Codex Code Avengers

Turn Codex into a six-role code review superteam.

Codex Code Avengers does not ask one agent to scan a diff and generate a generic checklist. NICK FURY assembles five visible Codex SubAgents, gives each one an independent review dimension, and makes them challenge one another before a finding reaches the final report.

The project remains read-only. The Avengers review the evidence; they do not silently rewrite your code.

Quick start

npx --yes codex-code-avengers@latest

Then review the entire repository:

Use $codex-code-avengers to perform a full code review of this repository.

Or review only the current changes:

Use $codex-code-avengers to review my current changes before I merge them.

Assemble the Avengers

| Avenger | Review role | What they investigate | |---|---|---| | NICK FURY | Review Commander | Scope, coordination, evidence quality, duplicate findings, and final verdict | | IRON MAN | Architecture Reviewer | Architecture, coupling, data flow, APIs, compatibility, and technical debt | | CAPTAIN AMERICA | Quality Reviewer | Correctness, contracts, maintainability, error handling, and test quality | | BLACK WIDOW | Security Reviewer | Authentication, permissions, trust boundaries, secrets, privacy, and abuse paths | | HULK | Adversarial Tester | Reproduction, malformed inputs, regressions, concurrency, and negative paths | | THOR | Reliability Reviewer | Performance, resources, retries, timeouts, resilience, and production failures |

All six roles run on Codex. No external model is required.

Five review modes

Pull request or diff review

Reviews uncommitted changes, staged files, commits, branches, or pull requests against the actual merge base. It also inspects affected callers, consumers, contracts, and tests outside the changed lines.

Full repository review

Maps the repository, ranks subsystems by risk, and reviews entry points, trust boundaries, stateful workflows, external integrations, storage, tests, configuration, and failure paths. Large repositories receive an honest coverage map instead of a fake claim that every line was reviewed equally.

Targeted review

Reviews a named feature, directory, file set, subsystem, or user journey while following the dependencies needed to understand its behavior.

Pre-release review

Evaluates whether the current release is safe to ship: tests, compatibility, migrations, permissions, data loss, rollback, monitoring, and production failure risk.

Risk review

Deepens one dimension such as security, performance, reliability, correctness, or maintainability while keeping the other Avengers active as independent challengers.

They do not merely divide the files

The Avengers communicate directly and cross-examine material findings:

flowchart TD
    U["You"] <--> F["NICK FURY"]
    F --> I["IRON MAN"]
    F --> C["CAPTAIN AMERICA"]
    F --> B["BLACK WIDOW"]
    F --> H["HULK"]
    F --> T["THOR"]
    I <--> C
    I <--> T
    C <--> H
    B <--> H
    B <--> T
    H -->|"Runtime evidence"| I
    H -->|"Runtime evidence"| C
    H -->|"Exploit evidence"| B

Examples:

• BLACK WIDOW traces a possible authorization bypass and asks HULK to reproduce it.
• CAPTAIN AMERICA finds a contract violation and HULK checks whether real input reaches it.
• THOR proposes a performance risk and IRON MAN verifies whether another architectural layer already bounds it.
• A candidate that does not survive the challenge is marked DISMISSED, not presented as a defect.

Evidence before severity

Every material finding includes:

• stable ID, severity, state, owner, and independent verifier;
• exact file and line;
• reachable behavior and real impact;
• repository-specific evidence;
• reproduction or an explicit execution limitation;
• minimal outcome-focused correction.

Finding states:

CANDIDATE → VERIFIED | SUPPORTED | UNVERIFIED | DISMISSED

Only verified and supported findings drive the verdict. False positives worth explaining remain visible in a separate ledger.

Final verdict

NICK FURY issues exactly one decision:

MERGE
MERGE_WITH_WARNINGS
CHANGES_REQUIRED
BLOCK

For a repository-wide review, the verdict represents readiness within the stated coverage—not a claim that the project is magically bug-free.

Native Codex report

The final result is one Markdown file that opens directly in Codex:

outputs/<review>-codex-code-avengers-report.md

It contains:

• NICK FURY's verdict and confidence;
• scope and coverage map;
• strengths worth preserving;
• verified, supported, and unverified findings;
• dismissed false positives;
• exact commands and results;
• direct cross-examination ledger;
• prioritized remediation plan;
• one recommended next move.

See the synthetic demo report for the complete format.

More prompts

Use $codex-code-avengers to review this pull request against main.

Use $codex-code-avengers to review the authentication system for security risks.

Use $codex-code-avengers to decide whether this repository is ready for release.

Use $codex-code-avengers to review src/payments and its callers for correctness and reliability.

Important limitations

• Multi-agent review uses more time and tokens than a normal single-agent review.
• The Avengers may run in visible waves because Codex concurrency varies by environment.
• Read-only boundaries are workflow rules unless the host provides hard filesystem isolation.
• Safe tests may create incidental caches or temporary outputs; the skill records rather than hides them.
• Review quality depends on the available code, tests, environment, and contracts.
• No static or dynamic review can guarantee that software is completely defect-free or secure.

Development

npm run demo
npm test

License

MIT