Skip to content

v3.21.0 - LLM-Powered Code Review Agent

Choose a tag to compare

View all tags
@sinewaveai sinewaveai released this 20 Mar 12:17
v3.21.0
a19f0b6

What's New

🤖 LLM-Powered Semantic Code Review Agent

This release adds code-review-agent/ — a new LLM-powered semantic code review tool that uses intent profiling to distinguish safe patterns from dangerous ones based on project context.

The key differentiator: Same code, different verdicts based on what the project is supposed to do:

  • A build tool running subprocess.run() with hardcoded commands → expected (that's its job)
  • An e-commerce app calling eval(req.query.filter) → dangerous (shouldn't eval user input)
  • A file organizer calling os.remove() → expected (that's its purpose)
  • An auth API calling fs.writeFile(req.body.path) → dangerous (shouldn't write arbitrary files)

Key Features

Feature Description
Intent Profiling Reads README, dependencies, and structure to understand project purpose
3 LLM Providers Anthropic API, OpenAI API, Claude CLI (no API key needed!)
3 Output Formats Colored terminal text, JSON, SARIF 2.1.0
Dynamic Chunking Large files split based on token budget, not hardcoded line limits
Dependency Graph Resolves JS/TS/Python imports including barrel re-exports
Prompt Injection Defense System prompts mark repo content as untrusted input

Usage

cd code-review-agent
npm install
npm run build

# Analyze a project (no API key needed with claude-cli!)
npx tsx bin/cr-agent.ts analyze ../path/to/project -p claude-cli -v

# View intent profile
npx tsx bin/cr-agent.ts intent ../path/to/project -p claude-cli

# Output as SARIF for GitHub Code Scanning
npx tsx bin/cr-agent.ts analyze ../path/to/project -f sarif

Stats

  • 17 source files, 9 test files (58 tests), 4 test fixture projects
  • Tested live: 18 real findings on VulnApp, ~1 false positive per 15 findings on hardenedapp

Full Changelog

New Features:

  • feat: add LLM-powered semantic code review agent (#44)

Dependencies:

  • chore(deps): bump @hono/node-server from 1.19.9 to 1.19.11
  • chore(deps): bump express-rate-limit from 8.2.1 to 8.3.0
  • chore(deps): bump hono from 4.12.5 to 4.12.7
Assets 2
Loading