Command line (mh)

mh brings MergeHarbor reviews to your terminal. It reviews the changes on your machine — commits on your branch, staged and unstaged edits, new files — with the same rules, configuration and codebase context as pull request reviews, before anyone else sees them.

Install

brew install mergeharbor/tap/mh

Or download the archive for macOS, Linux or Windows (Intel or ARM) from the releases page, check it against checksums.txt, and put mh on your PATH.

Sign in

mh login

mh shows a code and opens your browser. Check that the code matches, choose the organization, and approve. The CLI receives an API key that acts as you in that organization; it appears under Settings → API keys, where you can revoke it. The key is stored in your user configuration directory, readable by you alone, and mh only hands the browser an https:// link on the server you are signing in to.

The key is yours, not a separate identity:

• It sees the repositories you see. Repository-group grants, team grants and mirrored code-host permissions apply to the key exactly as they apply to you in the console.
• It never holds more than your current role. If your role is lowered, the key is lowered with it on its next request; if it is raised, the key keeps the role it was signed in with (run mh login again to pick up the new one). Owners sign in as admins.
• It stops working when you leave the organization or your account is disabled, and it expires after 90 days.

For CI, create an API key in the console and either set MH_API_KEY in the environment or pipe it in:

echo "$MH_API_KEY" | mh login --with-token

Passing the key as a command-line flag (--api-key) still works but prints a warning: flags are visible in shell history and to other users of the machine. A key created under Settings → API keys is a standalone identity: it keeps the role and repository groups it was created with until it is revoked, so revoke and recreate it when those should change. A key limited to repository groups can only create keys limited to the same groups or fewer.

Self-hosted MergeHarbor: mh login --url https://mergeharbor.example.com (or MERGEHARBOR_URL). The server URL must use https://; plain http:// is accepted only for localhost.

Review before you push

mh review              # everything on this branch that is not on the default branch, plus uncommitted edits
mh review --staged     # only what you are about to commit
mh review --committed  # only what you are about to push
mh review src/billing  # only these paths

Findings print grouped by file with severity, explanation and any suggested change. Add --deep or --max for a more thorough review tier, which uses more of your plan’s review allowance.

The repository must be connected to your organization. Reviews of local changes count toward your plan like pull request reviews and appear in the console under Pull requests → Local reviews. Nothing is posted to your code host.

Exit code	Meaning
0	No finding at or above --fail-on (default major)
1	At least one finding at or above --fail-on
2	Invalid command or flags
3	Network, server or git error

Run it on every push

mh hook install

git push then runs mh review --committed and stops when a major finding turns up. Skip it once with git push --no-verify, or set MH_FAIL_ON=critical to block only on critical findings.

In CI

mh review --committed --base main --sarif --fail-on none > mergeharbor.sarif

--sarif writes SARIF 2.1.0 for code-scanning dashboards; --json writes the full result.

To stop a build on vulnerable or license-denied dependencies (needs the Security add-on):

mh scan --fail-on high

mh scan uploads the lockfiles and manifests in the current directory (installed packages and build output are skipped), or one SBOM with --sbom sbom.cdx.json. It exits 1 on a vulnerability at --fail-on severity or above, on a known-exploited vulnerability, or on a license your policies deny; --fail-on none only reports. Nothing is stored unless you add --record --repo-id <id>, which keeps the result as that repository’s uploaded inventory.

More commands

Command	What it does
mh status	The pull request for your branch, its latest confidence score and open findings
mh onboard	Signs in, checks the repository is connected, writes a starter .mergeharbor/config.yml; --hook installs the push hook
mh onboard --agent	Prints instructions your coding agent can follow to write review rules for the codebase
mh config check	Validates every .mergeharbor configuration file in the working tree
mh config explain <file>	Shows which configuration files, settings and rules apply to a file
mh import	Converts configuration from another reviewer (guide)
mh scan	Checks dependencies against your organization’s vulnerability and license policies (for CI)
mh mcp	Runs the MergeHarbor MCP server for coding agents over stdio