Treat AI-Generated PRs Like Third-Party Dependencies

Monday. PR #214. The diff is 1,204 lines. The commit message says "refactor auth middleware." The agent wrote 1,191 lines. A human changed thirteen. Nobody read the whole thing.

This is normal now. But normal has a hidden cost. Agent code is generated from patterns. Patterns are not permission. A model can produce code that looks clean and violates security boundaries.

Treat the PR like an unknown dependency

AI-generated code is a new supply-chain origin. It looks like internal code. It is actually an unknown dependency. You would not merge an npm package without inspecting it. The same discipline applies to an agent branch.

This article documents a reproducible review workflow. It uses a risk score, a trust manifest, and a small Bash script. It runs on any machine with Bash and Git.

As of September 2026, MonkeyCode's free tier includes 10M tokens and a free server. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The free server can run the whole review loop without a local language runtime. The free model access can summarize a dense diff.

Step 1: Inventory every changed path

The first move is not reading code. It is counting code. Build a file list before touching the diff.

#!/usr/bin/env bash
# agent_pr_review.sh <PR_NUMBER> [BASE_BRANCH]
set -euo pipefail

PR="${1:?Usage: agent_pr_review.sh <PR_NUMBER> [BASE]}"
BASE="${2:-main}"

git fetch origin "pull/${PR}/head:pr-${PR}" >/dev/null 2>&1
FILES=$(git diff --name-only "$BASE...pr-${PR}")

echo "PR #$PR changed $(echo "$FILES" | wc -l | tr -d ' ') files"
echo

echo "Risk inventory (higher = review first)"
echo "$FILES" | awk '{
  score = 1
  if ($0 ~ /auth|secret|token|credential/) score = 5
  else if ($0 ~ /db|sql|migration/) score = 4
  else if ($0 ~ /config|[.]ya?ml|[.]env/) score = 3
  else if ($0 ~ /test|spec/) score = -1
  printf "%3d  %s\n", score, $0
}' | sort -rn

echo
echo "Untested files:"
echo "$FILES" | grep -Ev 'test|spec' || true

Save it as agent_pr_review.sh. Run it with bash agent_pr_review.sh 214. The output gives the review order. Auth files score five. Test files score minus one. The order tells the reviewer what to read first.

Step 2: Read the small dangerous files

Large diffs hide bugs. Small files hide intent. The reviewer does not read the whole PR. The reviewer reads files with the highest risk score.

auth/, config/, and db/ changes get the first pass. test/ files get a later pass. A three-line change in auth/session.go is more important than a 400-line change in views/.

Step 3: Add a trust manifest

A review without a record is a guess. A trust manifest keeps the decision auditable. Add PR_TRUST.md to the branch. Fill it during the review, not after.

# PR_TRUST.md

## Origin
- Branch: pull/214/head
- Human edits: 13 lines
- Test coverage added: no

## Decision
- [ ] Trust (merge after CI)
- [ ] Revert (revert the risky hunks)
- [ ] Re-Test (add tests before merge)

## Verification notes
- [ ] Diff checked for whitespace and merge markers
- [ ] Auth flows tested with two wrong passwords
- [ ] Dependency files inspected for version pin changes
- [ ] Logs checked for credential format strings

The manifest turns the review into a checklist. It also gives the next reviewer a starting point. This matters when the original human leaves.

Step 4: Run targeted tests, not full CI only

Full CI takes minutes. Targeted tests take seconds. The agent refactor should pass the same tests as the old code. Run them on the changed files.

git diff "$BASE...pr-${PR}" -- '*.lock' | head -50
git diff "$BASE...pr-${PR}" -- 'auth/*'

Then run the relevant test suite. Do not merge on green CI alone. Green CI means nothing when the agent deleted the test that covered the bad path.

Step 5: Decide with a table

A decision table removes emotion from the merge. The table below is a starting point.

Signal	Decision	Action
Active tests, low risk score	Trust	Run full CI
High risk files, no tests	Re-Test	Add differential tests
Auth/secret files changed	Revert/Block	Human review required
Lockfiles or build scripts changed	Re-Test	Pin versions and rebuild

The reviewer walks the table from top to bottom. The first matching row wins. This prevents "the diff looked good" from being the only argument.

Let the model classify, not decide

A model can compress one thousand lines into ten observations. It cannot verify behavior. The reviewer uses the free model access to classify the risk inventory. The output is a short list: "auth/session.go changes session timeout defaults", "migrations/003 changes a default constraint", "views/ has no side effects". This summary saves ten minutes of scrolling.

The free server makes this step practical. A script can send the diff, get the summary, and write it into the trust manifest. No local GPU is needed. The model becomes a note-taker, not a gate.

The final decision stays with the human. The model can miss context. It can also miss an entire file if the diff is truncated. Every summary line should be checked against the file name in the risk inventory.

Limitations and who should not use this

The risk score is a heuristic. It is not proof. A model can hide dangerous code in a filename with a low score. The script also misses semantic changes inside safe-looking files.

Teams without baseline tests should not use this workflow. Teams that merge on CI alone will get a false sense of safety. Teams under compliance audit should keep a full human review trail.

The workflow is designed for speed. It treats the PR as a supply-chain package. It builds a repeatable decision path. That is more valuable than reading every line of an agent's diff.