Graph based code review vs diff-only review
By Steven Van ·
Graphify explains how reviewing a pull request against a code graph catches broken callers that diff-only review misses, in hosted and local setups.
Graph based code review checks a pull request against a code graph of the whole repository, while diff-only review reads just the changed lines. Graphify published a comparison of the two approaches, aimed at bugs that sit outside the diff, such as a caller that relied on the old behavior.
How the two approaches differ
A diff-only reviewer, human or AI, sees the added and removed lines plus a little surrounding context. It needs no setup and works on any repository, but it cannot see who calls a changed function or which modules import a renamed constant.
A graph based reviewer starts from the diff, then follows calls, imports and references in the graph to the code a change can reach. Graphify lists these differences:
- Context: changed lines and nearby code, versus changed lines plus callers and dependencies.
- Broken callers: caught only if they are in the diff, versus caught through call edges.
- Renames and signature changes: the change is flagged, versus every use is checked.
- Noise: higher with diff-only review, which guesses about unseen code, and lower with graph review, where guesses become lookups.
- Setup: none for diff-only review, versus a code graph that stays current.
Where diff-only review falls short
The post gives three examples: a return type changes and a caller three files away still expects the old shape, a default argument changes and some callers relied on it, and a shared helper changes when only one of its twenty callers was tested. In each case the bug is in code the diff never shows.
Hosted review
Hosted Graphify reviews pull requests using your code graph. Findings appear on the pull request and on the Reviews page in the console. Reviews start when a pull request is opened, reopened or marked ready for review, and can be requested with @graphify review. Replies such as @graphify wrong finding teach reviews what to skip.
Reviews give advice. For a firmer answer, Graphify also runs formal verification on GitHub pull requests. For supported functions, it proves the changed version matches the previous one within checked bounds, or finds an input that differs.
Without hosted review
Open-source Graphify builds the graph locally under Apache 2.0, and its MCP server exposes get_pr_impact and triage_prs, which an agent can use to review an open pull request. Install it with uv tool install "graphifyy[mcp]". The CLI supports about 40 languages. Graphify indexes GitLab repositories, but formal verification runs only on GitHub pull requests.
