Overview¶

CloudAEye reviews uncommitted changes by default, before you commit. Pass an open PR number to a supported skill to review a pull request instead.

Working-tree review compares the change, including new files, with the branch's fork point from its integrated branch. See Custom Context for repository rules and context.

The three review passes¶

Pass	Scope	When to use
Inspect	Bugs, logic, edge cases, validation, and error handling	After a coding task
Security	Application, LLM, agent, MCP, and secret risks	For security-relevant changes
Review	Bugs and security together	Before a significant PR

Inspect does not run security checks. Run Security separately or use Review when a change touches authentication, untrusted input, secrets, or AI tooling.

Slop Score¶

A different question from the three passes above: not is there a bug in this change but how much careful reading does it need before it is merged. Nine signals of low-quality code — duplicate code, calls that resolve nowhere, dead code, missing tests, complexity this change added, generic names, boilerplate comments, overengineering, style the file disagrees with — reported as a score out of 100 and one of four review bands, with the findings behind it.

It reads whatever a review has already worked out on the same diff, so running it after a pass above costs very little. The band describes review burden, never authorship — it says a change needs a careful read, not who or what wrote it. See Skills & Commands.

Control Flow¶

Show how the change alters calls through before/after sequence diagrams. The arrows come from the repository's code graph, not guesses from diff text. See Control Flow Analysis.

Architecture Review¶

Show affected services, repository layers, and dependencies, then report architectural risks and questions. This is separate from bug detection. See Architecture Review.

The other commands¶

Change Risk¶

A fifth question, asked of an open pull request before anyone reads it: does it need a careful human review, why, and who should do it. Change Risk weighs who wrote the change, what it touches, and what those files and that author have been through over the last few weeks — bugs reported against the files, code rewritten soon after it landed, whose code it is, the author's recent pull requests — together with the pull request's own Slop Score. It returns a risk score out of 100 with its band, a recommendation, what needs attention ranked with the file, issue or pull request behind each line, and who to ask.

The history is read from the repository and from your GitHub issues and Jira bug tickets, each carrying a short note CloudAEye writes in the background saying which files the bug was in. Anything it could not measure is named and left out of the score, never counted as clean. It posts its card on the pull request only when you say so. See Skills & Commands.

The other three commands¶

See the complete Skills & Commands catalog.

The commands that write¶

Some commands create issues, request reviewers, post reports, or add PR review suggestions. These are real external writes, not working-tree edits. Follow each skill's confirmation rules and check whether delivery succeeded before repeating it. See the User Guide for command-specific behavior.

How a review runs¶

A working-tree review follows this sequence:

sequenceDiagram
    participant Agent as Coding agent
    participant Server as CloudAEye MCP
    Agent->>Server: initialize_repository
    Server-->>Agent: Repository ready or setup required
    Agent->>Server: start_session
    Server-->>Agent: Session, target branch, upload URL and grant
    Note over Agent: Build the working-tree Git diff
    Agent->>Server: Upload diff to returned URL
    Agent->>Server: Run analysis tool
    alt Queued analysis
        Server-->>Agent: Job ID
        loop Until terminal status or polling limit
            Agent->>Server: get_job_result
            Server-->>Agent: Job status and result when complete
        end
    else Synchronous response
        Server-->>Agent: Result or error
    end
    Agent->>Agent: Present completed result or report the error

OAuth determines the account and organization. The agent must complete repository initialization before creating a session. The returned target branch determines the baseline; without a usable fork point, the diff can fall back to HEAD.

For PR reviews, the server fetches the diff instead of requiring an upload from the agent. See Tool Reference for tool contracts.

Iterating¶

Wait for a review to finish before planning fixes. After edits, run the review again against the changed diff. Poll an existing job rather than submitting replacement work. Errors and expired results are not clean verdicts.

What leaves your machine¶

Working-tree analysis uploads a Git diff to CloudAEye.
Skills may mark untracked paths with git add --intent-to-add; this changes index entries without staging their contents. Preserve unrelated staged work.
A gitignored .cloudaeye/ directory holds temporary session/diff data.
Upload credentials use private temporary files, not Git-tracked settings. Do not paste credentials into chat or logs.

Supported Coding Agents¶

See Supported Coding Agents or IDE Integrations with MCP for setup instructions. Each client connects to the same backend but has its own authentication, skill installation, and tool configuration.