Code Review AI Apps

Paste a bug - symptoms, stack trace, the code involved, what changed recently - and get a systematic debugging plan: an honest read of reproducibility, root-cause hypotheses ranked by evidence, the cheapest experiments first, surgical instrumentation, conditional fix directions and open questions. The quick scanner runs free in your browser. Derived from @wshobson/debugging-strategies.

Paste PostgreSQL — a schema, a migration, or a slow query — and get an expert review: severity-ranked findings each with a runnable fix, the missing indexes as complete CREATE INDEX statements, a corrected rewrite of your SQL, and an honest five-area health check. A free instant prescan flags the classic anti-patterns (varchar(n), naive timestamps, float money, int primary keys, OFFSET pagination, unindexed foreign keys, unwrapped auth.uid()) in your browser before you run anything. Derived from @affaan-m/postgres-patterns.

Paste a git diff, commits, and your notes - get a reviewer-first pull request title and description in Conventional Commits style, with a client-side diff stats breakdown and title linter. Derived from @tldraw/write-pr.

Paste code in any language, pick your audience, and get a structured explanation: what it does, how it flows step by step, an ASCII diagram, the concepts you need, the pitfalls hiding in it, and a 3-question comprehension check. Free client-side prescan (language detection, function inventory, complexity hotspots) runs before you spend anything. Derived from @sickn33/code-documentation-code-explain (MIT).

Paste code - a function, a module or a diff - and get a prioritized review you can act on: a ship/fix/block verdict, critical/high/medium findings each with where it is, the problem with its impact and the concrete fix, what the code already does well, and recommendations. Security first, then performance, correctness and maintainability. A free in-browser quick scanner sizes the paste and flags the classic pattern hits before you ever sign in. Derived from @shubhamsaboo/code-reviewer.

Paste your system brief — what you are building, the expected load, the constraints — and get a senior backend architect review: a readiness posture, the component plan with data ownership, prioritized findings with concrete design fixes, quick wins and focus areas. A free instant prescan spots the technologies and load numbers your brief names and flags the gaps a reviewable brief should not have. Derived from @sickn33/backend-architect (MIT).

Paste code — a module, a component, a handler, a query layer — and get a performance review: severity-ranked findings each with a corrected snippet, the quick wins worth shipping first, an optimized rewrite of your worst hotspot, and a five-area health check across data access, memory, CPU, network and rendering. A free instant prescan flags the classic anti-patterns before you run anything. Derived from @mastra-ai/performance-review.

Paste a pull request - the unified diff, title and description - and get a presenter-ready walkthrough: segments ordered by understanding rather than by file, the exact hunk or function to show on screen for each beat, and the narration to speak over it in the author's voice. Generated files like lockfiles and API reports are filtered to a Not shown list. The diff scanner runs free in your browser. Derived from @tldraw/pr-walkthrough.

Paste your MCP server — TypeScript SDK, Python FastMCP or tool-definition JSON — and get a senior MCP engineer review: a readiness posture, the tool inventory, prioritized findings with corrected fragments, quick wins and focus areas. A free instant prescan flags missing descriptions and schemas, any-typed params, generic errors, unpaginated list tools, missing annotations, literal secrets, stdout logging on stdio and deprecated SSE before you run anything. Derived from @anthropics/mcp-builder.

Paste a GitHub Actions workflow and get a senior CI/CD engineer's review: a production-readiness posture, the workflow and job inventory, prioritized findings with corrected YAML fragments, quick wins and focus areas. A free instant prescan flags mutable action refs, missing permissions, script injection, secret leaks, missing timeouts and more. Derived from the @sickn33/github-workflow-automation skill.

Paste UI code — HTML, JSX, Vue or Svelte — and get a scored compliance audit against the Web Interface Guidelines: six groups scored out of 10, an issue list quoting the exact code with line numbers and concrete fixes, a corrected rewrite of the worst block, and a free instant lint that runs in your browser. Derived from the @vercel-labs/web-design-guidelines skill.

Paste the code review feedback you received plus the code it is about, and get each comment triaged the way a senior engineer receives review: verified against the code, then routed to Implement (with the concrete change), Push back (with the technical reason), Clarify first (with the question to ask) or Verify in code (with exactly what to check) - plus a short, professional reply with zero performative agreement. Derived from @obra/receiving-code-review.

Paste a JavaScript or TypeScript module and get a complete Vitest or Jest unit test file: behavior-named tests, boundaries and failure paths covered, determinism hazards handled with fakes, plus a test plan and honest notes on what could not be tested. The surface scanner and hazard detector run free in your browser. Derived from @tldraw/write-unit-tests.

Paste UWP C# or XAML and get it back rewritten for WinUI 3 / Windows App SDK: every legacy API replaced with its modern equivalent, nine named findings marked MUST-FIX, CHECK or CLEAN, the manual steps that remain, compatibility notes, and a verdict with a confidence score. The legacy-API scan and a searchable UWP-to-WinUI 3 API map run free in the browser. Derived from @github/winui3-migration-guide.

Paste React, Vue, Angular, Svelte or plain HTML/JS source and get an i18n readiness audit scored out of 30: hardcoded strings, concatenation bugs, plural hacks, locale-unsafe formatting and RTL risks — plus a string-extraction plan with suggested keys and a downloadable en.json locale starter. The pattern scan runs free in your browser. Derived from @sickn33/i18n-localization.

Paste Kotlin Compose UI code — a screen with its ViewModel, several files, or a grab-bag of composables — and get an expert review: a sound/refactor/rework verdict, severity-ranked findings with corrected Kotlin, a twelve-item Compose checklist, a five-area health check, and a full Refined.kt rewrite. A free instant prescan flags state-without-remember, exposed MutableStateFlow, GlobalScope work, unkeyed lazy lists, hardcoded colors and more before you run anything. Derived from the @affaan-m/compose-multiplatform-patterns skill (MIT).

Paste a system or architecture description and get an AppSec threat model: a posture verdict, components and trust boundaries, an attacker model with explicit non-capabilities, entry points, multi-step abuse paths, a prioritized threat table with mitigations and detection ideas, and the focus areas to review first. A free client-side prescan flags attack surfaces, sensitive assets and exposure hints, and the model must reconcile every one. Derived from the @openai/security-threat-model skill.

Paste your Terraform HCL and get an infrastructure-engineer review: a production-readiness posture, the block inventory, prioritized findings with corrected HCL fragments, quick wins and focus areas. A free instant prescan flags literal secrets, open ingress, public ACLs, wildcard IAM, missing version pins, local state, untyped variables and hardcoded AMIs while you type. Derived from @wshobson/terraform-module-library (MIT).

Paste Swift code and get a Swift 6.2 Approachable Concurrency migration review: data-race hazards, actor-isolation diagnosis, severity-tiered findings, a migrated rewrite in your own names, and a concrete build-settings migration plan. Free in-browser concurrency prescan before you sign in. Derived from @affaan-m/swift-concurrency-6-2.

Paste code — an API endpoint, a module, a diff — and get an application-security review: a ship/fix-first/block verdict, severity-ranked findings each with corrected code, a twelve-item pre-deploy checklist scored against your paste, and a hardened rewrite. A free instant prescan flags hardcoded secrets, SQL concatenation, unsafe HTML sinks and more before you run anything. Derived from @affaan-m/security-review.

Paste your Kubernetes YAML manifests and get a senior platform architect review: a production-readiness verdict, resource inventory, prioritized findings with concrete YAML fixes, quick wins, and the focus areas to tackle first. Free instant prescan catches missing limits, probes, :latest images, privileged pods and exposed services before you spend anything. Derived from @sickn33/kubernetes-architect (MIT).

Paste Java 17+ source and get the review a staff engineer would leave on the pull request: which stack it belongs to, a ship-it / tidy-first / rework verdict, and findings that quote a verbatim line from your own code. A free browser-side analyser lexes the source first (comments and string literals blanked so nothing false-matches), detects Spring Boot versus Quarkus from weighted evidence rather than guessing, and runs thirty deterministic rules — broad and silent catches, Optional.get(), field injection, raw types, static mutable state, concatenated log messages, magic numbers, deep nesting. The AI review must then adjudicate every one of those as confirmed or set aside, and every quote it makes is checked against your source. A derived work of @affaan-m/java-coding-standards from the open-source everything-claude-code collection (MIT).

Paste your Bash script (and optionally its helper files) and get a senior infrastructure engineer's defensive review: a production-readiness posture, the inventory of every file and function, prioritized findings with corrected shell fragments, a reconciliation of the free client-side prescan, quick wins and focus areas. The instant prescan (strict mode, unguarded rm -rf, curl piped to sh, backticks, unquoted $@, read without -r, fixed /tmp paths, missing traps, literal secrets and more) runs free in the browser. Derived from @wshobson/bash-defensive-patterns (MIT).

Paste Rust code — one file, several files, or a module — and get an idiomatic-Rust review: a sound/refactor/rework verdict, a five-area health check (ownership & borrowing, error handling, type design & API surface, concurrency & async, idioms & structure), severity-ranked findings each with corrected Rust, a twelve-item checklist scored against the paste, and a full refined.rs rewrite. A free instant prescan flags unwraps outside tests, borrow-checker-appeasing clones, Box<dyn Error> in public APIs, wildcard match arms, uncommented unsafe, blocking calls in async, String params, swallowed Results, unbounded channels and stringly-typed state before you run anything. Derived from @affaan-m/rust-patterns (MIT).

Paste Swift/SwiftUI code and get an independent iOS design review written against Apple's Human Interface Guidelines as they stood in February 2026: a sound/refactor/rework verdict, a health check across five design areas (layout & adaptivity, typography & Dynamic Type, color & dark mode, navigation & structure, accessibility), concrete findings with corrected SwiftUI, a twelve-point checklist, coverage reconciliation against the free SwiftScan prescan, and a full refined rewrite shown as a line diff against your own paste. The prescan runs free in your browser. Guidance only: the guidelines change with each OS release and the current HIG governs. Not affiliated with, authorised by or endorsed by Apple Inc., and no prediction of App Review outcomes. Derived from @wshobson/mobile-ios-design (MIT).

Paste GraphQL SDL and resolver code and get an expert API review: a sound/refactor/rework verdict, a five-area health check, severity-ranked findings with corrected SDL, a scored twelve-item checklist, and a full refined schema rewrite. A free instant prescan flags Int IDs, unpaginated lists, open introspection, missing depth limits and N+1 resolvers before you run anything. Derived from @sickn33/graphql (MIT).