[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-94652":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":9,"totalLinesOfCode":9,"stars":12,"forks":13,"watchers":14,"openIssues":14,"contributorsCount":9,"subscribersCount":14,"size":14,"stars1d":14,"stars7d":14,"stars30d":14,"stars90d":14,"forks30d":14,"starsTrendScore":14,"compositeScore":15,"rankGlobal":9,"rankLanguage":9,"license":9,"archived":16,"fork":16,"defaultBranch":17,"hasWiki":16,"hasPages":16,"topics":9,"createdAt":9,"pushedAt":9,"updatedAt":18,"readmeContent":19,"aiSummary":20,"trendingCount":14,"starSnapshotCount":14,"syncStatus":21,"lastSyncTime":9,"discoverSource":22},94652,"pr-af","Agent-Field\u002Fpr-af","Agent-Field","#1 open-source code reviewer on Code-Review-Bench",null,"https:\u002F\u002Fgithub.com\u002FAgent-Field\u002Fpr-af","Go",498,51,0,42.15,false,"main","2026-08-24 04:01:22","\u003Cdiv align=\"center\">\n\n# PR-AF\n\n### Open-Source Agentic Code Review Built on [AgentField](https:\u002F\u002Fgithub.com\u002FAgent-Field\u002Fagentfield)\n\n[![Apache 2.0](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FLicense-Apache%202.0-16a34a?style=for-the-badge)](LICENSE)\n[![Deploy on Railway](https:\u002F\u002Frailway.com\u002Fbutton.svg)](https:\u002F\u002Frailway.com\u002Fdeploy\u002Fpr-af)\n[![Built with AgentField](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FBuilt%20with-AgentField-0A66C2?style=for-the-badge)](https:\u002F\u002Fgithub.com\u002FAgent-Field\u002Fagentfield)\n[![More from Agent-Field](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FMore_from-Agent--Field-111827?style=for-the-badge&logo=github)](https:\u002F\u002Fgithub.com\u002FAgent-Field)\n\n\u003Cp>\n  \u003Ca href=\"#benchmark-position\">Benchmark\u003C\u002Fa> •\n  \u003Ca href=\"#one-call-dx\">One-Call DX\u003C\u002Fa> •\n  \u003Ca href=\"#how-it-works\">How It Works\u003C\u002Fa> •\n  \u003Ca href=\"#ecosystem-comparison\">Comparison\u003C\u002Fa> •\n  \u003Ca href=\"#quick-start\">Quick Start\u003C\u002Fa> •\n  \u003Ca href=\"docs\u002FARCHITECTURE.md\">Architecture\u003C\u002Fa>\n\u003C\u002Fp>\n\n\u003C\u002Fdiv>\n\nPR-AF is the **#1 open-source code reviewer on Martian Code-Review-Bench**. It is built\nfor deep code review, not shallow diff summaries: turn each PR into a task-specific\nreview plan, spawn focused reviewer agents, ground findings in code evidence, challenge\nthe results, and squeeze more useful review intelligence out of cheaper models. Run\nDeepSeek-class models for routine PRs, GLM-5.2 for deep open-model reviews, or Opus-class\nfrontier models for major PRs — where PR-AF tops the benchmark by a wide margin.\n\n\u003Cp align=\"center\">\n  \u003Cimg src=\"assets\u002Fhero.png\" alt=\"PR-AF — open-source agentic code review benchmark\" width=\"100%\" \u002F>\n\u003C\u002Fp>\n\n## Benchmark Position\n\nOn the 38 runnable Martian Code-Review-Bench PRs, **PR-AF with GLM-5.2 is the\n#1 open-source reviewer in golden recall**: 0.706 across 42 compared tools. It is ahead\nof cubic-v2 and every qodo, coderabbit, greptile, copilot, and devin variant in this\nsnapshot.\n\nWhere PR-AF shines:\n\n| strength | result |\n|---|---|\n| **Known bug recall** | 0.706 golden recall — #1 open source across 42 compared tools. |\n| **More real issues found** | 595 independently valid findings, ~3× more than the leading commercial tools in the adjusted comparison. |\n| **Open + reproducible** | Single open model (`GLM-5.2`), public results, per-PR judge verdicts, and reproduction scripts. |\n| **Self-hosted API** | Run locally with Docker; trigger reviews by CLI, curl, CI, or other agents. |\n| **Model-flexible** | Use cheaper models for regular PRs, GLM-5.2 for open-model CI gates, and Opus-class frontier models for highest-stakes reviews. |\n| **Frontier ceiling** | With Opus-class commercial models, PR-AF tops the benchmark by a wide margin. |\n| **Cost position** | About 10× cheaper per review than closed-source tools. |\n\nFull benchmark package: [`benchmark\u002Fmartian-code-review-bench`](benchmark\u002Fmartian-code-review-bench).\n\n## One-Call DX\n\nTrigger it with the `af` CLI (requires af ≥ 0.1.87) — it streams live progress and prints the result:\n\n```bash\naf call pr-af.review --in '{\"pr_url\": \"https:\u002F\u002Fgithub.com\u002Fowner\u002Frepo\u002Fpull\u002F123\"}'\n```\n\nPrefer raw HTTP? Hit the API directly with curl:\n\n```bash\ncurl -X POST http:\u002F\u002Flocalhost:8080\u002Fapi\u002Fv1\u002Fexecute\u002Fasync\u002Fpr-af.review \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"input\": {\"pr_url\": \"https:\u002F\u002Fgithub.com\u002Fowner\u002Frepo\u002Fpull\u002F123\"}}'\n```\n\nPosts inline GitHub review comments with evidence-grounded findings:\n\n```jsonc\n{\n  \"total_findings\": 5,\n  \"by_severity\": {\"critical\": 1, \"important\": 2, \"suggestion\": 2},\n  \"findings\": [\n    {\n      \"severity\": \"critical\",\n      \"title\": \"SQL injection in user input handling\",\n      \"file\": \"src\u002Fapi\u002Fusers.py\",\n      \"line\": 42,\n      \"body\": \"Raw query parameter interpolated directly into SQL. Tracer confirms no parameterization between input and cursor.execute().\",\n      \"suggestion\": \"cursor.execute('SELECT * FROM users WHERE id = %s', (user_id,))\",\n      \"evidence\": \"AST extraction confirms f-string SQL at users.py:42, no sanitization in call chain\",\n      \"compound_risk\": \"Combined with missing auth middleware (finding #2), this is exploitable by unauthenticated users\"\n    }\n  ],\n  \"review_dimensions\": 4\n}\n```\n\nCustom review strategy per PR. Evidence-grounded findings. About 10× cheaper per review than closed-source tools.\n\n---\n\n## Dynamic Pipeline Architecture\n\nPR-AF does not execute a static script. It structurally morphs its own execution graph based on the topology of the incoming Pull Request.\n\nWhen a PR arrives, the system dynamically compiles review dimensions — evaluating the diff through semantic, mechanical, and systemic lenses. It uses these dimensions to spawn specialized, ephemeral reviewer agents tailored exclusively to the exact context of the current PR.\n\n\u003Cp align=\"center\">\n  \u003Cimg src=\"assets\u002Farchitecture.png\" alt=\"PR-AF 7-Phase Adaptive Pipeline\" width=\"100%\" \u002F>\n\u003C\u002Fp>\n\n> Full architecture deep-dive: [`docs\u002FARCHITECTURE.md`](docs\u002FARCHITECTURE.md)\n\n\u003Cdetails>\n\u003Csummary>\u003Cstrong>Pipeline flow (Mermaid)\u003C\u002Fstrong>\u003C\u002Fsummary>\n\n```mermaid\ngraph TD\n    classDef intake fill:#f3f4f6,stroke:#4b5563,stroke-width:2px;\n    classDef dynamic fill:#dbeafe,stroke:#3b82f6,stroke-width:2px;\n    classDef verify fill:#fef3c7,stroke:#2563eb,stroke-width:2px;\n    classDef synthesize fill:#ede9fe,stroke:#d97706,stroke-width:2px;\n    classDef output fill:#ecfdf5,stroke:#8b5cf6,stroke-width:2px;\n\n    PR[Incoming Pull Request] --> I1[Intake Triage]:::intake\n    I1 --> A1[Topological Anatomy Mapping]:::intake\n    \n    A1 --> M1[Semantic Lens Generator]:::dynamic\n    A1 --> M2[Mechanical Lens Generator]:::dynamic\n    A1 --> M3[Systemic Lens Generator]:::dynamic\n    \n    M1 --> D[Dimension Deduplication & Compilation]:::dynamic\n    M2 --> D\n    M3 --> D\n    \n    D -->|Dynamically spawns N dimensions| R1(Thread 1: State Mutation)\n    D --> R2(Thread 2: API Boundaries)\n    D --> R3(Thread N: Dynamic Context...)\n    \n    R1 --> E[Programmatic AST Extraction Engine]:::verify\n    R2 --> E\n    R3 --> E\n    \n    E -->|Ground truth caller snippets| V[Evidence Verification Layer]:::verify\n    V -->|Unsubstantiated claims pruned| F[Falsifiability Gate]:::verify\n    \n    F --> C1(Compound Cluster: File Topology)\n    F --> C2(Compound Cluster: Shared Imports)\n    F --> C3(Compound Cluster: Tag Overlap)\n    \n    C1 --> S[Compound Vulnerability Synthesis]:::synthesize\n    C2 --> S\n    C3 --> S\n    \n    S --> L{Coverage Depth Gate}\n    L -->|Blind spots detected| I1\n    L -->|Full coverage achieved| O[Synthesized GitHub Annotations]:::output\n```\n\n\u003C\u002Fdetails>\n\n---\n\n## How It Works\n\nPR-AF uses this multi-phase cognitive pipeline to ensure rigorous, high-fidelity reviews:\n\n### 1. Evidence Grounding\nIf the system flags a missing validation check, PR-AF does not immediately accept it. It pulls exact caller snippets and import context from the repository, then verifies whether the finding is grounded in the code before it reaches the final review.\n\n### 2. Compound Vulnerability Synthesis\nStandard tools analyze code linearly. PR-AF clusters related risks across files and evaluates whether isolated findings combine into a larger systemic issue.\n\n### 3. Falsifiability Gates\nBefore a finding becomes a GitHub comment, the system tries to invalidate it: safe behavior, intended behavior, existing mitigations, or weak evidence. Findings that survive are returned with file, line, body, suggestion, and evidence.\n\n---\n\n## Ecosystem Comparison\n\nThere are excellent AI code review tools on the market. PR-AF is not designed to replace fast, interactive tools; it is designed for comprehensive CI\u002FCD gating where accuracy and architectural depth matter more than execution speed.\n\n| Feature | PR-AF (AgentField) | Claude Code CLI | Commercial SaaS (e.g. Codex, CodeRabbit) |\n|---|---|---|---|\n| **Best For** | Deep CI\u002FCD architectural audits | Fast, iterative inner-loop development | Clean GitHub UX and chat-based reviews |\n| **Cost** | **Free \u002F Open Source** (BYOK API costs only) | Pay-per-token (BYOK) | ~$20 - $25 \u002F user \u002F month |\n| **Architecture** | Massively parallel cognitive pipeline | Single-thread interactive loop | Context retrieval + LLM review |\n| **Execution Time**| ~35-50 minutes | Seconds to minutes | ~2-5 minutes |\n| **False Positives**| **Extremely low** (Evidence Grounding) | Moderate (relies on context window) | Low-to-Moderate (heuristic filtering) |\n| **Compound Risks**| **Yes** (Dedicated Compound Synthesizer) | Unlikely (diff-focused) | Partial (depends on retrieval accuracy) |\n\n*We highly recommend using Claude Code for your local development and running PR-AF as your final GitHub Actions gatekeeper.*\n\n---\n\n## Quick Start\n\n### Install into AgentField (`af install`)\n\nAlready running an [AgentField](https:\u002F\u002Fgithub.com\u002FAgent-Field\u002Fagentfield) control plane? Install PR-AF straight from GitHub — no clone, no local setup:\n\n```bash\naf install https:\u002F\u002Fgithub.com\u002FAgent-Field\u002Fpr-af\naf run pr-af\n```\n\n`af install` follows the repository manifest to the maintained Go package and registers it as the `pr-af` node with your control plane. If an older Python `pr-af` is installed, it is replaced in place, retaining the same node id, triggers, and node-scoped secrets. On first `af run` you're prompted for the required secrets — `OPENROUTER_API_KEY` and `GH_TOKEN` — which are stored encrypted and reused across every node, so you enter each only once. Then review a PR:\n\n```bash\naf call pr-af.review --in '{\"pr_url\": \"https:\u002F\u002Fgithub.com\u002Fowner\u002Frepo\u002Fpull\u002F123\"}'\n```\n\nNew to AgentField? Install the control plane first with `curl -fsSL https:\u002F\u002Fagentfield.ai\u002Finstall.sh | bash`, or use one of the options below.\n\nTo install the Python node deliberately, clone this repository and install the\ncheckout as a local path. Local-path installs do not follow `superseded_by`:\n\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002FAgent-Field\u002Fpr-af\naf install .\u002Fpr-af\n```\n\n### Deploy with Railway (fastest)\n\n[![Deploy on Railway](https:\u002F\u002Frailway.com\u002Fbutton.svg)](https:\u002F\u002Frailway.com\u002Fdeploy\u002Fpr-af)\n\nOne click deploys PR-AF + the AgentField control plane + PostgreSQL. Set two environment variables in Railway:\n\n- `OPENROUTER_API_KEY` — your [OpenRouter](https:\u002F\u002Fopenrouter.ai\u002Fkeys) key (routes to the review models)\n- `GH_TOKEN` — GitHub personal access token with `repo` scope, for reading PRs and posting reviews\n\nOnce deployed, trigger a review against the control plane (the public endpoint requires the `X-API-Key` header set to your `AGENTFIELD_API_KEY`):\n\n```bash\ncurl -X POST https:\u002F\u002F\u003Ccontrol-plane>.up.railway.app\u002Fapi\u002Fv1\u002Fexecute\u002Fasync\u002Fpr-af.review \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"X-API-Key: \u003CAGENTFIELD_API_KEY>\" \\\n  -d '{\"input\": {\"pr_url\": \"https:\u002F\u002Fgithub.com\u002Fowner\u002Frepo\u002Fpull\u002F123\"}}'\n```\n\n### Run locally (Docker Compose)\n\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002FAgent-Field\u002Fpr-af.git && cd pr-af\ncp .env.example .env          # Add OPENROUTER_API_KEY, GH_TOKEN\ndocker compose up --build\n```\n\nStarts AgentField control plane (`http:\u002F\u002Flocalhost:8080`) + PR-AF agent.\n\n```bash\ncurl -X POST http:\u002F\u002Flocalhost:8080\u002Fapi\u002Fv1\u002Fexecute\u002Fasync\u002Fpr-af.review \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"input\": {\"pr_url\": \"https:\u002F\u002Fgithub.com\u002Fowner\u002Frepo\u002Fpull\u002F123\"}}'\n```\n\nPoll for results:\n\n```bash\ncurl http:\u002F\u002Flocalhost:8080\u002Fapi\u002Fv1\u002Fexecutions\u002F\u003Cexecution_id>\n```\n\n### Configuration (environment variables)\n\nThe key knobs (see `.env.example` for the full list):\n\n| Variable                    | Purpose                                                        |\n|-----------------------------|----------------------------------------------------------------|\n| `OPENROUTER_API_KEY`        | LLM provider key (OpenRouter) — required                       |\n| `GH_TOKEN`                  | GitHub token (`repo` scope) for reading PRs and posting reviews |\n| `PR_AF_PROVIDER`            | Harness provider (default `opencode`)                          |\n| `PR_AF_MODEL`               | Harness model (default `openrouter\u002Fmoonshotai\u002Fkimi-k2.5`)      |\n| `PR_AF_MAX_COST_USD`        | Per-run cost ceiling in USD (default `2.0`)                    |\n| `PR_AF_MAX_DURATION_SECONDS`| Per-run wall-clock ceiling in seconds (default `3600`)         |\n| `AGENTFIELD_HARNESS_IDLE_SECONDS` | Harness no-output watchdog window in seconds (default `360`) — harness CLIs in JSON mode emit events only at completion boundaries, so long single completions look silent |\n| `PR_AF_WORKDIR`             | Where PR checkouts live (default `\u002Fworkspaces`); each PR gets its own `\u003Crepo>-pr\u003CN>` workspace |\n\n## GitHub Actions Integration\n\nThe easiest way to use PR-AF is to drop it into your GitHub Actions. It requires **zero configuration** and runs securely using GitHub's built-in `GITHUB_TOKEN`.\n\nAdd this workflow to your repository at `.github\u002Fworkflows\u002Fpr-af-review.yml`. It triggers automatically whenever you add the **`pr-af`** label to a Pull Request.\n\n```yaml\nname: AgentField PR Review\n\non:\n  pull_request:\n    types: [labeled]\n\njobs:\n  pr-af-review:\n    if: github.event.label.name == 'pr-af'\n    runs-on: ubuntu-latest\n\n    # Needs permissions to post comments and read code\n    permissions:\n      contents: read\n      pull-requests: write\n\n    steps:\n      - name: Checkout PR-AF\n        uses: actions\u002Fcheckout@v4\n        with:\n          repository: Agent-Field\u002Fpr-af\n          path: pr-af\n\n      - name: Start AgentField & PR-AF\n        working-directory: .\u002Fpr-af\n        env:\n          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n        run: |\n          docker compose up -d\n          sleep 15 # Wait for services to be healthy\n\n      - name: Execute Deep Architectural Audit\n        working-directory: .\u002Fpr-af\n        env:\n          PR_URL: ${{ github.event.pull_request.html_url }}\n        run: |\n          python3 scripts\u002Fci_runner.py\n```\n\n*Note: PR-AF runs a comprehensive parallel pipeline. Reviews typically take 35-50 minutes depending on PR complexity.*\n\n---\n## From the AgentField AF Ecosystem\n\nPR-AF is one example of a larger AgentField ecosystem for building autonomous, agent-native systems.\n\n* **[SWE-AF](http:\u002F\u002Fwww.agentfield.ai\u002Fgithub\u002Fswe-af)**: autonomous software factory for production ready PR\n* **[SEC-AF](http:\u002F\u002Fwww.agentfield.ai\u002Fgithub\u002Fsec-af)**: autonomous security factory for code security review, vulnerability investigation, and evidence-grounded remediation.\n\n## From the AgentField Blog\n\n### [How an AI-Native Engineering Team Does Code Review](https:\u002F\u002Fwww.agentfield.ai\u002Fblog\u002Fai-native-code-review?utm_source=github-readme&utm_campaign=pr-af-readme&utm_id=pr-af-readme-blog-ai-native-code-review)\n\nWhen the writer and the reviewer are the same intelligence, the pull request gate stops doing what it was designed to do.\n\n\u003Cp align=\"center\">\n  \u003Ca href=\"https:\u002F\u002Fwww.agentfield.ai\u002Fblog\u002Fai-native-code-review?utm_source=github-readme&utm_campaign=pr-af-readme&utm_id=pr-af-readme-blog-ai-native-code-review\">\n    \u003Cimg src=\"assets\u002Fblog-ai-native-code-review.webp\" alt=\"An engineer reading a pull request through a telescope of risk dimensions.\" width=\"100%\" \u002F>\n  \u003C\u002Fa>\n\u003C\u002Fp>\n\n[Read the post →](https:\u002F\u002Fwww.agentfield.ai\u002Fblog\u002Fai-native-code-review?utm_source=github-readme&utm_campaign=pr-af-readme&utm_id=pr-af-readme-blog-ai-native-code-review)\n\n---\n\n## Go implementation\n\nThe maintained node lives under [`go\u002F`](go\u002FREADME.md), and installing the bare\nrepository URL gives you this implementation as `pr-af` on its default port\n`8007`. The Python implementation remains available through `python -m\npr_af.app`, the root Docker Compose stack, or the local-path install escape\nhatch above. The Go add-on Compose file explicitly uses `pr-af-go` only so both\nimplementations can run against one control plane during a changeover. Build,\nrun, and Docker\u002Fcompose docs live in [`go\u002FREADME.md`](go\u002FREADME.md).\n","PR-AF 是一个开源的智能代码评审代理系统，专为深度 Pull Request 审查设计。它采用多智能体协同架构：将 PR 解析为任务计划，动态调度专注型评审 Agent，基于源码证据生成可验证问题，并通过自检机制提升结果可靠性；支持灵活模型适配（如 GLM-5.2、DeepSeek、Claude Opus），兼顾效果与成本。适用于 CI\u002FCD 流水线中的自动化代码质量门禁、开源项目协作审查及企业级自托管代码治理场景。",2,"trending"]