Code review
A review Claude Code has to finish, not one it decides it has finished
Ask Claude Code to review a codebase and it does something reasonable: it reads what fits, forms a view, and writes it up. The problem is the word "decides". The agent decides what counts as enough, and on a large codebase enough arrives long before the review is complete. This use case replaces that decision with a workflow.
The Code Quality package, included with the Starter license, runs two assessments — ISO/IEC 5055 and Clean Code — as several hundred individual steps. The engine hands Claude Code one check at a time, waits for the findings, has them reviewed, and only then opens the next. The review is complete when the workflow says so, and the report cites file and line for every finding.
This is deliberately not a Claude Code feature. It's an AI code review workflow that runs the same way for any MCP-capable agent, because the enforcement lives in the engine rather than in the agent's own instructions.
The facts
- ✓The Code Quality package is included with the Starter license.
- ✓ISO/IEC 5055:2021 covers four measures — Maintainability, Performance Efficiency, Reliability and Security — each weakness its own step.
- ✓Clean Code runs twelve chapter workflows, each appending reviewed findings to a shared log.
- ✓Works with Claude Code, Codex and any MCP-capable client over streamable HTTP.
- ✓Every finding cites a file and line and carries a severity and effort estimate — nothing is reported as prose a reader has to interpret.
The problem
Where it goes wrong without rails
Free-form reviews are confident, partial, and different every time you run them.
Long reviews degrade: by the time the agent reaches the last module, the first one has fallen out of context.
Findings without a file and line are opinions, and a reviewer cannot act on an opinion.
When a finding is disputed later, "the agent said so" isn't evidence, and a free-form review leaves nothing else behind.
How it works
What the engine does about it
- 1
Add one MCP server to Claude Code
An entry in .mcp.json pointing at the engine's streamable HTTP endpoint with an agent token. Claude Code now has the ccw_* tools alongside its own.
- 2
Start the review workflow
Claude Code calls ccw_start with the Code Quality workflow and the directory to review. From here the engine decides the order of events.
- 3
One check per step, reviewed before the next
Each weakness or chapter item arrives with its own instruction file. Findings go to a log on disk, not through the prompt, so the hundredth check is as sharp as the first. Each chapter loops through review until it passes.
- 4
A compiled report with the evidence
The compile step dedupes, ranks by severity and effort, and verifies that each recommendation is actionable — a finding reads like "ISO/IEC 5055 Security, api/users.ts:142: parameter concatenated into a raw query — severity high, effort S, recommendation: bind the parameter", not a paragraph of prose to interpret. The raw findings log stays alongside, so the numbers can be audited.
Questions
Asked before buying
- Does this replace a human reviewer?
- It replaces the part a human should not be doing by hand — checking hundreds of items exhaustively — and gives the human a ranked, cited report to review instead. The judgement stays with you.
- How is this different from putting a review checklist in CLAUDE.md?
- A checklist in the prompt is advice; the agent can still decide it has done enough. Here the engine holds the checklist and will not open the next step until the current one has findings written down and reviewed.
- Can I review a pull request rather than a whole codebase?
- The Boy Scout Coding package reviews a change from three angles — architecture anti-patterns, OWASP and Clean Code — scoped to the changed lines, as part of making the change.
- Is this an AI code review workflow, or specific to Claude Code?
- It runs the same way for Claude Code, Codex or any MCP-capable client — the engine enforces the steps, not the agent. "For Claude Code" describes where most people start, not a limitation of the workflow.
- Is there an audit trail if a finding gets disputed?
- Two of them. The raw findings log behind the compiled report keeps every finding before ranking and deduping, and ccw_instance_logs has the run's full step-by-step record — including any review loop that hit its retry limit and was force-approved, which is worth checking first.
- Can a human review the findings before anything happens?
- Always — this workflow produces a report, it doesn't act on one. If you also want a human gate before the agent changes anything, pair it with Boy Scout Coding, which gates on scope and then on design before a line is written.
Start with
The packages that fit
- Code Quality →
Run a full ISO/IEC 5055 and Clean Code assessment of any codebase with your coding agent, every check its own verified step. Included with every license.
- Boy Scout Coding →
A code change by your coding agent: scoped, designed, approved at two human gates, reviewed from three angles, covered by tests — and the code left cleaner.
Every plan and what it includes is on the pricing page.