Provenance for code
You can't prove which parts. Not reliably, not per pull request, not in a way you'd stake a release on. Diffport can.
How it works
Connecting is read-only and takes about a minute. Everything after it happens on its own, as pull requests arrive.
A GitHub App with read access. No keys, no database, no agent installed anywhere.
Read · never write
Commits, trailers, bot actors and diffs. What is already in the repository, not a survey.
Machine, person, or untraced. Untraced stays untraced — it is never rounded up to human.
Destructive migrations, unreviewed high-risk merges, coverage falling. Email, Slack or a signed webhook.
Why now
Git records who committed a change. It has never recorded who wrote it, because until recently there was no difference worth tracking.
There is now.
A commit authored by a person, generated by an agent under their account, or written half by each are three different things arriving through the same pipe, and nothing in your toolchain tells them apart.
Proof, not screenshots
A conclusion you cannot interrogate is one you will eventually learn to ignore. Diffport shows the signals it read, what each one covered, and how confident it is in each.
Confidence is reported as the weakest link in the chain, never the strongest. A chain is exactly as sound as its worst step.
Reported confidence is the lowest of the signals that moved the number. One file carried no signal at all and is counted as untraced, not as human.
Three positions
Never inferred
The tempting move is to treat anything unattributed as person-written. It makes the numbers look better and the dashboard look complete. It is also a lie that gets more expensive every month. When Diffport has no signal it says untraced, and it will never quietly upgrade that to human to fill a gap.
Weakest link
Most systems report their most confident guess. Diffport reports its least. A conclusion is exactly as sound as the worst step used to reach it, and reporting anything higher is how a tool teaches you to stop believing it.
Not a defect
Diffport does not score AI code as risky. It changes how much review a change has to earn. Those are different claims, and conflating them produces a tool that punishes the thing your team is trying to do, which is ship faster.
What it does not do
“By construction” is a stronger promise than “we would never”, because it does not depend on anyone keeping their word.
No credentials, no queries, no copy of your data. The schema view is reconstructed entirely from the migration files in your pull requests.
Detection reads your repository. Which agent you use is a fact about your commits, not an integration Diffport has to go and buy.
Beyond what the connection you grant already allows. Diffport reads. It cannot push, cannot open a pull request, and cannot change a branch.
The catalog is data, not a ranking. Adding an agent to it is a fact about detection, never an endorsement.
Start with one
Diffport reads a repository's history and tells you what it can prove, what it cannot, and which parts it will not guess about.
