How can I use LLMs to automate code reviews today
The short answer is: by writing clear prompts, connecting models to CI/CD, and leveraging new AI frameworks like Hermit, Prime Mega MoE, and joey-1. This article will show you a complete workflow, practical examples, and tips for achieving high-quality, automated code reviews.
Why LLMs are revolutionizing code review in 2026
- Speed:New models like Prime Mega MoE offer a forward pass up to 3.11x faster, reducing wait times for reviewing large codebases.
- Consistency:LLMs apply the same style and security standards across thousands of PRs without getting tired.
- Scalability:Tools like Hermit allow you to add new tools, memories, and instructions without retraining the model.
- Integration:Specialized decision models (e.g., joey-1) can determine whether a review requires human intervention, optimizing developers' workflow.
Released by Infini-AI-Lab, Hermit is an open-source Apache-2.0 project that adds an external layer of instructions, skills, memory, and tools to any LLM. For code review, this means being able to connect linters, formatters, and tests as plug-and-play extensions.
Prime Intellect has made DeepSeek’s MoE kernel fully trainable, accelerating the review process for large models. Using this kernel means getting faster reviews without sacrificing accuracy.
Baseten has released joey-1, a 2B parameter decision model that returns calibrated probabilities. It can be used as a "pass/stop" filter in CI pipelines: only high-risk changes go to the full review agent.
Building an LLM-based code review workflow
1. Define purpose and criteria
Before writing any prompts, clarify:
- Supported languages and frameworks (e.g., Python, React, Go)
- Style rules (PEP-8, Airbnb JS, etc.)
- Security checks (SQL injection, XSS, secret management)
- Performance metrics (cyclomatic complexity, test coverage)
2. Create an effective prompt
Use a structured instruction that includes context, examples, and constraints:
INSTRUCTION:
- You are an experienced code reviewer with knowledge of Python and OWASP security patterns.
- Examine the following snippet and indicate:
1. Style violations (according to PEP-8).
2. Potential bugs (logic, error handling).
3. Security issues.
4. Performance improvement suggestions.
- Return a reliability score from 1 to 5 and a markdown summary.
- If you find critical errors, flag them as 'BLOCKER'.
CODE:
```python
def user_login(username, password):
if username == "admin" and password == "1234":
return "Welcome admin"
else:
return "Invalid credentials"
```3. Connect the prompt to a CI
Here’s an example of a GitHub Actions workflow that sends the diff to an LLM API and comments on the PR:
name: LLM Code Review
on: pull_request
jobs:
review:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run LLM Review
run: |
DIFF=$(git diff HEAD~1 -- $GITHUB_EVENT_PATH)
RESPONSE=$(curl -X POST "https://api.llm-review.example/review" \
-H "Content-Type: application/json" \
-d "{\"code\": \"$DIFF\"}")
echo "$RESPONSE" >> review-comment.md
- name: Comment PR
uses: actions/github-script@v7
with:
script: |
const fs = require('fs');
const comment = fs.readFileSync('review-comment.md', 'utf8');
github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: comment
});Practical examples of prompts and when to use them
Use a short prompt that focuses only on formatting:
INSTRUCTION:
Check the style of the provided Python code. Report PEP-8 violations such as:
- variable names not in lower_case_with_underscores
- lines too long (>79 characters)
- improper use of spaces around operators.
Return a bulleted list of issues.Security prompt
Focus on common vulnerabilities:
INSTRUCTION:
Analyze the snippet for:
1. Potential injection (SQL, command, XSS).
2. Hard-coded secrets (API keys, passwords).
3. Use-after-free or unsafe memory handling.
Return each issue with a CWE reference.Evaluate complexity, unnecessary loops, and caching opportunities:
INSTRUCTION:
Evaluate the computational complexity of the code. Indicate:
- Maximum cyclomatic complexity degree.
- Loops that could be replaced by list comprehension or map.
- Possibility of caching expensive results.- GitHub Copilot Xcan suggest revisions in real time directly in the editor.
- GitLab CInow supports running LLM jobs via custom runners that leverage the Prime Mega MoE kernel.
- Jenkinscan use plugins that integrate the joey-1 decision filter to determine whether to start a thorough review.
How to measure success and iterate
Track:
- Detection coverage:how many real issues were reported manually vs. automatically.
- Review speed:average time per review (target
- False positives/negatives:adjust prompts based on patterns.
- Developer adoption:comments on the bot’s behavior in PRs.
Conclusion
LLMs have transformed code review from a slow, manual process into an automated, intelligent workflow. Clearly define criteria, leverage new frameworks like Hermit, accelerate with Prime Mega MoE, and filter risks with joey-1 to achieve high-quality reviews without overloading the team. Start experimenting today: write a prompt, connect it to your CI, and watch code quality improve while developers focus on more creative problems.
Next steps
- Create a test repository with a small open-source project.
- Implement the style prompt and monitor results.
- Add a security check using the dedicated prompt.
- Configure a joey-1 filter in your CI pipeline to reduce noise.
IMPORTANT: We are in 2026. All time references must be current. Do not mention past years like 2024, 2023, etc. Content must be fresh and relevant to the present.
CURRENT CONTEXT (October 2026):
Here are some recent trends and news for inspiration:
- Block Unveils Dessa, a Full-Duplex Speech Model Trained Only on Speech: Block’s AI lab released Dessa, a full-duplex speech-to-speech model trained only on human conversation audio. It runs locally on a MacBook Pro M4 Ma... [2026-10-29]
- Infini-AI-Lab Releases Hermit, an Open-Source Harness Adapter Framework for AI Agents: Infini-AI-Lab released Hermit, an Apache-2.0 harness adapter framework that trains an external layer of instructions, skills, memory and tools from ta... [2026-10-29]
- AssemblyAI Ships AssemblyAI-TTS-1: A $15 per 1M Character Text-to-Speech API for Voice Agents: AssemblyAI has released AssemblyAI-TTS-1, its first text-to-speech model for voice agents. It costs $15 per 1M characters, offers unlimited concurrenc... [2026-10-29]
Use this current information as inspiration to create an original and relevant prompt for 2026.