Code reviewer

from enum import Enum
 
from pydantic import BaseModel, Field
 
from agentroute import Agent
 
 
class Severity(str, Enum):
    critical = "critical"
    major = "major"
    minor = "minor"
    nit = "nit"
 
 
class Issue(BaseModel):
    severity: Severity = Field(description="How serious this issue is.")
    category: str = Field(description="e.g. correctness, security, performance, style.")
    description: str = Field(description="What is wrong and why it matters.")
    suggestion: str = Field(description="A concrete fix the author can apply.")
 
 
class Review(BaseModel):
    overall_score: int = Field(ge=0, le=100, description="Quality score from 0 to 100.")
    summary: str = Field(description="One-paragraph verdict.")
    issues: list[Issue] = Field(default_factory=list)
    strengths: list[str] = Field(default_factory=list)
 
 
reviewer = Agent(
    name="code-reviewer",
    model="claude-sonnet-4",
    instructions=(
        "You are a senior engineer doing a code review. Review standards:\n"
        "- Correctness first: flag bugs, edge cases, and incorrect error handling.\n"
        "- Security: flag injection, unsafe input handling, and secret leakage.\n"
        "- Performance: flag obvious inefficiencies, not micro-optimizations.\n"
        "- Style: follow PEP 8; prefer clear names and small functions.\n"
        "Be specific and actionable. Cite the exact construct you are critiquing. "
        "Score 90+ only for code you would merge as-is; 70-89 for code needing "
        "minor changes; below 70 for code with real defects. Also call out genuine "
        "strengths so the author knows what to keep."
    ),
    output=Review,
)
 
 
SNIPPET = '''
def get_user(db, user_id):
    query = "SELECT * FROM users WHERE id = " + user_id
    row = db.execute(query).fetchone()
    return row["name"]
'''
 
 
def main() -> None:
    result = reviewer.run(f"Review this Python function:\n\n{SNIPPET}")
    review: Review = result.output  # a validated Review instance
 
    print(f"Score: {review.overall_score}/100")
    print(f"Summary: {review.summary}\n")
 
    for issue in sorted(review.issues, key=lambda i: i.severity.value):
        print(f"[{issue.severity.value.upper()}] {issue.category}: {issue.description}")
        print(f"  fix: {issue.suggestion}")
 
    if review.strengths:
        print("\nStrengths:")
        for strength in review.strengths:
            print(f"  + {strength}")
 
 
if __name__ == "__main__":
    main()

export AGENTROUTE_API_KEY=sk-...
python code_reviewer.py

Score: 35/100
Summary: This function has a critical SQL injection vulnerability and a likely runtime error. It needs to be rewritten before merging.
 
[CRITICAL] security: user_id is concatenated directly into the SQL string, allowing SQL injection.
  fix: Use a parameterized query, e.g. db.execute("SELECT name FROM users WHERE id = ?", (user_id,)).
[MAJOR] correctness: fetchone() returns None when no row matches, so row["name"] will raise a TypeError.
  fix: Guard for a missing row and return None or raise a domain-specific error.
 
Strengths:
  + The function has a single, clear responsibility.