Automatic Multi-File Code Review Agent
This agent performs automated code review across multiple files simultaneously, analyzing quality, security, performance, and architectural consistency. It produces a structured report with recommendations prioritized by severity, refactoring suggestions, and corrected code snippets ready to integrate.
For who
Developers, tech leads, and development teams looking to automate and systematize their code reviews before merge or deployment.
Input
Le code source de 2 à 10 fichiers à reviewer, collés avec leur nom de fichier en en-tête (ex: // fichier: src/auth.ts). Peut inclure tout langage : JavaScript, TypeScript, Python, Java, Go, etc.
steps (4)
File Inventory and Mapping
promptAnalyzes the structure of submitted files and identifies dependencies between them.
Quality Analysis and Bug Detection
promptExamines each file to detect bugs, code smells, and best practice violations.
Security Audit and Compliance
promptDetects security vulnerabilities and verifies compliance with standards.
Recommendations and Corrected Code
promptSynthesizes all analyses and produces fixes ready to integrate.
Output
Rapport de code review complet en Markdown contenant : cartographie des fichiers, liste des bugs et code smells priorisés, audit de sécurité OWASP, correctifs de code prêts à intégrer, recommandations de refactoring et checklist de validation.
Example
Input
// file: src/controllers/userController.ts
import { db } from '../db';
export async function getUser(req, res) {
const user = await db.query(`SELECT * FROM users WHERE id = ${req.params.id}`);
res.json({ password: user.password, ...user });
}
// file: src/routes/api.ts
import { getUser } from '../controllers/userController';
router.get('/user/:id', getUser);
// file: src/middleware/auth.ts
export function checkAuth(req, res, next) {
if (req.headers.token == 'admin123') next();
else res.status(401).send('Unauthorized');
}Output
## Executive Summary
**Score: 22/100** — Changes required
- 3 critical, 2 major, 1 minor
### Top 3 Urgent Issues
1. **SQL Injection** (userController.ts:3) — Direct concatenation of req.params.id
2. **Password Exposure** (userController.ts:4) — Password hash is returned in the API response
3. **Hardcoded Secret** (auth.ts:2) — Admin token in plain text in source code
### Critical Fix #1 — SQL Injection
```typescript
// BEFORE (vulnerable)
const user = await db.query(`SELECT * FROM users WHERE id = ${req.params.id}`);
// AFTER (secure)
const user = await db.query('SELECT id, email, name FROM users WHERE id = $1', [req.params.id]);
```
[...full report with all fixes, recommendations and checklist]Customization
| Parameter | Description | Default |
|---|---|---|
| review_standard | Standard ou guide de style Ă appliquer lors de la review (ex: Airbnb, Google, conventions internes) | Bonnes pratiques universelles (SOLID, Clean Code, OWASP Top 10) |
| severity_filter | Niveau minimum de sévérité à inclure dans le rapport (critique, majeur, mineur, tous) | tous |
| focus_areas | Domaines d'analyse prioritaires séparés par virgules (sécurité, performance, maintenabilité, tests) | sécurité, qualité, maintenabilité |