🔍 TL;DR: a CLI tool that fixes the missed files and drifting line numbers general-purpose AI agents tend to produce during code review, backed by a hybrid design battle-tested inside Alibaba. Title: alibaba/open-code-review URL: 📌 Highlights ⚙️ Hard constraints for precision-critical steps, AI only for dynamic judgment 📝 Generates structured, line-level review comments straight from Git diffs 🕵️ Full-file scan mode for auditing unfamiliar codebases 🛡 Built-in multi-language rules for NPE, thread-safety, XSS, SQL injection 🔌 Plugs into Claude Code, Codex, Cursor, and other coding agents 📊 Beats Claude Code on Precision/F1 across 50 repos and 200 real PRs 💰 Uses about 1/9 the tokens of comparable alternatives Getting battle-tested precision from thousands of internal developers as an open-source CLI feels like a genuinely useful shortcut. #CodeReview# #AIAgents#

# Practical and Useful Patterns for OpenAI Agent SDK 🌍 Don't expose all MCP tools blindly -- use filters, prompts, and caching for smart control. From permission scoping to dynamic filtering, here are patterns for safe and fast MCP usage. Minimize permissions with tool filters, fetch dynamic instructions via prompts, and reduce latency with caching -- three features that take MCP operations to production grade. 📌 Title: MCP -- Tool filtering / Prompts / Caching 🔗 URL: 🧩 Overview Passing all MCP server tools directly to an agent risks unnecessary tool calls and permission overreach. Use `create_static_tool_filter` to statically restrict allowed tools, or dynamic filter functions to conditionally expose tools based on runtime context (role, tenant, etc.). Fetch dynamic instructions from MCP servers with `get_prompt`, improve latency by caching the tool list with `cache_tools_list=True`, and clear the cache with `invalidate_tools_cache()` when tools change. 🛠 How to Use Import `MCPServerStreamableHttp` and `create_static_tool_filter` from `agents.mcp`. Pass `create_static_tool_filter(allowed_tool_names=["read_file", "write_file"])` to the `tool_filter` parameter of `MCPServerStreamableHttp` to restrict the agent to only `read_file` and `write_file` tools. 🏗 Practical Usage Patterns **Permission Scoping with create_static_tool_filter** Restrict available tools to the minimum required for each agent's role. For a read-only agent, create a filter with `create_static_tool_filter(allowed_tool_names=["read_file", "search_docs", "list_files"])` and pass it to `MCPServerStreamableHttp`'s `tool_filter`. For full access, set `allowed_tool_names=["read_file", "write_file", "delete_file", "search_docs"]`. The same MCP server can expose different tool sets depending on the agent's role. **Dynamic Filter to Hide danger_ Tools** Dynamically hide dangerous tools based on agent role. Import `ToolFilterContext` from `agents.mcp` and define a `role_based_filter` function. When ` is `"CodeReviewer"` and `"danger_")`, return `False` to hide the tool; otherwise return `True`. Pass this function to `MCPServerStreamableHttp`'s `tool_filter` for dynamic role-based tool filtering. **Dynamic Instructions from MCP Server with get_prompt** Fetch prompts from the MCP server to dynamically compose agent instructions. Create an `MCPServerStreamableHttp` and use it in an `async with mcp:` context. Call `prompt_result = await mcp.get_prompt("operation_guidelines")` to fetch a prompt from the MCP server (an optional second argument takes a dict of prompt arguments), then embed `prompt_result.messages[0].content.text` into the agent's `instructions` to dynamically compose agent behavior. **Latency Improvement with cache_tools_list** Cache the tool list to reduce unnecessary requests to the MCP server. Set `cache_tools_list=True` on `MCPServerStreamableHttp` to cache the tool list and reduce unnecessary requests to the MCP server. When tools are added or changed, call `await mcp.invalidate_tools_cache()` to clear the cache. 💡 Use Cases 🔒 Enforce least-privilege with create_static_tool_filter allowing only read_file/write_file 🎭 Hide danger_ tools from CodeReviewer with dynamic filters for role-based access control 📜 Fetch latest operational guidelines from MCP server via get_prompt for dynamic agent instructions ⚡ Enable cache_tools_list=True to reduce repeated tool-list fetch latency ⚠️ Caveats - Typos in `allowed_tool_names` won't raise errors -- the non-existent tool name is simply ignored. Double-check your tool names. - Dynamic filters run on every tool list retrieval, so avoid heavy logic that could impact latency. - With `cache_tools_list=True`, changes to tools won't be reflected until you call `invalidate_tools_cache()`. ✨ Combine filters, prompts, and caching to improve MCP tool safety, flexibility, and performance simultaneously. Start with static filters for permission scoping, then add dynamic filters and caching as needed! #OpenAIAgentSDK# #AIAgent#

Harness Engineering Practices P14. Independent Self-Critique Pass (Separate Generator and Critic Context) 🎯 Point Do you trust an agent that reviews its own code and says "looks good"? Reviews only function when separated from the author. 📝 Overview After implementation, critique the diff against the spec in a separate context (ideally with a different role prompt). To avoid the "I just wrote it so it must be correct" bias, the generator and critic must not share context. 🔍 Explanation For the same reason human code reviews are performed by someone other than the author, agent self-critique requires context separation. When generation and critique happen in the same context, the "why I wrote it this way" bias carries directly into critique, making problems easier to miss. In a separate context — ideally a different prompt or model instance — showing only the diff and spec enables a fresh-perspective review. This adds computational cost, but the defect-prevention payoff is significant. 🛠 How to Practice - After implementation, launch a separate context (new conversation session) and provide only the diff and spec for review - Give critics focused roles ("spec divergence," "security risks," "regression potential," etc.) - Where possible, use different models or prompts for generation and critique to ensure perspective diversity - Have critique results output in structured format so the harness can auto-decide actions (send fix instructions, report to humans) 💼 Use Cases - Issue-to-PR agents running a self-review with a different prompt before completion - Autonomous bug fixing: validating fix soundness in a separate context - Code generation: running security-focused reviews as a separate agent ⚠ Pitfalls A critic designed to "flag everything" produces a flood of trivial comments, creating infinite implement-fix-critique-fix loops. Give critics focused roles: "spec divergence," "security risks," "regression potential." Low-quality critics also risk unnecessarily modifying correct implementations. #HarnessEngineering# #CodeReview#

# Codex Features and Practical Usage 🔍 Open a PR and get back only the genuinely serious findings, not noise. Codex's GitHub integration posts automated code reviews scoped to high-priority P0/P1 risks. 🏷️ Title: PR Review (@/codex review) 🔗 URL: 📘 Overview Codex's GitHub integration has the AI review a pull request's diff and post high-signal feedback. By design it filters to only P0 and P1 issues, so review comments stay focused on high-priority risks instead of drowning you in nitpicks. ⚙️ How It Works ・For a manual review, comment `@/codex review` on the PR. Codex reacts with 👀 and then posts a GitHub code review. ・Enable Automatic reviews in settings and a review runs the moment a PR is opened, with no mention required. ・Steer the review with a "Review guidelines" section in a top-level `AGENTS.md`. Codex applies the closest `AGENTS.md` to each changed file, so you can nest deeper instructions for package-level scrutiny. ・Mentioning `@/codex` with anything other than `review` kicks off a cloud task using the PR as context, e.g. `@/codex fix the CI failures`. 🛠️ Practical Usage ・First enable the Code review toggle for your repo in the settings (Codex cloud setup is a prerequisite). ・To lock in your review lens, add a "Review guidelines" section to `AGENTS.md` with rules like "Don't log PII" and "Verify authentication middleware wraps every route." ・For a one-off focus, append it inline: `@/codex review for security regressions`. ・To go from review straight to a fix, comment `@/codex fix the P1 issue` and Codex starts a cloud task to address it. 💡 Use Cases On a team where reviewers are stretched thin, let Codex do a first pass to clear P0/P1 issues before human review, cutting down review round-trips. Codify non-negotiable concerns like security and PII handling in `AGENTS.md` so every PR is checked for them automatically. ⚠️ Caveats ・Requires Codex cloud setup on the repo and code review enabled for it. ・The manual trigger must be the exact string `@/codex review`. ・Automatic reviews depend on the toggle being configured correctly, so verify settings during onboarding. #OpenAICodex# #CodeReview#

Harness Engineering Practices P20. Make Legibility and Calibrated Uncertainty an SLO 🎯 Point Now that generation is cheap, the real bottleneck is "human review time." Diffs should be optimized not just for correctness, but for reviewability. 📝 Overview Optimize diffs for review time, not just correctness. Small, focused PRs. Explanations that tell "why." Explicit flagging of risky areas. Additionally, have the agent explicitly output "areas of low confidence" so the harness can route them to additional verification or human review. Calibrated uncertainty is more valuable than false confidence. 🔍 Explanation As agent generation speed increases, the bottleneck shifts from "writing code" to "reviewing code." Giant PRs, unexplained changes, confidently-presented but actually uncertain implementations — these explosively consume reviewer time. Treating legibility as an SLO (Service Level Objective) and measuring/optimizing PR size, explanation presence, and change rationale improves overall throughput. Having agents explicitly state "I'm not confident here" and "this needs human verification" lets reviewers focus on what matters. This is the most overlooked practice for building trustworthy autonomous agents. 🛠 How to Practice - Add "change rationale," "confidence level (high/medium/low)," and "review focus areas" fields to PR templates and require the agent to fill them - Set PR size limits and force splitting when exceeded - Require "low confidence" markers in agent output so the harness can route those areas to additional verification - Measure review time per PR and identify causes of long reviews (giant diffs, missing explanations, etc.) for improvement 💼 Use Cases - Issue-to-PR agents including change rationale and confidence markers in PRs - Code review agents suppressing low-confidence trivial comments and focusing on types humans miss - Migration: keeping per-unit PRs small and focused to distribute reviewer load ⚠ Pitfalls Over-optimizing for legibility can make agent output overly conservative. "Uncertainty expression" can also become noise — an agent that says "I'm not confident" about everything is useless. Calibration is key: accurately marking only genuinely uncertain areas is what creates value. Don't forget to measure review time either. Quantitatively tracking whether PR spam or giant diffs are crushing review bandwidth is the starting point for improvement. #HarnessEngineering# #CodeReview#

Burning tokens on AI code review? 🔥 This tool turns your codebase into a structural graph so the AI reads only relevant files — cutting tokens by a median of 82x. Title: tirth8205/code-review-graph URL: 🔥 Overview A local-first code intelligence tool that persists a structural map (graph) of your codebase via Tree-sitter parsing. It lets AI assistants review by reading only contextually relevant files instead of the whole repository. ❓ Challenges Solved AI code review tools waste tokens by re-reading large parts of the codebase on every review. ・In large monorepos, context bloats and both cost and latency worsen ・Analyzing change impact required scanning the entire project 💡 Methodology & How It Works A three-stage pipeline. ・Parsing: Tree-sitter builds ASTs, extracting functions, classes, imports, and call relationships ・Graph storage: nodes and edges persist in SQLite (no external database) ・Analysis: on changes, blast-radius analysis traces affected callers, dependents, and tests, returning minimal context It supports many languages, incremental updates under 2 seconds, MCP integration (30 tools), a GitHub Action, and D3.js visualization. 📊 Experimental Results ・Token efficiency: 38x-528x reduction (median ~82x across 6 repos) ・Impact prediction F1 score: 0.71 average ・CLI example: full context 12,921 tokens → graph context 762 tokens (~94% saved) #CodeReview# #AIAgents#

Code review taking shape in Delta ✨ An agent turns the change into a structured review guide beside its original thread. You can inspect the code, comment in context, and talk with the people and agents who built it. We use it daily, can't wait for everyone to try it very soon!

Code reviews detect defects 200% more often than most testing (Capers Jones, 12k+ projects). That’s why we built CodeCheck, automated code review that enforces complexity, architecture, and maintainability rules before issues reach production.

# Claude Code Features and Practical Usage 🚀 Just mention "@/claude" in a PR or issue and watch fixes, features, and reviews happen automatically. Claude Code becomes an AI teammate that works inside your CI. 📌 Title and Feature URL Title: GitHub Actions URL: 📝 Overview Claude Code GitHub Actions integrates Claude Code into your GitHub workflow. Mention "@/claude" on any PR or issue and Claude analyzes your code, creates pull requests, implements features, or fixes bugs. Built on the Claude Agent SDK, it is ideal for automating routine engineering tasks. 🔧 How It Works - It auto-detects whether to run in interactive mode (responding to @/claude mentions) or automation mode (running immediately with a prompt) based on your config. - It respects the repository's CLAUDE.md, following your project standards and existing code patterns. - Code runs on GitHub-hosted runners and uses Sonnet by default (Opus 4.8 can be selected). - Beyond the direct Claude API, it supports Amazon Bedrock and Google Vertex AI. 🛠 Practical Usage - The easiest setup is running "/install-github-app" inside claude in your terminal; it guides you through the GitHub app and secrets (you need repo admin rights). - For manual setup: install the Claude GitHub app ( add ANTHROPIC_API_KEY as a repository secret, and copy examples/claude.yml into .github/workflows/. - Use the action "anthropics/claude-code-action@v1". Pass instructions via "prompt" and CLI arguments via "claude_args". - claude_args examples: --max-turns 5 / --model claude-sonnet-4-6 / --mcp-config /path/to/config.json - Comment examples: "@/claude implement this feature based on the issue description", "@/claude fix the TypeError in the user dashboard component". 🎯 Use Cases - Mention on an issue to auto-create a PR that turns requirements into working code. - Request a standard review on a PR: "@/claude review this for security issues". - Use a schedule (cron) trigger to auto-generate a daily summary of yesterday's commits and open issues. - Wire in the code-review plugin to run its skill automatically on every PR update. ⚠️ Caveats - Never commit API keys directly to the repo; always reference GitHub Secrets (secrets.ANTHROPIC_API_KEY). - Costs accrue both as GitHub Actions minutes and API tokens. Use --max-turns and timeouts to prevent runaway jobs. - If Claude doesn't respond, confirm the comment uses "@/claude" (not "/claude") and that the app and secrets are configured. - v1.0 has breaking changes from beta: remove mode, change direct_prompt to prompt, and move CLI options into claude_args. #ClaudeCode# #CICD#