{
  "markdown": "# agent-toolbox\n\n`agent-toolbox` is a tool for performing automated code reviews using\nAI agents. It is built with [Go](https://go.dev) and the\n[ADK](https://github.com/agent-development-kit/agent-development-kit-go)\nlibrary, which provides the agent loop and graph primitives used to\norchestrate the review workflow.\n\n## Overview\n\nThe project defines a set of cooperating agents, each responsible for a\ndistinct stage of the code review process:\n\n- **Triage Agent** — classifies the diff and routes it to the appropriate\n  reviewers.\n- **Static Analysis Agent** — checks style, formatting, and common\n  anti-patterns.\n- **Security Agent** — looks for vulnerabilities and unsafe patterns.\n- **Summary Agent** — aggregates findings into a single, human-readable\n  review report.\n\nThese agents are wired together as a graph using the ADK library, which\nmanages the control flow, tool dispatch, and state transitions between\nnodes.\n\n```mermaid\nflowchart TD\n    START([START]) --> triage\n    triage[\"Triage Agent<br/>(LLM)\"] --> route[\"Route<br/>(records category)\"]\n    route --> reviewers[\"Reviewers<br/>(dynamic: runs selected set)\"]\n    reviewers --> format[\"Format Findings<br/>(function)\"]\n    format --> summary[\"Summary Agent<br/>(LLM)\"]\n    summary --> END([END])\n```\n\nThe triage agent classifies the diff as `static`, `security`, or `both`.\nThe route node records the category in session state and passes the\nreview request through; the reviewers node is a dynamic orchestrator that\nreads the category and runs exactly the reviewer agents triage selected,\nin parallel, gathering their output into a map keyed by agent name. The\nfindings are then formatted and passed to the summary agent for a final\nreport.\n\nThe diff is presented to the reviewer agents with each added and context\nline prefixed by its new-file line number, and the `read_file` tool uses\nthe same numbering — reviewers are instructed to cite those numbers\nverbatim so the `file:line` references in the report (which anchor the\ninline comments posted with `--post-comments`) match GitHub's line\ncoordinates.\n\n## Repository rules\n\nRepository-specific review rules can be placed in `.review/rules/` as\nMarkdown files with YAML frontmatter. Rules are loaded automatically from\nthe repo root (or from the clone when reviewing a PR) and appended to\nmatching agents' instructions.\n\n### Rule file format\n\n```markdown\n---\ntitle: \"Require error wrapping\"\nagents: [\"static_analysis\", \"security\"]\nseverity: major\npriority: 10\ntags: [\"go\", \"errors\"]\n---\n\nAll error returns must be wrapped with fmt.Errorf using %w to preserve\nthe error chain.\n```\n\n### Frontmatter fields\n\n- `title` — human-readable rule name (default: filename)\n- `agents` — list of agent names to scope the rule to: `triage`,\n  `static_analysis`, `security`, `summary`, or `*` for all (required)\n- `severity` — `blocker`, `major`, `minor`, or `nit` (default: `minor`)\n- `priority` — numeric priority; higher = more important (default: `0`)\n- `enabled` — set to `false` to disable a rule without deleting it\n  (default: `true`)\n- `tags` — free-form tags for grouping\n\nRules are sorted by priority (descending) then severity (blocker > major\n> minor > nit) and appended to the agent's system instruction as\nadditional guidance. Use `--rules-dir` to override the default\n`.review/rules` location.\n\nThe reviewer agents (static and security) can call repo-inspection tools\nto look beyond the diff hunks:\n\n- `read_file` — read a repo-relative file\n- `list_files` — list a directory's contents\n- `git_blame` — blame a file line range\n- `git_log` — recent commit history for a file or the repo\n\nWhen reviewing a GitHub pull request, three additional tools are\navailable:\n\n- `pr_files` — the PR's changed-file list with per-file patches\n- `pr_comments` — line-anchored review comments left so far\n- `pr_reviews` — prior reviews submitted on the PR\n\n## Usage\n\n### Review a diff\n\n```sh\ngit diff | agent-toolbox review diff -m <model>\nagent-toolbox review diff changes.patch --base-url http://localhost:11434/v1 -m llama3.1:latest\nagent-toolbox review diff changes.patch --provider anthropic -m claude-sonnet-4-20250514\n```\n\nThe diff is read from a file argument or stdin. The reviewer tools are\nrooted at `--repo` (default: working directory).\n\n### Review a GitHub pull request\n\n```sh\nexport GITHUB_TOKEN=<token>\nagent-toolbox review pr <owner/repo> <number> -m <model>\n```\n\nExample:\n\n```sh\nagent-toolbox review pr geoffjay/agent-toolbox 42 -m gpt-4o-mini\n```\n\nThe PR subcommand fetches the diff from the GitHub REST API and\nshallow-clones the head repo into a temp directory so the\nrepo-inspection tools have code to look at. Flags:\n\n- `--github-token` — GitHub API token (defaults to `GITHUB_TOKEN`)\n- `--no-clone` — skip the clone; tools fall back to the working directory\n- `--clone-repo <path>` — use an existing local checkout instead of cloning\n- `--findings-gate` — pause after the reviewers finish and require a human\n  decision on the findings before the summary runs. `approve` continues,\n  `revise` loops the reviewers back with your feedback (up to 3 rounds),\n  `abort` fails the run. Requires an interactive terminal; non-interactive\n  input fails closed.\n- `--post-comments` — post the review summary as a GitHub PR review with\n  inline comments anchored to the file/line references in the findings\n  (requires `--github-token`). Before anything is submitted, the full\n  review body and inline comments are printed and human approval is\n  required on the terminal; declined or non-interactive input aborts\n  without posting.\n- `--assume-yes` — skip the confirmation prompt and post unattended\n  (for CI or scripted runs)\n\n### Diagnostic logging\n\nAll review subcommands share the logging flags. Log output goes to\nstderr; stdout stays reserved for the review report.\n\n- `-v` — verbose: the resolved model/provider configuration, the tool\n  list, the loaded rules directory, per-agent output size and tool-call\n  counts, and retry activity.\n- `-vv` (or `--debug`) — debug: every model event plus each tool call's\n  arguments and result (payloads truncated at 4 KiB).\n- `--debug` — same as `-vv`.\n\nWhen a review finishes with no findings on a non-trivial diff, the\nwarning is followed by diagnostics showing what the pipeline actually\nobserved — per-agent output bytes, tool-call counts, and a hint when\n`--no-clone` left the repo tools pointed at the wrong directory — to\ndistinguish an underpowered model from a broken pipeline.\n\nWithout a token, only public repos work and the API is rate-limited to 60\nrequests/hour.\n\nTo post the review back to GitHub:\n\n```sh\nagent-toolbox review pr geoffjay/agent-toolbox 42 -m gpt-4o-mini --post-comments\n```\n\n### Model configuration\n\nAll subcommands share the model flags:\n\n- `--provider` — model provider: `openai` or `anthropic` (auto-detected from env)\n- `-m / --model` — model name (env `OPENAI_MODEL` or `ANTHROPIC_MODEL`)\n- `--api-key` — API key sent as `x-api-key` (env `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`)\n- `--auth-token` — `Authorization: Bearer` token for the Anthropic provider,\n  used by gateways/proxies in front of Anthropic (env `ANTHROPIC_AUTH_TOKEN`)\n- `--base-url` — endpoint URL (env `OPENAI_BASE_URL` or `ANTHROPIC_BASE_URL`)\n\n#### OpenAI-compatible providers\n\nThe default `openai` provider works with OpenAI directly, with local\nruntimes like [Ollama](https://ollama.com)\n(`--base-url http://localhost:11434/v1`), or any other OpenAI-compatible\nendpoint.\n\n```sh\ngit diff | agent-toolbox review diff -m gpt-4o-mini\nagent-toolbox review diff changes.patch --base-url http://localhost:11434/v1 -m llama3.1:latest\n```\n\n#### Anthropic (Claude)\n\nThe `anthropic` provider talks directly to Anthropic's native Messages\nAPI, supporting Claude models without a translating proxy:\n\n```sh\nexport ANTHROPIC_API_KEY=<key>\nagent-toolbox review diff -m claude-sonnet-4-20250514 --provider anthropic\n```\n\nThe provider is auto-detected: if `ANTHROPIC_API_KEY` is set and\n`OPENAI_API_KEY` is not, `anthropic` is used by default. Set\n`--provider` explicitly to override.\n\nWhen talking to a gateway or proxy in front of Anthropic (any custom\n`--base-url`/`ANTHROPIC_BASE_URL`), the credential is sent as an\n`Authorization: Bearer` token, since gateways authenticate that way\nrather than with the native `x-api-key` header. Setting `--api-key`\n(or `ANTHROPIC_API_KEY`) alongside a custom base URL is enough — the key\nis reused as the bearer token; use `--auth-token` when the bearer\ncredential differs from the API key. Direct Anthropic keeps `x-api-key`.\n\n## Status\n\nThis project is a work in progress. Agent definitions, graph wiring,\nand tooling are under active development.\n",
  "bytes": 8653,
  "sha": "536105ea24c4ea6fa0d04926f004d570fde94411f9ec887fe377a958b264acce",
  "repo_slug": "geoffjay/agent-toolbox",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/okf_geoffjay_agent_toolbox_docs_knowledgebas_555b5f63/readme"
}