autoreview

autoreview is a Go CLI and agent skill for one structured, independent code review through Codex CLI, Claude Code, Cursor Agent, or Grok Build. It freezes an explicit Git target, scans the complete bundle for secrets, validates the provider result locally, and emits a stable terminal or JSON report.

Install

On macOS, install the signed CLI from the uinaf/tap Homebrew tap:

brew install --cask uinaf/tap/autoreview
autoreview --version

On Linux amd64 or arm64, install the latest released binary without Go, Homebrew, jq, or sudo:

curl --proto '=https' --tlsv1.2 -fsSL \
  https://raw.githubusercontent.com/uinaf/autoreview/main/install.sh | sh
~/.local/bin/autoreview --version

Pass --version v0.4.0 or --dest /chosen/bin after sh -s -- to pin a release or override ${HOME}/.local/bin. The installer downloads the archive and checksums.txt from the same GitHub Release, verifies the exact SHA-256, and atomically replaces the destination binary. See Release verification for the HTTPS trust boundary and independent Cosign and GitHub attestation checks.

Consumers that prefer Go tooling can instead install with Go 1.26 or newer:

go install github.com/uinaf/autoreview/cmd/autoreview@latest
autoreview --version

Runtime dependencies are Git 2.41 or newer, the trufflehog executable, and the selected review harness available on PATH. Multiple supported harnesses may be installed; --engine selects exactly one for each run.

Quick use

Inspect the effective configuration and its sources, then review dirty local changes:

prompt="Review this completed change against its acceptance criteria."
autoreview config --engine codex
autoreview review --mode local --engine codex \
  --prompt "$prompt"

Use branch for the complete merge-base-to-HEAD diff or commit for one non-merge commit:

prompt="Review this completed change against its acceptance criteria."
autoreview review --mode branch --base origin/main --engine claude \
  --prompt "$prompt"

autoreview review --mode commit --commit HEAD --engine codex \
  --prompt "$prompt"

Autoreview never edits source, runs tests, commits, pushes, chooses a provider, or falls back to another model. Builder verification happens before review.

Machine output

Use --output json for the versioned result contract. The JSON document is the only stdout value; progress and diagnostics use stderr.

prompt="Review this completed change against its acceptance criteria."
autoreview review --mode branch --base origin/main --engine codex \
  --output json --prompt "$prompt" > result.json

Exit 0 means a valid clean review, exit 1 means valid findings, and exit 2 means no trustworthy review result.

The installed binary also exposes its exact canonical contracts:

autoreview schema review > review-v1.schema.json
autoreview schema result > result-v1.schema.json

review describes the structured output expected from a review provider; result describes the CLI's final machine report. These are output contracts, not a generic schema for CLI request parameters.

Agent skill

The bundled agent skill delegates one independent review to the installed CLI. It does not contain a second runtime.

Documentation

• Configuration and isolation
• Review engines
• Local, branch, and commit targets
• Versioned result and exit contract
• Release artifacts and verification

Contributing

See Contributing for setup, release gates, and pull-request expectations.

License

This project succeeds OpenClaw's original autoreview agent skill. The original workflow is MIT licensed and credited to OpenClaw. This project's MIT license preserves the copyright notices for both OpenClaw and uinaf.