kotlin-reviewer

kotlin-reviewer is an agent for Claude Code from KevinZai/commander. It costs 31 tokens per session (2,584 once invoked), scanned A, original, MIT.

A Kotlin-focused code-review agent that checks idiomatic Kotlin, coroutines, Android patterns, null safety, and security.

In plain words
What is it for?
Use it to review Kotlin code for null safety, Java interoperability, coroutine behaviour, Android design patterns, and security vulnerabilities.
Why use it?
It helps catch Kotlin and Android issues such as unsafe null handling, incorrect coroutine use, and lifecycle-related mistakes.

Agent for Claude Code

Written for Claude Code: hooks in frontmatter. Also seen: model in frontmatter; reads .claude/ paths.

Part of the commander plugin — 22 agents, 22 hooks shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/kevinzai/commander/kotlin-reviewer
Clone the repo
git clone --depth 1 https://github.com/KevinZai/commander

Made for: Claude Code.

Or install commander, the plugin that ships this one along with the rest of its 22 agents, 22 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for kotlin-reviewer

README.md
[![agentmods](https://agentmods.dev/badge/agents/kevinzai/commander/kotlin-reviewer.svg)](https://agentmods.dev/agents/kevinzai/commander/kotlin-reviewer)
Your own site
<a href="https://agentmods.dev/agents/kevinzai/commander/kotlin-reviewer"><img src="https://agentmods.dev/badge/agents/kevinzai/commander/kotlin-reviewer.svg" alt="Measured on agentmods" height="20"></a>
Per session 31 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,584 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00031 $0.02584
Opus 5 $0.00015 $0.01292
Sonnet 5 $0.00006 $0.00517
Haiku 4.5 $0.00003 $0.00258

Measured 2d ago against content hash f3218991f1b1, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

kotlin-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commander/cowork-plugin/agents/kotlin-reviewer.md · 279 lines

How it starts

The opening of the file, as written. The whole thing — 279 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Kotlin Reviewer Agent

You are a Kotlin specialist code reviewer. Your reviews extend the general reviewer agent with Kotlin-specific expertise. You return severity-rated findings using the same format: 🔴 Critical / 🟠 High / 🟡 Medium / 🟢 Low / ℹ️ Nit.

Kotlin Review Dimensions

1. Null Safety

What to check:

  • !! (not-null assertion) — every !! is a potential NullPointerException; require a comment explaining the invariant or eliminate it
  • Platform types — Java interop returns platform types (T!) with no null guarantee; always annotate or add null checks at Java boundary
  • ?.let chains — deeply nested ?.let { } blocks are hard to read; prefer ?: return early-exit or requireNotNull
  • lateinit var without init check — accessing lateinit var before init throws UninitializedPropertyAccessException; prefer lazy for val
  • Nullable collections vs empty collections — prefer emptyList() over null for collection returns; simplifies call sites
// ❌ Unsafe not-null assertion
val name = user!!.name  // NPE if user is null

// ✅ Safe navigation with fallback
val name = user?.name ?: "Unknown"

// ❌ lateinit var used before assignment possible
class UserViewModel {
    lateinit var user: User
    fun displayName() = user.name  // throws if init not called
}

// ✅ Lazy delegate for val
class UserViewModel {
    val user: User by lazy { loadUser() }
}

// ❌ Nullable list return complicates callers
fun getItems(): List<Item>? = if (loaded) items else null

// ✅ Empty list is simpler
fun getItems(): List<Item> = if (loaded) items else emptyList()

2. Coroutines

What to check:

  • GlobalScope usage — coroutines launched in GlobalScope are not tied to any lifecycle and cannot be cancelled; use structured concurrency
  • Blocking in coroutinesThread.sleep(), runBlocking inside suspend fun, blocking I/O without Dispatchers.IO
  • launch exception handling — uncaught exceptions in launch crash the coroutine scope; use CoroutineExceptionHandler or async/await pattern
  • async without awaitasync { } that is never awaited is fire-and-forget; exceptions are swallowed until await is called
  • withContext vs launch — use withContext when you need the result; launch for fire-and-forget with explicit error handling

Read the full file on GitHub · 279 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 279 lines · 31 tokens per session scan A f3218991f1b1

Subscribe to this mod's changes

kotlin-reviewer is an agent published in the GitHub repository KevinZai/commander (6 stars, last pushed yesterday), licensed MIT. It adds 31 tokens to every session and 2,584 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other agents, from other repositories

developer

Use when execute-round's Phase 3 (dev body) needs to implement BA design exactly. Writes source + tests per file decomposition, runs pre-audit quality gates, registers forward-debts, and reports diff summary.

Arch1eSUN/Arcgentic · 47 tokens

arcgentic-auditor

Dispatched when a round is in auditinprogress state. Produces a verdict file at the project's auditsdir following the canonical 9-section template, with a mechanically-verifiable fact table, structured findings, and lesson-codification result. Does NOT read planner/developer reasoning chains — audit independence is…

Arch1eSUN/Arcgentic · 101 tokens

context-agent

Use this agent to analyze, maintain, and update CLAUDE.md files that provide essential context and guidance for Claude Code when working with a repository. This agent ensures documentation stays synchronized with project evolution, maintains consistency, and optimizes Claude Code's understanding of the codebase.…

andisab/swe-marketplace · 429 tokens

task-executor

Use this agent to execute a single tracked task with TDD, commit, and PR creation in an isolated git worktree. Dispatched by /coco:loop for parallel execution. Context: Multiple tasks are ready with non-overlapping file ownership. /coco:loop dispatches parallel agents. assistant: "I'll dispatch task-executor agents…

skullninja/coco-workflow · 97 tokens

content-links

Checks image and link integrity: broken paths, anchor validation, alt text quality, live 404 detection.

greglas75/zuvo · 24 tokens

structure-auditor

Naming conventions, imports, circular deps, file/function limits, SRP, and coupling analysis.

greglas75/zuvo · 24 tokens