AI Code Review — Catch Bugs Before You Merge

How it works

Code Review Board runs your diff through a three-phase adversarial review process instead of a single pass:

Phase 1 — Four reviewer lenses, one at a time. Security Skeptic, Reliability Realist, Maintainability Pragmatist, and Performance Pessimist each review the same code in turn, finishing one lens's notes before the next starts.

Phase 2 — Cross-examination. Every finding gets challenged or corroborated by the other three lenses — false positives get contested with a concrete reason, and issues that multiple lenses flag get marked as higher priority.

Phase 3 — Board verdict. Every finding is tagged CONFIRMED / CORROBORATED / DISPUTED, followed by one merge recommendation line you can actually act on.

Sample output

Illustrative sample, not a real run.

## Phase 3 — Board verdict
1. **[CORROBORATED]** Unparameterized SQL in refund handler (payments.js:42) — Security + Reliability both flagged this. Fix: use parameterized queries.
2. **[DISPUTED]** Possible stored XSS in note field — Security raised it, Maintainability countered: no render path exists in this diff. Your call.

**Merge recommendation:** Block merge — 1 CORROBORATED security finding.

Use cases

• Get a structured second pass on a PR before merging, without setting up a CI pipeline
• Push back on "looks good overall" reviews by requiring a concrete failure scenario for every finding
• Use inside Claude Code, Codex, or OpenClaw sessions directly — paste a diff and go

FAQ

Does this replace static analysis tools (linters, SAST)? No — it's a reasoning-based review layer, not a substitute for running your existing linter/type-checker/test suite.

What if my diff contains secrets or real customer data? Redact them before pasting. The Skill treats any secret it spots as a Security finding, but it has no server and does not collect your code itself; whatever you paste is sent as-is to your agent's model, and your agent or model provider may retain it under its own policy.