GitHub App, free
TagBot
Know which pull requests need you first. Size, type, risk and complexity labels on every PR the moment it opens, with a summary comment showing the numbers. No AI, no configuration, free.
Pure arithmetic over the pull request's file list. The same PR always gets the same answer.
What it posts
Labels on the pull request, and a comment with the numbers
Roughly 55 possible labels, applied the moment a pull request is opened, reopened or updated. Here is what a medium-sized feature looks like.
- 📏 size:medium
- 🏷️ type:feature
- ⚠️ risk:medium
- 🧩 complexity:medium
- lang:typescript
- config:files
PR analysis summary
| Lines added | +234 |
|---|---|
| Lines deleted | −67 |
| Files modified | 8 |
| Complexity score | 6 / 10 |
| Risk assessment | MEDIUM |
Why medium risk: package.json changed. Dependency manifests are a sensitive path.
Excluded from analysis: package-lock.json (lock file).
Size
size:small up to 100 lines, size:medium up to 500, size:large above that.Type
One of revert, hotfix, feature, bugfix, documentation, testing, performance, refactor, maintenance, security, style or ci-cd.Risk
risk:high or risk:medium. No label when low.Complexity
complexity:high at a score of 7 or more, complexity:medium at 4 or more.Language
lang: labels for JavaScript, Python, Java, Kotlin, Scala, Groovy, C, C++, C#, HTML, styling, Swift, Dart, Go, Rust, Ruby, PHP, R, Lua and shell.Docs
docs:markdown, docs:restructuredtext, docs:asciidoc.Other
config:files, database:sql, infra:terraform, infra:docker, breaking-change and dependencies.When
On opened, reopened and synchronize. Pushes made by bots are skipped.
How the scores work
Plain arithmetic, explained
Complexity, 0 to 10
A capped, weighted sum of lines changed, file count, change indicators (config, tests, SQL and migrations, dependency manifests, deletions) and risk patterns, scaled down for documentation-heavy pull requests. A documentation-only PR scores 1.0.Risk: low, medium, high
A sensitive-path scan runs first: package.json and lock files, requirements.txt, Dockerfile, .github/workflows, database and migration paths, .env, config, security and auth paths, Bicep and Terraform. Any hit, or complexity of 8 or more, is high. Complexity of 5 or more is medium. Documentation-only with no sensitive file is low.Type
A conventional-commit prefix wins outright: feat:, fix:, hotfix:, ci:. Otherwise a word-boundary keyword scan of the title, body and file list.Insights
The comment notes lopsided additions or deletions above 100 lines, and lists the files excluded from analysis with the reason.
What it ignores
Noise is filtered out and named
Minified and generated files, build directories, binaries and media, lock files, very large data files and compiled output are excluded automatically, and each one is listed in the comment with the reason. A documentation-only pull request scores low, and a sensitive file still raises the risk.
Privacy
File names only, never file contents
- TagBot reads the pull request's file list: filename, additions, deletions and status. It never reads file contents or patches.
- Nothing is sent to a model. There is no AI dependency.
- It stores your GitHub account ID and organisation name, the installation timestamp and repository list, and aggregate statistics per repository (operation counts, files processed, lines changed, average complexity, risk counts) in Azure Table Storage, UK South.
- GitHub App permissions: Pull requests (read and write) and Metadata (read).
More on the security page.
Always free
No tiers, no caps, no metering
Zero configuration. Install it and it works on the next pull request.