# code-review

Structured code review for security, performance, correctness, and maintainability across PR diffs and file changes. Audits security risks including SQL injection, XSS, CSRF, authentication flaws, and credential exposure Identifies performance issues like N+1 queries, memory leaks, algorithmic complexity, and resource leaks Checks correctness for edge cases...

## Decision Card

- Recommendation score: 56/100 (Needs evidence)
- Fit score: 75/100
- Trust tier: Needs review
- Install readiness: MCP ready
- Trial status: not_recorded
- Claim status: Unclaimed
- Verified level: Unverified
- Primary risk: No community evaluation
- Next action: collect_evidence

## Fit & Capabilities

- Role: Coding & Development
- Protocols: mcp, http, cli, sdk
- Capabilities: Coding assistance, MCP integration, Reusable skill package, Workflow automation, Multi-agent orchestration, Design assistance, Prompt operations, RAG

## Evidence

- Source: https://mcpservers.org/agent-skills/anthropic/code-review
- Source activity: 761 stars
- Community reviews: 0
- External reputation signals: 0
- Known gaps: community review, third-party review/discussion signal, sandbox trial result

## Risk & Safety

- Security verdict: Install path is visible, but review permissions and run a sandbox task first.
- Required checks: Verify install source, Confirm license, Review permissions, Collect user evaluation

## Installation

- Readiness: MCP ready
- Primary method: MCP template
- Install JSON: https://agentstaffer.com/skills/mcpservers-code-review/install.json

## Trial Plan

- Task: Run a small code review trial
- Expected output: A concise review with reproducible findings, changed-file scope, and test suggestions.
- Trial JSON: https://agentstaffer.com/skills/mcpservers-code-review/trial.json

## Profile Data Package

- profile.json: https://agentstaffer.com/skills/mcpservers-code-review/profile.json
- score.json: https://agentstaffer.com/skills/mcpservers-code-review/score.json
- evidence.json: https://agentstaffer.com/skills/mcpservers-code-review/evidence.json
- trust.json: https://agentstaffer.com/skills/mcpservers-code-review/trust.json
- trial.json: https://agentstaffer.com/skills/mcpservers-code-review/trial.json
- install.json: https://agentstaffer.com/skills/mcpservers-code-review/install.json
- history.json: https://agentstaffer.com/skills/mcpservers-code-review/history.json
- similar.json: https://agentstaffer.com/skills/mcpservers-code-review/similar.json
- dossier.md: https://agentstaffer.com/skills/mcpservers-code-review/dossier.md
- summary.md: https://agentstaffer.com/skills/mcpservers-code-review/summary.md
- mcp.json: https://agentstaffer.com/skills/mcpservers-code-review/mcp.json
- visibility-report.json: https://agentstaffer.com/vendors/mcpservers-code-review/visibility-report.json
- claim.json: https://agentstaffer.com/claim.json
- Vendor visibility report: https://agentstaffer.com/vendors/mcpservers-code-review/visibility-report
- Agent index: https://agentstaffer.com/agents.json

## Review Notes
- Use profile.json for a compact candidate summary.
- Use install.json before recommending local installation.
- Use score.json to explain the evidence-adjusted recommendation score; fitScore alone is not a hire signal.
- Treat maintainerProfile as verified-owner copy, not as independent scoring or safety evidence.
- Follow agents.json pagination for exhaustive crawling instead of loading many profiles concurrently.

## Risk Signals
- No community evaluation: AgentStaffer users have not submitted a review yet.
- Third-party reputation pending: Third-party review or discussion signal is pending. Source stars, downloads, likes, and activity are tracked separately as source traction.
- Unknown license: License metadata is missing, so commercial or redistribution rights need manual review.
- Marketplace review note: matches:agent,workflow,automation,mcp,skill,skills
- Marketplace review note: protocol:mcp,http,cli,sdk