
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
review-pro
Advanced tools
Repository-aware AI code review for coding agents. Installer CLI: puts the review-pro core (triage → 13 specialist reviewers → synthesis) into Claude Code, opencode, Cursor, Codex, plus per-repo stack packs.
review-pro is a tiered AI code-review system: triage → relevant specialist reviewers → synthesis. It reviews code written by AI agents, using AI agents — built to catch the failure modes AI-generated code actually ships with (hallucinated APIs, over-engineering, ignored conventions, needless dependencies).
This package is the installer CLI (
npx review-pro). It installs the review-pro core (skills + subagents) into your agent tool, and the stack packs into your repo's.review-pro/.
🌐 Landing page: https://tufantunc.github.io/review-pro/ 📦 Source & full docs: https://github.com/tufantunc/review-pro
Installs the review-pro core — 13 specialist reviewer skills + subagents + the review-pro orchestrator — into your agent tool's home, from one canonical source.
npx review-pro init # opencode (default)
npx review-pro init --target claude-code # or cursor | codex | all | auto
Supported targets: opencode · Claude Code · Cursor · Codex. Codex agents are auto-transformed to TOML; Cursor can also /add-plugin the repo directly.
No Node.js? review-pro is plain markdown skills and agents — you can copy them into your tool's folder and it works the same. See the manual install steps for each platform.
Stack packs layer language/framework-specific signals onto the reviewers at review time. Install the ones you use into the repo you review:
npx review-pro # interactive multi-select
npx review-pro add python # or: node, go, rust, typescript-react, dotnet, php,
# kotlin, swift, flutter, nextjs, react-native,
# wordpress, ai-ml
npx review-pro list # show catalog + installed versions
npx review-pro doctor # check drift / roster integrity
Packs land in the reviewed repo's .review-pro/ and carry their own version.
Restart your tool so the new skills/agents are discovered, then in the repo you want to review:
review-pro skill directly.A change's stated reason often points outside the repository: "fixed upstream in the new version". When it names something specific, the reviewer that owns the claim checks it against that artifact at the resolved dependency version, prefers the dependency source already on disk over the network, and records which channel settled it. An unsettled premise is reported as unsettled rather than trusted.
The agent runs the whole pipeline natively (git diff, reads changed files, Globs .review-pro/ for active stacks, dispatches the relevant reviewer subagents with their stack signals, has an independent verifier try to refute up to 8 Medium or higher code findings, and synthesizes one verdict: BLOCK / REQUEST CHANGES / APPROVE). No env vars, no scripts to run at review time.
| Command | What it does |
|---|---|
npx review-pro | interactive — select stacks to install into .review-pro/ |
init [--target <platform>] | install the core plugin into a tool's home |
uninstall [--target <platform>] | remove the core plugin from a tool's home |
add <stack> | install one stack pack (non-interactive, CI-safe) |
remove <stack> | remove an installed pack |
update [stack] | refresh installed packs to the catalog version |
list | show catalog stacks + installed versions + drift |
doctor | validate installed packs (version drift, roster integrity, orphans) |
Removes the review-pro core (the agents + skills init copied) from a tool's home. Mirrors init's --target logic.
npx review-pro uninstall --target opencode # or claude-code | codex | all | auto
Add -y to skip the confirmation prompt (CI).
Stack packs (.review-pro/) live in your repo and are not touched — remove them with npx review-pro remove <stack> or rm -rf .review-pro. Cursor manages its own plugins: run /remove-plugin review-pro in Cursor.
security · correctness · craft · ai-antipatterns · dry · performance · backend · frontend · a11y · db · api-contract · tests · spec
The ai-antipatterns reviewer is first-class: hallucinated APIs/symbols/imports, invented config/env keys, needless dependencies, and ignored existing helpers — the failure modes that come from code being written by an agent rather than a person.
FAQs
Repository-aware AI code review for coding agents. Installer CLI: puts the review-pro core (triage → 13 specialist reviewers → synthesis) into Claude Code, opencode, Cursor, Codex, plus per-repo stack packs.
We found that review-pro demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.