Best AI Agent Skills for Code Review in 2026

# The Best AI Agent Skills for Code Review in 2026

A senior engineer once told me the worst part of code review isn't the thinking, it's the bookkeeping. Pulling the diff, re-reading your own change before anyone else has to, running the linter, chasing down which of the 14 reviewer comments you actually addressed. The judgment part takes ten minutes. The mechanical part eats an hour.

That gap is where AI agent skills earn their place. None of the skills below will tell you whether a function belongs in this module or whether your abstraction is the right one. That's still your job, and anyone selling you otherwise is selling something. What they do is strip out the manual labor wrapped around the review: preparing a clean PR, running a static-analysis pass, and working through feedback in order instead of forgetting half of it.

I've pulled six skills that handle different slices of the review loop. Three come from one bundle, two are standalone, and one I'd tell you to read line-by-line before it touches your machine. Here's the map first, then the install commands.

Quick comparison

A quick note on the trust column, because it's the whole point of this site. "Verified" means the repo is real, the maintainer is known, and the code has had eyes on it. "Official" means it ships from the vendor itself. "Community / unreviewed" means none of that is guaranteed. Install at your own risk, and only after you've read it.

The Superpowers review trio

Three of the six come from the Superpowers bundle, a sprawling MIT-licensed collection sitting at ~227k stars. The review skills split the loop into before, during, and after, which matches how review actually feels when you're the one shipping.

sp-requesting-review, prep the PR before a human sees it

Most bad reviews start with a bad PR. No description, a 600-line diff with three unrelated changes, no note on what to look at first. This skill walks the agent through self-reviewing the change, writing the context a reviewer needs, and flagging the risky parts before anyone else burns time on them.

Install:

claude skill add obra/superpowers/requesting-code-review

Repo: https://github.com/obra/superpowers/tree/main/skills/requesting-code-review. Verified, MIT, community-reviewed. Part of the ~227k-star Superpowers bundle.

See the skill deep-dive for the full self-review checklist it runs.

sp-receiving-review, close the loop on feedback

Same loop, opposite end. You've got 14 comments back and you address 9, forget 3, and silently disagree with 2 without saying so. This skill processes the feedback as a list. Every comment gets a response, a fix, or a documented reason it's being left alone.

Install:

claude skill add obra/superpowers/receiving-code-review

Verified, MIT, community-reviewed. See the skill page for how it tracks comment resolution.

sp-finishing-branch, the pre-flight checklist

Before any of the above, there's the branch itself: stray debug logs, a failing test you meant to fix, a commit message that says "wip". This one runs the cleanup pass so the branch is actually ready for review instead of nearly ready.

Install:

claude skill add obra/superpowers/finishing-a-development-branch

Verified, MIT, community-reviewed. Details on the finishing-branch skill page.

semgrep, the tireless second reviewer

A human reviewer reads your diff once and catches what they catch. semgrep reads every variant of a known bug pattern, every time, without getting bored on line 400. It's a lightweight static-analysis engine that matches code against rules: SQL built from string concatenation, a secret hardcoded in a config, an unawaited promise, across most languages you'd actually use.

It doesn't replace the human. It does the pattern-matching the human shouldn't have to. At ~15k stars and an LGPL-2.1 license, it's the most battle-tested tool on this list outside of the GitHub integration.

Install:

claude skill add semgrep/semgrep

Repo: https://github.com/semgrep/semgrep. Verified, LGPL-2.1, community-reviewed.

For a workflow that wires this into a full review, see how to run code reviews with Claude skills.

github-mcp, the hands on the repo

The three Superpowers skills and semgrep produce review work. github-mcp is what lets the agent act on it inside GitHub itself: pull the PR diff, post line comments, set check statuses, read existing review threads. It's an MCP server, not a skill, so it installs differently and grants the agent direct GitHub API access.

This is the official GitHub server, MIT-licensed, audited, sitting at ~31k stars. Official-and-audited is the highest trust tier on this page, which matters more for an MCP than a skill. An MCP server holds a token and talks to your repos.

Install:

claude mcp add github -- npx -y @github/mcp-server

Repo: https://github.com/github/github-mcp-server. Official, MIT, audited.

dotclaude, useful, but read it first

dotclaude is a developer-environment bundle that ships a set of specialized agents, code review among them. The idea is fine. The provenance is the problem: ~557 stars, no clear license, and no security review I'd vouch for.

That's not a reason to never use it. It's a reason to treat it differently from the five above. Open the repo, read what the agents actually do, check what they touch, and decide for yourself before you run a single command. An agent bundle can read your code and shell out. "It has a code-review agent" is not a reason to trust it blindly.

Install (only after you've audited it):

claude skill add FradSer/dotclaude

Repo: https://github.com/FradSer/dotclaude. Community tier, license unknown, security UNREVIEWED.

Before installing this or any unvetted skill, walk through why AI agent skill security matters and how to audit a skill. Five minutes of reading beats a bad install.

How the pieces fit

A realistic review loop with these skills runs like this. sp-finishing-branch cleans the branch. semgrep runs its pattern pass and surfaces the mechanical bugs. sp-requesting-review assembles the PR with context and a self-review. github-mcp posts it and pulls reviewer comments back. sp-receiving-review makes sure every comment gets handled.

What's missing from that list, on purpose, is the part where someone decides whether the change is right. No skill here does that. They clear the underbrush so the human reviewer spends their time on judgment instead of janitorial work, which is the only honest pitch for AI in code review.

If you're assembling a broader toolkit, our full list for developers covers the tools that sit around this workflow, and building a code review process with Claude skills goes deeper on the team side.

Where these stop helping

Automating the mechanical layer has a ceiling, and it is worth naming so you do not over-trust the setup. semgrep catches pattern bugs, not design mistakes, it will happily wave through a function that is correct, tested, and in completely the wrong module. The Superpowers skills make a PR clean and well-described, which can make a weak change look more trustworthy than it is; a tidy diff is not a correct diff. And github-mcp posts whatever review the agent generates, so a shallow pass ships with the same confidence as a careful one.

The failure mode to watch for is review theater: green checks, a polished description, every comment marked resolved, and nobody actually asked whether the change should exist. These skills are at their best when a human still reads the diff and the automation clears everything around that read. Treat them as the prep crew, never the final say. If your team starts merging on the strength of the automation alone, you have automated the wrong half.

FAQ

Do these skills replace human code review? No, and you should be wary of anything claiming they do. They automate the mechanical layer: PR prep, static analysis, feedback tracking. Whether the change is correct and well-designed is still a human call.

What's the difference between a skill and an MCP server here? A skill is a packaged instruction set the agent follows. An MCP server is a running process that gives the agent live access to an external system. In github-mcp's case, that's your GitHub repos and a token. MCP servers carry more access, so trust tier matters more.

Which one should I install first? semgrep and github-mcp give the fastest standalone payoff. One catches bug patterns, the other wires the agent into your actual PRs. Add the Superpowers trio when you want the full request-and-receive loop.

Is it safe to install dotclaude? Unknown, which is the answer that should make you cautious. It's community-tier with no license clarity and no security review. Read the repo end-to-end before installing, or skip it for the verified options.

Are these free? The skills and the GitHub MCP are open-source and free to install. semgrep is open-core: the CLI and rules used here are free, and the company sells a paid platform on top.