Skip to main content

​
Overview

CodeAnt AI reviews every pull request by posting inline comments directly on the lines of code that need attention. Each comment is structured to give you everything you need to understand, verify, and fix the issue - without switching context.

​
What a Review Comment Looks Like

Every inline comment from CodeAnt AI includes four parts:

​
1. Issue Description

A clear explanation of what the problem is and why it matters. The description categorizes the issue (e.g., possible bug, logic error, concurrency bug) so you can quickly understand the nature of the problem.
Example: “Markdown fence parsing is done before trimming whitespace, so responses like \n```json ... fail JSON parsing and get downgraded to default LOW results. Strip whitespace first, then remove fences.” [possible bug]

​
2. Severity Level

Each issue is classified by severity so you can prioritize your fixes:

​
3. Suggested Fix

A ready-to-use code snippet that resolves the issue. You have two ways to apply it:
  • Apply Suggestion - click Commit suggestion directly on the review comment to commit the fix.
  • Prompt for AI Agent - expand the Prompt for AI Agent section on the review comment to get a ready-made prompt with the full context of the issue, the fix, and the steps of reproduction. Copy it and paste it into your AI coding agent (Cursor, Copilot, Claude Code) and let it apply the fix with full awareness of your codebase.
Prompt for AI Agent

​
4. Steps of Reproduction

This is the key differentiator. Each review comment includes detailed, numbered steps showing exactly how to trigger the issue - with file paths and line numbers.
For a bug where unscored secrets get incorrectly marked as false positives:
  1. Call POST /analysis/secrets/run, which creates Advanced_Analysis(feature="secrets") and executes run().
  2. In detection flow, entropy findings are capped by collect_entropy_secrets(..., max_tasks=500) so only the first 500 entropy items are AI-scored.
  3. Remaining entropy findings keep confidence_score=None because _process_confidence_scoring(tasks) only mutates selected tasks, then mark_false_positives() converts all None to FALSE_POSITIVE.
  4. Downstream components explicitly drop FALSE_POSITIVE, so unscored secrets disappear from outputs.
Steps of reproduction allow developers to:
  • Verify the issue exists by following the exact execution path
  • Understand the root cause through the chain of function calls
  • Test their fix by replaying the same scenario
  • Communicate with teammates using a shared, precise reference

​
Impact Analysis

Alongside the steps of reproduction, each critical or high severity comment includes an impact analysis - a bullet list of downstream consequences if the issue is left unfixed.
Example impact analysis:
  • Entropy secrets downgraded to FALSE_POSITIVE after parse miss.
  • Confidence scoring reliability drops on fenced AI output.
  • CI quality-gate scans may block on one file.

​
How to Respond to Reviews

You can interact with any review comment:

​
Security-only reviews

Limit AI code suggestions and their nitpicks to security issues: SQL injection, SSRF, command injection, cross-site scripting, CSRF, path traversal, insecure deserialization, XXE, authentication or authorization bypass, hardcoded secrets, sensitive data exposure, insecure cryptography and open redirects. Open review configuration, select the organization or a repository, and set Security Only Reviews to On under Review Behavior. The setting is off by default, and a repository can override the organization’s value. If your organization has a Code Security plan without AI Code Review, CodeAnt AI reviews pull requests in security-only mode automatically for authors with a Code Security seat. These reviews post security suggestions only, without a PR description or merge-risk comment. Quality gates run as usual.

​
Quality Gate Integration

Review findings feed into the Quality Gate results. After the review, a summary comment is posted with pass/fail status for: