
Agent Code Review Swarm
Spin up a multi-agent GitHub PR review swarm that posts structured findings on security, performance, and architecture before you merge.
Overview
Agent-code-review-swarm is an agent skill most often used in Ship (also Operate) that deploys specialized AI agents for comprehensive GitHub pull request reviews beyond static analysis.
Install
npx skills add https://github.com/ruvnet/ruflo --skill agent-code-review-swarmWhat is this skill?
- Multi-agent review swarm via ruv-swarm and Claude Flow MCP tools
- GitHub PR context: gh pr view JSON plus gh pr diff ingestion
- Security vulnerability, performance bottleneck, and architecture pattern checks
- Pre-hook enforces gh auth status before swarm starts
- Post-hook posts review results and evaluates quality gates on GitHub
Adoption & trust: 648 installs on skills.sh; 58.5k GitHub stars; 1/3 security scanners passed (skills.sh audits).
What problem does it solve?
You merge solo or with a tiny team and lack time for deep, multi-angle review on every PR.
Who is it for?
Indie builders using GitHub PRs who already use gh CLI and want orchestrated multi-agent review on real diffs.
Skip if: Repos without GitHub, teams forbidden from multi-agent MCP orchestration, or workflows that only need local lint without PR context.
When should I use this skill?
Invoke with $agent-code-review-swarm when you need comprehensive multi-agent GitHub PR review with swarm_init and task_orchestrate.
What do I get? / Deliverables
After a run, swarm agents analyze the PR diff, post review output to GitHub, and report whether quality gates passed.
- Posted GitHub review commentary from swarm agents
- Quality gate evaluation summary after post-hook
Recommended Skills
Journey fit
Spans multiple journey phases - primary shelf plus alternate fits below.
Automated PR review is a Ship gate: it runs when code is ready to merge but still needs human-grade critique at scale. Review subphase matches PR-centric orchestration with gh CLI diffs, swarm init, and quality-gate evaluation before release.
Where it fits
Run swarm review on PR #123 before merging a payments refactor.
Spawn security-focused agents on a diff that touches auth and secrets handling.
Re-swarm a hotfix PR after production incidents to catch regression patterns.
How it compares
Use instead of a single-pass linter when you want orchestrated agent specialization on the same PR diff.
Common Questions / FAQ
Who is agent-code-review-swarm for?
Solo and indie developers on GitHub who want automated, multi-perspective PR reviews with swarm tooling and quality gates.
When should I use agent-code-review-swarm?
Use it in Ship → Review before merging risky PRs; also in Operate → Iterate when revisiting merged code via follow-up PRs that need the same swarm treatment.
Is agent-code-review-swarm safe to install?
It requires gh auth, shell, and MCP swarm tools—review the Security Audits panel on this page and limit agent write access to repos you trust.
SKILL.md
READMESKILL.md - Agent Code Review Swarm
--- name: code-review-swarm description: Deploy specialized AI agents to perform comprehensive, intelligent code reviews that go beyond traditional static analysis tools: mcp__claude-flow__swarm_init, mcp__claude-flow__agent_spawn, mcp__claude-flow__task_orchestrate, Bash, Read, Write, TodoWrite color: blue type: development capabilities: - Automated multi-agent code review - Security vulnerability analysis - Performance bottleneck detection - Architecture pattern validation - Style and convention enforcement priority: high hooks: pre: | echo "Starting code-review-swarm..." echo "Initializing multi-agent review system" gh auth status || (echo "GitHub CLI not authenticated" && exit 1) post: | echo "Completed code-review-swarm" echo "Review results posted to GitHub" echo "Quality gates evaluated" --- # Code Review Swarm - Automated Code Review with AI Agents ## Overview Deploy specialized AI agents to perform comprehensive, intelligent code reviews that go beyond traditional static analysis. ## Core Features ### 1. Multi-Agent Review System ```bash # Initialize code review swarm with gh CLI # Get PR details PR_DATA=$(gh pr view 123 --json files,additions,deletions,title,body) PR_DIFF=$(gh pr diff 123) # Initialize swarm with PR context npx ruv-swarm github review-init \ --pr 123 \ --pr-data "$PR_DATA" \ --diff "$PR_DIFF" \ --agents "security,performance,style,architecture,accessibility" \ --depth comprehensive # Post initial review status gh pr comment 123 --body "🔍 Multi-agent code review initiated" ``` ### 2. Specialized Review Agents #### Security Agent ```bash # Security-focused review with gh CLI # Get changed files CHANGED_FILES=$(gh pr view 123 --json files --jq '.files[].path') # Run security review SECURITY_RESULTS=$(npx ruv-swarm github review-security \ --pr 123 \ --files "$CHANGED_FILES" \ --check "owasp,cve,secrets,permissions" \ --suggest-fixes) # Post security findings if echo "$SECURITY_RESULTS" | grep -q "critical"; then # Request changes for critical issues gh pr review 123 --request-changes --body "$SECURITY_RESULTS" # Add security label gh pr edit 123 --add-label "security-review-required" else # Post as comment for non-critical issues gh pr comment 123 --body "$SECURITY_RESULTS" fi ``` #### Performance Agent ```bash # Performance analysis npx ruv-swarm github review-performance \ --pr 123 \ --profile "cpu,memory,io" \ --benchmark-against main \ --suggest-optimizations ``` #### Architecture Agent ```bash # Architecture review npx ruv-swarm github review-architecture \ --pr 123 \ --check "patterns,coupling,cohesion,solid" \ --visualize-impact \ --suggest-refactoring ``` ### 3. Review Configuration ```yaml # .github$review-swarm.yml version: 1 review: auto-trigger: true required-agents: - security - performance - style optional-agents: - architecture - accessibility - i18n thresholds: security: block performance: warn style: suggest rules: security: - no-eval - no-hardcoded-secrets - proper-auth-checks performance: - no-n-plus-one - efficient-queries - proper-caching architecture: - max-coupling: 5 - min-cohesion: 0.7 - follow-patterns ``` ## Review Agents ### Security Review Agent ```javascript // Security checks performed { "checks": [ "SQL injection vulnerabilities", "XSS attack vectors", "Authentication bypasses", "Authorization flaws", "Cryptographic weaknesses", "Dependency vulnerabilities", "Secret exposure", "CORS misconfigurations" ], "actions": [ "Block PR on critical issues", "Suggest secure alternatives", "Add security test cases", "Update security documentation" ] } ``` ### Performance Review Agent ```ja