Turn on PR reviews per repository and review Mjolnir’s full-scan setup
The Configuration page does two jobs. It is where you switch Mjolnir PR reviews on for individual repositories, and it is a read-only view of how Mjolnir’s full scan is set up for a given pentest.Open it from Security testing > Full pentests > Pentest settings in the sidebar. If you have more than one Mjolnir-configured pentest, use the pentest selector in the page header to switch between them.The full-scan sections are read-only. To change any of them, use the Edit in Setup Wizard button, which takes you back to the wizard with the current configuration loaded as a draft. The button appears only once a pentest has a Mjolnir configuration.
The PR Reviews section lists every repository your connected GitHub integration can reach, each with a toggle. Turning a repository on is all it takes to start reviewing its pull requests. You don’t need a full-scan configuration or a completed Mjolnir run first.If you have connected Azure DevOps, a second PR Reviews · Azure DevOps section lists those repositories in the same way.Each row shows the repository name and the branch reviews run against. Switching a repository on expands its settings; collapse them again with the chevron to keep a long list readable.
Setting
Description
Default
Trigger mode
Review when a PR is opened, or review on every push. In open-only mode, use the Run Mjolnir Review button for later commits. When reviewing every push, commits that arrive in quick succession collapse into one review of the latest
Review on PR open only
Blocking severity threshold
Fail the GitHub Check on Critical only, High and above, Medium and above, or never block
Never block
Auto-suppression
When the same finding pattern is dismissed across several PRs, create a suppression rule for it automatically
On
Auto-suppression threshold
How many different PRs must dismiss a pattern before auto-suppression fires. The minimum is 2; a lower number is rejected and the field reverts
3
Every control saves as soon as you change it. The threshold field saves when you click away from it.
In open-only mode, when new commits land after a review, Mjolnir updates its comment on the pull request with a Run Mjolnir Review button that links back to Odin, so you can run the next review without leaving GitHub.
The Targets section shows the primary target URL Mjolnir tests, plus any extra domains in scope. These come from Step 2: Scope & Connectivity of the setup wizard.
The Repositories section shows the primary repository and any additional repositories Mjolnir analyses for this pentest, each with its branch and, where one is set, its subdirectory. These come from Step 3: Code & Documentation.
With no Mjolnir configuration and neither GitHub nor Azure DevOps connected, the page shows a Connect GitHub to enable PR reviews card instead of the sections above. Installing the GitHub App from there lists your repositories and lets you turn reviews on without going through full-scan setup.The same card also sits above the sections whenever GitHub is not connected. Connecting needs the Member role or higher; Read only members are told to ask a colleague.
