Code Review

Review code with AI and get issues with severity, line numbers and suggested fixes. Focus on security, performance, readability or bugs.

Pay by wallet (x402) AI-generated code-review

Example

Example answer

{
  "focus": "all",
  "issues": [
    {
      "category": "readability",
      "severity": "low",
      "description": "Function name 'hello' lacks context about what it returns. Naming could be more descriptive.",
      "line_number": 1,
      "fix_suggestion": "Rename to something more specific like 'getGreeting()' or 'getDefaultGreeting()'"
    },
    {
      "category": "style",
      "severity": "low",
      "description": "Missing JSDoc comment for function documentation",
      "line_number": 1,
      "fix_suggestion": "Add JSDoc: /** @returns {string} A greeting message */ above the function"
    }
  ],
  "summary": "This is a well-written, secure function with no bugs. Minor improvements would involve adding documentation and considering if a constant might be more appropriate than a function.",
  "quick_wins": [
    "Add JSDoc comment for better code documentation",
    "Consider if this function needs parameters or if it should be a constant",
    "Add semicolon for consistency (if not using automatic formatting)"
  ],
  "code_length": 36,
  "overall_score": 85,
  "security_flags": [],
  "positive_aspects": [
    "Simple, focused function with single responsibility",
    "No security vulnerabilities present",
    "Function is pure with no side effects",
    "Clear, concise implementation"
  ],
  "language_detected": "JavaScript"
}

Inputs

Field	Type	Required	What it is
`code`	string	Yes	—
`focus`	string	No	security/performance/readability/bugs/all
`language`	string	No	—

Output fields

How reliably each field appears in a successful answer.

Field	Type	Appears
`issues`	array	Always (present in every successful answer)
`quick_wins`	array	Always (present in every successful answer)
`overall_score`	integer	Always (present in every successful answer)
`security_flags`	array	Always (present in every successful answer)

How to call it

The same tool through each route. MCP clients reach it through Strale’s server at https://api.strale.io/mcp; the call below is what the agent sends.

# Needs an API key. max_price_cents caps what this call may cost.
curl -X POST https://api.strale.io/v1/do \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "capability_slug": "code-review",
    "inputs": {
      "code": "function hello() { return 'world'; }",
      "language": "en"
    },
    "max_price_cents": 20
  }'

{
  "tool": "strale_execute",
  "arguments": {
    "slug": "code-review",
    "inputs": {
      "code": "function hello() { return 'world'; }",
      "language": "en"
    },
    "max_price_cents": 20
  }
}

import { Strale } from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY! });
const result = await strale.do({
  capability_slug: "code-review",
  inputs: {
    "code": "function hello() { return 'world'; }",
    "language": "en"
  },
  max_price_cents: 20,
});

import os
from straleio import Strale, DoRequest

strale = Strale(api_key=os.environ["STRALE_API_KEY"])
result = strale.do(DoRequest(
    capability_slug="code-review",
    inputs={
        "code": "function hello() { return 'world'; }",
        "language": "en",
    },
    max_price_cents=20,
))

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i -X POST https://api.strale.io/x402/v2/code-review \
  -H 'Content-Type: application/json' \
  -d '{
    "code": "function hello() { return 'world'; }",
    "language": "en"
  }'

Limitations

Subtle or context-dependent bugs can be missed
AI-powered review may miss subtle logic errors or context-dependent bugs that require full codebase understanding
What to do instead: Use as a first-pass filter to catch common issues, then follow up with human review for critical code paths
Cross-file dependencies and architecture are not reviewed
Reviews individual code snippets — cannot analyse cross-file dependencies or architectural patterns
What to do instead: Provide surrounding context or interface definitions in the input to improve review accuracy for coupled code

Related tools

LLM Output Validation €0.05
Prompt Optimiser €0.15