Claude Code Reviewer: Magento 2 PR Review Sub-Agent
Paste code. Get a Magento-aware review in real time.
A Python sidecar (FastAPI) running next to Magento on the private docker network checks your snippet against 15 Magento-specific rules: ObjectManager misuse, raw SQL, vendor edits, SQL-injection vectors, plain die() calls. The traffic never leaves your stack.
That looks like plain text rather than Magento code. Paste a real PHP / phtml / XML snippet (or click a sample on the left) to get a Magento-aware review.
No findings: your snippet matches all 15 Magento-flavoured guardrails.
Paste code or click a sample. Auto-review fires 700ms after you stop typing.
Source: python/app.py, python/lint_rules.py, app/code/Panth/ClaudeBridge/. Run docker compose up -d python to start the sidecar locally.
Keep going
- Learning paths Backend, Hyvä, DevOps, architect: pick the path that matches your role.
- Magento playground Safe sandbox recipes for plugins, observers, GraphQL, and UI components.
- Module anatomy Every Magento 2 module file, mapped and explained.
- Glossary 80+ Magento and Claude Code terms, defined without jargon.
- Recipes cookbook Copy-paste recipes that turn one prompt into shippable Magento code.
- Prompt engineering Write prompts that produce Marketplace-pass Magento code.
- Anti-patterns Twelve ways AI-paired Magento work goes wrong, and the fixes.
- CLI sandbox Run Claude Code on Magento safely with Docker, hooks, and allowlists.
- Slash-commands Production slash-commands for Magento 2 workflows.
- 30-day roadmap Day-by-day plan to ship a Magento module with Claude Code.
Common questions
What does the code-reviewer sub-agent actually check on a Magento PR?
Six layers. (1) Style: phpcs --standard=Magento2 on changed files. (2) Static analysis: phpstan --level=6. (3) EQP: no ObjectManager in non-setup code, no vendor edits, plugins over preferences, service contracts over direct model access, _isAllowed() on every admin controller. (4) Security: SQL concatenation, unescaped phtml output, missing CSRF, hardcoded secrets. (5) Performance: n+1 queries (look for ->load() in a foreach), missing indexes on new db_schema.xml tables, missing cache tags on blocks. (6) Marketplace: composer.json license, README presence, no GPL deps. Output is a categorised Markdown report, same shape as a GitHub review comment.
How do I invoke the reviewer mid-PR?
From inside Claude Code: /review or explicitly Task tool with subagent_type: code-reviewer and the diff URL or branch name. From CI: a GitHub Action that runs claude code -p "review this diff: $DIFF" --agent code-reviewer and posts the output as a PR comment. The agent reads the diff, the changed files in full context, and your CLAUDE.md, it does not read the entire repo, which keeps the cost predictable. Typical run: 30-60 seconds for a small PR (1-5 files), 2-3 minutes for a large one (20+ files).
How do I deal with false positives from the reviewer?
Treat the reviewer's report as a draft, not a verdict. Three calibration moves. (1) Add a ## Project conventions section to your CLAUDE.md listing exceptions ("ObjectManager is allowed in Test/Unit, mocks need it"). (2) For repeated false positives, add an .claude/agents/code-reviewer.md override that explicitly mentions the convention. (3) If a finding is genuinely wrong, reply in-thread, the reviewer will adjust within the session. After two weeks of use, the false-positive rate is < 5%; on day 1 it'll be 20%. Patience pays.
Can it actually predict Marketplace tech-review failures?
About 80% of them, yes, the deterministic ones. Things it catches reliably: vendor edits, raw SQL, deprecated APIs (anything in @deprecated blocks across vendor/magento/*), missing service contracts, hardcoded URLs, missing translations on user-facing strings, missing composer.json dependencies, license file mismatches. Things it can't predict: subjective UX issues, regional compliance flags (GDPR, ADA), and Marketplace-listing copy. For those you still need a human reviewer (hire one). But shipping a PR with zero deterministic findings means the human review is fast and pleasant instead of soul-crushing.
How do I extend the reviewer with my own org-specific rules?
Edit .claude/agents/code-reviewer.md. Add a ## Org-specific rules section with concrete prohibitions: "No new dependencies in composer.json without architecture-team approval. All new admin controllers must extend Vendor\Common\Controller\Adminhtml\Base. All new emails must use the Vendor_Email template loader, not Magento_Email." The agent treats these the same as the built-in EQP rules. For pattern-based rules (regex matches) that the model would miss, add a PostToolUse hook that runs a literal grep and feeds findings back. Treat the code-reviewer.md file as living documentation, it is the source of truth for what "shippable" means in your org.
Send a brief. Get a written quote in 24 hours.
Two paragraphs is enough: scope, price and timeline come back in writing.