openai-review

Cross-model code review: OpenAI provides "fresh eyes" on Claude Code changes.

Advisory only - never blocking. Focuses on objective issues (bugs, security, edge cases), not style preferences.

Installation

cd ~/.claude/mcp-servers/openai-review
pnpm install
pnpm build

Configuration

Set your OpenAI API key via your shell profile or a secrets manager — never commit real keys:

# Add to ~/.bashrc, ~/.zshrc, or use a secrets manager (e.g., 1Password CLI, direnv)
export OPENAI_API_KEY="<your-key-here>"

Optional environment variables:

| Variable | Default | Description | |----------|---------|-------------| | OPENAI_MODEL | gpt-4o | Model to use | | OPENAI_MAX_TOKENS | 4096 | Response limit | | OPENAI_TIMEOUT | 60000 | Request timeout (ms) | | OPENAI_MAX_DIFF_CHARS | 50000 | Max diff size |

Usage

CLI

# Review staged changes
npx openai-review --staged

# Review specific files
npx openai-review src/auth.ts src/api.ts

# Review from stdin
git diff HEAD~3 | npx openai-review --stdin

# JSON output
npx openai-review --staged --json

MCP Server

Add to your .mcp.json:

{
  "mcpServers": {
    "openai-review": {
      "command": "node",
      "args": ["~/.claude/mcp-servers/openai-review/dist/mcp/server.js"],
      "env": {
        "OPENAI_API_KEY": "${OPENAI_API_KEY}"
      }
    }
  }
}

Available tools:

• review_staged - Review all staged git changes
• review_diff - Review arbitrary diff string
• review_files - Review specific files

Hooks

Add to your ~/.claude/settings.json:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "node ~/.claude/mcp-servers/openai-review/dist/cli/review-hook.js"
          }
        ]
      }
    ],
    "Stop": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "node ~/.claude/mcp-servers/openai-review/dist/cli/review-hook.js"
          }
        ]
      }
    ]
  }
}

What It Reviews

Focus areas:

• Bugs: logic errors, null handling, off-by-one, race conditions
• Security: injection, XSS, CSRF, hardcoded secrets
• Edge cases: empty inputs, error handling, concurrency
• Performance: N+1 queries, memory leaks (obvious only)

Ignores:

• Style preferences
• Naming conventions
• Formatting
• Architecture opinions (unless critical)

Response Format

interface ReviewResult {
  findings: Array<{
    severity: 'critical' | 'high' | 'medium' | 'low' | 'info';
    category: 'bug' | 'security' | 'edge-case' | 'performance';
    file?: string;
    line?: number;
    description: string;
    suggestion?: string;
  }>;
  summary: string;
  reviewedAt: string;
}

Error Handling

• Never blocks on failure - API errors continue silently
• Large diffs truncated at 50k chars
• Timeout after 60s by default

License

MIT