audit-project

Multi-agent iterative code review that loops until zero issues remain.

Why

Manual code reviews miss things. Single-pass automated reviews find issues but leave fixing to you. audit-project runs up to 10 specialized review agents, fixes the issues it finds, re-reviews the fixes, and repeats until the codebase is clean - or you tell it to stop.

Use it when you want:

• A thorough review before a release or major merge
• Security-focused auditing of a specific area
• Quick feedback on recent commits
• Automated cleanup of accumulated code quality issues

Installation

agentsys install audit-project

Requires agentsys as the plugin runtime.

Quick Start

/audit-project              # Full iterative review of the entire project
/audit-project --quick      # Single pass, findings only, no fixes
/audit-project --recent     # Review last 5 commits only

How It Works

1. Context gathering - Detects project type, framework, languages, and infrastructure (DB, API, CI/CD, frontend/backend). 2. Agent selection - Activates 4 core agents plus up to 6 conditional agents based on what the project contains. 3. Multi-agent review - Each agent reviews only the files relevant to its domain and produces structured findings with file:line locations, severity, and suggested fixes. 4. Automated fixes - Applies fixes in severity order (critical first), batched by file. Rolls back any fix that breaks tests or build. 5. Re-review - Runs agents again on changed files. If new issues appear, fixes and re-reviews again. 6. Decision gate - After each iteration, reports remaining issues and asks whether to continue, create GitHub issues, update TECHNICAL_DEBT.md, or save the queue for later.

Review Agents

Always active:

| Agent | Focus | |-------|-------| | code-quality-reviewer | Error handling, maintainability, code patterns | | security-expert | Vulnerabilities, auth, input validation | | performance-engineer | Bottlenecks, algorithms, memory usage | | test-quality-guardian | Test coverage gaps, test quality |

Conditional (activated by project signals):

| Agent | Activated when | |-------|---------------| | architecture-reviewer | 50+ tracked files | | database-specialist | Sequelize, Prisma, or TypeORM detected | | api-designer | Express, Fastify, or NestJS detected | | frontend-specialist | .tsx, .jsx, .vue, or .svelte files present | | backend-specialist | Server framework detected | | devops-reviewer | CI/CD configuration files present |

Finding Format

Every finding includes file:line location, severity (critical/high/medium/low), a code quote, a suggested fix, and an effort estimate (small/medium/large).

Usage

/audit-project                      # Full iterative review
/audit-project src/api              # Review a specific path
/audit-project --domain security    # Run only the security-expert agent
/audit-project --quick              # Single pass, no fixes applied
/audit-project --recent             # Scope to last 5 commits
/audit-project --create-tech-debt   # Force TECHNICAL_DEBT.md creation
/audit-project --resume             # Resume from a saved review queue

Repo Intelligence

When agent-analyzer repo-intel data is available, audit-project uses test-gap signals to prioritize review. Files with high churn but no co-changing test file receive extra scrutiny.

Requirements

• agentsys runtime
• Git repository
• Works with Claude Code, OpenCode, Codex, and Cursor

Related Plugins

• enhance - Plugin structure and config analysis
• perf - Dedicated performance investigation with profiling
• repo-intel - Unified static analysis (git history, AST symbols, doc-code sync)
• ship - PR workflow from commit to production

License

MIT