Review

Nothing breaks in production. Review is the Frontier Investigation Agent for code changes: an AI reviewer for your pull requests (PRs) and merge requests (MRs). When someone opens one, CloudThinker reads the change, posts a summary comment and inline findings on it, and checks the fix when you push again. A linter matches patterns. Review reads what the change is trying to do: the diff, the linked ticket, your team’s convention files and, if you keep one, a BUSINESS.md that describes the rules your product must keep. That lets it flag a broken business rule or a risky migration, not only a style slip.

How it works

When a PR or MR opens, the Git provider sends CloudThinker an event; CloudThinker gathers the diff, linked ticket and repository files, runs the review, and posts a summary and inline comments on the PR, and each new push gets an incremental review. — Every PR or MR gets a review posted back on it, and each new push gets an incremental review.

A PR or MR opens. You connect your Git provider and pick repositories once, and after that your provider sends CloudThinker an event whenever a PR or MR opens, with nobody starting a review. Draft PRs and MRs are skipped until they’re marked ready for review.
CloudThinker gathers context. It checks out the change and reads the diff, a ticket linked from the description (Jira, Linear, Backlog or a provider issue, once you add an extension), and the files listed in What Review reads.
The review runs. Depth depends on the workspace review mode: Fast, Auto or Advanced. Each review uses credits; see usage and credits.
Findings land on the PR. You get one summary comment plus inline comments. Each finding has a severity (Critical, High, Medium or Low) and a suggested fix.
New pushes get an incremental review. Only the commits pushed since the last review are read, and the review checks whether earlier findings were fixed.

The most severe unresolved finding sets the review’s verdict, and a run that never finished or was skipped gets a status of its own instead. The verdict is CloudThinker’s label on the change, and your provider’s branch rules still decide whether it can merge. See verdicts for all seven and what each one asks of you.

CloudThinker keeps its own copy of each selected repository to read it, and deletes those copies when you click Remove setup. Secrets in tool output are replaced with placeholders before the model sees them; see data protection.

Changed test files, fixtures and test data, snapshots, generated code, Storybook stories, prototypes, HTML under docs/ and vendored Jsonnet aren’t reviewed: no finding is ever placed in one.

Full list of skipped path patterns

**/test_*.py              **/conftest.py              **/*_test.go
**/src/test/java/**/*.java                            **/src/test/**/*.{kt,kts}
**/*.test.{js,jsx,ts,tsx} **/*.spec.{js,jsx,ts,tsx}   **/__tests__/**
**/test/**/*_test.py      **/tests/**/*_test.py       **/*_test.py
**/*_spec.rb              **/spec/**/*_spec.rb        **/*Test.java
**/*Tests.java            **/*_test.rs                **/oh_modules/**
**/*.test.ets             **/test/**/*.jl             **/test/**/*.hs
**/*Spec.hs               **/test/**/*.lhs            **/*Spec.lhs
**/tests/**/*.nim         **/tests/**/*.R             **/__snapshots__/**
**/*.snap                 **/testdata/**              **/fixtures/**
**/.ipynb_checkpoints/**  **/*.generated.*            **/*.gen.go
**/*.pb.go                **/*.pb.cc                  **/*.pb.h
**/*Test.swift            **/*Tests.swift             **/Tests/**/*.swift
**/tests/**/*.elm         **/vendor/**/*.{jsonnet,libsonnet}
**/test/**/*.zig          **/*_test.zig               **/kitex_gen/**/*.go
**/*.capnp.h              **/*.capnp.go               **/*.capnp.ts
**/*_capnp.rs             **/*_capnp.py               **/test/**/*.ml
**/tb_*.{v,sv,vhd,vhdl}   **/*_tb.{v,sv,vhd,vhdl}     lib/**/*.sol
**/*.t.sol                **/test/**/*.sol            **/tests/**/*.sol
**/test/**/*.vy           **/tests/**/*.vy            **/*.stories.{js,jsx,ts,tsx,mdx}
**/prototypes/**          **/docs/**/*.html

Matching is by file path only, against this built-in list that you can’t add to. For the paths this catches by surprise, see findings are wrong or noisy.

What Review reads

Besides the diff, Review reads your team’s own knowledge. All of it is optional, and it makes every review sharper over time.

File	Where it goes	What it does
`BUSINESS.md`	Repository root, on the target branch	Describes your product’s modules and the rules (invariants) they must keep. Business flow findings come from it. Read whenever it exists: it doesn’t depend on Repository conventions
Convention files	`AGENTS.md`, `CLAUDE.md`, `CONVENTIONS.md` and the rule files of coding agents such as Cursor or Copilot, in the repository root or any folder	Coding conventions Review follows, when Repository conventions is on. Every path it recognizes
Learnings	Kept by CloudThinker for each repository, no file needed	Rules CloudThinker learns from the findings your team resolved. Review applies them to every new review, so the same mistake gets caught the next time

You write BUSINESS.md by hand in a short, fixed format: see Business flow checks. If the file doesn’t parse, the review still runs without it.

What it checks

Each finding carries one category.

Category	What it catches	Example
Security	Injection, exposed secrets, unsafe auth or permissions	A query built from request input without parameters
Correctness	Logic errors, null handling, race conditions	A lost update when two requests write the same row
Performance	Slow queries, N+1 loops, blocking calls	A full table scan inside a request handler
Pattern	Breaks a convention your repository already follows	A new handler that skips the shared error wrapper
Deploy, migration, backward compatibility	Changes that break a rollout or existing clients	A migration that drops a column the current release still reads
Test gap	Changed behavior that no test covers	A new error path with no test, in a PR that adds none
Business flow	A change that breaks a rule in your `BUSINESS.md`	Code that lets a trial account use a feature an invariant reserves for paid plans

What you can do

Capability	What you get	Learn more
Automatic review	A summary and inline findings on every new PR or MR	Set up Review
Follow a walkthrough	One pull request that would break production: the finding, how you check it, and the fix before the merge	Catch a risky pull request with Review
Overview dashboard	Find changes waiting on you and check review activity	Review Dashboard
Codebase Atlas	See what your team merged, where it landed and what needs attention	Codebase Atlas
Ultra review	A deeper review that posts only verified bugs worth fixing, started with one comment	Ultra review
UI Review: Loupe	Screenshots of the pages a change touches, checked in your running app before merge	UI Review: Loupe
Business flow checks	Findings when a change breaks a pricing, entitlement or money rule you describe	Business flow checks
Personalization	Set summary sections, tone and language for your team	Review Personalization
Repository management	Control Review, Atlas mapping and Learnings per repository	Manage Review Repositories
Review workspace	Every reviewed change, its findings and status, in CloudThinker	Review workspace
Mention commands	Ask a question, re-run a review or fix findings with `@cloudthinker-ai` in a PR comment	Mention commands
Learnings	Recurring patterns from resolved findings, applied to future reviews	Learnings
Pipeline analysis	An explanation and suggested fix for each failed CI run	Pipeline Analysis
Auto-resolve conflicts	A follow-up MR/PR that resolves merge conflicts on an open MR/PR. Not on Azure DevOps	Auto-resolve conflicts
Release Risk	One ship-or-block verdict on every release tag, shared with the team, and a deploy that waits on blockers	Release Risk
Insights	Which finding categories hit your team, and how fast they get fixed	Insights
Troubleshooting	Why a review didn’t post, stopped or was skipped, with the cause, the check and the fix	Review troubleshooting

Supported providers

GitHub, GitLab (GitLab.com or self-hosted), Bitbucket Cloud, Azure DevOps and AWS CodeCommit. See provider authentication for what each one needs. Check these limits before you plan a rollout:

One provider and one Azure DevOps project per workspace. A second provider, or repositories in a second Azure DevOps project, need their own workspace.
Self-hosted GitLab is the only instance URL you can enter. GitHub Enterprise Server and Bitbucket Data Center aren’t options, and a CodeCommit connection covers one AWS account and region.

Automatic reviews run on all five providers. The actions on top of them don’t:

Comment commands with @cloudthinker-ai differ by provider, and AWS CodeCommit takes top-level questions only. See provider support.
Apply fix is listed per provider in Work the findings; Fix all findings and Merge in Re-run, fix, and merge.
Auto-resolve conflicts works on every provider except Azure DevOps.

Two pieces of text look alike but go in different places: @cloudthinker-ai in a comment asks a question, a re-review or a fix, while @cloudthinker:ignore in the description skips the review on that one change. See mention commands.

Get started

Set up

Use Review

Insights and help

How it works

What Review reads

What it checks

What you can do

Supported providers

Get started

Set up Review

Provider authentication

​How it works

​What Review reads

​What it checks

​What you can do

​Supported providers

​Get started

Set up Review

Provider authentication

How it works

What Review reads

What it checks

What you can do

Supported providers

Get started