Start free

Shipmoor · Code Review

Advisory AI code review, run locally with your own agent

Shipmoor Code Review reads your change and reports advisory findings, the kind a careful reviewer would raise. It runs on your machine with your own agent. Shipmoor hosts no model and uploads no source. One command reviews the diff, and the review never blocks your build.

Start free Start free Read the docs Read the docs
  • Advisory, never gates the build
  • Bring your own agent, local
  • No hosted model, no source upload

read → note → note → done · the review reports and exits 0; your build never waits on it.

A coding agent finishes a task and opens a pull request. The diff compiles, but a reviewer still has to read it: an except clause quietly swallows a failed refund and returns success, a side effect is missing, a function is harder to follow than it should be. This is reading-level work the deterministic scan does not try to do, because it is judgment, not a structural fact.

Shipmoor Code Review adds that reading pass, and keeps it advisory. The deterministic scan stays the gate. Code Review is the second pair of eyes next to it, on the CLI, in your IDE, in CI, in Agent Skills, and in the Agent Harness.

  • advisory only
  • bring your own agent
  • local review
  • shipmoor.scan.v1
  • SARIF
  • no hosted model
  • no source upload
$ shipmoor review --agent claude --from main --to HEAD
 
Reviewing 4 changed files (main..HEAD) · agent: claude · advisory
 
MEDIUM  error-handling   services/api/handlers/refund.py:54
        the except clause swallows the error and returns 200; a failed
        refund would look successful to the caller. Consider re-raising.
LOW     readability      services/api/handlers/refund.py:31
        nested conditionals; an early return would read more clearly.
 
Review: 2 advisory findings · 1 medium, 1 low · exit 0 (advisory)
shipmoor.scan.v1 and SARIF written · the gate is unchanged

One command reviews the change with your own agent, then reports advisory findings. The build is never blocked.

Why not just ask the agent to review?

A bare "review this diff" prompt or a loose skill produces a review that drifts. A real review pass scopes the change, pins findings to lines, and returns the same evidence format every time.

skill-onlyA prompt that asks for a review
  • Coverage gapsIt reads what fits the context window and skims the rest, so whole files in a large change go unread.
  • Position driftFindings land on the wrong line, or no line at all, so you re-hunt the spot the model meant.
  • Unstable qualityThe same diff yields a different review run to run, and nothing downstream can parse the prose.
shipmoor reviewA real review pass
  • Scoped to the changeThe CLI scopes the diff, changed, staged, or a range, and drives the agent over the whole change, not a window of it.
  • Pinned to exact linesEvery finding carries a severity and a file:line location you can jump straight to.
  • Structured outputFindings come back as shipmoor.scan.v1 and SARIF, the same evidence the scan produces, machine-readable every run.

A skill makes the agent want to review. The CLI is what turns that into a complete, located, parseable review, the difference between a chat reply and a review pass.

Two engines, each doing what it's best at

Shipmoor already ships a deterministic scan that can fail the build on structural defects. Code Review is the other half: a reading pass that advises and never blocks. They stay in their own lanes.

Deterministic scan

Structural facts, the same every run

Phantom imports, hallucinated APIs, stub paths, placeholder bodies. A rule fires or it does not, an exit code you can put in front of a merge button.

enforces · can fail the build
Your agent reads

Judgment, the soft questions

Is that the right query? Should that connection close? Does the change actually do what was asked? Your own agent reads and raises advisory findings.

advises · always exit 0

A model is good at reading and bad at being a gate. So Shipmoor lets the model read and surfaces what it found, and leaves enforcement to rules that behave the same way every time.

Advisory review, not a gate

The review reports findings and exits zero, every time. Three things follow from that.

  • Advisory by design It reports findings and exits zero. A second pair of eyes, not a quality gate, so it can read broadly without the risk of a false block holding up a merge.
  • The scan still gates The deterministic scan is the part that can fail a build, on phantom imports, hallucinated APIs, stub paths, and placeholder bodies. Code Review sits next to it and never changes that gate.
  • Your judgment decides An agent reads the change and raises advisory findings. You decide what to act on. Nothing the review surfaces can block the build on its own.

Run the review for the reading-level feedback, and keep the scan as the gate. One advises, the other enforces.

Findings pinned to the exact line

Each finding carries a severity, a rule, and a file:line location, anchored where the change actually is, not floating in a summary.

refund.py
52 try:
53 charge = gateway.refund(order_id)
54 except Exception:
mediumerror-handlingrefund.py:54

The except clause swallows the error and returns 200; a failed refund would look successful to the caller.

suggestre-raise after logging, or return a 5xx so the failure is visible to the caller.

55 return ok(200)
56 log.info("refund handled")

advisory · this finding reports and exits 0, it does not fail the build.

The same review, native in your agent

Install the skills and the review is a step your coding agent runs itself: review the change, then fix what it surfaced, all driven by the local CLI on your machine.

  • CClaude Code
    > /shipmoor-review reading change (advisory)… 3 findings · exit 0
  • OCodex
    $ shipmoor review --agent codex advisory pass over diff… 2 findings · exit 0
  • ⌘Cursor
    $ shipmoor review --agent cursor diagnostics on changed lines… advisory · never errors

Skills make the agent run review, then fix, as one loop where the code is written. The review reads and reports; it never calls the change done on the advisory pass alone.

Bring your own agent. Shipmoor hosts no model.

Code Review never selects, builds, or hosts a model. The review rides the agent you already use under your existing provider relationship. The easy path is --agent claude; any agent you can run from a command works the same way. Source code and diffs are not uploaded to Shipmoor.

  • claude
  • codex
  • cursor
  • aider
  • your own agent

How a review runs

Code Review is one command. It scopes to your change, asks your own agent to read it, and writes advisory findings in the same formats the scan already produces.

  • Review the working change

    shipmoor review --agent claude

  • Review only what the branch introduced

    shipmoor review --agent claude --from main --to HEAD

  • Review the staged change before a commit

    shipmoor review --agent claude --staged

  • Write SARIF for an advisory upload

    shipmoor review --agent claude --from main --to HEAD --sarif --output review.sarif

The review reads the change and reports. It never edits your code on its own, and it never holds up a merge.

Code Review across local surfaces

The same advisory pass across local product surfaces. Start in the CLI, then surface it in your editor, export a report, or run it in your agent and harness. The CLI is the source of truth, and review never gates.

  • cli

    Command line

    The fast local loop. Review the change with your own agent and read findings in your shell, before you open a pull request.

  • ide

    IDE diagnostics

    The same findings as Information diagnostics on the changed lines, never an error squiggle, never counted in your problem totals.

  • report

    Local SARIF export

    Write advisory findings to SARIF for local inspection or an integration you control. Self-managed CI remains Scan-only.

  • agent skills

    Review then fix

    A loop your agent runs: review the change, repair what it finds, re-review, never done on the advisory pass alone.

  • agent harness

    In the loop

    Review findings ride the local feedback loop as advisory signal, alongside the deterministic gate.

The review runs on your machine, with your model

Code Review reads the change locally and asks the agent you already run to do the reading. Shipmoor selects no model and hosts no model. Your source code and diffs are not uploaded to Shipmoor; the CLI contacts the service for authentication, entitlements, command allowances, and features you explicitly enable. The agent call rides your own provider relationship.

PythonTypeScriptJavaScriptGo

5 Reviews per month on Free

A new personal account receives one 30-day period of full Pro at account creation, with no card or invitation required. After that, Free includes 5 standalone Reviews per month and Pro is unlimited.

  • Free · $0

    Recurring local verification

    Separate command allowances plus unlimited local workflow tools.

    • 5 Reviews per month
    • 5/month each for Claim Check, Test Evidence, and Blast Radius
    • Unlimited Scan, Agent Harness, and Agent Skills
    • Account required; source and diffs are not uploaded
  • Pro · $19 / month

    Unlimited verification

    Unlimited individual commands and the full advanced workflow.

    • Unlimited Claim Check, Review, Test Evidence, and Blast Radius
    • Unlimited Scan, Agent Harness, and Agent Skills
    • Full IDE and advanced configuration
    • Advisory findings never gate the build

Add an advisory reviewer to your next agent change

Create a personal account to receive one 30-day period of unlimited Pro with no card, then run shipmoor review --agent claude on your change. After that period, Free includes 5 Reviews per month.

Install Shipmoor

Free account. Local execution. No source upload.

Start free
curl -fsSL https://dl.shipmoor.dev/install.sh | bash

Code Review docs

Code Review FAQ FAQs

Advisory review, bring your own agent, and how it differs from the gate.

Keep exploring

AI code integrity for agent-assisted teams. Free account · Local execution · No source upload.

Contact sales

Our team can help with custom support, team rollouts, and self-hosted deployments. Or to get started now, explore our self-serve plans.