How to Perform Automated Code Review with LLMs Today

Introduction: Why Automated Code Review with LLMs is Already a Reality

Automated code review using large language models (LLMs) is no longer a futuristic concept. By 2026, models like LLaMA-3.1, Mistral-Large, and dedicated API services can understand code in context, identifying bugs, style issues, and security vulnerabilities with accuracy comparable to expert human reviewers. This article explains how to leverage these capabilities, what tools to use, and when to integrate them into your daily workflow.

Why LLMs are the Ideal Engine for Code Review

Contextual understanding of code

Modern LLMs are trained on billions of lines of open-source code and documentation. They can interpret specific programming languages, frameworks, and project conventions without needing rigid rules, making them ideal for autonomous code review.

• They recognize patterns in Python, TypeScript, Go, Rust, and many other languages.
• They understand project documentation, README files, and previous commits.
• They adapt their review style to match your team’s specific guidelines.

Generating suggestions and corrections

Beyond flagging issues, LLMs can propose corrective or improvement code, generate complete code blocks, provide explanations, and link to best practices, accelerating the review process.

Which tool to use and how to integrate it into your workflow

There are three main options available in 2026:

1. Cloud-based APIs (OpenAI, Anthropic, Cohere) â€" a quick solution without infrastructure overhead.
2. Local models via Docker/Ollama (e.g., LLaMA-3.1 in 8B parameters) â€" ideal for teams with privacy constraints.
3. Integrated CI/CD platforms (GitHub Copilot X, GitLab Duo, JetBrains IDE AI Assistant) â€" inline reviews directly in pull requests.

Below is an example of a GitHub Actions workflow that uses an LLM API to perform an automated review within each pull request.

name: LLM Code Review
on:
  pull_request:
    types: [opened, synchronize]
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - name: Install dependencies
        run: |
          pip install requests openai
      - name: Perform LLM review
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: |
          import requests, json, os
          from pathlib import Path

          # Collect PR code snapshot
          repo = os.getenv('GITHUB_REPOSITORY')
          pr_number = os.getenv('GITHUB_REF', '').split('/')[-1]
          url = f'https://api.github.com/repos/{repo}/pull/{pr_number}/files'
          resp = requests.get(url, headers={'Authorization': f'token {os.getenv("GITHUB_TOKEN")}'})
          files = resp.json()

          # Prepare prompt for the model
          prompt = 'Perform a code review for the following files:\n'
          for f in files[:5]:  # limit to 5 files for demo
              prompt += f'\n### {f["filename"]}\n```\n{f["patch"]}\n```'
          prompt += '\n\nProvide concise comments, highlighting bugs, style issues, and security vulnerabilities.'

          # Call OpenAI API
          response = requests.post(
              'https://api.openai.com/v1/chat/completions',
              headers={'Authorization': f'Bearer {os.getenv("OPENAI_API_KEY")}'},
              json={
                  'model': 'gpt-4o',
                  'messages': [{'role': 'user', 'content': prompt}],
                  'temperature': 0.2,
                  'max_tokens': 1500
              }
          )
          review = response.json()['choices'][0]['message']['content']

          # Publish a comment on the PR
          comment_url = f'https://api.github.com/repos/{repo}/issues/{pr_number}/comments'
          requests.post(comment_url, headers={'Authorization': f'token {os.getenv("GITHUB_TOKEN")}'},
                        json={'body': f'**ðŸ" Automated LLM Review**\n\n{review}'})

How to write effective prompts for high-quality code review

The quality of the review depends on the prompt. Follow this checklist to ensure reliable results:

• Define the context â€" language, framework, naming conventions, security standards.
• Be specific â€" indicate what types of bugs to look for (e.g., error handling, input validation).
• Request a structured format â€" bullet points, severity, and suggested code.
• Specify the tone â€" formal, concise, or with detailed explanations.
• Include examples â€" show a code block that meets or violates the rule.

Example prompt for a secure review of an authentication function in TypeScript:

You are a security-savvy reviewer specializing in TypeScript. Analyze the following code and flag:
1. Potential injection vulnerabilities, authentication/authorization flaws, and exposure of sensitive data.
2. Deviations from our project conventions (e.g., naming, use of 'any', missing type handling).
3. Suggestions for improving readability and performance.

Provide the response as:
- **Severity:** [high/medium/low]
- **Issue:** brief description
- **Suggested code:** full code block (if applicable)
- **Explanation:** why the issue matters

---
Function to review:
```typescript
export async function loginUser(email: string, password: string): Promise<Session> {
  const user = await db.users.findOne({ email });
  if (!user) throw new Error('User not found');
  const valid = await bcrypt.compare(password, user.passwordHash);
  if (!valid) throw new Error('Invalid credentials');
  return generateSession(user.id);
}
```

Practical examples: From a pull request to automatic comments

The previous workflow demonstrates how to transform raw PR data into a readable review. For teams that prefer a local instance, a simple Python script with Ollama can replace the cloud API:

import subprocess, json, requests, os

# Retrieve PR diff (simplified)
diff = subprocess.check_output(['git', 'diff', '--no-patch', '--unified=10', 'HEAD~1']).decode()

# Load local model (e.g., LLaMA-3.1 8B)
prompt = f"Perform a code review for the following diff:\n\n{diff}"
result = subprocess.run(['ollama', 'run', 'llama3.1', prompt], capture_output=True, text=True)
review = result.stdout

# Post comment on GitHub
requests.post('https://api.github.com/repos/...' , json={'body': f'**ðŸ" LLM Review**\n\n{review}'})

Common mistakes and how to avoid them

• Too generic prompts â†' Be specific about language and standards.
• Ignoring project context â†' Upload .gitignore, .prettierrc, and team rules.
• Relying solely on cloud API â†' Use local models for sensitive data.
• Not limiting the number of files â†' Limit review to a manageable subset (e.g., first 5 files).
• Neglecting false positives â†' Implement a feedback loop to refine prompts and models.

Conclusion: Take Your Code Review to the Next Level

LLMs have transformed code review from a slow, manual task into an automated, intelligent process. Define the context, choose the right tool (cloud or local), and refine prompts to achieve reviews that balance security, style, and performance. Start today with a simple CI/CD workflow, monitor the results, and continuously improve your AI-powered review system.

Back to top â†'