Skip to main content

​
Use case

Agent-driven code review. Clone a repo, lint it, let the agent propose fixes via the apply_patch tool, summarize findings. The review never runs on your laptop — the clone, the linter, and the diff all live in a throwaway VM.

​
Template

ai-agent — large template with common agent-framework deps pre-installed (langchain, crewai, autogen, plus git/python tooling). Good choice when the agent needs to run Python code with a rich set of imports without a pip install delay.

​
Run it

export DECLAW_API_KEY=dcl_...
export DECLAW_DOMAIN=api.declaw.ai
export OPENAI_API_KEY=sk-...
# Optional: review a different repo
export TARGET_REPO=https://github.com/<owner>/<repo>.git

python cookbook/openai_agents_code_reviewer.py

​
Security policy

SecurityPolicy(
    injection_defense=InjectionDefenseConfig(enabled=True, sensitivity="medium"),
    network=NetworkPolicy(
        allow_out=[
            "api.openai.com",
            "pypi.org",
            "files.pythonhosted.org",
            "github.com",
            "codeload.github.com",
            "objects.githubusercontent.com",
        ],
    ),
)
Injection defense matters because an adversarial README.md could try to override the reviewer’s system prompt. The scanner runs on the request body before the LLM call — the agent code doesn’t have to implement any defense itself.

​
Env isolation in practice

envs={
    "REVIEWER_ID": "rev-001",
    "REVIEW_DEPTH": "standard",
    "TARGET_REPO": target_repo,
}
The agent reads these with printenv rather than having them in the system prompt. This means:
  • No secret values in model traces or guardrails logs.
  • Rotating a value doesn’t need a prompt change.
  • Per-reviewer customization (depth, id) stays structured.

​
What the agent does

  1. printenv REVIEWER_ID REVIEW_DEPTH TARGET_REPO
  2. git clone --depth 1 $TARGET_REPO /workspace/repo
  3. pip install -q ruff
  4. ruff check /workspace/repo
  5. ruff check --fix /workspace/repo && git -C /workspace/repo diff
  6. Write /workspace/review.md with sections for metadata, findings, auto-fixes, and remaining action items.

​
Expected output

== /workspace/review.md ==
## Reviewer metadata
- id: rev-001 · depth: standard · repo: https://...

## Lint findings
- flask/examples/.../app.py:12 E501 line too long
...

## Auto-fixes applied
- 3 files modified by `ruff check --fix`
...

​
Full source

See cookbook/openai_agents_code_reviewer.py in the repo.