If you use Claude Code, Codex CLI or Aider, you now read more code than you write. The agent edits twelve files, you run git diff, and the diff scrolls past in the order the agent touched things, not in the order that matters.
This post describes how I review that kind of change in a terminal, and the open-source tool I built for it, Klaub. Short version: read functions instead of hunks, let a deterministic ranking tell you where to look first, make the agent explain the choices it made, and ask it questions about whatever is on your screen.
Why is reviewing AI-generated code harder than reviewing a colleague's?
A colleague's pull request comes with a description, a history and a person you can ask. An agent's change comes with a chat transcript you probably skimmed.
Sonar's 2026 State of Code survey of more than 1,100 developers found that 96% do not fully trust AI-generated code, and only 48% said they always verify it before committing. 38% said reviewing AI code takes more effort than reviewing a colleague's. Sonar sells code verification and the numbers are self-reported, so I read them as a signal and not as a measurement. The bottleneck has moved from writing code to reading it.
What is a good way to review code an AI agent wrote?
Three things help most.
- Review by function, not by line. An agent rewrites a function top to bottom, and a line diff shows that as a wall of red and green. Seeing the old and the new version of the whole function in the same place is faster to read.
- Start with the riskiest change. A changed public signature that a route reaches deserves your attention before a renamed local variable.
- Know why the agent chose what it chose. A diff shows what changed. The choices behind it, such as a new storage format or a swallowed exception, are rarely written down anywhere.
Klaub does the first two by analyzing the code and the third by asking your agent. The next sections show each one.
How do you know which AI-written change to read first?
Klaub parses your repository (Python, JavaScript, TypeScript, Rust, Go and Java get full analysis), matches symbols across the two versions and puts every changed function, class and file in a queue ordered P0 to P3. Press w on any entry and it lists the points that put it there.
In the sample repository from the demo above, a payment function lands at P0 with a score of 83:
- +25: the declaration of a public symbol changed
- +20: an external entrypoint (a route) can reach it
- +15: it touches a sensitive area (
payments) - +15: an error is discarded, and the finding is marked as introduced by this change
- +8: no associated test was found
There is no model in that ranking, so the same change gives the same queue every time, and each number can be taken apart. The priority orders your reading. It does not say how severe a problem is, and a P3 can still matter.
Press i on a unit to see its contract: parameters before and after, the routes it serves, the exceptions it raises, its direct callers and the entrypoints that reach it. Each hop is marked resolved, heuristic or unresolved, because a missing path does not prove that nothing depends on the code.
How do you find out what technical decisions an AI agent made?
Klaub has a Decisions window for this. If the file does not exist, it puts a request in your agent's input asking for the technical decisions of the change, as JSON. You press Enter yourself. The request carries everything the agent needs, so you install nothing.
Each decision is written for someone who knows nothing about the code or about what the product does in that place: the context, what was decided, why, the alternatives with their trade-offs, what it changes, and the question you are asked. It also says whether the decision was stated in the change (a commit message, a comment, a test) or inferred from the diff. The inferred ones are the ones worth questioning, because nobody wrote them down.
Klaub validates the file against the snapshot before showing it, and shows nothing that fails validation or belongs to another state of the code. Then one decision fills the screen, quiz style. You press a to approve, d to reject, c to comment, and the arrows to move. At the end, the rejected and commented ones can go back to the agent as one short instruction.
In the sample repository the agent listed five decisions. Two of them were worth stopping on:
- A failed call to the payment provider is caught and ignored, so an order can be saved as if it had been paid. Nothing in the diff says why.
- A new endpoint lists the orders of any user, and checks that the caller is logged in but not that the caller is that user.
Both are easy to miss in a line diff, because each one is something the code does not check. One caveat: the decisions are the agent's account of its own work. Klaub validates the format and the references, not the truth, so treat them as a reading guide.
Can you ask your coding agent about the code you are reviewing?
Yes. If you start the agent through Klaub:
klaub wrap claude # or: klaub wrap codex
Klaub runs the agent in its own session with a reader window next to it. Shift+→ goes to the reader and Shift+← goes back. Press t on any screen in the reader and it puts a description of what you are looking at into the agent's input: the unit, how it changed, the lines on screen and the git diff, or the whole decision card, or the steps of a diagram. You land in the agent, type your question and press Enter.
The text tells the agent not to change or run anything before your question. It is one line, sent as a bracketed paste, and Klaub never presses Enter.
How do you see how an AI-written change actually runs?
The Flow window draws the execution path as a diagram: a box per step, connectors between them, the steps the change touched outlined, and the certainty of each step marked. You set a focus in free text and choose the level of detail, from high-level components to individual functions, and whether to reach end to end through the frontend and storage. Klaub builds the request, your agent writes the diagram file, and it appears when the file is saved.
What the agent claims is treated as a hypothesis. If a step names a symbol that does not exist in the index, the difference is shown.
Is there a code review tool that works offline, without an LLM?
Klaub makes no network requests, has no telemetry and needs no account. The analysis is deterministic. A language model is involved in exactly two places, the decisions and the flow diagram, and in both it is your own agent that writes the file, not Klaub.
The trade is real. Klaub cannot find a bug that requires understanding what the code is for, because it applies fixed rules and a call graph. It finds what those can show: swallowed errors, queries built from dynamic text, secrets in code, I/O inside loops, dynamic code execution, unsafe blocks and disabled certificate checks.
How does this compare with other ways to review agent code?
| Approach | What you read | Where it falls short |
|---|---|---|
| The diff in the agent's own output | Line diff, in the order of the edits | No ranking, no callers, and a long session scrolls away |
| A pull request on a hosting site | Line diff, after you push | The code leaves your machine before the first read, and the loop with the agent is slow |
| A second AI model as reviewer | The model's findings | Findings are probabilistic, so you still read the code to know which to believe |
| Klaub | Functions ranked by risk, with contracts, callers and the agent's decisions | Fixed rules find what rules and a call graph can show, and the decisions are the agent's own account |
They combine well. A second model's findings, Klaub's queue and your tests answer different questions.
How do you install Klaub?
brew install myrk-kale/tap/klaub
cd my-project
klaub review
It runs on macOS and Linux and needs Git on your PATH. cargo install klaub --locked works too, and the README lists release archives and an install script. Windows is not supported yet. klaub review opens the reader on what changed since HEAD, with the riskiest change first. Press ? for the keys.
Klaub is MIT licensed. If you try it on a real agent session, I would like to hear what the queue got wrong, because that is where the ranking rules improve. Issues are open at github.com/myrk-kale/klaub.
Frequently asked questions
What is Klaub?
A free, open-source terminal application for reviewing code changes by function and class, ranked by risk. It was built for reading what AI coding agents write, and it works on any Git change.
Which AI coding agents does Klaub work with?
Codex CLI, Claude Code and Aider are the targets. Any interactive terminal program can run through klaub wrap, and klaub review works with no agent at all.
Does Klaub send my code anywhere?
No. It makes no network requests. Reviews and your answers are files under .klaub/ in your repository. What your agent does with a request is up to the agent you chose.
Does Klaub press Enter in my agent?
No. It shows the destination and the exact text first, sends one line as a bracketed paste, and you press Enter. The t shortcut skips the confirmation by default and works the same way, and ask_agent_confirms = true in the config makes it ask.
Which languages does Klaub analyze?
Python, JavaScript, TypeScript (including TSX), Rust, Go and Java get full semantic analysis. Other files are listed, shown whole and compared as text.
Top comments (0)