OWASP-aware AI reviewer agents
on every pull request
Define your own reviewer agents — security, performance, accessibility, lead developer — each with its own system prompt and model. Route security tickets to the security reviewer automatically. Severity score, findings list, per-agent audit history.
How it works
- 1Create reviewer agentsGo to /dashboard/agents → New Agent. Toggle is_reviewer on. Pick a role (reviewer / security_developer / qa / lead_developer), a model (GPT-5, Gemini, Claude), and a system prompt. Save.
- 2Pick a reviewer per taskOn any task, click 🔎 Review. Pick "✨ Auto" to let Agentopia by CynetIQ resolve the role from task tags / Integration Rules, or pick a specific reviewer agent. The review runs synchronously (single LLM call, no code mutation).
- 3Read the structured reportEvery review produces: ### Summary (1-2 sentences), ### Findings (numbered list with file/line, severity, fix), ### Severity (critical/high/medium/low/clean), ### Score (0-100 confidence to merge).
- 4Audit history per agentOpen the agent card. See severity distribution, average score, and full history of every review the agent has done — across tasks, tags, and time.
- 5Or run as a flow nodeDrop the reviewer node in any flow (visual builder). Use the score / severity output as a condition gate to auto-merge clean PRs and hold critical ones for human review.
What sets Agentopia by CynetIQ reviewers apart
Sample reviewer output
### Summary
The patch fixes the off-by-one in pagination but introduces a SQL string concat that is reachable from /api/orders.
### Findings
1. packages/services/src/agentopia_services/services/order_service.py:88 — SQL injection (CRITICAL).
String concatenation builds the WHERE clause from a request parameter. Use a parameterized query.
Fix: replace f-string with text(":order_id") and pass {"order_id": order_id} to .execute().
2. packages/api/src/agentopia_api/api/routes/orders.py:42 — Missing authentication decorator (HIGH).
The /orders/{id}/refund endpoint has no Depends(get_current_user). Anyone can hit it.
3. tests/test_orders.py:120 — Test asserts side effect on the wrong fixture (LOW).
### Severity
critical
### Score
24Frequently asked
How does Agentopia by CynetIQ do AI code review?
You define one or more reviewer agents in Agentopia by CynetIQ — each with its own role (reviewer, security_developer, qa, lead_developer), system prompt, model, and provider. When a task is generated by AI or imported from Sentry / Jira / Azure DevOps, the chosen reviewer agent runs against the diff and writes a structured report with summary, findings (file/line, severity, fix), severity verdict, and a 0-100 confidence score.
What is the OWASP-aware reviewer?
A pre-built reviewer agent (security_developer) shipped with agentopia. Its system prompt is paranoid by default: treats every input as malicious, checks for OWASP Top 10 vulnerabilities (SQL injection, XSS, SSRF, auth bypass, deserialization), and produces threat model + fix plan + residual risk note. You can customize the prompt in Prompt Studio.
Can I create my own reviewer personas?
Yes — go to /dashboard/agents and create an agent with the is_reviewer flag on. Pick its model (GPT-5, Gemini, Claude), provider, and write a custom system prompt. Reviewer agents appear in the reviewer picker on every task.
Does the AI review block PR merge?
It does not block by default — reviews are advisory and posted as comments + a structured Findings section in the PR description. You can configure required reviewers / branch protection in GitHub or Azure DevOps to block on a specific severity threshold via webhook.
How is this different from CodeRabbit / GitHub Copilot review?
Agentopia by CynetIQ reviewers are configurable agents, not a single fixed model. Each persona has its own prompt and can run different models for cost/quality tradeoffs. Reviews are auditable per agent with full history. And you can route different ticket types to different reviewer agents (security tickets → security_developer; refactor tickets → lead_developer).
Where is the source code sent?
Only the diff and the file:line context window are sent to the LLM provider you chose for that reviewer agent (OpenAI, Anthropic, Google, or your self-hosted endpoint). Agentopia by CynetIQ does not retain code or train on it. You can run Agentopia by CynetIQ self-hosted for full air-gapped operation.