6 AI-pattern rules · 40 total · 3 engines

Who reviews the code
your AI agent writes?

Claude Code, Codex, Cursor write code fast — but they hallucinate imports, use eval(), swallow exceptions. This agent catches those patterns: 6 dedicated AI-pattern rules + AST structural analysis + LLM semantic review with cross-validation. Every issue tagged with its source engine.

40
Rules
9
Languages
93
Tests
12
Endpoints
cli.py — commit HEAD~1
$ python cli.py --commit HEAD~1 Analyzing 2 files · 3 engines... ✓ Review complete Score: 72/C Issues: 4 ● CRITICAL SQL Injection line 2 rule:sql_injection · confirmed → Use parameterized query ● MAJOR Hardcoded Secret line 6 rule:hardcoded_secret · confirmed → Read from env variable ● MAJOR eval() Usage line 7 ast:eval_usage → Replace with json.loads ─── engines ─────────────────── rule: 2 ast: 1 llm: 1 confirmed: 2
how it works

Three engines. One verdict.

A single rule engine finds known patterns. A single LLM hallucinates. AST analysis alone misses semantics. Running all three and cross-validating gives you determinism where it matters and depth where it counts.

01

Rule Engine — 40 patterns, zero API cost

Deterministic pattern matching across 9 languages. Security vulnerabilities, performance anti-patterns, AI hallucination signatures. Runs in milliseconds, works offline, never costs a token.

# matches in <5ms, no LLM call sql_injection → CRITICAL line 2 hardcoded_secret → MAJOR line 6 eval_usage → CRITICAL line 7
02

AST Analyzer — structural analysis

Python ast.parse walks the syntax tree to catch what regex can't: undefined variables, unused imports, duplicate definitions, empty functions, syntax errors. Deterministic, precise, zero false positives on structural issues.

# ast_analyzer.py — structural only undefined_var → MAJOR 'user_id' used before assignment unused_import → INFO 'os' imported but never used duplicate_def → MAJOR 'process_user' defined twice
03

LLM Semantic — the deep review

Receives rule + AST pre-scan results, then does what deterministic engines can't: logic errors, architecture flaws, business boundary violations. Confirms or denies rule hits, eliminating false positives.

// LLM receives pre-scan context, then: "User input flows into SQL query without sanitization — confirmed injection risk." → issue.source = "confirmed" // both agree → issue.confidence = 0.95 // auto-boosted
04

5-Dimension Scoring — quantified quality

Correctness, Security, Performance, Maintainability, Best Practice — each 0–100. Composite score weighted: security 30% + correctness 25%. Every issue links back to its source engine and rule ID.

security: 45/100 ████████░░░░░░ D correctness: 72/100 ██████████████ C performance: 85/100 ████████████████ B overall: 68/C
05

Fix Code — copy-paste ready

Every issue ships with a fix_code snippet. Rule engine auto-generates for 8 key patterns. LLM covers complex semantic fixes. One click applies directly to your input — no manual rewriting.

--- line 2 - query = f"SELECT * FROM users WHERE id = {user_id}" + query = "SELECT * FROM users WHERE id = ?" + cursor.execute(query, (user_id,))
06

MCP + REST + SARIF — integrate anywhere

10 MCP tools for AI agents. 12 REST endpoints for CI/CD. SARIF 2.1.0 export for GitHub Code Scanning and VS Code. PR URL review for GitHub pull requests. All on one server.

POST /v1/review → REST (CI/CD) MCP review_code → Agent tool MCP analyze_metrics → Agent tool POST /v1/sarif → GitHub Code Scanning POST /v1/review_pr → GitHub PR URL
try it

Paste code. Get a review.

Paste code or diff, click review. Or use CLI: python cli.py --commit HEAD~1

Code Review
Diff Review
Multi-File
Auto Fix
Click "Start Review" to see results
workbench

Live Workbench — free & instant

Deterministic engines run server-side — no LLM, no API key, millisecond latency. Try metrics, SARIF export, rule catalog, or PR URL review.

Metrics
SARIF Export
Rule Catalog
PR URL
Click a tab above and run — results appear here instantly.
api

12 endpoints. 10 MCP tools.

REST API and MCP tools coexist on the same server. SARIF export for GitHub Code Scanning. PR URL review for pull requests.

POST/v1/reviewReview source code, return 5-dimension scores + issues + fix code
POST/v1/review_diffReview Unified Diff, return change metadata + review report
POST/v1/review_filesMulti-file batch review, per-file scan + cross-file analysis
POST/v1/review_prReview GitHub PR or commit URL by fetching diff remotely
POST/v1/suggest_fixGenerate complete fixed version (fixed_code + change notes)
POST/v1/metricsCode quality metrics: complexity, function lengths, comment ratio
POST/v1/sarifExport SARIF 2.1.0 for GitHub Code Scanning / VS Code
GET/v1/rulesList all 40 rule engine rules
GET/v1/rules/{rule_id}View single rule details and fix guidance
GET/mcpRemote MCP streamable HTTP endpoint (10 tools)
GET/healthHealth check, returns deployment commit
GET/.well-known/xagent-verification.jsonDeployment proof — signed commit for hackathon judges