Code review that reads past the diff

Run /review on a branch or PR. ML.ai reads the change and the code around it, checks what it finds, and puts Blocking issues first.

Install ML.ai All use cases

New sessionAutomationsReview

Sessions

Tests for formatPrice
Add dueDate to tasks
Review feat/export-csv

Review feat/export-csvacme/shop48s

/review branch feat/export-csv

Ran git diff against master1 commit

Read every source file in the repo

Ran the import of exportCsv.jsERR_MODULE_NOT_FOUND

3 Blocking findings, then 3 Non-blocking notes.

The export route trusts a userId from the query string, so any caller can export any user’s contacts.

Read only. No files in your repo were changed.

Describe a task or ask a question

Mode BuildModel AutoEffortlowmediumhigh

ReviewRead only · 0 files changed

Blockingroute.js:5 userId comes from the query string, so any caller can export any user’s contacts

BlockingexportCsv.js:1 date.js and db.js do not exist, so the module cannot be imported

BlockingexportCsv.js:6 Fields are not escaped, so a comma in a name corrupts the row

Who uses to review code

Developers who want a careful first pass before a person spends time on the change.

Authors before a PR
A check of your own branch for what you stopped seeing.
Reviewers with a queue
Start with what blocks the merge.
Small teams
A review on every change, including the late-night ones.

The risky line is rarely in the diff

A diff shows what changed, not what it depends on.

route.jssession.jsexportCsv.jspasted into chat

4export async function GET(req) {

5 const userId = url.searchParams.get('userId')

6 return new Response(await exportCsv(userId), …)

Who is signed in is decided in a file that wasn't pasted.

What a pasted hunk can see

A chat window sees one pasted hunk

It cannot tell that the signed-in user comes from a helper in a file nobody pasted.

route.js:5userId = url.searchParams.get('userId')

session.js:2getSession(req) // the signed-in user

exportCsv.js:6rows.map((r) => r.name + ',' + r.email)

From the changed line into the repo around it

It reads the repo, not only the diff

ML.ai ran git diff against the base branch, then read every source file. That is how it caught a query-string userId the session helper should supply.

Blockingroute.js:5 userId comes from the query string, so any caller can export any user’s contacts

BlockingexportCsv.js:1 date.js and db.js do not exist, so the module cannot be imported

BlockingexportCsv.js:6 Fields are not escaped, so a comma in a name corrupts the row

Findings grouped, each with file and line

Blocking issues come first

Each finding has a file, a line, the code, why it matters, and a suggested fix.

Ran the import of exportCsv.js

ERR_MODULE_NOT_FOUND: Cannot find module ‘src/lib/date.js’

I can’t assess whether db.contacts.find returns an array or a cursor.

Checked by running it, and what it could not check

It runs code to check, and admits gaps

It ran an import to prove two modules were missing. It also said what it could not assess.

Reviewing by hand versus handing it off

You skim the diff, open the files that look risky, and approve before reaching the one that matters.

Pull request, 2 new files

route.jsSkimmed

exportCsv.jsSkimmed

date.js, db.jsNever opened

Two imported files were never committed

You run one command. ML.ai reads the change in context and lists Blocking issues first.

/review branch feat/export-csv

Read the repo and ran the importERR_MODULE_NOT_FOUND

Blockingroute.js:5

BlockingexportCsv.js:1

Read only. Nothing was changed.

Which agent actually does this

Build

ReadRun gitReport

Build · Read · Run git · Report

Runs the review in your session

Reads the diff and the repo, runs git and code to check findings, and hands parts of the work to subagents.

explore

ReadSearchWrite

explore · Read · Search · Write

Optional: questions about the change

Read-only. Ask where a changed function is called and get exact file paths.

From /review to findings

A diff shows what changed. ML.ai also reads what the change depends on.

Explorer

src/api/export/route.js
src/auth/session.js
src/lib/exportCsv.js
package.json

ML.ai ML.ai

Build

/review checks uncommitted changes, a commit, a branch or a PR

/review branch feat/export-csv

Mode BuildModel AutoEffortlowmediumhigh

1Run /reviewThe menu reads: review changes [commit|branch|pr], defaults to uncommitted. Add a branch, commit or PR.

Explorer

src/api/export/route.js
src/auth/session.js
src/lib/exportCsv.js
package.json

ML.ai ML.ai

Build

/review branch feat/export-csv

Ran git diff against master1 commit

Read every source file

Ran the importERR_MODULE_NOT_FOUND

Grouped the findings, edited nothing

Describe a task or ask a question

Mode BuildModel AutoEffortlowmediumhigh

2It reads the diff, then the repogit status and a diff against the base branch, then every source file and any AGENTS.md.

Explorer

src/api/export/route.js
src/auth/session.js
src/lib/exportCsv.js
package.json

ML.ai ML.ai

Build

Review: feat/export-csv. 3 Blocking findings, then 3 Non-blocking notes.

Blockingroute.js:5 userId comes from the query string, so any caller can export any user’s contacts
BlockingexportCsv.js:1 date.js and db.js do not exist, so the module cannot be imported
BlockingexportCsv.js:6 Fields are not escaped, so a comma in a name corrupts the row

Read only. Nothing was changed.

Describe a task or ask a question

Mode BuildModel AutoEffortlowmediumhigh

3It checks what it findsIt runs code to confirm, such as an import that fails with ERR_MODULE_NOT_FOUND.

Explorer

src/api/export/route.js
src/auth/session.js
src/lib/exportCsv.js
package.json

ML.ai ML.ai

Build

Review: feat/export-csv. 3 Blocking findings, then 3 Non-blocking notes.

Blockingroute.js:5 userId comes from the query string, so any caller can export any user’s contacts
BlockingexportCsv.js:1 date.js and db.js do not exist, so the module cannot be imported
BlockingexportCsv.js:6 Fields are not escaped, so a comma in a name corrupts the row

Read only. Nothing was changed.

Reviewed · 3 Blocking, 3 Non-blocking, 0 files changed

Describe a task or ask a question

Mode BuildModel AutoEffortlowmediumhigh

4You read the findingsBlocking first, each with file, line and a fix. Your repo is unchanged.

Explorer

src/api/export/route.js
src/auth/session.js
src/lib/exportCsv.js
package.json

ML.ai ML.ai

Build

/review checks uncommitted changes, a commit, a branch or a PR

/review branch feat/export-csv

Mode BuildModel AutoEffortlowmediumhigh

Where reviews miss things

Three common failures, and what ML.ai did about each in a real run.

exportCsv.js importsWith ML.ai

date.jsmissing, verified

db.jsmissing

exportCsv.jsBlocking

Checked by running it

The module nobody committed

The diff reads fine, but two imported files were never committed. It breaks on load.

How ML.ai ML.ai handles it

ML.ai ran the import, quoted the ERR_MODULE_NOT_FOUND for date.js, and noted db.js would fail the same way.

FindingsWith ML.ai

route.js:5Blocking

exportCsv.js:6Blocking

content-dispositionNon-blocking

Blocking first

Comments with no order

Twelve comments of equal weight, and the important one is number nine.

How ML.ai ML.ai handles it

Findings are split into Blocking and Non-blocking.

The auth fixWith ML.ai

route.jsgetSession(req)

no header401 via try/catch

Uses what the repo has

A fix that ignores your codebase

A generic fix invents a helper the repo does not have.

How ML.ai ML.ai handles it

The auth finding pointed at the existing getSession and noted it throws without a header, so the route needs a try/catch returning 401.

Where this stops

What to expect, so nothing surprises you.

db.contacts.find: array or cursor?Answer

It names what it could not check

In the run, it could not tell what db.contacts.find returns. Check gaps like that yourself.

Wants to write 1 line in route.js

AllowAlwaysDeny

Fixes are a separate step

The review changed no files. A fix waits for Allow, Always or Deny.

exploreBuild

Ask before you fix

Use @explore, which is read-only, to see where a function is called before asking for a fix.

Root cause in session.ts

The store returns null before the session write finishes, so the middleware rejects a valid token.

session.ts+2 −1

40export async function getSession(id) {

41- const s = store.get(id)

41+ const s = await store.get(id)

42+ if (!s) throw new SessionNotFound(id)

AllowAlwaysDeny

Debug

Give ML.ai a failing test or a stack trace. It finds the actual cause and proposes a fix you approve.

See how it works

Apply edits to 4 files?

The definition and every caller, in one diff.

route.tsuserService.tsuseUser.ts+1 −1

20export async function GET(_, ctx) {

21- const user = await getUserById(ctx.id)

21+ const user = await findUserById(ctx.id)

22 return Response.json(user)

AllowAlwaysDeny

Refactoring

ML.ai finds every reference before it edits the definition, then lands the rename and each caller in one diff.

See how it works

FAQs

What can /review look at?

Uncommitted changes, a commit, a branch, or a PR. It defaults to uncommitted.

Does it edit my code?

No. In the run, the repo was unchanged afterwards. A fix is a separate edit you approve.

Does it read more than the diff?

Yes. It read every source file and looked for conventions files such as AGENTS.md.

Does it replace a human reviewer?

No. It is a first pass with Blocking issues first. A person still decides on the merge.

Try today, or talk to us about what is next

Install the editor agent on your own machine, or book a call to talk through your team’s workloads

Download ML.ai Book a call

Code review that reads past the diff

Who uses to review code

Authors before a PR

Reviewers with a queue

Small teams

The risky line is rarely in the diff

A chat window sees one pasted hunk

It reads the repo, not only the diff

Blocking issues come first

It runs code to check, and admits gaps

Reviewing by hand versus handing it off

By hand

With

Which agent actually does this

Runs the review in your session

Optional: questions about the change

From /review to findings

Where reviews miss things

The module nobody committed

Comments with no order

A fix that ignores your codebase

Where this stops

It names what it could not check

Fixes are a separate step

Ask before you fix

Related use cases

Debug

Refactoring

FAQs

Try today, or talk to us about what is next