Build a PR Review Agent With an SDK and Run It in CI — Agent Engineering

Step 1 of 4

Lab brief

Goal

A reviewer that posts useful, file-and-line findings on PRs, runs with read-only tools and a turn cap, and has a measured false-positive rate.

Failure mode

A review bot with write access and no turn limit that posts twenty vague style nits per PR until the team mutes it.

Staff move

Least privilege, a tight checklist, a cap on turns and findings, and a feedback loop that tracks which comments were acted on.

Step 2 of 4

1. Write the agent

review.ts (Claude Agent SDK)

import { query } from "@anthropic-ai/claude-agent-sdk";

const diff = process.env.PR_DIFF_PATH!;
for await (const m of query({
  prompt: `Review the diff in ${diff} using the checklist in
    .claude/skills/review/SKILL.md. Report at most 5 findings,
    each with file:line, severity, and a concrete fix. If none, say LGTM.`,
  options: { allowedTools: ["Read", "Grep", "Glob"], maxTurns: 12 },
})) {
  if (m.type === "result") console.log(m.result);
}

Cursor SDK alternative: Agent.prompt(prompt, { local: { cwd }, model }) in the same script, exiting non-zero when result.status is not 'finished'.

Step 3 of 4

2. Run it in CI

Workflow on pull_request: checkout, write the diff to a file (gh pr diff > pr.diff), run the script
Post the result as one PR comment (gh pr comment) — a single sticky comment, not many
Use repository secrets for the API key; permissions: contents read, pull-requests write
Skip or restrict runs for PRs from forks so untrusted content cannot reach secrets

Shortcut

anthropics/claude-code-action@v1 and openai/codex-action@v1 wrap this pattern; the Starter Kit has ready workflows. Build it once by hand first so you understand the moving parts.

Step 4 of 4

3. Measure and tune

For two weeks, tag each finding as acted-on or ignored
Tighten the checklist until at least half of findings are acted on
Seed a known bug in a test PR and confirm the agent catches it