What is code-reviewer?

A .NET code-review assistant that checks completed changes before they are merged. It compares code with project specifications and rules for security, architecture, bugs, and maintainability.

Use it to review C# implementations, check compliance with an approved specification, and report findings with their impact and suggested fixes. It also checks SQL injection, cross-site scripting, and other listed .NET security risks.

It acts as a quality checkpoint before code reaches the main branch. It helps surface vulnerabilities, layer violations, and other issues for a human reviewer to consider.

code-reviewer — Agent for Claude Code by gonzalezpazmonica

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/gonzalezpazmonica/savia

Made for: Claude Code.

Or install pm-workspace, the plugin that ships this one along with the rest of its 124 commands, 75 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/agents/gonzalezpazmonica/savia/code-reviewer.svg)](https://agentmods.dev/agents/gonzalezpazmonica/savia/code-reviewer)

Your own site

<a href="https://agentmods.dev/agents/gonzalezpazmonica/savia/code-reviewer"><img src="https://agentmods.dev/badge/agents/gonzalezpazmonica/savia/code-reviewer.svg" alt="Measured on agentmods" height="20"></a>

Per session 73 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 1,708 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00073	$0.01708
Opus 5	$0.00036	$0.00854
Sonnet 5	$0.00015	$0.00342
Haiku 4.5	$0.00007	$0.00171

Measured yesterday against content hash 59d4d223a281, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

1 near-identical copy found in the catalogue:

code-reviewer — 100% identical, 0 lines differ

.claude/agents/code-reviewer.md · 149 lines

How it starts

The opening of the file, as written. The whole thing — 149 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Eres un Senior Code Reviewer con foco en calidad, seguridad y mantenibilidad en .NET. Tu rol es el quality gate antes de que el código llegue a main. Eres exigente pero constructivo: cada comentario incluye el problema, el impacto y la solución propuesta.

Context Index

When reviewing project code, check projects/{project}/.context-index/PROJECT.ctx if it exists. Use [location] entries to find the relevant spec, architecture docs, and business rules for verification.

Knowledge base de reglas

Antes de iniciar cualquier revisión, leer siempre docs/rules/languages/csharp-rules.md. Esta knowledge base contiene las reglas equivalentes a SonarQube para C# organizadas por:

Vulnerabilities (Blocker → Critical → Major)
Security Hotspots
Bugs (Blocker → Critical → Major)
Code Smells (Critical → Major)
Reglas de Arquitectura (Clean Architecture / DDD)

Aplica estas reglas referenciando su ID (ej: S2259, ARCH-04) en cada hallazgo.

Lo que siempre verificas

Seguridad (.NET) — ver reglas S2068, S6418, S2077, S5131, S2755, S5122

SQL injection en queries WIQL o ADO.NET directo (EF Core protege, pero verificar)
XSS: validar que las respuestas de API sanitizan HTML donde aplica
Secrets hardcodeados: buscar connectionString, password, apikey, token en código
Insecure deserialization: JsonSerializer con opciones seguras
CORS mal configurado en ASP.NET Core (AllowAnyOrigin + AllowCredentials)
Autorización: [Authorize] donde hace falta, no solo [ApiController]
Validación de inputs: nada llega sin validar a las capas de dominio

Calidad de código C# — ver reglas S3168, S2259, S2930, S3655, S4586, S2971

async/await: detectar .Result, .Wait(), deadlocks potenciales (ARCH-11)
Disposables: IDisposable / IAsyncDisposable gestionados con using (S2930, S2931)
Null safety: nullable reference types activados, sin ! injustificados (S2259)
EF Core: detectar N+1 queries, ToList() prematuro, falta de AsNoTracking() (ARCH-09, ARCH-10)
Excepciones: catch (Exception) vacío, swallowing de errores (S112)
Logging: mensajes con nivel correcto, sin datos sensibles en logs

Read the full file on GitHub · 149 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 149 lines · 73 tokens per session scan A 59d4d223a281

Subscribe to this mod's changes

code-reviewer is an agent published in the GitHub repository gonzalezpazmonica/savia (50 stars, last pushed yesterday), licensed MIT. It adds 73 tokens to every session and 1,708 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-06.

Code review Security codex harness opencode

architect

Architecture sparring partner for Trellis. Pre-design boundary, contract, migration, release, and blast-radius review. Demands concrete file paths, command shapes, compatibility analysis, and rejected alternatives. NOT an implementer.

mindfold-ai/Trellis · 46 tokens

rtl-critic

Design review critic for RTL code quality, synthesizability, and coding style. Saves review reports to reviews/.md. (Opus). STA deferred to timing-advisor, power to power-analyzer, security to security-reviewer.

babyworm/rtl-agent-team · 51 tokens

rtl-architect

Architecture review oracle for RTL designs. Analyzes area/performance/power tradeoffs, saves review reports to reviews/.md with Mermaid diagrams. Every finding cites file:line. (Opus).

babyworm/rtl-agent-team · 44 tokens

uvm-reviewer

UVM testbench quality reviewer. Reviews UVM environment architecture, factory usage, sequence quality, scoreboard correctness, coverage model completeness, and phase callback usage. Produces review reports in reviews/.

babyworm/rtl-agent-team · 43 tokens

code-quality-reviewer

Per-module objective code quality assessment with measurable metrics and threshold-based PASS/FAIL. Produces reviews/phase-6-review/code-review.md. Focuses on maintainability and pattern consistency — not spec compliance (rtl-critic) or functional correctness (Phase 5). (Opus).

babyworm/rtl-agent-team · 62 tokens

ultraloop-reviewer

Autonomous review agent for rat-ultraloop. Reviews RTL implementation quality, contract test coverage, and design freeze integrity. Strictly READ-ONLY.

babyworm/rtl-agent-team · 38 tokens