Review Guard

# ReviewGuard — AI-Powered Code Review and Security Assistant Small teams ship code without the safety net that larger engineering organizations take for granted: a dedicated security reviewer, a performance specialist, a test-coverage owner, and enough reviewer bandwidth to actually read every diff carefully. In practice, this means the most common and best-understood failure modes — hardcoded secrets, SQL injection, unhandled exceptions, untested critical paths, quadratic loops hiding in plain sight — slip through silently, not because anyone is careless, but because no one has the time to look for all of them, every time, on every pull request. ReviewGuard was built to close that gap. ReviewGuard is an AI-powered code review and security assistant built for the IBM Bob Hackathon, designed to review a Git diff or pull request the way a five-person senior review panel would, in a fraction of the time a single human reviewer needs. Rather than relying on one large language model prompt trying to hold every kind of code quality concern in its head at once, ReviewGuard dispatches five specialized, isolated subagents in parallel — Security, Correctness, Performance, Testing, and Maintainability — each scoped narrowly to one category of defect. This isolation is deliberate: keeping each subagent's context independent prevents one agent's framing of an issue from suppressing another agent's independent read of the same code, so a line that is simultaneously a missing-validation bug and a security risk gets flagged by both perspectives rather than getting collapsed into whichever framing happened to run first. Before any of the five subagents run, a deterministic pre-pass using tools like Semgrep and Gitleaks scans the diff for pattern-matchable signals — hardcoded API keys, string-concatenated SQL, known-insecure function calls — so the Security subagent starts with a head start rather than a blank page, and the system doesn't burn AI reasoning on the kind of detection a regex already handles reliably. Once all five subagents return their structured findings, a deterministic aggregation step merges overlapping or duplicate warnings into single entries, resolves severity conflicts by taking the higher of two disagreeing assessments, and produces one clean, ranked list instead of five overlapping reports a developer would have to reconcile by hand. What sets ReviewGuard apart from a typical AI code-review bot is that it doesn't stop at describing a problem. For every finding at Medium severity or above, a dedicated Patch Generator subagent writes a concrete, minimal patch — not a full-file rewrite, but a targeted fix scoped to the specific issue. That patch is then applied in an isolated sandbox, and a Test Runner subagent runs the project's existing test suite against it, along with any newly generated tests for previously uncovered functions. Only patches that pass this verification step are marked "Verified" in the final report — closing the loop from finding to fix to confirmation, rather than leaving a developer to trust an untested suggestion. The end result is a single, severity-ranked report — Critical, High, Medium, Low, Info — complete with plain-language explanations, file and line references, confidence scores, and tested patches, delivered as a PR comment and a persistent dashboard entry in under five minutes, compared to the roughly thirty minutes a manual review typically takes with inconsistent depth and no structured record. ReviewGuard is built natively as an IBM Bob workflow, combining Bob's parallel subagent dispatch with deterministic pipeline steps wherever reasoning isn't required, making it a practical example of how agentic tooling can give small teams a reviewing capability they'd otherwise need a much larger headcount to afford.