Skip to content

Code Review

CloudAEye Code Review helps engineering teams identify bugs, security vulnerabilities, and implementation risks before code is merged. It analyzes code changes, reports actionable findings, and helps developers improve code quality throughout the development lifecycle.

CloudAEye supports two complementary review workflows:

  • Pull request reviews: Analyze changes directly in GitHub, GitLab, or Bitbucket using pull request comments or configured Auto Review.
  • Coding agent reviews: Analyze local changes through an AI coding agent integrated with CloudAEye, allowing developers to identify and resolve issues before committing code.

Why Code Review?

AI coding agents and modern development tools make it easier to generate code quickly. However, generated code still needs to be validated for correctness, security, maintainability, and compliance with project requirements.

CloudAEye helps engineering teams address these challenges by providing automated analysis of code changes.

Key capabilities include:

  • Bug detection: Identify logic errors, edge cases, incorrect assumptions, and potential runtime failures.
  • Security analysis: Detect vulnerabilities in application code, authentication, authorization, data handling, and other security-sensitive areas.
  • AI application security: Analyze relevant risks in LLM applications, AI agents, and Model Context Protocol (MCP) servers.
  • Actionable findings: Explain identified issues, their potential impact, and possible remediation.
  • Requirements validation: Compare implementation changes against linked Jira or GitHub issues.
  • Policy enforcement: Apply configured review checklists, custom rules, and supported linting checks.
  • Pull request governance: Use review verdicts and configured approval policies to help teams enforce quality gates.
  • Developer workflow integration: Review changes directly in pull requests or through supported AI coding agents.

Use Cases

1. Catch Bugs Before Merging

Code changes can introduce regressions, incorrect business logic, missing validations, and edge-case failures that are not immediately apparent.

CloudAEye analyzes changed code to identify potential defects and recommends corrective actions.

Example: A developer changes payment calculation logic but does not account for a zero-value transaction. CloudAEye can flag the missing edge-case handling and explain the potential impact.

When to use it: During everyday development and before merging pull requests.

2. Review AI-Generated Code

AI coding agents can generate substantial code changes quickly, but generated code may contain subtle bugs, unsafe assumptions, or incomplete error handling.

CloudAEye provides an independent review of those changes, helping developers validate the output of their coding agents.

Example: A coding agent generates an API endpoint that accepts user-supplied identifiers. CloudAEye can identify missing input validation or authorization checks in the implementation.

When to use it: After a coding agent completes a task, before committing changes, and before merging AI-generated code.

3. Detect Security Vulnerabilities

Security issues can be introduced through insecure input handling, missing authorization checks, exposed credentials, unsafe deserialization, and other implementation mistakes.

CloudAEye analyzes relevant security-sensitive code paths and provides findings with remediation guidance.

Example: A pull request adds an endpoint that returns account information without verifying that the requesting user is authorized to access the account. CloudAEye can flag the potential access-control vulnerability.

When to use it: Before merging security-sensitive changes, including authentication, authorization, API endpoints, data access, and cryptographic functionality.

4. Secure LLM Applications and AI Agents

Applications built with LLMs and AI agents introduce additional risks, including prompt injection, sensitive information disclosure, unsafe output handling, excessive agency, and tool misuse.

CloudAEye supports security analysis for applicable LLM applications, agentic systems, and MCP servers.

Example: An AI agent accepts untrusted input and passes it to a tool that can execute privileged operations. CloudAEye can identify relevant risks in how the application validates input, constrains tool access, and handles agent actions.

When to use it: When developing LLM-powered applications, retrieval-augmented generation (RAG) systems, AI agents, or MCP servers.

5. Validate Changes Against Requirements

A pull request may contain technically valid code without fully implementing the requirements described in its associated ticket.

CloudAEye can compare code changes with linked Jira or GitHub issues and report whether the implementation appears to satisfy the requested work.

Example: A Jira ticket requires an API to validate email addresses and reject invalid input. A pull request implements the API but omits the validation. CloudAEye can identify the missing requirement when issue alignment is enabled and the ticket is available.

When to use it: When implementing feature requests, bug fixes, acceptance criteria, or other ticket-driven development work.

6. Enforce Engineering Standards

Teams often need consistent enforcement of repository-specific policies, required review steps, coding standards, and quality checks.

CloudAEye supports configured review checklists, custom rules, and linters where enabled.

Example: An engineering team requires new API endpoints to include appropriate error handling and follow its internal security conventions. The team can use configured rules and review checks to help enforce those requirements.

When to use it: When standardizing code quality across teams, repositories, and engineering workflows.

7. Prioritize Critical Findings

Not every finding has the same impact. Developers need to distinguish serious vulnerabilities and correctness problems from lower-priority maintainability or style issues.

CloudAEye categorizes findings by severity and supports severity filtering in its coding-agent review workflow.

Example: A developer wants to focus on critical and high-severity problems before releasing a production change. They can request a review with an appropriate severity threshold in a supported coding-agent workflow.

When to use it: During release preparation, security remediation, and reviews of high-impact changes.

8. Automate Reviews Across Repositories

Manually initiating reviews for every pull request can create inconsistent coverage, especially across large engineering organizations.

CloudAEye supports Auto Review so teams can configure automatic reviews globally or individually for supported repositories.

Example: A team wants every pull request targeting its production branch to receive an automated review. It can configure Auto Review and use repository-level filters to target the relevant pull requests.

When to use it: When establishing consistent review coverage and reducing the manual effort required to initiate reviews.

Review Commands

CloudAEye provides different review commands depending on the workflow and depth of analysis required.

Pull Request Commands

Run these commands by commenting on a pull request in a connected repository.

/inspect

@cloudaeye /inspect

Runs a focused inspection of the pull request changes across 10 targeted categories, covering common code-quality issues and foundational security checks.

It checks for issues such as:

  • Logic errors
  • Edge case handling
  • Code clarity
  • Input validation
  • Concurrency safety
  • Naming consistency
  • Error handling
  • Code signature
  • Auth and access
  • Injection protection

Use /inspect for an initial review or to catch common problems before requesting a more comprehensive review.

/security

@cloudaeye /security

The @cloudaeye /security command performs a focused security review of your code changes to identify vulnerabilities, exposed secrets, and security risks across traditional applications, LLM-powered systems, AI agents, and Model Context Protocol (MCP) integrations.

It helps developers identify security issues before they reach production, aligning code reviews with OWASP Top 10 guidance and enterprise security expectations without disrupting the development workflow.

When to Use

Run /security when code changes involve:

  • Authentication, authorization, or access control
  • Untrusted input, database queries, or command execution
  • API keys, credentials, tokens, or other secrets
  • Cryptography, sensitive data, or serialization and deserialization
  • LLM prompts, model integrations, or AI-generated content
  • AI agent orchestration, tool definitions, or agent permissions
  • MCP servers, tools, and resource access

You can also run /security whenever you need a dedicated security assessment of a pull request, regardless of the changes involved.

What It Checks

CloudAEye evaluates code changes across five security report categories.

1. Application Security

It identifies common application security vulnerabilities, including:

  • Injection Protection: Detects potential SQL, NoSQL, and command injection vulnerabilities.
  • Authentication and Authorization: Identifies access control weaknesses, authorization bypasses, and improperly enforced permissions.
  • Sensitive Data Handling: Detects potential exposure of personally identifiable information (PII) or sensitive data through logs, request parameters, and other output channels.
  • Safe Deserialization: Identifies unsafe deserialization patterns that could allow untrusted data to compromise application security.
  • Security Misconfiguration: Flags overly permissive settings and insecure configurations that could increase the application's attack surface.
  • XML External Entity (XXE): Detects XML processing configurations that may allow external entity resolution, potentially exposing local files or enabling unauthorized external requests.
  • Cryptographic Failures: Identifies insecure cryptographic practices and weaknesses in the protection of sensitive data.
2. LLM Security

It focuses on security risks in applications that use large language models (LLMs), including prompt injection, unsafe handling of model inputs and outputs, and other LLM-specific vulnerabilities.

3. AI Agent Security

It examines security risks in AI agent implementations, including unsafe agent behavior, tool access, permissions, and orchestration patterns that could lead to unintended or unauthorized actions.

4. MCP Security

It reviews Model Context Protocol (MCP) implementations for security weaknesses involving tool definitions, resource access, input validation, and interactions between MCP clients and servers.

5. Secret Detection

It identifies secrets exposed in changed lines, including API keys, credentials, access tokens, and other potentially sensitive values that should not be committed to source control.

Scope

The /security command follows the same execution flow, output structure, and iteration behavior as /inspect. The difference is the review scope: /security focuses specifically on security vulnerabilities and risks across application code, LLMs, AI agents, MCP integrations, and exposed secrets.

The command provides a focused security assessment to help your team identify and address vulnerabilities before merging code into your main branch.

/review

@cloudaeye /review

Runs a comprehensive review of the pull request changes. It includes broader bug detection, security analysis, and applicable configured review checks.

Depending on the repository configuration and the code being analyzed, it can include:

  • Potential bugs and logical errors
  • OWASP-aligned application security checks
  • LLM, AI-agent, and MCP security analysis
  • Configured pull request checklists
  • Repository-specific custom rules
  • Configured linting checks
  • Issue alignment against linked Jira or GitHub issues

Use /review before merging significant changes or when you need a broader assessment of correctness, security, and policy compliance.

Coding Agent Commands

CloudAEye also integrates with supported AI coding agents through MCP.

The Claude Code plugin exposes the following commands:

Command Purpose
/cloudaeye:inspect Focused bug detection for routine coding tasks
/cloudaeye:security Security-focused analysis
/cloudaeye:review Comprehensive review combining bug detection and security analysis

These commands can analyze local uncommitted changes. The review can be scoped to the entire change, a directory, an individual file, or an eligible open pull request.

For invocation syntax, severity filters, supported scopes, and iterative review workflows, see the Coding Agent User Guide.

Review Categories and Approval

For pull request reviews, CloudAEye organizes findings into review categories. The configured review level determines which categories are included.

Review level Category Purpose
1 Critical Identifies issues that must be resolved before approval.
2 Important Highlights significant correctness, security, or technical-debt concerns.
3 Nice to have Recommends improvements to robustness and completeness.
4 Style and code conventions Identifies readability, naming, consistency, and convention issues.

The categories are cumulative. Higher review levels include the categories from lower levels.

CloudAEye submits a GitHub review verdict based on its findings and configured review behavior:

  • Approved: The review verdict is APPROVED.
  • Changes requested: The review verdict is CHANGES_REQUESTED.
  • Neutral review: If CloudAEye cannot interpret the approval summary, it submits a neutral review rather than approving the pull request or requesting changes.

A pull request containing a Critical finding is not approved by CloudAEye.

Review verdicts are automated assessments and should be considered alongside engineering judgment and any additional checks required by your organization.

Issue Alignment

CloudAEye can compare the pull request with one or more Jira or GitHub issues and report whether the requested work is complete.

For a manual review, add the issue references to the /review comment:

@cloudaeye /review [BETA-5225, #42]

For an automatic pull request review, add the issue references to the pull request title. For example:

[BETA-5225, owner/repo#42] Fix account validation

Supported reference formats:

Format Example Issue source
Jira issue key [BETA-5225] or [BETA-5225, BETA-5223] The tenant's Jira instance connected through the CloudAEye Jira Forge app.
GitHub issue in the reviewed repository [#42] Issue 42 in the repository under review.
Qualified GitHub issue [owner/repo#42] Issue 42 in the specified repository.
GitHub issue URL [https://github.com/owner/repo/issues/42] The issue identified by the URL.
Mixed Jira and GitHub issues [BETA-5225, #42] Each issue is fetched concurrently from its own source.

Separate references with commas, semicolons, or whitespace. Jira and GitHub references can be mixed freely in one list, with a maximum of 10 references per review.

When issue references are present, CloudAEye adds an issue-alignment summary to the pull request:

Status Meaning
DONE The pull request completes all work defined by the referenced ticket or tickets.
NOT_DONE The pull request does not complete all work defined by the referenced ticket or tickets.
ERROR CloudAEye encountered an error while evaluating issue alignment.

For pull request reviews, use the following sequence:

  1. Open a pull request in a connected repository.
  2. Run @cloudaeye /inspect to identify common issues.
  3. Address the findings and update the code.
  4. Run @cloudaeye /review for a comprehensive review before merging.
  5. Review the findings, resolve applicable issues, and verify the changes.
  6. Confirm that required review checks and approval policies are satisfied.

For coding-agent workflows, run /cloudaeye:inspect after completing a coding task, ask the agent to address relevant findings, and run the inspection again to verify the updated changes. Use /cloudaeye:security for security-sensitive work and /cloudaeye:review before significant changes.

Auto Review & Tech Stack Knowledge

You can also automate your pull request (PR) review workflow by following the Auto PR Review guide.

For more accurate and relevant reviews, you can configure CloudAEye to reference your existing technology stack documentation. This provides additional context about your architecture, frameworks, and technologies, helping CloudAEye tailor its reviews to your project.

Report Types

CloudAEye code review offers different types of review reports.

Bug Report

CloudAEye provides details about potential bugs that has been found in a PR code change. It includes following details:

  • Bug Priority
  • Bug Details
  • Where this bug was found
  • Possible Fix

Code Review - Bug Report

Security Report

CloudAEye provides details about potential security issues that has been found in a PR code change. It includes following details:

  • Security Issue Type
  • Security Issue Details
  • Where this Security Issue was found
  • Possible Fix

Code Review - Security Report

Categories used for Security vulnerability

  • Broken Authentication
  • Sensitive Data Exposure
  • Broken Access Control
  • Injection
  • Cross-Site Scripting (XSS)
  • Security Misconfiguration
  • XML External Entities (XXE)
  • Insecure Deserialization
  • Insufficient Logging & Monitoring

Risk Score Guidelines

Risk Score Risk Type Description
5.0 Critical Immediate system-level security risk
4.0 High Significant security risk requiring urgent attention
3.0 Medium Notable security concern requiring attention
2.0 Low Minor security issue that should be addressed
1.0 Info Potential security improvement
0.0 None No security impact

LLM Security Report

CloudAEye provides details about potential LLM security issues and vulnerabilities introduced by the use of large language models (LLMs) in applications. These include:

  • Security Issue Priority
  • Security Issue Details
  • Where this Security Issue was found
  • Possible Fix

Code Review - Security Report

Categories used for LLM security alerts

  • Output Handling and Agency Control
  • Agency and Autonomy Issues
  • Sensitive Information Protection
  • Injection Attack
  • Over-Reliance Assessment
  • Cost and Resource Management

AI Code Report

CloudAEye scans your PR code changes and provides details about potential code issues found in your GenAI and Agentic AI code. These include:

  • Issue Priority
  • Issue Details
  • Possible Fix

Code Review - Security Report

Example from GitLab environment.

Code Review - AI Security Report

Security Coverage

CloudAEye analyzes security risks relevant to the code being changed. Depending on the application and applicable review configuration, coverage includes:

  • Application security: Authentication, authorization, injection, sensitive data exposure, insecure deserialization, security misconfiguration, and other common vulnerability classes.
  • LLM application security: Prompt injection, sensitive information disclosure, unsafe output handling, system prompt leakage, and uncontrolled resource consumption.
  • AI-agent security: Tool misuse, excessive agency, privilege compromise, memory poisoning, and risks associated with autonomous actions.
  • MCP server security: Tool and resource definitions, parameter validation, error handling, authorization boundaries, and safe tool interactions.
  • Secrets and credentials: Potentially exposed API keys, tokens, and other sensitive values in applicable review workflows.

Security findings include issue details and potential remediation guidance to help developers investigate and resolve the identified risks.

For a focused review of application, LLM, and agent security plus credentials exposed in changed lines, use Security Review. Comment @cloudaeye /security on a pull request or merge request, or run /cloudaeye:security from your coding agent.

Security Features

CloudAEye provides deep, policy-driven OWASP-aligned security coverage.

Security & Compliance

These checks align with OWASP Top 10 and enterprise security expectations without slowing developers down.

  • No Secrets in Code: Secrets, API keys, or credentials are not exposed.
  • Injection Protection: Code is safeguarded against SQL/NoSQL/command injection.
  • Authentication & Authorization: Access controls are implemented correctly without bypass path
  • Sensitive Data Handling: PII or sensitive data is not leaked in logs or request parameters.
  • Safe Deserialization: Deserialization logic avoids insecure patterns.
  • Security Misconfiguration: Lazy or overly permissive security settings that make your app easier to attack are not used.
  • XML External Entity (XXE): Reading XML files without blocking external references that attackers can no longer use to steal sensitive files or make unauthorized requests.

LLM and Gen AI Apps Security

This makes CloudAEye suited for teams building AI-native products.

For RAG based LLM applications like chatbots, content generation, and Q&A systems WITHOUT autonomous agents.

  • Prompt Injection: User prompts do not alter the LLM’s behavior or output in unintended ways.
  • Sensitive Information Disclosure: Sensitive data included in prompts to external LLM APIs without redaction.
  • Improper Output Handling: Insufficient validation, sanitization, and handling of the outputs generated by large language models before they are passed downstream to other components and systems.
  • Excessive Agency: Does not enable damaging actions to be performed in response to unexpected, ambiguous, or manipulated outputs from an LLM.
  • System Prompt Leakage: System prompts or instructions used to steer the behavior of the model are not inadvertently leaked.
  • Vector and Embedding Weaknesses: Vectors and embeddings vulnerabilities are not present in systems utilizing Retrieval Augmented Generation (RAG) with Large Language Models (LLMs).
  • Misinformation: Code can address situations where LLMs produce false or misleading information that appears credible.
  • Unbounded Consumption: Large Language Model (LLM) application does not allow users to conduct excessive and uncontrolled inferences, leading to risks such as denial of service (DoS), economic losses, model theft, and service degradation.

Agentic Security

CloudAEye supports OWASP Top 10 for Agentic Applications.

For autonomous AI agents that make decisions, use tools, and execute actions independently.

  • Memory Poisoning: Prevent injection of malicious data into persistent agent memory that could corrupt behavior across sessions or agents.
  • Tool Misuse: Adversarial tool misuse through chaining, privilege escalation, or execution of unintended actions is prevented.
  • Privilege Compromise: Attackers can’t exploit implicit trust relationships between agents, tools, memory contexts, or task transitions to execute actions beyond intended permissions.
  • Resource Overload: Attackers can’t exploit open-ended goals, long planning chains, or looping delegation to consume compute, memory, storage, or API credits.
  • Cascading Hallucination: Hallucinations are prevented and can’t cascade into widespread misinformation, faulty decisions, or unsafe actions.
  • Intent Breaking & Goal Manipulation: Prevent manipulation of agent goals or planning logic that could cause unintended actions.
  • Repudiation & Untraceability: Code has proper traceability to reduce the risk of repudiation.
  • Overwhelming Human-in-the-Loop: Agents may not flood users with requests, obscure critical decisions, or exploit approval fatigue.
  • Unexpected RCE & Code Attacks: Exploit of code-generation features or embedded tool access to escalate actions into remote code execution (RCE), local misuse, or exploitation of internal systems is prevented.
  • Agent Communication Poisoning: No injection of malicious content into inter-agent messages or shared communication channels, corrupting coordination, triggering undesired workflows, or manipulating agent responses.
  • Rogue Agents in Multi-Agent Systems: Malicious, unauthorized, or compromised agents can’t embed themselves in a multi-agent system (MAS), influencing workflows, exfiltrating data, or sabotaging operations.

MCP Server

For building Model Context Protocol servers that integrate with AI tools.

Definition & Documentation:

  • MCP Server Metadata: Server has a clear, descriptive name and purpose that helps users understand what it does.
  • Tool Definitions: Each tool includes a clear explanation of what it does and when to use it.
  • Resource Definitions: Data sources have clear descriptions and specify what format data is returned in.
  • Prompt Definitions: Reusable prompts include clear instructions about what information they need.
  • Parameter Descriptions: Every input field has a description explaining what values are valid and what format to use.
  • Internal vs Client Descriptions: Documentation focuses on how to use features, not internal technical details.
  • Naming Conventions: Tools, resources, and prompts use clear, descriptive names that make their purpose obvious.

Tool Parameter Handling:

  • Type Annotations: All inputs specify what type of data they expect (text, numbers, lists, etc.).
  • Optional vs Required: Clear indication of which inputs are mandatory and which have default values.
  • Validation Constraints: User inputs are checked for valid values, proper formats, and safe ranges.
  • Hidden Parameters: Sensitive information like API keys are injected securely, never exposed as user inputs.
  • Complex Types: Complex inputs use well-defined structures instead of generic formats.

Tool Call Return Optimization:

  • Async vs Sync: Tools use appropriate methods for fast vs slow operations (network calls, file operations).
  • Return Type Validation: Outputs follow consistent, validated structures.
  • Content Formatting: Different types of content (images, text, structured data) are returned in the correct format.
  • Response Size: Large datasets are paginated or filtered to prevent overwhelming responses.
  • Streaming Responses: Large data exports use incremental delivery for better performance.

Error Handling:

  • Error Handling: Error messages are clear and helpful, without exposing technical internals.
  • Internal Detail Masking: Detailed error information is logged for debugging while keeping user messages simple.
  • Graceful Degradation: When optional features fail, the system continues working with reduced functionality.
  • Timeout Handling: External operations have time limits and provide clear timeout messages.

Autonomous Tool Interactions:

  • Tool Safety: Destructive operations (like deletes) are clearly marked and require confirmation.
  • Tool Availability: Tools automatically enable/disable based on whether required dependencies are available.
  • Tool Dependencies: Clear documentation of which tools depend on others.
  • Rate Limiting: Protection against excessive requests to backend resources.
  • Idempotency: Operations that can be safely retried are marked as such.

Sampling and Elicitation:

  • Prompt Injection Protection: User inputs are properly separated from system instructions to prevent manipulation.
  • LLM Response Validation: Responses from AI models are validated against expected formats before use.
  • Client Authenticity: Server doesn't blindly trust client responses without validation.
  • Elicitation Patterns: Complex requirements are broken into clear, step-by-step prompts.
  • Context Management: Chat history is managed appropriately for context.
  • Destructive Operation Elicitation: Destructive actions use interactive prompts to verify user intent.

Code Review Examples

CloudAEye goes beyond traditional linting and static analysis to identify security vulnerabilities, AI agent risks, logic errors, and architectural issues. By combining code analysis with full codebase context and technology stack awareness, CloudAEye helps engineering teams ship secure, reliable software with confidence.

Security Review

Identify vulnerabilities across application code, AI agents, LLM-powered workflows, and Model Context Protocol (MCP) servers.

1. Hardcoded Secrets

OWASP Category: Cryptographic Failures

Detect hardcoded API keys and other sensitive credentials that could expose services or compromise accounts if committed to source control.

View example: Hardcoded API key detection

2. Security Misconfiguration

OWASP Category: Security Misconfiguration

Identify insecure configuration choices that could expose infrastructure, weaken access controls, or increase the attack surface of an application.

View example: Security misconfiguration

3. AI Agent Security

OWASP Category: AG3: Unbounded Agency in Chat Assistant

Detect AI agent designs that grant excessive autonomy or allow actions without adequate constraints. Help prevent unintended operations by identifying missing safeguards, authorization boundaries, and controls over agent behavior.

View example: Unbounded agency in an AI assistant

4. LLM Application Security

OWASP Category: LLM-1: Prompt Injection

Identify prompt injection risks in LLM-powered workflows, including scenarios where untrusted input may influence an agent's instructions, tool usage, or downstream actions.

View example: Prompt injection in a web research task

Code Review

Find logic errors, context-dependent vulnerabilities, and implementation risks that require understanding more than the changed lines.

5. Bug Detection: Division by Zero

Issue: Division by Zero Risk in Log-Scaled Transformation

Detect potential runtime failures caused by mathematical edge cases. For example, log-scaled transformations may encounter zero or invalid values, leading to division by zero or unexpected numerical results.

View example: Division by zero risk

6. MCP Security: Tenant Isolation

OWASP Category: MCP4: Potential Tenant Isolation Failure

Analyze MCP server implementations for potential cross-tenant data exposure. Identify cases where request handling, database access, or authorization checks may fail to enforce tenant boundaries.

View example: Potential tenant isolation failure

7. Technology Stack-Aware Review

What if your code review agent truly understood your entire technology stack?

CloudAEye evaluates code changes in the context of the frameworks, infrastructure, configuration, and platform conventions used by your project. This enables more relevant findings that account for technology-specific behavior and integration risks.

View example: Technology stack-aware code review

8. Full Codebase Context

Understand how code changes affect the rest of your system.

CloudAEye analyzes relationships among files, functions, classes, modules, and dependencies to identify issues that isolated line-by-line analysis can miss. By considering broader codebase context, it can surface potential regressions, cross-module issues, and implementation risks that require understanding how components work together.

View example: Full codebase context

Prerequisites

Before using CloudAEye Code Review:

  1. Create a CloudAEye account.
  2. Connect your repository using a supported integration.
  3. Complete the repository onboarding and configuration steps.
  4. For coding-agent reviews, install and configure the appropriate integration.

See the Getting Started guide for pull request setup and the IDE Integration Guide for coding-agent setup.