ModelRefs / AI Code Review — AI Glossary
AI Code Review — AI Glossary
Using LLMs to automatically review code changes for bugs, security vulnerabilities, style violations, and best practice adherence.
Overview
AI code review tools (CodeRabbit, GitHub Copilot code review, Cursor) analyze diffs and provide inline comments. They identify: logic errors, security flaws (OWASP Top 10), performance antipatterns, and style violations. LLMs contextualize suggestions with surrounding code. Complement rather than replace human review; excel at catching common patterns.
Reference details
| Topic | applications |
|---|---|
| Last reviewed | 2026-06-24 |
Related terms
How it works
- The diff is the unit of review, with enough surrounding context pulled in that a changed line can be judged against what it calls and what calls it.
- Changes are grouped so related edits are reasoned about together rather than line by line, which is what allows a comment about an interaction rather than a line.
- Findings are produced against specific categories — logic errors, security patterns, performance antipatterns, convention breaches — because an open-ended 'review this' yields style notes.
- Each finding is anchored to a line with a stated reason, so a human can dismiss it on the reason rather than on vibes.
- Output is filtered hard, since precision governs adoption: a reviewer who learns the comments are mostly noise stops reading them, and the tool's value goes to zero regardless of recall.
Example: Precision decides whether anyone keeps reading
A tool posts 20 comments on a pull request and 4 are real issues. That is 20% precision, and a reviewer reads 16 false positives to find 4 — most will start skimming, and the next genuine finding is missed because it arrived in the same stream as the noise. Tuned to post only high-confidence findings, it posts 5 comments of which 4 are real: 80% precision, the same 4 issues found, and a reviewer who still reads them. Recall fell or stayed flat and the tool became more useful, which is the counterintuitive part.
Commonly confused with
Lumped in with linters and static analysis, which it does not replace. A linter applies deterministic rules and is right or wrong for a knowable reason; static analysis proves properties over paths. An LLM reviewer reasons about intent — whether this change does what its own description claims — which no rule encodes, and is probabilistic, so it can be confidently wrong in ways a linter cannot. The sensible arrangement runs all three: rules for what rules catch, analysis for what it can prove, and the model for the intent gap, with the model's findings treated as suggestions rather than gates.
When to use it
Reach for it when:
- High pull-request volume where a first pass catches common classes before human review.
- Spotting mismatches between a change's stated purpose and its actual effect.
- Flagging recognisable security and performance patterns early in the cycle.
Reach for something else when:
- As a merge gate, where a confident false positive blocks correct work.
- Architectural review, which needs context about intent and history outside the diff.
- In place of human review on consequential changes — it complements accountability, it does not hold it.
Continue your research
Use these connected ModelRefs sections to compare alternatives, inspect implementation paths, and review the evidence and governance boundaries relevant to AI Code Review — AI Glossary.
Frequently asked questions
What is AI Code Review?
Using LLMs to automatically review code changes for bugs, security vulnerabilities, style violations, and best practice adherence.
What concepts are related to AI Code Review?
Closely related concepts include code generation, llm security, test generation.