The new Cloudflare AI code review system gives you the ability to automate your first-pass reviews for thousands of repositories in a multi-agent orchestration system. The design of this architecture allows different domains of the review to be handled by specialized models as opposed to one monolithic prompt.
In this guide, we will walk through setting up this system, configuring model routing, and executing code refactoring.
Multi-Agent Orchestration Architecture
In place of a single reviewer, this implementation utilizes an orchestrator LLM that controls a cluster of up to seven AI agents that are responsible for different tasks. The orchestrator analyses pull requests and decides when a review is required. The orchestrator then launches the spawn_reviewers tool using a custom runtime plugin.
Configuring such an architecture necessitates knowledge about multi-agent architectures in order to properly orchestrate the execution and consolidation of results. Each spawned agent is responsible for its own narrow domain. The concerns are separated into six distinct roles of reviewers:
- Security: looks for vulnerabilities and insecure patterns;
- Performance: identifies performance regressions and inefficiencies;
- Code Quality: analyses maintainability, readability, and style;
- Documentation: verifies correctness of README.md and documentation inside the code;
- Compliance: checks whether the code is compliant with internal standards – Engineering Codex;
- Release Management: verifies the proper versioning and deployment flags.
The Compliance agent checks the code according to organizational guidelines extracted straight from internal RFCs. The agent references the exact rules from the Engineering Codex and provides constructive criticism. The tedious manual audit process is streamlined into an automated one.
Local Environment & Execution
The developer can execute the same review orchestration locally prior to code submission. This way, rules used for CI pipelines will match the local environment rules one-to-one. Early inclusion of such checks is an essential element of modern vibe coding practices, where immediate feedback determines development pace.
Install the @opencode-reviewer/local package to implement review abilities in your OpenCode terminal user interface.
This package uses the same proxy and orchestration mechanism as the main CI pipeline does. After the plugin installation, launch the multi-agent review by executing the /fullreview command through OpenCode TUI.
The local execution starts the spawn_reviewers function that retrieves feedback from all seven dedicated agents right into your terminal.
Model Routing & Infrastructure
The orchestrator routes tasks to various models based on the complexity of the task and the need for context. All tasks go through AI Gateway for caching, rate limiting, and strict observability purposes. Effective management of these routing rules requires adequate LLM observability to measure token usage by different models.
Documentation tasks and simple compliance checks are routed to Workers AI. This layer takes care of 15% of the total reviewer traffic and relies on the Kimi K2.5 model.
Kimi K2.5 has a large context window of 256k and is effective in standardizing documentation reviews. You should leverage structured output in Kimi K2.5 to properly parse the documentation feedback received.
Tasks that require complex architectural analysis and deep security reviews need better reasoning abilities. Orchestration routes such tasks to frontier models like GPT-5.4 and Opus 4.6.
Security and Sandboxing in Code Mode
Any kind of automated code manipulation needs stringent security boundaries. With OpenCode, the Code Mode is designed to ensure safe execution of the code generated by the agents.
The Code Mode allows a sandboxed execution environment for particular agents. If the agent generates code to fix the security flaw or regression, the code runs in a sandbox environment.
The design allows an isolation layer from any malicious, untested, or malformed logic that could be executed in a sensitive deployment environment. All multi-agent LLMs are proxied by a single dedicated worker, which is also connected to Cloudflare Access for a Zero Trust authentication layer.
The security policy is stringently applied to each and every request. Start by installing the @opencode-reviewer/local plugin in a single repository and route your initial tests to the AI Gateway to benchmark the latency and tokens consumed.
The Orchestration Magic
This is where all the magic happens – orchestration. Here’s how agents cooperate when dealing with a complex feature:
1. User Request: “Create a user authentication system”
2. Research Agent analyzes:
- Authentication patterns used in the codebase
- Best practices for security and performance
3. Code Generator generates:
- User authentication endpoints
- User models
- Token-based authorization using JWTs
- Password hashing algorithm
4. Analysis Agent evaluates:
- Potential security issues
- Quality of code
- Performance problems
5. Tools Refiner provides:
- Rate limiting
- Logging mechanism
- Error handling
- Monitoring
And it all works like magic, without any agent doing something in isolation.
Prompt Engineering & Evaluations for Research Agents
Multi-agent systems have distinct characteristics compared to single-agent systems, such as fast increase in coordination complexity. The early agents were prone to such mistakes as spawning 50 subagents for simple queries, endlessly searching the web for nonexistent sources, and distracting each other through excessive updates.
As every agent operates according to the prompt, prompt engineering became our main lever for addressing these issues.
Here are several rules that you should master while prompting agents:
1. Think like your agents.
In order to iterate on prompts, one should know the implications of those. For that purpose, we created simulation environments where we ran the agents with the identical prompts and set of tools as in our system, step by step.
That allowed us to see the flaws in the agents’ behavior: agents proceeding even if they have enough data already, forming excessively verbose queries for search, and using the wrong tools. Prompting is all about building a solid model of the agent’s behavior.
2. Effort should be scaled based on the difficulty of the question.
It is hard for agents to know how much effort to put into various types of questions; hence, scaling rules were built right into the prompts.
For instance, simple fact-finding would require only 1 agent using up to 3-10 tools, while direct comparisons could involve 2-4 subagents making 10-15 tool calls each, and complicated research could use over 10 subagents with well-defined roles.
3. Let the agents improve themselves.
In our work, we saw that Claude 4 models could become outstanding prompt engineers. Given the prompt and the failure mode, the model can understand why the agent is not working properly and how it should be improved.
We even came up with an agent that tests tools. It tries to use the MCP tool and then rewrites its description so that it does not fail. With repeated usage of the tool dozens of times, the agent discovered some nuances and bugs.
This method of improving the ergonomics of the tool decreased the task completion time by 40 percent in the future when using the new description.
4. Start broadly, and then refine the search.
The search approach needs to reflect the way experts in the field conduct broad searches first and then refine them. The agents tend to fall into the trap of making queries too specific, and thus too long, yielding only a few results.
Conclusion:
This is the complete orchestration architecture for developing a multi-agent AI platform for automated code review. It is not rocket science but requires a systematic process. Here you can hire AI developers who understand how multi-agent platforms work.
