code-review-core

The whole pipeline runs on a plain git diff. It makes no API call to any code-hosting provider, issue tracker or chat service, and it posts nothing anywhere. Transport is a separate concern and lives in a separate plugin — see github-workflow if you want a verdict to reach a pull request.

Three stages. A zero-token detection pass dispatches one deterministic detector per tool family (Python, shell, Terraform, secrets, dependency pinning, comment quality, change impact) over only the files the branch touched. Bounded judgement agents then cover semantics, testing, architecture and authoring conformance, with the last three gated so they do not run on diffs that cannot benefit. Finally a validator re-reads every line each agent cited and owns the verdict, writing .code-review/VALIDATED.json — a machine-readable contract a script can gate on.

Reach for it to review a branch against its merge base, locally or in CI, with no credentials of any kind. Do not reach for it if you want a chat-style "review my code" conversation; this is a pipeline with a contract, not a discussion.

This plugin is Claude Code only. The pipeline is shell scripts over a git checkout and the judgement stage is subagents. On the web there is neither, and there is no degraded mode to fall back to — a review that silently produced no findings because it could not run would be worse than no review.