/review-all

Multi-agent code review for Claude Code, for any language or stack. It runs the repo's own typecheck/lint/tests, has up to ten review agents read the diff in parallel, then has a separate verifier re-check every finding before it reaches the report.

Install

/plugin marketplace add ncoevoet/claude-review-all
/plugin install review-all@ncoevoet-review-all

Or, to hack on the skill: git clone this repo and run make install, which copies skills/review-all/ to ~/.claude/skills/review-all/ (make uninstall removes it).

Requires Claude Code, git, bash, python3. gh is optional: it is used for PR #N targets and for the post-to-PR / create-issue actions.

Use

Argument	Reviews
(empty)	Uncommitted changes, else current branch vs default branch, else last commit
--staged / --unstaged	Only staged / unstaged changes
last commit, last N commits	HEAD~N..HEAD
vs	Current branch vs merge-base with ``
<sha1>..<sha2>	A commit range
PR #N or #N	A GitHub PR (needs gh)
file paths, --paths a,b, --exclude x,y	Narrow the diff to / away from these paths
gate / --ci	Headless mode: JSON verdict and exit code, no menu (see Gate mode)

/review-all
/review-all PR #123
/review-all vs main --exclude apps/legacy
/review-all gate --severity important

How it works

1. Discover. One script (scripts/discover.sh) detects the toolchain, test layout and available tools. Rules extracted from CLAUDE.md are cached; toolchain data is re-probed every run.
2. Deterministic gates. Typecheck, lint and scoped tests run in parallel. New public code without a test is flagged. A failing gate becomes a finding directly, and its output is passed to the agents as a <gate_results> block.
3. Select files and agents. select-files.py drops binaries, secrets, generated/vendor output and oversized files before any agent runs. select-agents.py picks the axes: six always run; security deep-dive, test-quality, API-contract and a11y/i18n run only when the diff contains matching files. Skipped axes are named in the report.
4. Review in parallel. Axes: standards, bugs+security, DRY, consistency, simplification, security deep-dive, performance, test quality, API contract, a11y/i18n. Every spawn names its model: opus for behavioral axes (bugs, security, performance, API contract) and sonnet for the others. Each agent gets the diff in its own file order (agent-order.py), plus per-language rule packs from rules/. Completed axes are saved to .claude/review-all/checkpoints/, so an interrupted run picks up where it stopped.
5. Dedupe and verify. Findings are grouped by root cause (the report says "Flagged independently by N agents"). Then a verifier (Haiku by default) tries to disprove each one: a behavior claim has to be backed by a quoted source line. Findings scoring ≥75 go in the report, 50–74 in the appendix, and the rest are dropped.
6. Claim classes. A runtime, data or rendering claim that is backed only by reading the source gets the unverified verdict. It is shown in its own section with the observation that would settle it, and it never blocks a gate.
7. Report. It opens with a verdict line, then gate results with a Provenance column (command, exit code, time), then findings by severity. It ends with a machine-readable `` tally.