Farol is a free, open-source CLI and GitHub Action designed to help code reviewers prioritize their attention by identifying which changes pose the greatest risk.
According to the tool’s documentation, the core problem farol addresses is reviewer attention: when approval authority is spread across all pull requests, even simple changes can slip through unexamined. Farol comes after AI code review agents have already commented on individual lines—it provides the human approver with what AI cannot reliably deliver: a risk assessment of the entire merge and which files warrant the closest scrutiny.
The tool generates three key outputs. First, it maps what the change reaches—every existing page, API operation, RPC method, job, and script that runs the changed code, with call chains to each. Second, it assigns a risk verdict (fast track, quick review, or careful review) and a 0–100 risk score based on reach, diff coverage, security findings, contract breaks, and dependency changes. Third, it highlights the riskiest files first, with inline diffs, untested lines marked, and a checklist of what to test manually.
Farol distinguishes itself from AI reviewers by using static analysis—compilers’ own views of code—rather than probabilistic models. This means the same pull request always receives the same risk assessment, and every claim comes with its call chain. The tool builds a declaration graph using actual compilers: the TypeScript type checker, go/types, and Python’s AST.
The tool detects contract breaks before they reach clients, identifying removed response fields, new required parameters, changed types in GraphQL, FastAPI, Go handlers, and gRPC, along with the services calling each endpoint. It integrates with existing CI infrastructure, reusing coverage, lint, security, and audit reports rather than running them twice.
Farol runs locally or in CI runners and never executes user code or sends it anywhere. It requires Node.js 22+ and git, plus language-specific tools: go for Go projects and Python 3.11+ for Python. Setup involves creating a farol.config.json file at the project root, with configuration varying by stack (React Router, Next.js, TypeScript APIs, Go, Python).
The tool is free under the MIT license and can be run with npx or installed globally. It comments on every pull request and never blocks a merge. According to its documentation, it operates on the principle that “review effort follows the risk of the change,” a principle the Claude Code team also describes in their code review process.
Key facts
- Farol is open-source (MIT license) and runs locally or in CI without sending code anywhere
- It generates deterministic risk scores (0–100) and verdicts based on reach, coverage, security findings, and contract breaks
- The tool builds declaration graphs using actual compilers to map what code changes reach
- It integrates with existing CI reports for coverage, lint, security, and audit findings
- Farol supports React (Router, Next.js, TanStack Router), TypeScript APIs, Go, and Python (FastAPI, Flask, Django, Celery)
- It requires Node.js 22+, git, and language-specific tools; setup is a single-line config file