review-loop plugin
A Claude Code plugin: Claude does the task, then a stop hook starts an independent Codex review and Claude fixes the findings in the same session
- 726 ★ on the repository
- Last commit
Broad access
Why this level
- By default Codex runs with the --dangerously-bypass-approvals-and-sandbox flag: no approvals and no sandbox
- The stop hook blocks the Claude Code session from finishing and runs a generated script
- Project code and the diff are passed to an external model, and the command edits ~/.codex/config.toml
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/review-loopDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- By default Codex runs with the --dangerously-bypass-approvals-and-sandbox flag: no approvals and no sandbox
- The stop hook blocks the Claude Code session from finishing and runs a generated script
- Project code and the diff are passed to an external model, and the command edits ~/.codex/config.toml
This is third-party code. Review the repository files before installing.
What it does
review-loop adds a `/review-loop` command with a task description to Claude Code. The command creates a state file `.claude/review-loop.local.md` and a `reviews/` folder, and then Claude implements the task as usual. When it is about to finish, a stop hook fires: it detects the project type, writes a Codex runner script and a prompt into `.claude/`, blocks the exit and asks Claude to run `bash .claude/review-loop-run-codex.sh`. Codex output streams to the terminal, so the review is visible in real time. Codex starts up to four parallel review agents. The first looks at `git diff` and recent commits: code quality, tests, security against the OWASP Top 10. The second assesses the whole project, including structure, documentation and AGENTS.md files. The third checks Next.js when the project has `next.config.*` or a `next` dependency in `package.json`: App Router, server components, caching, Server Actions. The fourth, when `app/`, `pages/`, `public/` or an `index.html` exist, checks the interface in a browser through agent-browser: accessibility and responsiveness. Codex then removes duplicates and writes one report to `reviews/review-<id>.md`. Claude then reads the report, fixes the findings it agrees with, and only after that does the hook allow the session to end. `/cancel-review` aborts the loop. On any error the hook lets the session go by default, so it never traps it in a broken loop. A run log with timestamps and Codex exit codes is written to `.claude/review-loop.log`.
Who it is for. For developers who write code in Claude Code and want an automatic second opinion from Codex before they accept the changes.
Good fit when
- A medium-sized task needs an independent check by another model before you accept the changes
- A Next.js project needs App Router, server components and caching checked right away
- You want to watch the review in the terminal as it happens rather than get a finished report later
- You want a report with findings on the diff, project structure and interface in a separate `reviews/review-<id>.md` file
Not a fit when
- Codex CLI is not installed or not available: without it `/review-loop` exits with an error, and a Claude self-review is no substitute for the plugin's purpose
- You want a one-off manual review without an automatic block on finishing: the official Codex plugin for Claude Code has on-demand `/codex:review` commands
- The project must not go to external services: the code and diff are sent to Codex for the review
- The machine has no `jq` or Bash: the plugin scripts are written in Bash and require `jq`
Example request
/review-loop Add JWT token login and cover it with testsLimitations
- There is no license file in the repository, although the plugin manifest names MIT. The author has not specified a license, rights to use and copy are undefined, ask the author.
- Claude Code, `jq` and an installed Codex CLI (`npm install -g @openai/codex`) are required. The OpenAI API is unavailable from Russia.
- By default Codex runs with `--dangerously-bypass-approvals-and-sandbox`, that is, with no approvals and no sandbox. The safer `--sandbox workspace-write` is set through the `REVIEW_LOOP_CODEX_FLAGS` variable.
- On first run `/review-loop` itself enables `multi_agent = true` in `~/.codex/config.toml` and creates the file if it did not exist.
- A second model does the review, so findings do not guarantee the absence of bugs. Claude fixes only the items it agrees with, and the rest stay in the report.
- The author advises adding the state file `.claude/review-loop.local.md` and the log `.claude/review-loop.log` to `.gitignore`.
How to disable. Abort the current loop with `/cancel-review`. To remove the plugin, run `/plugin` in Claude Code and remove review-loop, or use `claude plugin uninstall review-loop@hamel-review`. Delete the `reviews/` folder and the files in `.claude/` by hand. The `multi_agent = true` line in `~/.codex/config.toml` stays, remove it yourself if needed.
FAQ
How does the plugin decide which review agents to run?
The hook inspects project files. The diff review and the project review always run. The Next.js agent is added when `next.config.js`, `.mjs` or `.ts` exists or `"next"` appears in `package.json`. The interface agent is added if `app/`, `pages/`, `src/app`, `src/pages`, `public/` or `index.html` exists.
What happens if the hook breaks in the middle of a loop?
On any error the script answers with an approve decision and deletes the temporary files: the lock, the Codex runner script, the prompt text and the retry counter. The author built this so the user never gets stuck in a broken loop. Look for the cause in the `.claude/review-loop.log` log.
Where is the review result stored?
In `reviews/review-<id>.md`, where the id is made of the date, the time and six hexadecimal characters. Each finding carries a file path, a line, a severity from critical to low, a category, a description and a suggested fix.
How do I make the Codex launch safer?
Set the `REVIEW_LOOP_CODEX_FLAGS` variable to `--sandbox workspace-write`. The default is `--dangerously-bypass-approvals-and-sandbox`, under which Codex runs without approvals and without isolation.
Can the plugin be updated?
Yes. Run `claude plugin marketplace update hamel-review`, then `claude plugin update review-loop@hamel-review`. The plugin manifest currently says version 1.8.0.
Discussion
No questions or reviews yet.
Related
PluginsOpenAI's official plugin: Codex reviews of your changes and task delegation to Codex from inside a Claude Code session
A skill for second-agent review of plans or code: Claude Code starts rounds, Codex reviews, and they exchange files
A Claude Code plugin: 39 commands for PRs, review, commits and specs, nine expert roles and hooks, in eight language versions
A code-review CLI and plugin for agents: reads a git diff and writes line-level comments with context
A set of slash commands, skills and subagents for Claude Code: review, tests, security, releases, docs and GitHub to Linear sync
A ready-made Claude Code setup: agents, slash commands, skills, safety hooks, rules and MCP connections in one install
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Repository stars | Main difference |
|---|---|---|---|
| review-loop (this entry) | no | 726 | |
| Codex plugin for Claude Code | no | 34,511 | OpenAI's official plugin: review and task handoff to Codex are on-demand commands, with no stop-hook loop |
| open-code-review | no | 48,149 | a standalone ocr command that reads git diff and writes line-level comments, with no Claude Code or Codex |
| OpenQodex | no | 796 | openQodex reviews your change before a push |
README in short
The repository holds a marketplace with a single plugin: a manifest, two commands, a stop hook and a setup script. The project description covers the two-phase loop with the exit block, a table of four review agents, requirements, manual setup of Codex multi-agent mode, and the install, update and cancel commands. An environment variable for Codex flags and the run log are described separately. The repository has no tests.