AI PR Reviewer: 3 Parallel Subagents for Code Review Automat

TL;DR: A developer built a production-ready AI code reviewer using three parallel specialized subagents (security, style, performance) in ~40 lines of Python with Pydantic AI, delivering prioritized PR reviews in 30 seconds instead of 2–4 hours of senior engineer time.

The Human Cost of Code Review

Senior developers spend 2–4 hours daily on pull request reviews—10–20 hours per week—executing repetitive pattern-matching tasks: checking for SQL injection, spotting N+1 queries, flagging missing type hints. At a team of five seniors, that's 50–100 hours of expert brainpower weekly spent on checks that follow clear, automatable rules. The architecture presented here doesn't replace human judgment; it augments it by catching obvious issues before senior reviewers see the PR, freeing them for architectural and design decisions.

How the Three-Agent Architecture Works

The solution splits code review into three specialized domains, each handled by a subagent that receives the same git diff and reviews it through its domain lens. A coordinator agent runs all three in parallel, then aggregates and deduplicates findings into a unified, severity-sorted review.

Security Reviewer scans for SQL injection, XSS, hardcoded secrets, unsafe deserialization, command injection, and insecure file operations. Style Reviewer checks naming conventions, code duplication, cyclomatic complexity, type hint coverage, and dead code. Performance Reviewer identifies N+1 query patterns, unnecessary memory allocations, blocking I/O in async code, missing indexes, and unoptimized loops.

This is the "deep agent" pattern—a coordinator that plans, delegates to specialists, and synthesizes results. It mirrors the architecture of Claude Code and production coding agents, built on Pydantic AI as an open-source alternative.

Why This Matters for Developer Productivity

The implementation achieves results in ~30 seconds through three design decisions: (1) Structured output via Pydantic models validates findings at runtime—no free-form text, only actionable data with file, line number, severity, category, description, and fix suggestion; (2) Domain-specific instructions per subagent eliminate generalist hand-waving ("check for SQL injection, XSS, hardcoded secrets" vs. vague "review this code"); (3) Parallel execution runs all three subagents concurrently instead of sequentially, reducing latency from ~90 to ~30 seconds.

Each subagent is an expert in its domain, not a generalist covering everything. This specificity drives utility: when the parent agent aggregates results, it deduplicates findings (e.g., a hardcoded API key flagged as both security and style issue) and sorts by severity, producing a clean, prioritized review that a senior reviewer scans in 30 seconds.

Code Implementation: Minimal, Production-Ready

The full implementation requires ~40 lines of logic using pydantic-deep. A ReviewFinding Pydantic model defines the output structure (file, line, severity, category, description, suggestion). Three SubAgentConfigs define specialists with unique names, descriptions (used for routing), and domain-specific system prompts. The parent agent's instructions specify parallel delegation and aggregation by severity.

LocalBackend(root_dir=".") grants filesystem access for reading git diffs and inspecting files; this can be swapped for StateBackend (in-memory) or DockerSandbox (containerized) without changing agent logic. The backend abstraction decouples agent logic from execution environment—a key design pattern for production AI systems.

Example Output: Structured, Actionable

A real-world review against a 4-file PR produces 7 findings: 2 critical (SQL injection via f-string, hardcoded AWS secret), 3 warnings (N+1 query loop, cyclomatic complexity, string concatenation in loop), 2 info (missing type hints, unused imports). Each finding includes the exact file and line number, a concrete reproduction of the issue, and a specific fix (e.g., replace f-string with parameterized queries, use selectinload for ORM optimization).

This structured format enables downstream automation: findings can be directly posted as GitHub comments, fed into issue trackers, or aggregated into team metrics. A senior reviewer scans the prioritized list in 30 seconds and decides which findings to accept, modify, or dismiss—focusing their expertise on issues that require judgment.

Deployment Patterns

The reviewer runs as a standalone Python script (pip install pydantic-deep, then python review.py). It can also be integrated as a GitHub Action, slash command, or API endpoint. The agent code remains unchanged; only the orchestration layer differs. This decoupling is critical for production systems—the same business logic works across multiple deployment contexts.

Implications for AI-Assisted Code Review

This pattern demonstrates that agent specialization—not scale or raw model capability—drives practical value in code review automation. By constraining each agent's scope, you get faster execution (parallel runs), higher precision (domain-specific prompts reduce false positives), and easier debugging (failures are isolated to a specific domain).

The result is a 50–100 hour per week reclamation of senior engineer time, reallocated to architecture, mentoring, and design—the work that drives business value. Early-stage teams without senior engineers can use this as a first-pass filter, reducing code review time by 30–50%. Mature teams can use it to enforce standards before human review, reducing reviewer fatigue.

Source: Kacperwlodarczyk, Medium (March 2026)