What is multi-model-review?

A set of rules for reviewing important code with several AI models and a security scanner. It covers code quality, correctness, performance, security, maintainability, tests, and documentation.

Use it to guide reviews, compare findings from different models, scan for security issues, set merge thresholds, and verify fixes.

It gives teams a defined review path for payment, order, user, security-sensitive, shared-library, and performance-critical code before merging it.

multi-model-review — Cursor rule by bestcarly

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add rules/bestcarly/opc-coding-guide/multi-model-review

Clone the repo

git clone --depth 1 https://github.com/bestcarly/opc-coding-guide

Per session 1,858 This file is loaded in full into every session.

When invoked 1,858 The same file — it is already loaded in full.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.01858	$0.01858
Opus 5	$0.00929	$0.00929
Sonnet 5	$0.00372	$0.00372
Haiku 4.5	$0.00186	$0.00186

Measured 2d ago against content hash f16956b7ad15, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

multi-model-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/cursor-rules/multi-model-review.mdc · 275 lines

How it starts

The opening of the file, as written. The whole thing — 275 lines — stays where its author put it; the contents beside it link to each section on GitHub.

多模型审查规则（2026 年版）

补充人：墨铃 (Mori)
补充日期：2026-02-28
参考章节：第十一章 11.2 节

适用范围

以下代码必须进行多模型审查：

核心业务逻辑：支付、订单、用户管理
安全敏感代码：认证、授权、加密、数据处理
公共库和框架：被多处引用的模块
性能关键代码：高频调用、大数据处理

审查流程

1. 开发者完成代码并自测
   ↓
2. 运行模型 A 审查（Claude Opus 4.5）
   ↓
3. 运行模型 B 审查（GPT-5.3-Codex）
   ↓
4. 运行安全扫描（Claude Code Security）
   ↓
5. 对比分析，生成综合报告
   ↓
6. 人工审查 Critical/High 问题
   ↓
7. 修复问题
   ↓
8. 重新验证
   ↓
9. 合并代码

模型分工

模型	角色	特长	超时配置
Claude Opus 4.5	深度审查	架构分析、边界条件、可维护性	300s
GPT-5.3-Codex	快速扫描	代码规范、性能、测试覆盖	180s
Claude Code Security	安全扫描	漏洞检测、合规检查	240s

审查维度

代码质量

命名规范
函数长度（< 50 行）
圈复杂度（< 10）
重复代码检测
注释完整性

功能正确

需求覆盖
边界条件
异常处理
错误恢复

性能

时间复杂度
空间复杂度
数据库查询优化
缓存策略

安全

输入验证
认证授权
数据加密
敏感信息泄露

可维护性

模块化
依赖管理
测试覆盖
文档完整

质量门槛

代码必须满足以下条件才能合并：

指标	门槛	说明
总体评分	≥ 8/10	综合评估
Critical 问题	0 个	必须全部修复
High 问题	≤ 2 个	修复或记录风险
测试覆盖率	≥ 80%	核心模块 ≥ 90%
安全扫描	通过	无 Critical/High

提示词模板

模型 A（Claude）审查提示词

# Role: 资深代码审查专家

## Profile
- 15 年后端开发经验
- 精通 TypeScript/Node.js/Python
- 专长：架构设计、边界条件、可维护性

## Goals
对代码进行深度审查，发现潜在问题

## Workflow
1. 理解代码意图和上下文
2. 检查架构和设计模式
3. 分析边界条件和异常处理
4. 评估可维护性和扩展性
5. 提出改进建议

## Input
- 代码：[文件路径或代码块]
- 上下文：[相关文档/需求]
- 重点：[安全/性能/可维护性]

## Output Format
### 审查报告

#### 概览
- 文件：[文件名]
- 评分：[X/10]
- 总结：[一句话总结]

#### 问题列表
| 序号 | 类型 | 位置 | 严重程度 | 描述 | 建议 |
|------|------|------|----------|------|------|
| 1 | 边界条件 | auth.ts:45 | Medium | 未处理空值 | 添加空值检查 |

#### 优点
- [列出代码优点]

#### 改进建议
- [列出改进建议]

模型 B（Codex）审查提示词

# Role: 代码质量工程师

## Profile
- 10 年全栈开发经验
- 精通代码规范和最佳实践
- 专长：性能优化、测试覆盖、代码规范

## Goals
快速扫描代码质量问题

## Workflow
1. 检查代码规范
2. 分析性能瓶颈
3. 评估测试覆盖
4. 检测重复代码
5. 提出优化建议

## Input
- 代码：[文件路径或代码块]
- 规范：[编码规范文档]

## Output Format
### 快速扫描报告

#### 评分
- 代码规范：[X/10]
- 性能：[X/10]
- 测试覆盖：[X/10]
- 总体：[X/10]

#### 问题列表
| 序号 | 类型 | 位置 | 严重程度 | 描述 |
|------|------|------|----------|------|
| 1 | 性能 | user.ts:120 | High | N+1 查询问题 |

#### 建议修复
[修复代码示例]

Read the full file on GitHub · 275 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 275 lines · 1,858 tokens per session scan A f16956b7ad15

Subscribe to this mod's changes

multi-model-review is a cursor rule published in the GitHub repository bestcarly/opc-coding-guide (7 stars, last pushed 5mo ago), licensed MIT. It adds 1,858 tokens to every session, about $0.0093 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Code review Security Testing

multi-model-review