DEV Community

Will
Will

Posted on

63 Code Review Rules Your AI Assistant Should Enforce (Python, JS, Go, Java)

#python #javascript #codequality #mcp

AI review is only as good as the rules you give it

An AI assistant in Claude Code, Cursor or Windsurf will happily review every diff — but by default it reviews with its own taste. One teammate's model flags style, another's flags security, and your CI stays silent.

The fix is the same one human teams converged on years ago: shared, versioned review rules.

We built aicraft-code-review (free, MIT) to run those rules locally as an MCP server. I'm sharing the rule set we now ship as a paid pack — 63 rules across Python, JavaScript/TypeScript, Go and Java. You can adapt the examples below for free.

The rule format

Every rule is plain YAML in .mcp-code-review.yaml:

custom_rules:
  - name: no-pickle-loads
    pattern: '\bpickle\.loads?\s*\('
    severity: high
    category: security
    issue: "pickle.load/loads can execute arbitrary code during unpickling"
    fix: "Use json, or pickle only for trusted data"

severity_overrides:
  bare_except: high
  hardcoded_secret: critical
Enter fullscreen mode Exit fullscreen mode

Severities are critical / high / medium / info. The server scans every changed line and emits a structured report — nothing leaves your machine.

The 10 rules that catch the most real bugs

Python

Pattern Severity Why it matters
\beval\s*\( critical arbitrary code execution
\bpickle\.loads?\s*\( high RCE during unpickling
shell\s*=\s*True high command injection
def ... (x=[]) high mutable default shared across calls
yaml\.load\( high unsafe YAML parsing

JavaScript / TypeScript

Pattern Severity Why it matters
\bnew\s+Function\s*\( critical compiles strings into code
\bv-html\s*= / dangerouslySetInnerHTML high XSS
localStorage.setItem("token"...) high tokens readable by any XSS
setTimeout\("string" high dynamic code execution
await fetch(...) without res.ok check medium silent non-2xx handling

Go

Pattern Severity Why it matters
http.Get(...) with no timeout high hangs forever
md5.Sum / sha1.Sum high broken hashes
math/rand for tokens high predictable randomness
panic(...) in library code medium crashes the host process
defer inside a loop medium deferred callbacks pile up

Java

Pattern Severity Why it matters
Runtime.getRuntime().exec(...) high command injection
Statement.execute* with concatenated SQL high SQL injection
MessageDigest.getInstance("MD5") high broken hash
new Random() for security high predictable
double/float for money high precision loss

Make CI enforce them too

The server has a CLI mode with CI-friendly exit codes:

pip install aicraft-code-review
git diff origin/main...HEAD | mcp-code-review review-diff
Enter fullscreen mode Exit fullscreen mode

Exit codes: 0 clean · 1 high/medium findings · 2 critical findings. Wire 2 to fail the pipeline and your merge button becomes the reviewer.

# .github/workflows/review.yml — the core of it
- name: Run review
  run: |
    git diff ${{ github.event.pull_request.base.sha }}...HEAD > /tmp/changes.diff
    mcp-code-review review-diff --git-diff /tmp/changes.diff || [ $? -lt 2 ]
Enter fullscreen mode Exit fullscreen mode

Get the full pack

  • Free forever: pip install aicraft-code-review — the server + built-in checks (OWASP patterns, N+1, race analysis) stay MIT.
  • Team Rules Pack ($49, one-time): all 63 rules as drop-in profiles for the 4 languages, a GitHub Actions workflow that comments every PR and blocks merges on critical findings, a GitLab CI gate, and 20 LLM review prompts (security sweep, N+1 hunt, race-condition hunt, test-gap analysis...). Lifetime updates.

Pack: aicraft.vip · Source: github.com/GoodJobwilliam/aicraft

What rule has caught the most bugs for your team? I'll add the best community suggestions to the next pack update.

Top comments (0)