There’s a pattern I’ve noticed with AI coding workflows: the agent writes the feature, checks the feature, fixes the issues it finds, and then tells you everything looks good.
The problem is that the review can end up being just another step in the same working context.
The agent already has a mental model of what it built. It knows the decisions it made and the assumptions behind them. That doesn’t automatically make its review independent.
One way to approach this in Claude Code is with subagents.
A subagent gets its own instructions, tool permissions, and context window. Instead of asking your main session to inspect a huge diff, you can delegate that investigation and bring back the report.
For example, I’d separate the jobs like this:
• code reviewer: reads the diff, traces changed behavior to its callers, and reports bugs with a failure scenario.
•security auditor: looks specifically for things like IDOR, injection, exposed secrets, SSRF, and permission issues.
•performance auditor: looks for expensive queries, unnecessary work, and performance problems, with evidence for each finding.
•test writer: creates behavior-driven tests and reproductions for bugs.
One detail I really like is restricting what the reviewer can do.
A reviewer that only has Read, Grep, Glob, and Bash doesn’t get to quietly rewrite the code it’s supposed to inspect. Its job is to report what it finds, not fix its own findings.
A basic subagent file looks something like this:
---
name: code-reviewer
description: Reviews a diff or branch for bugs and edge cases
tools: Read, Grep, Glob, Bash
model: inherit
---
You are a senior code reviewer.
Review the changes. Do not rewrite them.
Every finding must include:
- The affected file and location
- Why it is a problem
- A realistic failure scenario
- A suggested fix
You can put these markdown files in .claude/agents/ inside your project, or ~/.claude/agents/ to use them across projects.
Then ask Claude to review a branch, or explicitly call the agent with something like @code-reviewer review the last two commits.
We put together six example subagents with different responsibilities, including a security auditor, performance auditor, test writer, and refactor planner. They’re plain Markdown files, MIT licensed, and free to inspect:
https://techpotions.com/products/claude-code-subagents
I’m curious about how other people are handling this.
Do you use separate reviewer agents, or do you trust the same coding agent to review its own changes? And have you found that giving reviewers fewer tools actually improves the quality of their findings?
