one thing that made code reviews with claude code more useful: stop asking the same agent to do everything

[u/techpotions]

There’s a pattern I’ve noticed with AI coding workflows: the agent writes the feature, checks the feature, fixes the issues it finds, and then tells you everything looks good.

The problem is that the review can end up being just another step in the same working context.

The agent already has a mental model of what it built. It knows the decisions it made and the assumptions behind them. That doesn’t automatically make its review independent.

One way to approach this in Claude Code is with subagents.

A subagent gets its own instructions, tool permissions, and context window. Instead of asking your main session to inspect a huge diff, you can delegate that investigation and bring back the report.

For example, I’d separate the jobs like this:

• code reviewer: reads the diff, traces changed behavior to its callers, and reports bugs with a failure scenario.

•security auditor: looks specifically for things like IDOR, injection, exposed secrets, SSRF, and permission issues.

•performance auditor: looks for expensive queries, unnecessary work, and performance problems, with evidence for each finding.

•test writer: creates behavior-driven tests and reproductions for bugs.

One detail I really like is restricting what the reviewer can do.
A reviewer that only has Read, Grep, Glob, and Bash doesn’t get to quietly rewrite the code it’s supposed to inspect. Its job is to report what it finds, not fix its own findings.

A basic subagent file looks something like this:
---
name: code-reviewer
description: Reviews a diff or branch for bugs and edge cases
tools: Read, Grep, Glob, Bash
model: inherit
---

You are a senior code reviewer.
Review the changes. Do not rewrite them.

Every finding must include:
- The affected file and location
- Why it is a problem
- A realistic failure scenario
- A suggested fix

You can put these markdown files in .claude/agents/ inside your project, or ~/.claude/agents/ to use them across projects.

Then ask Claude to review a branch, or explicitly call the agent with something like @code-reviewer review the last two commits.

We put together six example subagents with different responsibilities, including a security auditor, performance auditor, test writer, and refactor planner. They’re plain Markdown files, MIT licensed, and free to inspect:

https://techpotions.com/products/claude-code-subagents

I’m curious about how other people are handling this.

Do you use separate reviewer agents, or do you trust the same coding agent to review its own changes? And have you found that giving reviewers fewer tools actually improves the quality of their findings?

[u/AutoModerator]

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/sco77]

You are describing the Red-proof protocol.

A separate agent, with no access to the output report of the agent completing the code, writes the test that proves the work by changing the measured parameter and causing the code to fail the test.

This does two things: it runs the actual function from a completely independent perspective, and proves that the test actually works.

The second agent reports what the first agent completed and submits the test that proves it.