code-review

code-review is a command for Claude Code from specstoryai/getspecstory. It costs 7 tokens per session (955 once invoked), scanned A, original, Apache-2.0.

A review command for examining the current proposed code changes and new files in a git repository.

In plain words
What is it for?
Use it before merging changes to understand each modification, identify problems, and reference findings by file, line number, and observation number.
Why use it?
It turns a code review into a numbered, line-by-line inspection covering readability, Go conventions, comments, logs, analytics, and goroutine handling.

Command for Claude Code

About the project

SpecStory is a local-first tool that records and indexes conversations with AI coding assistants so developers can search, reuse, and share their solutions. It is for preserving coding decisions, snippets, and other knowledge across projects and development tools. Its catalogue skills and commands process saved sessions into reusable agent skills and connect the workflow to coding agents.

specstoryai/getspecstory · 1,318 stars · on GitHub

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/specstoryai/getspecstory/code-review
Clone the repo
git clone --depth 1 https://github.com/specstoryai/getspecstory

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for code-review

README.md
[![agentmods](https://agentmods.dev/badge/commands/specstoryai/getspecstory/code-review.svg)](https://agentmods.dev/commands/specstoryai/getspecstory/code-review)
Your own site
<a href="https://agentmods.dev/commands/specstoryai/getspecstory/code-review"><img src="https://agentmods.dev/badge/commands/specstoryai/getspecstory/code-review.svg" alt="Measured on agentmods" height="20"></a>
Per session 7 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 955 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00007 $0.00955
Opus 5 $0.00003 $0.00477
Sonnet 5 $0.00001 $0.00191
Haiku 4.5 $0.00001 $0.00096

Measured 5d ago against content hash 3118ea7d4ae3, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

1 near-identical copy found in the catalogue:

  • pr-review — 91% identical, 14 lines differ
specstory-cli/.claude/commands/code-review.md · 82 lines

How it starts

The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Context

  • Current git status: !git status
  • Current git diff: !git diff
  • Current untracked files: !git ls-files --others --exclude-standard

Your task

Examine the current proposed code changes and new files using git commands.

Ignore any changes to:

  • .specstory/history files
  • .claude/ files
  • .cursor/ files
  • ./specstory binary
  • CLAUDE.md
  • AGENT.md

Please code review this change.

Review line by line and explain to me the purpose of each change. Use file names and line numbers to reference the changes, but also sequentially number every observation so we can easily reference them.

In the line by line review, pay attention to:

  • clarity of variable names
  • Go lang idiomatic code
  • code clarity and simplicity, readable over clever
  • "why" comments, not "how" comments
  • missing comments
  • missing log output
  • missing analytics tracking
  • single function exit point where possible (immediate guard clauses are OK)
  • goroutines tracked by a sync.WaitGroup use wg.Go(func() { ... }), never wg.Add(1) paired with a defer wg.Done() — flag any Add/Done pair, especially one where the Done sits in a different function from its Add
  • verify the code has to exist, is actually needed, and is in use
  • verify the code is DRY, and doesn't replicate the same or similar code
  • for test cases, ensure a data-driven approach is being used rather than lots of repetitive test code

Format your line by line review like this example:

  cmd/remote.go

  Line 12 (removed): Removed unused import of pkg/service package
  - (1) ✅ Good - Cleaning up unused imports is proper Go hygiene

  Lines 157-162 (modified): Changed from loading config directly to using RPC client
  // Old: config, err := service.LoadConfig(dir)
  // New: rpcClient, err := client.NewRPCClient(dir)
  - (2) ✅ Good architectural decision - Now operates via daemon RPC instead of direct file access
  - (3) ✅ Proper defer cleanup pattern for RPC client
  - (4) ✅ Variable name rpcClient is clear and follows conventions

  Lines 164-189 (new): Added remote status check before disabling
  - (5) ✅ Good UX - Detects current connection state to provide better feedback
  - (6) ✅ Type assertions use the two-value form (ok pattern) for safety
  - (7) ⚠️ Nested if statements become deeply indented (4 levels) - could be refactored for readability
  - (8) ✅ Variable names wasConnected, oldURL are descriptive
  - (9) ❓ Missing error handling - if remote.status call fails, we continue anyway. Should we?

  ---
  pkg/remote/sync.go
  Lines 260-265 (modified): Success messages now come after RPC call
  - (10) ✅ Comment "config is now saved" is helpful context
  - (11) ⚠️ Misleading comment placement - comment says "config is now saved" but we can't be certain from this code's perspective (that happens in the daemon)

Read the full file on GitHub · 82 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 82 lines · 7 tokens per session scan A 3118ea7d4ae3

Subscribe to this mod's changes

code-review is a command published in the GitHub repository specstoryai/getspecstory (1,318 stars, last pushed yesterday), licensed Apache-2.0. It adds 7 tokens to every session and 955 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.