How do you build an AI agent for automated code review?

An AI code review agent combines static analysis with LLM-powered semantic understanding. Architecture: trigger on pull request events (GitHub webhook), fetch the diff, run static analysis tools (ESLint, Pylint, SonarQube) for rule-based checks, then use an LLM to review for logic errors, security vulnerabilities, performance issues, and coding standards violations. Implementation: parse the diff into file-level changes, provide each file with its surrounding context (imports, related files), prompt the LLM with coding standards and review guidelines, and generate inline comments on specific lines. Multi-pass review: first pass checks for security issues (SQL injection, XSS, hardcoded secrets), second pass evaluates logic and correctness, third pass assesses code style and maintainability, and fourth pass checks test coverage adequacy. Agent tools: file reader (access full file context beyond the diff), dependency checker (verify package vulnerabilities), test runner (execute related tests), and documentation checker (verify API documentation updates). Output: structured review comments with severity levels, suggested code fixes, and links to relevant documentation or best practices. Integration: post comments via GitHub/GitLab API, update PR status checks, and aggregate metrics (issues found per PR, false positive rate, developer acceptance rate of suggestions).