---
name: ai-code-review
description: Multi-AI code review system using Gemini (gemini-3-pro-preview) and Codex (gpt-5.1-codex-max) to validate and improve Claude Code's work. TRIGGERS: "review my work", "check this code", "validate changes", "suggest improvements", "dual AI review", "get second opinion". USE FOR: code quality validation, security review, performance suggestions, architectural feedback, best practice enforcement. Combines 2M token Gemini context with Codex reasoning for comprehensive analysis.
---

# AI Code Review Skill

## Overview

This skill leverages two powerful AI systems to review and improve Claude Code's work:

- **Gemini CLI** (gemini-3-pro-preview): 2M token context for large-scale analysis
- **Codex MCP** (gpt-5.1-codex-max): Deep reasoning for detailed code review

**Purpose:** Get independent AI perspectives on code changes to catch issues, suggest improvements, and ensure quality before deployment.

## Model Configuration

### Gemini CLI

- **Model:** `gemini-3-pro-preview`
- **Context:** 2M tokens (can analyze entire codebase)
- **Strength:** Pattern detection, security audits, architectural analysis

### Codex MCP

- **Model:** `gpt-5.1-codex-max`
- **Mode:** xhigh (maximum reasoning)
- **Strength:** Deep code analysis, logic verification, improvement suggestions

## When to Use This Skill

### Primary Triggers

1. After completing a significant feature implementation
2. Before committing code to main/master branch
3. When making security-sensitive changes
4. For architectural decisions validation
5. When refactoring complex code
6. Before production deployments

### Use Cases

- **Code Quality Review:** Check for bugs, edge cases, and logic errors
- **Security Audit:** Identify vulnerabilities and security gaps
- **Performance Analysis:** Find bottlenecks and optimization opportunities
- **Best Practices:** Ensure code follows project standards
- **Architecture Review:** Validate design decisions and patterns

## Quick Start

### Basic Review (Single File)

```bash
# Gemini review
mcp__gemini-cli__ask-gemini \
  prompt="@path/to/file.ts Review this code for bugs, security issues, and improvements" \
  model="gemini-3-pro-preview"

# Codex review
mcp__codex__codex \
  prompt="Review this code and suggest improvements: [paste code]" \
  model="gpt-5.1-codex-max"
```

### Comprehensive Review (Multi-File)

```bash
# Gemini analyzes scope
mcp__gemini-cli__ask-gemini \
  prompt="@app/api/**/*.ts @lib/**/*.ts Review all recent changes for: 1) Security issues 2) Performance problems 3) Code quality 4) Missing error handling" \
  model="gemini-3-pro-preview"

# Codex provides detailed fixes
mcp__codex__codex \
  prompt="Based on these issues found: [paste Gemini findings], provide detailed code fixes" \
  model="gpt-5.1-codex-max"
```

## Review Workflows

### Workflow 1: Standard Code Review

**Step 1: Gemini Broad Analysis**

```typescript
// Use Gemini to scan all changed files
mcp__gemini -
  cli__ask -
  gemini({
    prompt: `@app/api/[changed-route]/route.ts
Review this API route for:
1. Security vulnerabilities (auth, injection, CSRF)
2. Error handling completeness
3. Input validation
4. Performance issues
5. Code style consistency

Provide specific line references for each issue.`,
    model: "gemini-3-pro-preview",
  });
```

**Step 2: Codex Deep Analysis**

```typescript
// Use Codex for detailed reasoning on specific issues
mcp__codex__codex({
  prompt: `Analyze this code change and provide:
1. Logic verification - are there any edge cases missed?
2. Improvement suggestions with code examples
3. Alternative approaches if applicable
4. Test cases that should be written

Code:
[paste the specific code section]`,
  model: "gpt-5.1-codex-max",
});
```

**Step 3: Synthesize Feedback**
Combine insights from both AIs to create actionable improvements.

### Workflow 2: Security-Focused Review

```bash
# Gemini: Broad security scan
mcp__gemini-cli__ask-gemini \
  prompt="@app/api/**/route.ts @lib/auth.ts @lib/staff-session.ts \
Security audit focusing on:
- Authentication bypasses
- Authorization gaps
- SQL/NoSQL injection
- XSS vulnerabilities
- CSRF protection
- Rate limiting
- Sensitive data exposure" \
  model="gemini-3-pro-preview"

# Codex: Deep security analysis
mcp__codex__codex \
  prompt="Security review: [paste specific endpoint code] \
Check for OWASP Top 10 vulnerabilities and provide fixes." \
  model="gpt-5.1-codex-max"
```

### Workflow 3: Performance Review

```bash
# Gemini: Find performance patterns
mcp__gemini-cli__ask-gemini \
  prompt="@lib/services/**/*.ts @app/api/**/*.ts \
Performance analysis:
- N+1 query patterns
- Missing database indexes
- Unnecessary data fetching
- Blocking operations
- Memory leaks
- Cache opportunities" \
  model="gemini-3-pro-preview"

# Codex: Optimization suggestions
mcp__codex__codex \
  prompt="Optimize this code for performance: [paste code] \
Provide optimized version with explanations." \
  model="gpt-5.1-codex-max"
```

### Workflow 4: Architecture Review

```bash
# Gemini: Architectural analysis
mcp__gemini-cli__ask-gemini \
  prompt="@lib/**/*.ts @app/api/**/*.ts \
Architecture review:
- Separation of concerns
- SOLID principles adherence
- Dependency management
- Error propagation patterns
- Service layer design
- Database access patterns" \
  model="gemini-3-pro-preview"

# Codex: Design improvement suggestions
mcp__codex__codex \
  prompt="Review this architecture and suggest improvements: \
[describe current architecture] \
Focus on scalability and maintainability." \
  model="gpt-5.1-codex-max"
```

## Review Templates

### Template 1: Feature Implementation Review

```
GEMINI PROMPT:
@[feature-files]
Review this new feature implementation:
1. Does it follow existing patterns in the codebase?
2. Is error handling complete?
3. Are there any security concerns?
4. Is it properly typed?
5. Does it handle edge cases?

CODEX PROMPT:
Review this feature implementation for logic correctness:
[paste main feature code]
1. Are there any logical bugs?
2. What test cases should cover this?
3. Any improvements for readability?
```

### Template 2: Bug Fix Review

```
GEMINI PROMPT:
@[affected-files]
Verify this bug fix:
1. Does it address the root cause?
2. Could it introduce regressions?
3. Are related areas affected?

CODEX PROMPT:
Analyze this bug fix:
Before: [old code]
After: [new code]
1. Is the fix correct?
2. Are there edge cases not covered?
3. Better alternatives?
```

### Template 3: Refactoring Review

```
GEMINI PROMPT:
@[refactored-files]
Review this refactoring:
1. Does behavior remain unchanged?
2. Is the new structure better?
3. Any breaking changes?

CODEX PROMPT:
Compare refactored code:
Original: [old code]
Refactored: [new code]
1. Functional equivalence check
2. Improvement assessment
3. Risk analysis
```

## Output Format

### Gemini Output Structure

```markdown
## Code Review Summary

### Critical Issues (Must Fix)

1. [Issue description] - file:line
   - Impact: [severity]
   - Recommendation: [fix]

### Warnings (Should Fix)

1. [Issue description] - file:line

### Suggestions (Nice to Have)

1. [Improvement idea]

### Positive Notes

1. [What was done well]
```

### Codex Output Structure

````markdown
## Detailed Analysis

### Logic Verification

- [Analysis of code logic]

### Suggested Improvements

```typescript
// Before
[original code]

// After (improved)
[improved code]
```
````

### Test Cases Recommended

1. [Test case description]
2. [Test case description]

### Alternative Approaches

[If applicable, alternative implementation ideas]

````

## Integration with Claude Code

### Automatic Review Trigger
When Claude Code completes a task, invoke this skill:

```typescript
// After completing implementation
const geminiReview = await mcp__gemini-cli__ask-gemini({
  prompt: `@[changed-files] Review Claude's implementation for quality and improvements`,
  model: "gemini-3-pro-preview"
});

const codexReview = await mcp__codex__codex({
  prompt: `Review and improve: ${codeChanges}`,
  model: "gpt-5.1-codex-max"
});

// Claude applies improvements based on feedback
````

### Review Checklist

Before requesting AI review, ensure:

- [ ] All files are saved
- [ ] Code compiles without errors
- [ ] Basic tests pass
- [ ] Clear description of changes available

## Best Practices

### DO:

- Use Gemini for broad codebase analysis (many files)
- Use Codex for deep single-file analysis
- Combine both perspectives for comprehensive review
- Run reviews before committing to main branch
- Include context about what the code should do
- Save review outputs for documentation

### DON'T:

- Skip reviews for "small" changes (bugs hide everywhere)
- Ignore security warnings
- Apply suggestions blindly - verify they make sense
- Use reviews as substitute for testing
- Forget to review tests themselves

## Example Review Session

```bash
# 1. Claude implements a new API endpoint
# [Claude creates app/api/appointments/route.ts]

# 2. Invoke Gemini for broad analysis
mcp__gemini-cli__ask-gemini \
  prompt="@app/api/appointments/route.ts @lib/auth.ts \
Review this new appointments API:
- Security: auth, validation, rate limiting
- Error handling: all cases covered?
- Performance: efficient queries?
- Mawidi patterns: follows existing conventions?" \
  model="gemini-3-pro-preview"

# 3. Invoke Codex for detailed improvements
mcp__codex__codex \
  prompt="Improve this appointments API endpoint: \
[paste route.ts content] \
Focus on: error messages, edge cases, TypeScript types" \
  model="gpt-5.1-codex-max"

# 4. Claude applies improvements from both reviews
# [Claude updates the code based on feedback]

# 5. Final verification
mcp__gemini-cli__ask-gemini \
  prompt="@app/api/appointments/route.ts \
Final check: Is this production-ready?" \
  model="gemini-3-pro-preview"
```

## Mawidi-Specific Review Points

When reviewing Mawidi code, always check:

1. **Dual Database Sync**
   - Uses `saveToBothDatabases()` for write operations
   - Consistent between Prisma and Supabase

2. **i18n Compliance**
   - All UI text has Arabic/English translations
   - RTL/LTR handling correct

3. **Authentication**
   - User routes use `auth()` from `@/lib/auth`
   - Staff routes use `validateStaffSession()`

4. **Error Handling**
   - Uses `createApiResponse()` for consistent responses
   - Proper error codes and messages

5. **Rate Limiting**
   - Sensitive endpoints have rate limiting
   - Uses `rateLimit()` from `@/lib/rate-limiter`

## Troubleshooting

### Gemini Issues

- **Timeout:** Use smaller file sets, add `--model gemini-2.5-flash` for quicker response
- **Context exceeded:** Split analysis into multiple queries

### Codex Issues

- **No response:** Check model name is correct (`gpt-5.1-codex-max`)
- **Incomplete:** Use follow-up with `codex-reply` for continuation

## Quick Reference

| Task                    | Tool           | Model                |
| ----------------------- | -------------- | -------------------- |
| Full codebase scan      | Gemini         | gemini-3-pro-preview |
| Single file deep review | Codex          | gpt-5.1-codex-max    |
| Security audit          | Gemini + Codex | Both                 |
| Performance analysis    | Gemini         | gemini-3-pro-preview |
| Logic verification      | Codex          | gpt-5.1-codex-max    |
| Architecture review     | Gemini         | gemini-3-pro-preview |
| Improvement suggestions | Codex          | gpt-5.1-codex-max    |

---

**Last Updated:** 2025-12-10
**Models:** gemini-3-pro-preview, gpt-5.1-codex-max
**Purpose:** Multi-AI code review for quality assurance
