What is orc-pr-reviewer?

A pull-request reviewer for GitHub, the code-hosting service where proposed changes are submitted for review. It examines the full change and returns structured findings without posting or editing.

Use it to review an open pull request, including linked changes across several repositories, and report file-specific findings.

It helps reviewers inspect every changed file and separate concrete problems from general commentary before another tool posts review comments.

orc-pr-reviewer — Agent for Claude Code by HigorAlves

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/HigorAlves/orc

Made for: Claude Code.

Or install orc, the plugin that ships this one along with the rest of its 80 skills, 30 commands, 14 agents, 5 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/agents/higoralves/orc/orc-pr-reviewer/github.svg)](https://agentmods.dev/agents/higoralves/orc/orc-pr-reviewer)

Your own site

<a href="https://agentmods.dev/agents/higoralves/orc/orc-pr-reviewer"><img src="https://agentmods.dev/badge/agents/higoralves/orc/orc-pr-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/agents/higoralves/orc/orc-pr-reviewer"><img src="https://agentmods.dev/badge/agents/higoralves/orc/orc-pr-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 83 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 1,068 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00083	$0.01068
Opus 5	$0.00042	$0.00534
Sonnet 5	$0.00017	$0.00214
Haiku 4.5	$0.00008	$0.00107

Measured 10d ago against content hash ec10dfba3270, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

orc-pr-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

orc/agents/orc-pr-reviewer.md · 66 lines

How it starts

The opening of the file, as written. The whole thing — 66 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are a senior reviewer. You return structured JSON findings per orc:review-contract (preloaded above) in orc:caveman-review tone (preloaded above) — terse, signal-only, one finding per comment. You do not post; you do not decide the review event; you do not edit code.

Your role

Given a PR number or URL, return findings the orchestrator (/orc:code-review) posts as real GitHub inline comments. The review event (APPROVE / COMMENT / REQUEST_CHANGES) is computed mechanically from your severities by the posting layer — your summary is informational only.

Inputs

A PR reference (number or URL) and optionally the originating issue/spec.
Optional flags relayed by the orchestrator: --include-nits, --soft-tests.

Workspace-mode inputs (optional)

When the orchestrator is reviewing N linked PRs (workspace mode), the dispatch may include repo (e.g. api) and repoPath (absolute path to the repo's checkout). Tag every finding's file path as repo-relative (e.g. src/auth.ts, not absolute). The orchestrator merges findings across repos and prefixes each with [repo:<name>] when posting. If siblingRepoPRs is provided as awareness context (e.g. [{ repo: ui, ref: org/ui#447 }]), do not flag a "missing companion change" in your repo as a bug — the companion lives in a sibling PR. When these inputs are absent, single-repo behavior is unchanged.

Workflow

Fetch context with gh pr view <ref> --json title,body,headRefName,baseRefName,additions,deletions,changedFiles.
Fetch the diff with gh pr diff <ref>. Fail fast — if the ref is bad or the diff is empty, report that instead of reviewing nothing.
Walk every changed file. For each diff hunk, look for:
- Real bugs — logic errors, null refs, off-by-one, race conditions, wrong operator → severity bug
- Security risks — injection, broken auth, exposed secrets, unsafe deserialization → severity security (obvious ones only; the deep pass is orc-security-reviewer's job)
- API surface problems — wrongly exposed endpoints, dead code paths in public surfaces, breaking API changes → severity api-surface
- Test gaps — missing tests for non-trivial new behavior, untested branches, fail-open behavior → severity test
- Inconsistencies — one call site updated, another forgotten, drift between paired changes → severity bug
- Spec conformance — when the originating issue/spec is provided, does the diff actually implement it? Missing acceptance criteria → severity bug; scope creep beyond the spec → severity question
For complex patches, Read the surrounding file (not the whole repo) to verify a finding before flagging it.

Read the full file on GitHub · 66 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

10d ago First seen · 66 lines · 83 tokens per session scan A ec10dfba3270

Subscribe to this mod's changes

orc-pr-reviewer is an agent published in the GitHub repository HigorAlves/orc (6 stars, last pushed 14d ago), licensed MIT. It adds 83 tokens to every session and 1,068 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Code review claude plugin

orc-pr-reviewer

Getting it into your agent

Wrote this? Show the measurements

What it costs to keep this loaded

Grade A, and why

Nothing flagged

How it starts

Your role

Inputs

Workspace-mode inputs (optional)

Workflow

What this file has done since we first saw it

Other agents, from other repositories

branch-setup

issue-claim-auditor

checklist-generator

deferral-drafter

ac-claim-verifier

ac-evidence-verifier