AI Toolbox
中文/EN
Home›Use cases›Create a code review assistant
Developer referenceEngineering teams, platform engineers, and technical leads

Create a code review assistant

Automatically identify defects, security risks, performance issues, and missing tests in pull requests

ARCHITECTURE

Five-stage workflow

01Ingest diffs, repository rules, and related code context
02Run static checks, tests, and dependency security scans
03Use a model to locate high-confidence issues and explain impact
04Attach recommendations to exact files and lines
05Track false positives, adoption, and escaped defects
STACK

Recommended components

Start with one component per capability and replace it only when evaluation data shows a clear gap.

GitHub REST API ✓ VerifiedDeveloper Tools · Read and manage GitHub repositories, issues, pull requests, Actions, and related development data.→Context7 ✓ VerifiedMCP Services · Bring current, version-matched development documentation into AI coding contexts.→Playwright MCP ✓ VerifiedMCP Services · Let AI agents control browsers through structured page state and accessible browser actions.→MCP TypeScript SDK ✓ VerifiedDeveloper Tools · The official TypeScript SDK for building MCP servers and clients.→
DELIVERY

From proof of concept to production

  1. 01Define the user journey, input and output schemas, permission boundaries, and success metrics.
  2. 02Build one end-to-end happy path with the smallest viable tool stack and a fixed evaluation set.
  3. 03Add authentication, timeouts, retries, fallbacks, audit logs, and human review for risky actions.
  4. 04Release to a limited audience, measure quality, latency, and cost, then expand with evidence.
CODE SAMPLE

Framework-neutral orchestration skeleton

TypeScript
type WorkflowInput = { request: string; userId: string };
type StageAdapter = (context: unknown) => Promise<unknown>;

const stages = [
  "Ingest diffs, repository rules, and related code context",
  "Run static checks, tests, and dependency security scans",
  "Use a model to locate high-confidence issues and explain impact",
  "Attach recommendations to exact files and lines",
  "Track false positives, adoption, and escaped defects"
];
const selectedTools = [
  "GitHub REST API",
  "Context7",
  "Playwright MCP",
  "MCP TypeScript SDK"
];

export async function runWorkflow(input: WorkflowInput, adapters: Record<string, StageAdapter>) {
  let context: unknown = { ...input, selectedTools };

  for (const stage of stages) {
    const adapter = adapters[stage];
    if (!adapter) throw new Error(`Missing adapter: ${stage}`);
    context = await adapter(context);
  }

  return context;
}

Implement each adapter on the server with the selected component’s official SDK or API. Never expose provider credentials in browser code.

LAUNCH CHECK

Production checklist

  • ✓Every stage has a defined owner, input, output, timeout, and failure state.
  • ✓Credentials and sensitive data stay server-side with least-privilege access.
  • ✓Model output is validated before it reaches a database, user, or external action.
  • ✓Sources, tool calls, prompts, versions, and human decisions are traceable.
  • ✓A fixed evaluation set covers normal, ambiguous, adversarial, and unavailable-tool cases.
  • ✓The workflow has a visible fallback and a manual recovery path.