Chat on WhatsApp
  • Sign In
  • Create an Account
Toggle Nav
My Cart
Account
Back to /claude
Claude code cluster

Claude Code Reviewer: Magento 2 PR Review Sub-Agent

A drop-in Claude Code sub-agent that reviews Magento 2 pull requests like an Adobe EQP reviewer would. Style, static analysis, security, performance, Marketplace blockers — categorised report, ready to paste as a GitHub PR comment.

Live code reviewer

Paste code. Get a Magento-aware review in real time.

A Python sidecar (FastAPI) running next to Magento on the private docker network checks your snippet against 15 Magento-specific rules — ObjectManager misuse, raw SQL, vendor edits, SQL-injection vectors, plain die() calls. The traffic never leaves your stack.

Sidecar online http://python:8000
Python sidecar offline Run docker compose up -d python locally to enable the live review. The page below stays usable; rule descriptions are static.
PHP / phtml / XML
bytes · lines

How this works

  1. Browser POSTs your code to /claude-api/lint (this Magento store).
  2. Panth_ClaudeBridge Magento module receives it, forwards to http://python:8000/api/lint over the private docker network.
  3. FastAPI sidecar runs 15 regex-based Magento rules in lint_rules.py, returns JSON.
  4. Result bubbles back to the browser, Alpine renders the score + findings inline.

Source: python/app.py, python/lint_rules.py, app/code/Panth/ClaudeBridge/. Run docker compose up -d python to start the sidecar locally.

More in the cluster

Keep going

FAQ

Common questions

What does the code-reviewer sub-agent actually check on a Magento PR?

Six layers. (1) Style: phpcs --standard=Magento2 on changed files. (2) Static analysis: phpstan --level=6. (3) EQP: no ObjectManager in non-setup code, no vendor edits, plugins over preferences, service contracts over direct model access, _isAllowed() on every admin controller. (4) Security: SQL concatenation, unescaped phtml output, missing CSRF, hardcoded secrets. (5) Performance: n+1 queries (look for ->load() in a foreach), missing indexes on new db_schema.xml tables, missing cache tags on blocks. (6) Marketplace: composer.json license, README presence, no GPL deps. Output is a categorised Markdown report — same shape as a GitHub review comment.

How do I invoke the reviewer mid-PR?

From inside Claude Code: /review or explicitly Task tool with subagent_type: code-reviewer and the diff URL or branch name. From CI: a GitHub Action that runs claude code -p "review this diff: $DIFF" --agent code-reviewer and posts the output as a PR comment. The agent reads the diff, the changed files in full context, and your CLAUDE.md — it does not read the entire repo, which keeps the cost predictable. Typical run: 30–60 seconds for a small PR (1–5 files), 2–3 minutes for a large one (20+ files).

How do I deal with false positives from the reviewer?

Treat the reviewer's report as a draft, not a verdict. Three calibration moves. (1) Add a ## Project conventions section to your CLAUDE.md listing exceptions ("ObjectManager is allowed in Test/Unit — mocks need it"). (2) For repeated false positives, add an .claude/agents/code-reviewer.md override that explicitly mentions the convention. (3) If a finding is genuinely wrong, reply in-thread — the reviewer will adjust within the session. After two weeks of use, the false-positive rate is < 5%; on day 1 it'll be 20%. Patience pays.

Can it actually predict Marketplace tech-review failures?

About 80% of them, yes — the deterministic ones. Things it catches reliably: vendor edits, raw SQL, deprecated APIs (anything in @deprecated blocks across vendor/magento/*), missing service contracts, hardcoded URLs, missing translations on user-facing strings, missing composer.json dependencies, license file mismatches. Things it can't predict: subjective UX issues, regional compliance flags (GDPR, ADA), and Marketplace-listing copy. For those you still need a human reviewer (hire one). But shipping a PR with zero deterministic findings means the human review is fast and pleasant instead of soul-crushing.

How do I extend the reviewer with my own org-specific rules?

Edit .claude/agents/code-reviewer.md. Add a ## Org-specific rules section with concrete prohibitions: "No new dependencies in composer.json without architecture-team approval. All new admin controllers must extend Vendor\Common\Controller\Adminhtml\Base. All new emails must use the Vendor_Email template loader, not Magento_Email." The agent treats these the same as the built-in EQP rules. For pattern-based rules (regex matches) that the model would miss, add a PostToolUse hook that runs a literal grep and feeds findings back. Treat the code-reviewer.md file as living documentation — it is the source of truth for what "shippable" means in your org.