and each new push to it, while your workspace has reviews left and automatic reviews are on for that repository. A push within 5 minutes of a finished review is skipped.
How do I stop Jasper reviewing a repository?
Remove the repository from the app's repository access in your GitHub settings. Jasper then deletes its copy of the code.
What can I ask Jasper in a comment?
Mention @jasper or start with /jasper, then explain, improve, security, docs, summary, review or help. You can also ask a question in your own words, such as "@jasper why does this loop start at 1?".
Why does the app ask for administration access?
Only so Jasper can set branch protection and rulesets on your repositories when you ask it to. Reviews do not use it.
Can we sign in to Jasper with GitHub?
Yes. GitHub sign-in is separate from the app and asks for read:org and user:email.
Works with
Other integrations
Checked against the product on 4 October 2026.