Development

AI Code Review Assistant

A first-pass reviewer that reads the diff in repository context

Featured Verified Trending Advanced Agentic Workflow Mostly automated Freemium
Use this workflow
Est. time
~10 min
Est. cost
$0.45
Steps
7
Automation
Mostly automated
Trigger
GitHub event

Overview

Human review time is the scarce resource. This assistant does the first pass — the mechanical checks, the convention violations, the obvious correctness and security problems — so the human reviewer spends their attention on design and intent.

It posts comments; it does not approve or block. Merge authority stays with people.

Business value

Shortens review cycles and catches routine issues before a human spends attention on them.

Expected outcome

Every pull request receives a first-pass review with inline comments within minutes of opening.

Problems it solves

  • Review queues block delivery
  • Convention violations consume reviewer attention
  • Security issues slip through under time pressure
  • Review depth varies with reviewer workload

Who it is for

  • Engineering teams with meaningful PR volume
  • Open-source maintainers triaging contributions
  • Teams enforcing consistent conventions

Benefits

  • First-pass review arrives in minutes, not hours
  • Consistent standard regardless of who is on rota
  • Security patterns checked on every change
  • Human reviewers start from a triaged list

Limitations

  • Produces false positives — the human triage step is essential
  • Weak on architectural judgement and product intent
  • Needs repository retrieval to be useful on a large codebase
  • Must never gate merge on its own

Success metrics

  • Time to first review comment
  • Precision of flagged issues (accepted versus dismissed)
  • Defects caught before human review
  • Cycle time from PR open to merge

Implementation guide

Run it in comment-only mode for a month and track which comment categories your team actually accepts. Turn off the categories with poor precision — a noisy bot gets muted, and then it catches nothing.

Flow diagram

Every step in order, colour-coded by how much of it runs without a human.

Scroll to pan · use the controls to zoom, expand or export.

Steps

7 steps from trigger to result.

1

Pull request opened

GitHub 1 min Automated
Webhook fires with the diff, changed files and PR description.
InputPR payload
OutputReview job
2

Retrieve repository context

2 min Automated
Fetch the definitions, callers and tests around the changed lines — a diff read without context produces useless review.
InputChanged files
OutputContext bundle
  • This step is the difference between a useful reviewer and a linter with opinions
3

Review for correctness

Claude Sonnet 3 min Automated
Look for logic errors, unhandled edge cases, race conditions and broken assumptions.
InputDiff + context
OutputCorrectness findings
Prompt
Review this diff for correctness. You have the surrounding repository context.

Diff:
{{diff}}

Context:
{{context}}

For each issue found:
- file and line
- what is wrong
- a concrete failure scenario: specific inputs or state that produce the wrong result
- suggested fix

Only report issues you can describe a concrete failure for. Do not report style preferences here. If the diff looks correct, say so — a clean review is a valid result.
4

Review for security

Claude Sonnet 2 min Automated
Check for injection, authorisation gaps, unsafe deserialisation, secret exposure and dependency risk.
InputDiff + context
OutputSecurity findings
  • Anything touching authentication, authorisation, payments or user data should escalate to a named human reviewer regardless of the finding
5

Check conventions

1 min Automated
Compare against the repository's own conventions — naming, error handling, test placement, comment density.
InputDiff + conventions doc
OutputConvention findings
6

Post inline comments

GitHub 1 min Automated
Deduplicate findings, rank by severity and post them inline, capped so the PR stays readable.
InputAll findings
OutputPR comments
Expected result: A triaged comment set on the PR within minutes.
  • Cap the comment count — thirty comments on one PR gets the bot muted permanently
7

Human review and merge

5 min Manual Human review
A human triages the comments, reviews design and intent, and decides on merge.
InputPR + comments
OutputMerge decision
Expected result: Merge authority stays with a person.

AI tools

Each tool records the role it plays and whether it is required.

Integrations

Services this workflow connects to, and how each authenticates.

Prompt library

Every prompt in the workflow, in chain order. Swap the highlighted placeholders for your own values.

3. Review for correctness · User prompt · Claude Sonnet
Review this diff for correctness. You have the surrounding repository context.

Diff:
{{diff}}

Context:
{{context}}

For each issue found:
- file and line
- what is wrong
- a concrete failure scenario: specific inputs or state that produce the wrong result
- suggested fix

Only report issues you can describe a concrete failure for. Do not report style preferences here. If the diff looks correct, say so — a clean review is a valid result.
diff context

Prerequisites

Have these ready before you start.

LLM API key
A model with strong code reasoning and a large context window.
GitHub or GitLab
With webhook and PR comment permissions.
Repository access scope
Least-privilege token — read the diff and post comments, nothing more.
Conventions document Optional
Your actual standards, so it flags against yours rather than generic ones.

Use cases

Pre-review triage

Catch routine issues before a human opens the PR.

Shorter review cycles

Open-source contributions

Give first-time contributors immediate, consistent feedback.

Faster contributor onboarding

Security-sensitive repositories

Run a security pass on every change automatically.

Consistent security review

Metrics

Author estimates — treat them as a starting point and measure your own runs.

Execution time
~10 min
Estimated AI cost
$0.45
Token usage
25K
Success rate
87%
Automated
80%
Human review
20%

Accepts

codeAPIJSON

Produces

CodeSummaryReport

FAQ

Should it block merges?
No. Precision is not high enough to gate on, and a bot that blocks merges on false positives gets disabled within a week. Comment-only, human decides.
Was this helpful?
How do we stop it being noisy?
Cap comments per PR, require a concrete failure scenario before reporting a correctness issue, and disable the categories your team consistently dismisses.
Was this helpful?
Does our code get used for training?
That depends on your provider and plan. Business and enterprise tiers usually exclude it contractually — verify in writing before connecting a private repository.
Was this helpful?

Reviews

No reviews yet — be the first to share how this worked for you.

Write a review

You will be asked to sign in.