X-RayView

X-RayView reviews a GitHub pull request inside VS Code or Cursor. Agents on your computer read the change. You keep the findings you agree with, then you post the review. Nothing goes to GitHub until you press Post now.

This guide is also on the web: xanadupia.github.io/xrayview.

Start here

You need:

• VS Code 1.95 or later, or Cursor
• GitHub CLI, signed in: gh auth login (cli.github.com)
• git
• One program that can run the agents: Cursor Agent, Claude Code, Codex, or Pi

Install X-RayView from the Extensions view. The id is aliqaryan.xrayview. Cursor installs it from Open VSX. VS Code installs it from the Visual Studio Marketplace. Reload the window when the editor asks.

Then:

1. Click the X-RayView icon in the activity bar.
2. Run X-RayView: Choose Agent Harnesses… and pick Cursor, Claude Code, Codex, or Pi, then a model. Claude Code, Codex, and Pi also ask for a level.
3. Open a pull request and press Run.

If the sidebar stays empty, run gh auth login, then Refresh.

Automatic runs are on. About two minutes after the first start, agents begin on pull requests that request your review by name. Turn off xrayview.agents.autoRun before that if you want to press Run yourself.

The review page

Comments stay on this computer until you post them.

Every comment has a level, High, Medium, or Low. On GitHub it opens the comment as a colored priority tag, as Greptile's comments do: P1 for High, P2 for Medium, P3 for Low. Pick it under the kind of comment when you write one.

Replies post as written, since the thread's first comment has the level. When X-RayView reads a pull request, its own P1, P2, and P3 tags and Greptile's P0 and P1 (High) and P2 (Medium) show as the level on each thread.

Pick a model

Choose Agent Harnesses… is the picker. Choose model… under the arrow beside Run agents, and Change on the model line, open it too. Its top rows are Cursor Agent, Codex, and Claude Code. Pick one, then a model, and every agent runs on it. For Pi, use Default for all agents.

• Cursor lists the models on your Cursor account. The first row keeps whatever cursor-agent used last. Pick a model by name if you care which one reviews.
• Codex lists the models that CLI provides, then a reasoning level such as medium or high.
• Claude Code lists its models with their versions, such as Opus 5.5 and Sonnet 5.5, then an effort level from low to max. Each row is Claude Code's short name, such as opus, so it moves to the newest version when Claude Code updates. To keep one version, set xrayview.claude.model to its full id, such as claude-opus-5-5.
• Pi lists the models it is signed in to, then a thinking level.

For Codex and Claude Code, Change installed version… at the bottom of the model list picks another installed copy, or installs one.

After you pick, X-RayView says what the agents will use, such as "Claude Code agents will use Opus 5.5 at high effort." Press OK to run them again on the open pull request.

One agent can use a different model from the others. That model's name is stored on that agent and wins over the default.

What runs by itself

Agents start on their own only when a pull request requests your review by name, when it opens and after each push. A two-minute pause folds a burst of pushes into one run. Drafts are skipped. Each pull request gets at most five automatic runs. A pull request over 100 files or 5,000 changed lines waits until you press Run.

If the pull request is already approved, X-RayView asks once per push: Skip this PR, Run anyway, or Always skip approved.

With several windows open, one window starts the automatic runs. A pull request's agents run in one window at a time. The others say they are running in another window.

If something looks wrong

• The sidebar is empty. Run gh auth status, then gh auth login. Team requests and code owners also need gh auth refresh -s read:org.
• An agent program is not found. Choose Agent Harnesses… says so, and can install Codex or Claude Code. Or set xrayview.cursor.path, xrayview.claude.path, xrayview.codex.path, or xrayview.pi.path to the full path. Sign in by running that program once. For Cursor: cursor-agent login.
• Cursor cannot use a model. Open Choose model… beside Run agents, or Choose Agent Harnesses…, and pick a model from the list.
• Agents fail or find nothing. X-RayView: Show Agent Log lists the agents, errors, tokens, and cost.
• Agents are running in another window. Stop them there, or wait.
• A link does nothing. Use cursor://aliqaryan.xrayview/... in Cursor and vscode://aliqaryan.xrayview/... in VS Code. A Diffline link does not open X-RayView. Pasting the GitHub URL into Open a Pull Request… works in either editor.

What the sidebar shows

A pull request appears in the first group it fits.

The icon on a row is the pull request: green is open, a draft icon is a draft, purple is merged, and red is closed. The colored dot beside it is the risk: green is low, orange is medium, and red is high. The full score is in the row's tooltip. While agents are running, the icon is a spinner.

Each row also says where X-RayView's review stands, right after the pull request's state:

The tooltip says it in full on its X-RayView line, such as "Reviewed a9dca66 3 hours ago: 13 findings." On the review page, the same state is a pill beside the risk score, such as X-RayView reviewed · 13 findings or X-RayView reviewing · 2/5. Click it to open Agent activity.

The view menu groups by relationship, repository, or author. Filter… is one checklist. My pull requests shows only ones you opened. Each of status and author has its own All. Check any of the rest, then press Return. The list only contains the pull requests it has already loaded, including recently merged and closed ones.

The agents

Five agents ship. The guide checks the description, sets a reading order, and draws the flow. Architecture, correctness, tests, and security look for problems. You can add more with X-RayView: New Agent….

On Claude Code, the agents that look for problems hand over to Claude Code's own /code-review. It runs once, at the effort level you picked, and its findings show under one Code review agent. The guide keeps its own instructions, and agents on Cursor, Codex, or Pi run as usual. /code-review reads the diff with git in Claude Code's sandbox, which writes nothing and reads only the checkout and its git history. X-RayView: Show Agent Log has its report.

To watch the agents work, click Agents are running, or open the arrow beside Run agents and choose Agent activity…. The agents are listed the way GitHub lists a pull request's checks: a line that sums them up, such as "1 failing, 1 in progress, 2 successful agents", then each agent under its status with its harness, model, and time. Click an agent's name, or open its ⋯ menu and choose View details, to see its log. All agents goes back. In the log, what the agent says stands as text, and the commands, reads, and searches between those messages fold into one line, such as "Ran 2 commands, read cart.js". Open that line for each step, and open a command for its output. The activity stays after the run until the next one. Pi reports its work when it finishes, so its steps don't show.

The first run writes ~/.xrayview (XRAYVIEW_HOME moves it): agents.yml for the list, and one instruction file per agent. Customize Agents… opens those files. Changes apply on the next run.

What leaves this computer

Stays here: drafts, agent results, run logs, and ~/.xrayview. The review page does not load remote images, fonts, or scripts. There is no telemetry.

Leaves:

• GitHub, through gh and git. The only write is Post now: your review, then any replies and thread resolutions you queued.
• The model provider, through the program you picked. Agents send the diff, the title, the description, the review threads, and the files they read.

Agents do not post to GitHub by themselves. A pull request's own Cursor hooks, rules, and AGENTS.md do not run. Your own ~/.cursor rules still apply. Before posting, X-RayView refuses a review that looks like it contains a private key or token.

X-RayView adds no charge of its own. Usage counts against the account of the program that ran.

Commands

Open a Pull Request… is ⌥⇧⌘P on macOS and Ctrl+Shift+Alt+P on Windows and Linux.

Settings

Diffline's diffline.* settings do not apply here.

The other xrayview.watch.* switches turn each sidebar group on or off. They are on by default.

X-RayView and Diffline

X-RayView is Diffline 0.3.2 by Armin Karimi, plus Cursor as a way to run the agents. You can install both. They do not share settings, reviews, or links. If automatic runs are on in both, both can start agents on the same pull request.

Comments that span several lines, file-level comments, and editing a comment after it is posted are not supported yet.

License

MIT. Copyright (c) 2026 Ali Qaryan for the Cursor agent runner and this edition. Copyright (c) 2026 Armin Karimi for Diffline, which X-RayView is built from.