> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enclave.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Enclave in these docs is the code and cloud security platform at enclave.ai. It is not Open Enclave, Intel SGX or other hardware enclaves, or enclave.gg.
> People use Enclave in the web app at https://app.enclave.ai or the desktop app. These docs describe no public Enclave API or CLI, so don't invent endpoints, commands, or config files.
> Connecting an integration needs a person to sign in and approve access in a browser. Tell the user the exact step to take instead of saying you completed it.

# PR and dependency analysis

> Review every pull request for security issues and risky dependency changes before it merges.

PR review checks every pull request for security issues. It reviews the changed code and any changed dependencies, verifies what it finds, and comments on the pull request.

PR review works with [GitHub](https://docs.enclave.ai/integrations/github.md) and [GitLab](https://docs.enclave.ai/integrations/gitlab.md). It isn't available for Azure DevOps.

## Turn on PR review

PR review is on by default. Two switches control it:

* **For your organization:** the **Triggers** switch on **PR review** in **Workflows**.
* **For each repository:** the **PR Reviews** column in **Coverage → Repositories**.

You need the **Owner** or **Admin** role to change them.

## When a review runs

A review runs when a pull request is opened, reopened, marked ready for review, or gets new commits.

* Drafts aren't reviewed until they're ready.
* New commits cancel the older review.
* Pull requests from forks are reviewed.
* Pull requests with more than 300 changed files are skipped.
* When your monthly allowance runs out, Enclave comments to say it skipped the review.

To review a pull request on demand, ask Research: `Run the Workflow "PR review"`.

## What the review does

1. Analyzes the changed code, and the dependencies if a manifest or lockfile changed.
2. Drops issues that aren't real, aren't security issues, or don't point at the change.
3. Adjusts severity based on whether the code is reachable from the internet.
4. Saves the findings to **Risk** and comments on the pull request.

On GitHub, the review also adds a check named **Enclave / PR analysis**. Public repositories don't get comments.

> [!TIP]
>
> Start with the check as non-blocking. Make it required once your team trusts the signal.

## PR findings in Risk

Open **Risk → PR findings** to see every PR finding with its repository, pull request, and severity.

Open a finding to see the issue, its impact, and the affected lines. Click **AI fix prompt** to copy a prompt for your coding assistant.

PR findings don't have a triage status, and closing the pull request doesn't change them.

## Dependency analysis

When a pull request changes a manifest or lockfile, Enclave checks the changed packages for supply-chain risk, not just known CVEs. It looks for:

* Compromised or malicious packages
* Typosquats and untrusted packages
* Attacks hidden in routine version bumps
* Known vulnerabilities

For each changed package, Enclave weighs registry signals such as publish age, maintainer changes, and install scripts, and inspects the package code when something looks off.

Supported ecosystems:

| Ecosystem | Files |
| - | - |
| Python | `pyproject.toml`, `poetry.lock`, `uv.lock`, `requirements.txt`, `Pipfile`, `Pipfile.lock` |
| JavaScript and TypeScript | `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock` |

The binary `bun.lockb` format isn't supported.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.