DEV Community: Will

63 Code Review Rules Your AI Assistant Should Enforce (Python, JS, Go, Java)

Will — Sun, 16 Aug 2026 07:14:12 +0000

AI review is only as good as the rules you give it

An AI assistant in Claude Code, Cursor or Windsurf will happily review every diff — but by default it reviews with its own taste. One teammate's model flags style, another's flags security, and your CI stays silent.

The fix is the same one human teams converged on years ago: shared, versioned review rules.

We built aicraft-code-review (free, MIT) to run those rules locally as an MCP server. I'm sharing the rule set we now ship as a paid pack — 63 rules across Python, JavaScript/TypeScript, Go and Java. You can adapt the examples below for free.

The rule format

Every rule is plain YAML in .mcp-code-review.yaml:

custom_rules:
  - name: no-pickle-loads
    pattern: '\bpickle\.loads?\s*\('
    severity: high
    category: security
    issue: "pickle.load/loads can execute arbitrary code during unpickling"
    fix: "Use json, or pickle only for trusted data"

severity_overrides:
  bare_except: high
  hardcoded_secret: critical

Severities are critical / high / medium / info. The server scans every changed line and emits a structured report — nothing leaves your machine.

The 10 rules that catch the most real bugs

Python

Pattern	Severity	Why it matters
`\beval\s*\(`	critical	arbitrary code execution
`\bpickle\.loads?\s*\(`	high	RCE during unpickling
`shell\s=\sTrue`	high	command injection
`def ... (x=[])`	high	mutable default shared across calls
`yaml\.load\(`	high	unsafe YAML parsing

JavaScript / TypeScript

Pattern	Severity	Why it matters
`\bnew\s+Function\s*\(`	critical	compiles strings into code
`\bv-html\s*=` / `dangerouslySetInnerHTML`	high	XSS
`localStorage.setItem("token"...)`	high	tokens readable by any XSS
`setTimeout\("string"`	high	dynamic code execution
`await fetch(...)` without `res.ok` check	medium	silent non-2xx handling

Go

Pattern	Severity	Why it matters
`http.Get(...)` with no timeout	high	hangs forever
`md5.Sum` / `sha1.Sum`	high	broken hashes
`math/rand` for tokens	high	predictable randomness
`panic(...)` in library code	medium	crashes the host process
`defer` inside a loop	medium	deferred callbacks pile up

Java

Pattern	Severity	Why it matters
`Runtime.getRuntime().exec(...)`	high	command injection
`Statement.execute*` with concatenated SQL	high	SQL injection
`MessageDigest.getInstance("MD5")`	high	broken hash
`new Random()` for security	high	predictable
`double/float` for money	high	precision loss

Make CI enforce them too

The server has a CLI mode with CI-friendly exit codes:

pip install aicraft-code-review
git diff origin/main...HEAD | mcp-code-review review-diff

Exit codes: 0 clean · 1 high/medium findings · 2 critical findings. Wire 2 to fail the pipeline and your merge button becomes the reviewer.

# .github/workflows/review.yml — the core of it
- name: Run review
  run: |
    git diff ${{ github.event.pull_request.base.sha }}...HEAD > /tmp/changes.diff
    mcp-code-review review-diff --git-diff /tmp/changes.diff || [ $? -lt 2 ]

Get the full pack

Free forever: pip install aicraft-code-review — the server + built-in checks (OWASP patterns, N+1, race analysis) stay MIT.
Team Rules Pack ($49, one-time): all 63 rules as drop-in profiles for the 4 languages, a GitHub Actions workflow that comments every PR and blocks merges on critical findings, a GitLab CI gate, and 20 LLM review prompts (security sweep, N+1 hunt, race-condition hunt, test-gap analysis...). Lifetime updates.

Pack: aicraft.vip · Source: github.com/GoodJobwilliam/aicraft

What rule has caught the most bugs for your team? I'll add the best community suggestions to the next pack update.

Code Review From the Terminal and CI, No MCP Client Required

Will — Sun, 16 Aug 2026 06:17:00 +0000

A month ago I shipped aicraft-code-review, an MCP server that reviews code locally. This week I added a CLI mode — because not everyone wants to wire up an MCP client just to check a diff.

Now the same reviewer runs three ways:

MCP tools — review_code / review_diff / review_file inside Claude Code, Cursor, Cline
CLI — mcp-code-review review-file path/to/file.py
CI — pipe git diff into it and branch on the exit code

The CLI

pip install aicraft-code-review

# a single file (config auto-discovered from the file's directory upward)
mcp-code-review review-file src/api.py

# the current diff
git diff | mcp-code-review review-diff

# a snippet
mcp-code-review review-code "import os; os.system('ls')"

Exit codes are CI-friendly:

Code	Meaning
`0`	clean, or only info-level findings
`1`	high / medium issues found
`2`	critical issues found

What it catches out of the box

Security (OWASP patterns), performance (N+1, unbounded growth), quality (bare excepts, TODOs, missing type hints), style (naming, line length). Real output:

### 🟠 High (2)
| Line | Issue | Category | Fix |
| 4 | Command injection risk | security | subprocess.run with args list |
| 9 | N+1 query in loop | performance | batch query / eager loading |

### 🟢 Info (2) — missing return type annotations

Verdict: Conditional Pass — address high/medium issues

Making it match YOUR rules

The config file is the part I'd actually show a teammate:

custom_rules:
  - name: no-console-log
    pattern: 'console\.log\('
    severity: high
    category: quality
    issue: Console logging left in production code
    fix: Use a structured logger instead

disabled_checks:
  - todo_comment

severity_overrides:
  hardcoded_secret: critical

.mcp-code-review.yaml is auto-discovered from the reviewed file's directory upward
MCP_CODE_REVIEW_CONFIG points a whole team at one shared profile
valid severities: critical / high / medium / info
regex patterns work best in single quotes (double quotes will error on escapes like \.)

One caveat if you're also shipping Python MCP servers

Pin your MCP dependency. mcp 2.0.0 shipped breaking changes and broke fresh installs of servers that had mcp>=1.6 unpinned. Use mcp>=1.6,<2 until you've migrated.

The server is MIT-licensed: pip install aicraft-code-review, or claude mcp add code-review -- uvx aicraft-code-review. Issues and feedback welcome on GitHub.

The $0 Distribution Playbook for MCP Servers: 12 Channels, 30 Days, Real Numbers

Will — Sun, 16 Aug 2026 05:34:13 +0000

A month ago I shipped aicraft-code-review — an open-source MCP server that reviews code locally (OWASP scanning, N+1 detection, style rules) for Claude Code, Cursor and Cline. I had $0 marketing budget and no audience.

One month later: 650+ PyPI installs, 12 Product Hunt followers, and listings in 5 directories — with more pending. Zero dollars spent. Here's the exact playbook, including what didn't work.

The channels, ranked by effort-to-reach

Channel	Cost	Status	What it took
PyPI	$0	✅ 650+ installs	One afternoon: `pyproject.toml`, wheel build, `twine upload`
Smithery	$0	✅ Live	Deploy via their CLI, quality score 52/100
mcpservers.org	$0	✅ Approved in ~1 day	Simple submit form
cursor.directory	$0	✅ Live	Submit plugin + MCP server + rule
Product Hunt	$0	✅ Launched	Free launch, real user feedback
Glama	$0	⏳ Reviewing	Submit + `glama.json` + Dockerfile
awesome-mcp-servers	$0	⏳ PR open	Needs Glama listing + badge first
Docker MCP Registry	$0	⏳ PR open	Root `Dockerfile`, `LICENSE`, `SECURITY.md`
Official MCP Registry	$0	⏳ Next	`mcp-publisher publish` from the PyPI package
MCPFind / Cline marketplace	$0	⏳ PRs open	YAML metadata, waiting on maintainers
Hacker News	$0	✅ 1 point	Honest "Show HN" style post
Reddit r/mcp	$0	❌ Failed	See below

What actually moved the needle

1. Directory listings compound. Every listing adds an install path, a backlink, and social proof for the next directory. mcpservers.org approved me in a day; that listing made the cursor.directory submission stronger.

2. Product Hunt gave us the roadmap. We only got 3 upvotes — but two comments became our next release:

"Team-shared rule profiles so my whole squad syncs rules" → shipped MCP_CODE_REVIEW_CONFIG
"Custom rule sets per repo" → shipped .mcp-code-review.yaml auto-discovery

Real users telling you what to build beats any amount of guessing.

3. The awesome-mcp-servers repo is the prize. It has 92k stars and its README is how most people discover MCP servers. But the bar is real: your server must be listed on Glama with a quality score badge. Budget 2 weeks for review.

What didn't work (so you don't waste a week)

Reddit with a new account = spam filter. Both my r/mcp posts got silently removed. New accounts can't message mods either. Lesson: build karma in technical subreddits before you have something to promote.

HN is a lottery. One point, zero comments. Fine — the post is still a permanent backlink.

Paid directories come early. mcp.so wants $39. OpenTools is paid-only. Skip them at the start.

The bug that almost sank fresh installs

Two weeks after 0.1.0 shipped, mcp 2.0.0 dropped with a breaking API change — and fresh installs of my server crashed at import. I had pinned mcp>=1.6 without an upper bound.

If you ship a Python MCP server today: pin mcp>=1.6,<2 in your dependencies right now. The 0.1.1 release with the fix went out the same week.

The honest numbers

PyPI: 650+ installs, 150/month
Product Hunt: 3 upvotes, 12 followers, 7 comments (all replied)
GitHub: 2 stars (yes, two)
Revenue: $0 so far — distribution first, monetization is the next chapter

The playbook in 5 steps

Ship on PyPI/npm first. Every other channel references your package.
Prepare the common requirements once: Dockerfile, LICENSE, SECURITY.md, glama.json, install docs. Every directory asks for a subset of these.
Submit to free directories in parallel. Fast approvals build momentum.
Capture feedback (PH comments, issues) and ship it — then tell people you shipped it.
Do the two big PRs last: awesome-mcp-servers and the Docker MCP Registry, once your listing quality score is in shape.

Next up: the official MCP Registry publish and the Glama badge. If you're building an MCP server, steal this list — and tell me which channel I'm missing.

aicraft-code-review is MIT-licensed and installs with pip install aicraft-code-review.

Team-Shared Code Review Rules for Your MCP AI Assistant

Will — Sun, 16 Aug 2026 03:26:32 +0000

Last month I shipped an MCP server that reviews code locally — no SaaS, no uploads. Two pieces of feedback kept coming up on Product Hunt:

"Can my whole team sync the same review rules?"
"Can each repo have its own rule set?"

So I built exactly that. aicraft-code-review now reads a config file from your repo.

One config file per repo

Drop a .mcp-code-review.yaml in your project root:

disabled_checks:
  - todo_comment

severity_overrides:
  hardcoded_secret: critical

min_severity: medium

custom_rules:
  - name: no-console-log
    pattern: 'console\.log\('
    severity: high
    issue: Console logging left in production code
    fix: Use a structured logger instead

That gives you:

Custom regex rules with their own severity, message, and suggested fix
disabled_checks to silence noise
severity_overrides to make your team's blockers actually block
min_severity to keep junior devs from drowning in info-level findings

Config is auto-discovered from the reviewed file's directory upward — one file per repo works automatically.

YAML tip: put regex patterns in single quotes. Double-quoted patterns like "console\.log\(" can trigger YAML escape errors — single quotes keep the backslashes literal.

Team-wide profiles

For a single shared profile, point every teammate at the same file:

{
  "mcpServers": {
    "code-review": {
      "command": "uvx",
      "args": ["aicraft-code-review"],
      "env": {
        "MCP_CODE_REVIEW_CONFIG": "/path/to/team-repo/.mcp-code-review.yaml"
      }
    }
  }
}

Commit the YAML to your repo and every machine gives identical feedback.

Try it

uvx aicraft-code-review

JSON configs work with zero extra dependencies; YAML needs pip install "aicraft-code-review[yaml]".

The server is MIT-licensed and reviews code snippets, git diffs, and local files with OWASP security checks, N+1 detection, and style/quality passes.

GitHub: https://github.com/GoodJobwilliam/aicraft
PyPI: https://pypi.org/project/aicraft-code-review/

Happy reviewing!

I Built an MCP Server That Reviews Code Locally — No SaaS, No Uploads

Will — Sat, 15 Aug 2026 16:51:10 +0000

AI coding assistants ship code fast. But someone still has to review it. I wanted that "senior engineer second pair of eyes" to live inside my editor, run entirely on my machine, and work with whatever assistant I'm using today. So I built MCP Code Review Server — a Model Context Protocol (MCP) server that connects to Claude Code, Cursor, Cline, or any MCP client.

What it does

It exposes three tools to your AI assistant:

review_code — paste any snippet and get a structured review
review_diff — review a git diff before you merge
review_file — point it at a local file

Each review returns findings with severity ratings (Critical / High / Medium / Low), file locations, and concrete fix suggestions.

The checks are the ones I kept catching my own assistants missing:

OWASP Top 10 security scanning — injection, broken auth patterns, crypto misuse, unsafe deserialization
Bug detection — None handling, exception swallowing, mutable default arguments, race conditions
N+1 query detection — the classic ORM performance killer
Performance profiling — repeated work in loops, blocking I/O, memory hotspots
Style and complexity — long functions, deep nesting, configurable rule thresholds

Installation is one command

No signup, no API keys. It's on PyPI:

# Claude Code
claude mcp add code-review -- uvx aicraft-code-review

# Cursor / Claude Desktop — add to ~/.cursor/mcp.json
{
  "mcpServers": {
    "code-review": {
      "command": "uvx",
      "args": ["aicraft-code-review"]
    }
  }
}

# Or pip
pip install aicraft-code-review

That's it. Your assistant now has a review tool it can call whenever you ask.

Why MCP instead of another SaaS tool

I tried the hosted code-review tools first. They're good, but three things kept bothering me:

Privacy. My review tool never needs to see the rest of my codebase. Uploading proprietary code to yet another vendor felt wrong.
Cost. Per-seat subscriptions for something that runs fine on the laptop in front of me.
Lock-in. I switch between Claude Code, Cursor, and Cline depending on the task. MCP is the common denominator — build once, run everywhere.

The server runs over stdio as a local process. Your code never leaves your machine. The only cost is the electricity.

Design decisions worth stealing

A few things I'd do the same way again:

Python + stdio. Simple, zero-dependency-at-runtime design, works on macOS/Linux/Windows. uvx means users never even install it.
Structured output. Severity ratings + file/line references instead of prose. Agents consume structured data far more reliably than paragraphs, and humans can triage by severity.
Static-first, then heuristic. It combines AST walking (Python) with regex/pattern rules for other languages, so it catches both structural issues (N+1 patterns) and localized smells (unsafe string formatting into SQL).
Git-native. review_diff slots right into the "review before commit" habit that agents already have.

What I learned about MCP distribution

Getting a server working is the easy part. Getting it found is the real work:

PyPI is where the install commands live, but almost nobody discovers tools there.
Directories (Smithery, Glama, mcp.so, cursor.directory, awesome lists) are the actual discovery surface. Each has its own submission flow, quality bar, and wait time.
AI agents now install MCP servers directly from directories — the distribution channel is increasingly agents themselves, not just humans.

That's why I've been submitting the server to every directory with a review process, and keeping the repo metadata (glama.json, .mcp.json, smithery.yaml, a Dockerfile) in shape for their automated checks.

Try it

GitHub: GoodJobwilliam/aicraft
PyPI: aicraft-code-review
Site: aicraft.vip

If you try it and hit a case it misses, open an issue — the rules are all configurable, and new checks are the fastest way this thing gets better.

What would you want an in-editor code reviewer to catch that yours currently misses?