Multi-agent AI-powered code review system using Claude
Multi-agent AI-powered code review system using Claude. Finds semantic bugs, security vulnerabilities, and logic errors that linters miss.
``bash`
npm install -g @sanasai/ai-code-review
Or use with npx:
`bash`
npx @sanasai/ai-code-review scan
`bashInitialize configuration
ai-review init
What It Finds (That Linters Don't)
- Logic Errors: Off-by-one errors, incorrect conditionals, missing null checks
- Security: SQL injection, XSS, authentication bypasses, hardcoded secrets
- Concurrency: Race conditions, missing awaits, deadlocks
- Performance: N+1 queries, algorithmic inefficiencies, memory leaks
- Testing Gaps: Missing error path tests, flaky tests, untested edge cases
- API Misuse: Resource leaks, deprecated APIs, incorrect library usage
Features
$3
- Security: Runtime vulnerabilities, auth issues, crypto problems
- Quality: Logic errors, race conditions, semantic bugs
- Testing: Coverage gaps, flaky tests, edge cases
- Performance: Query patterns, complexity issues, memory leaks
- Accessibility: WCAG compliance, keyboard navigation
- Breakage Detection: API changes, deleted exports, schema modifications, behavioral changes$3
- AI-generated explanations for each finding
- Copy-to-clipboard for coding agents
- Bad/good code examples
- Real-world security impact examples
- OWASP/CWE references$3
JavaScript/TypeScript, Python, Rust, C/C++, C#, Java, Go, Ruby, PHP, Swift, Kotlin, DartUsage
$3
`bash
Staged changes (opens HTML report)
ai-review scan --stagedTerminal output only
ai-review scan --staged --no-htmlSpecific agents
ai-review scan --staged --agents security,testingJSON output
ai-review scan --staged --format json --output report.jsonCommit range
ai-review scan --base main --target HEADScan a single file
ai-review scan --file src/app.tsScan a directory recursively
ai-review scan --dir src/Scan multiple files with custom config
ai-review scan --dir src/ -c .ai-review.json --verbose
`$3
Git-based Review:
-
--staged: Review staged changes
- -b, --base : Base git reference
- -t, --target : Target git referenceFile/Directory Scanning:
-
--file : Scan a specific file
- --dir : Scan a directory recursively (respects exclude/include patterns)Output Options:
-
-f, --format : Output format (terminal, json, html)
- -o, --output : Output file path
- --no-html: Disable HTML report
- --no-open: Don't open browser automaticallyInteractive Fixing:
-
--fix: Interactively fix detected issues using Claude CLI (requires Claude CLI to be installed)Configuration & Control:
-
--agents : Comma-separated agents to run
- -c, --config : Path to config file
- -v, --verbose: Verbose outputNote: Cannot mix git options (
--staged, --base, --target) with file/directory scanning (--file, --dir)Interactive Auto-Fix
Fix detected issues directly with AI assistance using the
--fix flag. Claude will guide you through fixing issues one at a time with full context and explanation.$3
Install Claude CLI (required for interactive fixing):
`bash
npm install -g @anthropic-ai/claude-cli
or
brew install anthropics/brew/claude-cli
`For more installation options, visit: Claude CLI Repository
$3
`bash
Review and fix staged changes
ai-review scan --staged --fixReview and fix a directory
ai-review scan --dir src/ --fixReview specific agents and fix
ai-review scan --staged --agents security,quality --fix
`$3
1. Scan: AI reviews your code and finds issues
2. Preview: See list of all fixable issues
3. Select: For each issue, choose to:
- Y - Fix this issue
- n - Skip this issue
- s - Show full context
- q - Quit and stop fixing
4. Fix: Claude opens in your terminal and fixes all selected issues
5. Done: Type
exit when finished, and you're back in the CLI$3
`bash
$ ai-review scan --staged --fix✓ Starting AI code review...
✓ Running code review with 5 agents...
Found 3 issues eligible for fixing
Finding 1 of 3
────────────────────────────────────────────────────
🟠 HIGH - SQL Injection Vulnerability
File: src/api/users.ts:45
Agent: security
Description: User input is directly concatenated into SQL query
Code Snippet:
const query =
SELECT * FROM users WHERE id = ${userId};Suggestion: Use parameterized queries to prevent SQL injection
────────────────────────────────────────────────────
? Apply fix for this issue? (Y/n/s/q) Y
Issue: SQL Injection Vulnerability
Severity: HIGH
File: src/api/users.ts
Line: 45
Category: database
Description: User input is directly concatenated into SQL query
Current Code:
const query =
SELECT * FROM users WHERE id = ${userId};Suggestion: Use parameterized queries to prevent SQL injection
Please fix this issue by...
[Claude opens interactively - you apply the fix and type 'exit']
[Repeats for remaining issues...]
`$3
- Code Review: Before committing, review and fix issues immediately
- PR Preparation: Clean up issues before submitting pull requests
- Knowledge: Learn how to fix issues with Claude's explanations
- Efficiency: Batch fix multiple issues in one session
- Quality: Ensure code quality without manual searching
$3
- Interactive Session: Claude runs directly in your terminal
- Full Context: See complete issue details before deciding
- Batch Fixes: Fix multiple issues in one conversation for better context
- Selective Fixing: Choose which issues to fix - skip others
- Learn: See Claude's fixes and explanations in real-time
$3
1. Start Small: Use
--fix on staged changes first to test the workflow
2. By Agent: Use --fix --agents security to focus on specific issue types
3. Review Changes: After fixing, run git diff to review what was changed
4. Test: Run your test suite after fixes to ensure nothing broke
5. Claude CLI Settings: Configure Claude CLI for your preferred model/settings$3
"Claude CLI is not installed"
Install Claude CLI:
npm install -g @anthropic-ai/claude-cli"No findings are eligible for fixing"
Some issues (like breakage detection) aren't eligible for auto-fix. Only fixable issues are offered.
"Can't write to file"
Ensure your files have write permissions and aren't read-only.
"Changes weren't applied"
Claude runs interactively - make sure to save your changes in the Claude session and type
exit to return to the CLI.Configuration
$3
The tool will prompt for your API key on first use and save it to
~/.ai-review/.ai-review.json. Alternatively:`bash
Set environment variable (highest priority)
export ANTHROPIC_API_KEY="your-api-key"Or run init command to configure interactively
ai-review init
`API Key Priority:
1. Environment variable
ANTHROPIC_API_KEY
2. Global config ~/.ai-review/.ai-review.json
3. Interactive prompt (saved to global config)$3
Create
.ai-review.json in your project for custom settings:`json
{
"claude": {
"model": "claude-sonnet-4-20250514",
"temperature": 0.3
},
"agents": {
"security": { "enabled": true },
"quality": { "enabled": true },
"testing": { "enabled": true },
"performance": { "enabled": false },
"accessibility": { "enabled": false },
"breakage": { "enabled": true }
}
}
`Note: API keys should NOT be stored in project config files. Use the global config or environment variables instead.
File & Directory Scanning
In addition to git-based reviews, you can scan individual files or entire directories without requiring git changes.
$3
- Standalone Code Review: Review files independently of git history
- New Codebase: Audit code before committing to git
- Bulk Analysis: Review all files in a directory at once
- Offline Development: Code review without git tracking
$3
`bash
Review a single file
ai-review scan --file src/components/App.tsxReview an entire directory
ai-review scan --dir src/Review with specific agents
ai-review scan --dir src/ --agents security,qualityReview with custom output
ai-review scan --file src/app.ts --format json --output review.jsonVerbose mode to see scanning progress
ai-review scan --dir src/ --verbose
`$3
- Scans all matching files based on
includePatterns and excludePaths from config
- Binary files (images, compiled code) are automatically detected and skipped
- Files larger than maxDiffSize are skipped with a warning
- Entire files are treated as "added code" for review purposes
- All 6 specialized agents analyze the files as if they were new code$3
File/directory scanning respects your existing
.ai-review.json configuration:`json
{
"git": {
"includePatterns": ["/.ts", "/.js", "*/.tsx"],
"excludePaths": ["node_modules/", "dist/", "*/.test.ts"],
"maxDiffSize": 10000
}
}
`- includePatterns: Only scan files matching these glob patterns
- excludePaths: Skip files matching these patterns
- maxDiffSize: Maximum file size in lines (files exceeding this are skipped)
$3
- Scanning >50 files triggers a warning about API token consumption
- Use
--agents security,quality to run only essential agents
- Exclude large generated files and node_modules
- Consider scanning specific directories rather than entire reposCI/CD Integration
📦 Click to expand CI/CD integration examples
$3
Create
.github/workflows/ai-code-review.yml:`yaml
ai-code-review:
stage: code-review
image: node:${NODE_VERSION}
needs: [] rules:
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
before_script:
- npm install -g @sanasai/ai-code-review
- git fetch origin ${CI_MERGE_REQUEST_TARGET_BRANCH_NAME}
script:
- |
ai-review scan \
--base origin/${CI_MERGE_REQUEST_TARGET_BRANCH_NAME} \
--target ${CI_COMMIT_SHA} \
--verbose \
--no-open \
--agents performance,breakage
artifacts:
expose_as: "AI Code Review Report"
paths:
- report.html
when: always
expire_in: 30 days
allow_failure: true
`Setup:
1. Add
ANTHROPIC_API_KEY to repository secrets (Settings → Secrets and variables → Actions)
2. Commit the workflow file
3. Workflow runs automatically on pull requests---
$3
#### Basic Configuration
Create
.gitlab-ci.yml:`yaml
ai-code-review:
stage: test
image: node:18
only:
- merge_requests
before_script:
- npm install -g @sanasai/ai-code-review
script:
- |
ai-review scan \
--base origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME \
--target $CI_COMMIT_SHA \
--format json \
--output review-results.json \
--no-html
artifacts:
when: always
paths:
- review-results.json
expire_in: 30 days
variables:
ANTHROPIC_API_KEY: $ANTHROPIC_API_KEY
`#### Advanced: MR Comments on Critical Issues
`yaml
stages:
- test
- reportai-code-review:
stage: test
image: node:18
only:
- merge_requests
before_script:
- npm install -g @sanasai/ai-code-review
script:
- |
ai-review scan \
--base origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME \
--target $CI_COMMIT_SHA \
--format json \
--output review-results.json \
--agents security,quality \
--no-html
artifacts:
when: always
paths:
- review-results.json
expire_in: 30 days
allow_failure: true
variables:
ANTHROPIC_API_KEY: $ANTHROPIC_API_KEY
comment-on-mr:
stage: report
image: node:18
only:
- merge_requests
dependencies:
- ai-code-review
before_script:
- npm install axios
script:
- |
node -e "
const fs = require('fs');
const axios = require('axios');
const results = JSON.parse(fs.readFileSync('review-results.json', 'utf8'));
const criticalIssues = results.findings?.filter(f =>
f.severity === 'critical' || f.severity === 'high'
) || [];
if (criticalIssues.length === 0) {
console.log('No critical issues found');
process.exit(0);
}
const comment = \
## 🚨 AI Code Review Found \${criticalIssues.length} Critical/High Issues\n\n\ +
criticalIssues.slice(0, 5).map(issue =>
\### \${issue.title} (\${issue.severity})\n\ +
\- File: \\\\${issue.file}:\${issue.line}\\\\n\ +
\- Description: \${issue.description}\n\
).join('\n'); axios.post(
\
\${process.env.CI_API_V4_URL}/projects/\${process.env.CI_PROJECT_ID}/merge_requests/\${process.env.CI_MERGE_REQUEST_IID}/notes\,
{ body: comment },
{ headers: { 'PRIVATE-TOKEN': process.env.GITLAB_TOKEN } }
).then(() => console.log('Comment posted'))
.catch(err => console.error('Failed:', err.message));
"
when: on_failure
allow_failure: true
`Setup:
1. Go to Settings → CI/CD → Variables
2. Add
ANTHROPIC_API_KEY (mask and protect)
3. For MR comments, add GITLAB_TOKEN with api scope
4. Commit .gitlab-ci.yml---
$3
Add to
Jenkinsfile:`groovy
pipeline {
agent any environment {
ANTHROPIC_API_KEY = credentials('anthropic-api-key')
}
stages {
stage('AI Code Review') {
steps {
sh 'npm install -g @sanasai/ai-code-review'
sh """
ai-review scan \
--base origin/main \
--target ${env.GIT_COMMIT} \
--format json \
--output review-results.json \
--no-html
"""
archiveArtifacts artifacts: 'review-results.json'
}
}
}
}
`Setup:
1. Add
ANTHROPIC_API_KEY as Jenkins credential
2. Update Jenkinsfile in repository---
$3
Create
.circleci/config.yml:`yaml
version: 2.1jobs:
ai-code-review:
docker:
- image: cimg/node:18.0
steps:
- checkout
- run:
name: Install AI Code Review
command: npm install -g @sanasai/ai-code-review
- run:
name: Run AI Code Review
command: |
ai-review scan \
--base origin/main \
--target $CIRCLE_SHA1 \
--format json \
--output review-results.json \
--no-html
- store_artifacts:
path: review-results.json
workflows:
version: 2
review:
jobs:
- ai-code-review:
filters:
branches:
ignore: main
`Setup:
1. Add
ANTHROPIC_API_KEY in CircleCI project settings
2. Commit configuration file---
$3
1. API Key Security: Always use CI/CD secrets, never commit keys
2. Target Specific Agents: Use
--agents security,quality for critical-only reviews
3. Exit Codes: Tool exits non-zero on critical issues
4. Caching: Cache npm installations to speed up CI
5. Conditional Runs: Only run on PRs/MRs to save API costs
6. Artifact Storage: Always store JSON reports as artifacts
7. Fail on Critical: Configure CI to fail on critical/high severity$3
Cache Dependencies (GitLab)
`yaml
cache:
key: ${CI_COMMIT_REF_SLUG}
paths:
- .npm/
`Parallel Agent Execution (GitLab)
`yaml
security-review:
script: ai-review scan --agents securityquality-review:
script: ai-review scan --agents quality
`Scheduled Full Codebase Reviews
`yaml
scheduled-review:
only:
- schedules
script:
- ai-review scan --base HEAD~100 --target HEAD
`$3
Issue: Pipeline fails with "ANTHROPIC_API_KEY not set"
Solution: Ensure the environment variable is added to CI/CD settings and properly masked
Issue: "git diff returned no changes"
Solution: Ensure
fetch-depth: 0 (GitHub Actions) or full clone is enabledIssue: High API costs
Solution: Use
--agents security,quality to run only essential agents in CIWhy Use This Instead of Linters?
| Linters | AI Code Review |
|---------|----------------|
| Missing semicolons | SQL injection vulnerabilities |
| Unused variables | Race conditions in async code |
| Formatting issues | Off-by-one errors |
| Import order | N+1 query patterns |
| Naming conventions | Missing null checks |
Linters find style issues. AI finds bugs.
Configuration Commands
`bash
Show current config
ai-review config showValidate config
ai-review config validateShow config file path
ai-review config path
``Apache-2.0
---
Built with ❤️ by Sanas AI Engineering