review-code

review-code is a command for Claude Code from coleam00/Archon. It costs 0 tokens per session (2,001 once invoked), scanned A, original, MIT.

A read-only code-review command searches a change for defects that could break required behavior or existing expectations.

In plain words
What is it for?
Use it to inspect a precisely scoped pull request or change and record evidence-based findings for a later review decision.
Why use it?
It helps catch real bugs before the change is accepted, without turning the review into a style score or code summary.

Command for Claude Code

Written for Claude Code: a Claude Code command (commands/*.md). Also seen: mentions CLAUDE.md; mentions AGENTS.md.

Good fit Use it to inspect a precisely scoped pull request or change and record evidence-based findings for a later review decision.

Compare 6 commands from other repositories ↓
Install with agentmods
npx agentmods add commands/coleam00/archon/review-code
About the project

Archon is a workflow engine for AI coding agents that turns development processes into YAML-defined sequences with phases, validation gates, and artifacts. Developers use it to run repeatable processes such as planning, implementation, testing, code review, and pull-request creation across projects. The catalogue entries provide commands, agents, skills, hooks, instructions, and settings for working with Archon.

coleam00/Archon · 23,701 stars · on GitHub · archon.diy

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo
git clone --depth 1 https://github.com/coleam00/Archon

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for review-code

README.md
[![agentmods](https://agentmods.dev/badge/commands/coleam00/archon/review-code/github.svg)](https://agentmods.dev/commands/coleam00/archon/review-code)
Your own site
<a href="https://agentmods.dev/commands/coleam00/archon/review-code"><img src="https://agentmods.dev/badge/commands/coleam00/archon/review-code/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for review-code

Your own site · 80×15
<a href="https://agentmods.dev/commands/coleam00/archon/review-code"><img src="https://agentmods.dev/badge/commands/coleam00/archon/review-code.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,001 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00000 $0.02001
Opus 5.5 $0.00000 $0.00800
Sonnet 5.5 $0.00000 $0.00400
Haiku 4.5 $0.00000 $0.00200

Measured yesterday against content hash 7dec9497b386, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

review-code scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.archon/workflows/sdlc/review/commands/review-code.md · 51 lines

How it starts

The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Code Review — Correctness

Find defects the change introduces. Do not grade the code, summarize the diff, or reward activity. You are read-only: never modify files, commit, or post anywhere. Never edit this checkout, not even to revert: sibling reviewers read it at the same time, and the engine fails a reviewer that leaves it changed. Try a mutation in a scratch worktree under this run (git worktree add --detach "$(mkdir -p "$ARTIFACTS_DIR/scratch/code" && mktemp -d "$ARTIFACTS_DIR/scratch/code/XXXXXX")" HEAD; the workflow removes it), and before running anything there, install its dependencies with the project's own package manager in locked mode, never updating a lockfile. Any other scratch file you write — a probe script, a note, captured output — goes under $ARTIFACTS_DIR, never in this checkout. Your findings go in a file; the synthesizer aggregates them.

Read $ARTIFACTS_DIR/review/scope.md first. Then review exactly the diff scope.md describes. The project's own values are in its steering documents: open, where the project has them, its engineering.md and its direction document — at the root, in a config directory such as .archon/, or wherever its steering files point — only when a finding depends on a value one of them states, and read the section you cite, not the whole file. A preference one of them states is a finding you cite, and one none of them states is taste you leave out. Anchor the review on the accepted work order's stated invariants, and apply the supplied full-review policy: $mode.output.risks. In light mode, scope.md names the prior report and the correction delta: read the prior report and $ARTIFACTS_DIR/implementation.md, judge each prior finding assigned to this lens as resolved by the delta, validly declined (the implementer's evidence holds), or still open, then apply the same bar to the delta only.

Evidence bar — report only what is proved

  1. Behavioral defect — a reachable input or state produces an outcome that contradicts the change's required behavior, an existing contract, or a supported caller's expectation.
  2. Repository-rule violation — the changed code violates an explicit applicable rule in the repo's steering files (AGENTS.md, CLAUDE.md, contributor guidance) or enforced configuration. A preference no project document states is not a rule, and framework folklore is not a project rule.

Read the full file on GitHub · 51 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday Changed · +2 lines 7dec9497b386
  2. 2d ago Changed 83b71e19feee
  3. 11d ago Changed · +10 lines 35f32160f66f
  4. 12d ago Changed · -7 lines d0321e91f445
  5. 1mo ago First seen · 46 lines · 0 tokens per session scan A 63ed5398b232

Subscribe to this mod's changes

review-code is a command published in the GitHub repository coleam00/Archon (23,701 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,001 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.