Two-model code review for Claude Code and Codex.
cross-review runs Claude's native /code-review and Codex's native review independently on the same change, reconciles their findings against the source, and records how each reviewer performed. The result is a single verified report, plus metrics that show over time how much each model contributes.
It works on Azure DevOps and GitHub pull requests, uncommitted changes, and branch comparisons. It is read-only: it never edits code, posts comments, or changes PR state.
- Why two reviewers
- How it works
- Requirements
- Installation
- Usage
- Output
- Security and privacy
- Design details
- Development
- License
Each model finds issues the other misses, and each raises some false positives. Running both independently, then checking every finding against the source, gives you:
- Wider coverage. Findings from either reviewer make it into the final report.
- Fewer false positives. Every finding is confirmed, rejected, or marked uncertain from source evidence before it is reported.
- Measurable value. Precision, agreement, and added value are recorded for every run, so you can see whether the second reviewer is paying for itself.
There are two implementations with the same workflow. They differ in which tool runs the review and makes the final decisions.
| Claude-led | Codex-led | |
|---|---|---|
| Invoked from | Claude Code: /cross-review |
Codex: $cross-review |
| Independent reviews | Codex in the background, Claude in the session | Both as fresh child processes, concurrently |
| Comparison pass | Codex (selected effort) | Claude (selected effort) |
| Final adjudication | Claude, in the session | Codex, in the session |
| Run folders | .reviews/runs/*_claude-led_* |
.reviews/runs/*_codex-led_* |
Select the review scope
-> show the complete preflight and ask for confirmation
-> Claude /code-review and Codex review, independently and concurrently
-> comparison pass by the non-host model
-> source verification and final adjudication by the host
-> deterministic metrics, final report, and history
The two reviews start before either has written any findings, so neither can see the other's output. The comparison pass groups what the reviewers found and checks each group with targeted reads of the relevant source; it does not re-review the diff. The host then makes the final call on each finding from the source.
For PR reviews, the skill captures existing text comment threads after the independent reviews finish. The comparison pass matches them to model findings and checks comment-only concerns against the frozen source. The final report identifies findings already discussed on the PR and lists verified comment-only issues under Existing PR discussion. Those issues do not count toward either model's effectiveness metrics. PR comment retrieval uses a capable provider MCP operation or its authenticated CLI fallback. GitHub capture includes conversation comments, review summaries, inline threads, and all replies, retaining resolved/outdated state and current/original locations.
Both reviewers and the comparison pass run at the selected effort, medium by default. Pinning each stage makes runs reproducible; the host's final adjudication uses its current session effort.
- Claude Code with the native
/code-reviewskill - Codex CLI with
codex exec review - Git
- PowerShell 5.1 or later for the Claude-led skill; PowerShell 7.4 or later (
pwsh) for the Codex-led skill - For Azure DevOps PR reviews: Azure DevOps MCP (preferred), or authenticated Azure CLI with the
azure-devopsextension (fallback) - For GitHub PR reviews: capable GitHub MCP operations (preferred), or authenticated GitHub CLI (
gh, fallback)
Metadata and discussion operations are checked separately; an MCP connection that can read a PR may still need CLI fallback to capture complete discussion. Failed or incomplete metadata requests are reported as errors. If neither MCP nor CLI can capture the discussion, the review still finishes, and the report says the discussion was not captured and why instead of implying the PR has no comments.
Uncommitted and branch reviews need no provider API authentication. A remote branch comparison uses Git authentication; local main/master comparisons work without a remote.
The Codex-led skill needs a native claude executable on PATH and a complete native Codex installation. It discovers codex.exe from PATH or standard local installation locations, and requires codex-code-mode-host.exe beside it. The Codex reviewer also needs write access to its runtime home under CODEX_HOME; its source-review sandbox remains read-only.
Note
The skills are developed and tested on Windows.
Both skills use your existing CLI sessions and authentication. No API keys or additional integrations are needed.
Clone the repository and run the installer for each host you use:
./Install-Skill.ps1 -HostApp Claude
./Install-Skill.ps1 -HostApp CodexThis installs a self-contained skill to the default location for each host:
| Host | Location |
|---|---|
| Claude Code | %USERPROFILE%\.claude\skills\cross-review\ |
| Codex | %USERPROFILE%\.agents\skills\cross-review\ |
To install somewhere else, pass the full destination skill directory:
./Install-Skill.ps1 -HostApp Claude -DestinationPath <path>\cross-reviewThe installer combines the host's skill with the shared scripts and references, so install with the script rather than copying the repository or a skills/ directory directly.
Upgrading. Run the installer again. It replaces an existing installation completely, so files removed from the repository do not linger, and any local edits to the installed copy are lost. The new copy is built beside the old one and swapped in only after every file is copied, so a failed install leaves the existing installation unchanged. The installer refuses to replace a destination that is not a cross-review skill directory.
Restart Claude Code or Codex if the skill does not appear.
In Claude Code:
/cross-review
/cross-review pr 1234
/cross-review --debug
/cross-review --effort high
/cross-review pr 1234 --effort xhigh
/cross-review pr https://github.com/owner/repo/pull/1234
In Codex:
$cross-review
$cross-review pr 1234
$cross-review --debug
$cross-review --effort high
$cross-review pr 1234 --effort xhigh
$cross-review pr https://github.com/owner/repo/pull/1234
With no arguments, the skill reviews the first of these that applies:
- Uncommitted changes (staged, unstaged, or untracked) against
HEAD - The active/open Azure DevOps or GitHub pull request for the current source repository and branch
- The current branch against the repository's actual default branch (any valid name; main/master are local fallbacks)
If none applies, there is nothing to review. Passing pr <id> reviews that pull request ahead of everything else.
A pull request must match your exact checked-out branch and validated local repository identities. GitHub forks are supported: the source remote identifies the fork, and an explicit PR URL can select the target repository's local upstream remote. The skill never switches your branch.
Provider detection uses the branch tracking remote, then origin, then a sole remote. Ambiguous remotes stop. GitHub HTTPS and SSH URLs are recognized; configure GH_HOST for GitHub Enterprise. Unknown providers and repositories without a remote retain local review support.
With --debug, preflight shows Repository provider: GitHub (github.com), Azure DevOps (<host>), Unknown (<host or local remote>), or Local Git (no remote), independently of whether PR lookup ran. PR metadata separately shows MCP/CLI and any fallback reason. Provider and host are also included in the saved report's Provenance section and structured run artifacts.
Use --effort low|medium|high|xhigh to set the two independent reviewers and comparison pass. The default is medium. The option can appear before or after pr <id>. It does not change the effort of the already-running Claude or Codex session that makes the final decisions; the preflight shows that session's effort when available. Model or organization limits may cap a requested level, so any reported fallback is disclosed in the result.
Add --debug to include the diagnostic Run issues section in the saved report and chat output, including early stop messages. It defaults to off and can appear anywhere alongside the other options. Blocking errors and material review limitations are still reported.
Before anything runs, the skill shows a complete preflight and asks for confirmation. Preflight leads with Repo, Branch, and Review Scope, in that order. For PR reviews, Review Scope includes the PR number, such as Pull request #1234, in both preflight and saved provenance. These fields receive more emphasis than model settings. It also shows tools, the models and effort levels used and where each value came from, review size, and estimated duration. Other scope and revision details (PR, provider/host, source/target refs and commits, metadata access, and workspace) appear in preflight only with --debug, and always remain in the saved report and structured artifacts. Only y or yes continues. Any other answer, including cancelling, stops without creating any files, worktrees, or history.
Claude Code displays an interactive Yes/No selector. Codex displays the preflight in chat and uses a short inline Yes/No question only when the host permits a blocking input tool for approval in the active mode. When that tool is unavailable, restricted, or fails, Codex asks you to reply yes or no in chat. It does not use queued asynchronous follow-up questions for confirmation. A skill cannot change how Codex renders input tools, and printing Yes/No bullets does not create a selector.
To preview a run without starting it, invoke the skill and answer no.
Each run gets its own folder under .reviews/runs/ in the reviewed repository. Only the history files, which every run adds to, sit outside the run folders.
.reviews/
history.jsonl Claude-led history
codex-led/history.jsonl Codex-led history
runs/
pr-1234_20260918T142501Z_claude-led_9d2c7f15/
run-context.json scope, commits, tools, models, and estimate
claude-review.md Claude's independent review
codex-independent.md Codex's independent review
pr-comments.json PR discussion snapshot (PR reviews only)
codex-evaluation.md comparison pass (claude-evaluation.md for Codex-led)
adjudication.json final decision on every finding
metrics.json calculated metrics
final.md final report
Run folders are named <scope>_<UTC start time>_<skill>_<run ID prefix>, where the scope is pr-<id>, branch-<branch>, or uncommitted-<branch>. All runs of the same PR or branch therefore list together, oldest first, and a later run can find earlier ones by matching the scope, for example .reviews/runs/pr-1234_*. Each history entry also records its run folder.
The skills never delete or overwrite a run folder. A folder without a final.md belongs to a run that failed after its reviews finished; it is kept for inspection. Delete old run folders by hand when you no longer need them.
The skill adds /.reviews/ and /.claude/worktrees/ to the repository's local .git/info/exclude, so these files stay out of git status without changing your .gitignore.
Note
Earlier versions wrote each run's files directly into .reviews/ or .reviews/codex-led/, replacing the previous run's. Those files are left where they are and are no longer updated; you can delete them.
Both the saved report and chat output start with Cross-review effectiveness, followed immediately by Summary and Confirmed Findings. The summary describes the reviewed changes in one or two paragraphs, emphasizing critical or breaking behavior; the findings number every confirmed issue with its severity and put its suggested fix beneath the issue description. Supporting sections follow the confirmed findings. The saved report includes a Provenance section after the findings and supporting sections, with Repo, Branch, and Review Scope first, followed by PR, identifiers, provider/host, refs and commits, model/effort settings and their sources, review size, and estimates. All provenance details are saved regardless of --debug; source/target details receive secondary emphasis and model/effort text uses the same regular size and weight as other supporting information. Chat output omits Provenance, including with --debug, to keep the focus on findings. This information also remains in preflight and structured run artifacts. The effectiveness block includes:
- total run time in the cross-review effectiveness block
- initial Claude and Codex finding counts by severity
- confirmed counts by severity
- agreed, Claude-only, and Codex-only confirmed findings
- rejected false positives, merged duplicates, and uncertain findings
- the precision of each reviewer and the value added by the second reviewer
With --debug set, a closing Run issues section lists unexpected failures, workarounds, their effects, and likely skill bugs. Runs without issues omit it.
Every initial finding gets a permanent ID (C-001 for Claude, X-001 for Codex). Findings that describe the same issue are grouped, and each group is confirmed, rejected, or marked uncertain.
Claude precision = Claude findings in confirmed groups / all Claude findings
Codex precision = Codex findings in confirmed groups / all Codex findings
Codex added value = Codex-only confirmed groups / all confirmed groups
Cross-review reduction = 1 - (confirmed groups / initial unique findings)
A metric with a zero denominator is shown as N/A. The Codex-led skill also reports the value Claude added.
The calculations are deterministic, but the grouping and confirmation they rely on are model judgments. The precision figures describe confirmation by this pipeline; they are not an objective ranking of the two models.
Each completed run is appended to a repository history and a user-level history:
| Skill | Repository history | User-level history |
|---|---|---|
| Claude-led | .reviews/history.jsonl |
%USERPROFILE%\.claude\cross-review\history.jsonl |
| Codex-led | .reviews/codex-led/history.jsonl |
%USERPROFILE%\.codex\cross-review\history.jsonl |
History is used to estimate how long future reviews will take. Failed or declined runs are not recorded, existing lines are never rewritten, and the two skills never mix their histories.
- Read-only. Both Codex stages run with
--sandbox read-only --ephemeral. Claude runs without edit tools and without bypassing permissions. The skill never requests an approval bypass or a writable sandbox. - Fetch permissions. If the host sandbox blocks a required PR or default-branch fetch, the skill requests narrow approval for that fetch operation and retries it. It does not request Full access; the review confirmation and reviewer sandbox restrictions still apply.
- No credentials. The skills use your existing Claude Code, Codex, Git, Azure DevOps, and GitHub sessions with their current permissions.
- URL sanitization. Credentials, query strings, and fragments are removed from repository URLs before they are shown or stored, so a token embedded in
originnever reaches the history. - Untrusted input. Repository content, diffs, PR metadata, branch names, and reviewer output are treated as data, not instructions. Command arguments are passed as discrete values rather than shell text, provider branch refs must be valid
refs/heads/*refs, and review storage paths are checked against symbolic-link and directory redirection before anything is written. - Frozen commits. Both reviewers receive the exact source and target commits shown in the preflight, not branch names, so a fetch or push during the review cannot change what was approved.
Important
Review artifacts can contain repository names, commit IDs, findings, and source excerpts. They stay on your machine under .reviews/ and your user profile. Check them before sharing. The local Git exclusion does not protect artifacts that were already tracked or force-added.
Pull request resolution
PR metadata comes from the detected provider's MCP operations, with Azure CLI or GitHub CLI fallback when an operation is unavailable or deficient. Both paths use the same provider validator. Identity, branch, inactive/closed PR, and ambiguity failures stop rather than trigger fallback.
GitHub resolution validates target and source repository identities, including forks. Source is fetched through the target repository's PR head ref; target is the actual base branch. The fetched source commit is checked against metadata before preflight; moved PRs get a bounded metadata refresh/retry. For both providers the freshly fetched target is authoritative, because neither reports the current base-branch tip.
PR lookup runs even when local changes exist; it is skipped for unsupported providers/no remote. Branch and PR reviews include committed changes together with staged, unstaged, and untracked local edits. Uncommitted-only review applies on the default branch or when an unsupported/no-remote repository has no resolvable branch base. The shared provider workflow describes detection, raw MCP contracts, pagination, fetching, and discussion normalization.
Review workspace
PR and branch reviews run against the exact source commit from the preflight. If your checkout is clean and already at that commit, which is the usual case when you have pulled a PR branch, the review runs in place. When local edits exist, the review uses local HEAD (which must contain the PR head for a PR review) and freezes those edits in a detached worktree using a temporary index. Both reviewers see the branch diff plus the local overlay, including new files. The original checkout and index stay unchanged, and no snapshot commit is created. Clean checkouts on a different source commit use a detached worktree at that commit.
The worktree is kept until adjudication finishes, so every source check sees the reviewed commit. It is then removed, along with all temporary review data, whether the run succeeds or fails. The cleanup script only touches that exact worktree path and reports anything it deliberately left in place.
Models and effort levels
| Stage | Setting |
|---|---|
| Claude independent review | /code-review <selected-effort> |
| Codex independent review | reasoning <selected-effort> |
| Comparison pass | <selected-effort> |
Every launched stage is pinned explicitly. Without that, Claude would reuse the level from your last /code-review and Codex would use whatever model_reasoning_effort is in your configuration, which the skill cannot read back. Effort names are provider-specific and do not imply equal reasoning budgets.
For Claude-led runs, the Claude model comes from the current session. For Codex-led runs, the skill discovers Claude's configured model from the environment or settings and passes it to both Claude stages when found. The Codex model comes from read-only codex doctor --json diagnostics; Codex-led diagnostics and reviewer processes use the same Codex home. If a model cannot be determined without making a model request, the preflight says so rather than guessing. Each stage's settings are recorded separately, so a change in results can be traced to the setting that caused it.
Size and duration estimates
Review size counts changed files, added and deleted lines, commits, and binary files across the whole repository, even when invoked from a subdirectory. Text files up to 5 MiB are counted exactly; larger files are estimated from their byte size.
The first run uses a fixed estimate of 4, 6, 8, or 10 minutes for small through very large reviews. After that, estimates blend in up to seven past runs of the same review mode, preferring runs from the same repository and ignoring runs more than about 7.4 times larger or smaller. History carries about 11% of the weight with one sample, rising to 80% with seven.
Timing starts when you confirm, so time spent reading the preflight is not counted. The effectiveness summary shows total run time through final-report generation; history timing ends when the run is recorded. Runs longer than four hours are recorded but not used for estimates.
Codex-led process supervision
The Codex-led skill runs both reviewers as child processes. The supervisor starts both before waiting, reads both output streams, and stops the whole process tree on failure or after a 30-minute stage timeout. It records process IDs, start times, and transcript paths, so Stop-ReviewProcesses.ps1 can cancel a run without mistaking a reused process ID for a reviewer.
A review counts only if the reviewer finished and produced a report: Claude must have run native code-review at the selected effort, and Codex must have completed its turn. A missing native skill stops the run; it is never replaced with a generic review prompt. Tool or sandbox denials are kept as diagnostics rather than failing an otherwise complete report.
After the run, the skill lists commands the Claude reviewer was denied and can offer narrow rules, such as Bash(ls *), to allow on future runs. It adds only rules you explicitly accept, stores them in %USERPROFILE%\.codex\cross-review\claude-allowed-tools.json, and never grants blanket Bash access. Codex denials are reported but never added to an allowlist, because that would weaken the read-only sandbox.
skills/
claude/cross-review/ Claude-led skill and its comparison prompt
codex/cross-review/ Codex-led skill, comparison prompt, and process helpers
shared/
scripts/ helpers used by both skills
references/ artifact and history contracts
tests/
Run-Tests.ps1 test entry point, Claude-led and shared helpers
Run-CodexTests.ps1 Codex-led helpers
Run-ProviderTests.ps1 provider identities, forks, discussion pagination, and fetch guards
Install-Skill.ps1
Shared scripts and references are maintained once under shared/ and copied into each installed skill. Host-specific files must not use the same paths as shared ones; the installer fails if they collide.
The artifact and history formats are defined in shared/references/artifact-contract.md. The Claude-led skill writes schema version 3 and the Codex-led skill writes version 4.
The tests have no external dependencies. They build a temporary installation and run the helpers from it, so they test packaging as well as behavior.
./tests/Run-Tests.ps1This also runs the Codex-led tests when you are on PowerShell 7.4 or later.
Released under the MIT License.