AgentReview

AI writes the code. AgentReview reviews it.

AgentReview is an independent security reviewer for AI-generated code. It works alongside your existing AI coding agent — Copilot, Claude Code, Cursor, Codex, or any other — to detect security vulnerabilities in code changes before they reach production.

Why?

AI coding agents are incredibly productive. They write implementations fast. But speed without security review creates risk.

AgentReview provides the missing piece:

Developer gives task to AI agent
         ↓
AI agent modifies code
         ↓
AgentReview detects & reviews changes
         ↓
Security findings appear in VS Code
         ↓
Developer clicks "Fix with Agent"
         ↓
AI agent receives precise remediation instructions
         ↓
AgentReview re-runs → vulnerability resolved ✅

AgentReview is NOT another coding agent. It's the security layer around your coding agent.

Features

• 🔍 Git Change Detection — Reviews only what changed, not the entire repository
• 🛡️ 10 Security Detectors — SQL injection, command injection, XSS, SSRF, path traversal, hardcoded secrets, weak crypto, unsafe deserialization, auth issues, dependency risk
• 📊 VS Code Integration — Problems panel, inline diagnostics, sidebar tree, review dashboard
• 🤖 Fix with Agent — Generates precise remediation prompts for your existing AI agent
• 🔄 Re-review Loop — Verifies whether the fix actually resolved the vulnerability
• 📜 Review History — Tracks review sessions and resolved findings
• 🔒 Privacy First — All analysis is local. No code leaves your machine.
• 💰 Zero LLM Cost — No API keys required. No cloud dependencies.

How It Works

AgentReview runs entirely locally using deterministic security analysis:

Git Diff → Pattern Analysis → Secret Scanning → Security Rules → Findings → VS Code UI

When a finding is detected, you can:

1. View the vulnerable code in context
2. Fix with Agent — copies a detailed remediation prompt to your clipboard
3. Paste the prompt into your AI coding agent
4. Re-review to verify the fix

Installation

From Source

git clone https://github.com/akhilvvn/agentreview.git
cd agentreview
npm install
npm run build

Then press F5 in VS Code to launch the Extension Development Host.

From VSIX

npm run package
code --install-extension agent-review-security-0.1.0.vsix

Quick Start

1. Open a project in VS Code
2. Make some code changes (or let your AI agent make them)
3. Open the Command Palette (Ctrl+Shift+P / Cmd+Shift+P)
4. Run: AgentReview: Review Changes
5. Review findings in the sidebar and Problems panel
6. Click Fix with Agent on any finding
7. Paste the remediation prompt into your AI coding agent
8. Run: AgentReview: Re-run Review to verify the fix

Commands

Configuration

Security Detectors

Security & Privacy

• All analysis is local — no code leaves your machine
• No telemetry — no usage data collected
• No API keys required — zero cloud dependencies
• Privacy-sensitive files excluded by default (.env, *.pem, secrets/)
• Secrets are masked in findings — never exposed in full
• No LLM integration in the MVP — AgentReview does not call or pay for an AI service
• Fix with Agent copies a prompt — it does not automatically modify files or claim to control another agent

Architecture

See docs/architecture.md for details.

src/
├── extension.ts          # Entry point
├── git/                  # Git integration & diff parsing
├── analysis/             # Analysis engine & detector interface
├── detectors/            # 10 security detectors
├── findings/             # Finding model, store, deduplication
├── fix/                  # Fix prompt generation & agent integration
├── review/               # Review engine, sessions, history
├── ui/                   # Diagnostics, tree view, panel, status bar
└── utils/                # Logger, hashing, config, paths

Development

# Install dependencies
npm install

# Type check
npm run typecheck

# Build
npm run build

# Watch mode
npm run watch

# Run tests
npm test

# Lint
npm run lint

# Format
npm run format

# Package VSIX
npm run package

The MVP is entirely local and deterministic. It reviews Git changes, untracked text files, or the active file when Git is unavailable. The Fix with Agent action copies a focused remediation prompt to the clipboard for the user's existing coding agent.

Roadmap

Current (MVP)

• ✅ Local deterministic security analysis
• ✅ 10 security detectors
• ✅ Fix with Agent (clipboard)
• ✅ Re-review loop
• ✅ Review history

Next

• Native VS Code Chat API integration
• AST-based data flow analysis
• Additional language support
• Custom security rules

Future

• Optional AI-powered adversarial reviewer
• Team policies and dashboards
• CI/CD integration

Contributing

See docs/development.md.

License

MIT