crefft Source 2026.10.4

Code Agent Family Guide

crefft > AI > Code Agents

The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in RFC 2119.

Quick Reference

CommandAgentModelUse Case
/codeCode ArchitectOpusFull code assessment
/code quickCode ReviewerHaikuFast scan, critical only
/code reviewCode ReviewerSonnetStandard code review
/code perfPerformance ReviewerSonnetPerformance analysis
/code a11yAccessibility ReviewerSonnetWCAG/A11y compliance
/code apiREST API ReviewerSonnetREST API design
/code api --graphqlGraphQL API ReviewerSonnetGraphQL schema design
/code testsTest WriterSonnetTest generation
/code simplifyCode SimplifierSonnetComplexity reduction
/code docsDocumentation Writer (docs family)SonnetDocumentation

Overview

The crefft Code Agent Family is a coordinated set of specialized AI agents for comprehensive code analysis and generation. Unlike monolithic review tools, this family provides:

  1. Specialized Expertise - Each agent is an expert in its domain
  2. Cost Optimization - Right model for each task (Haiku → Sonnet → Opus)
  3. Comprehensive Coverage - From quick scans to deep architectural review
  4. Educational Focus - Explains issues, not just flags them
  5. Auto-Fix Oriented - Every issue includes remediation

Architecture

┌─────────────────────────────────────────────────────────────────────────────┐
│                        CREFFT  CODE AGENT FAMILY                            │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│                      ┌────────────────────────────┐                         │
│                      │     CODE ARCHITECT         │                         │
│                      │    (Opus - Coordinator)    │                         │
│                      └─────────────┬──────────────┘                         │
│                                    │                                         │
│  ┌──────────┬──────────┬──────────┼──────────┬──────────┬──────────┐       │
│  ▼          ▼          ▼          ▼          ▼          ▼          ▼       │
│ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ ┌──────┐│
│ │ CODE   │ │PERFORM-│ │ACCESS- │ │  API   │ │  API   │ │ TEST   │ │SIMPL-││
│ │REVIEWER│ │ ANCE   │ │IBILITY │ │  REST  │ │GRAPHQL │ │ WRITER │ │IFIER ││
│ │(Sonnet)│ │(Sonnet)│ │(Sonnet)│ │(Sonnet)│ │(Sonnet)│ │(Sonnet)│ │(Son.)││
│ └────────┘ └────────┘ └────────┘ └────────┘ └────────┘ └────────┘ └──────┘│
│                                                                              │
│ ┌────────────────────────────────────────────────────────────────────────┐  │
│ │                        SUPPORTING AGENTS                               │  │
│ │  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐                 │  │
│ │  │  DOC WRITER  │  │   VERIFY     │  │   (Future)   │                 │  │
│ │  │   (Sonnet)   │  │    BUILD     │  │              │                 │  │
│ │  │ docs family  │  │  (Sonnet)    │  │              │                 │  │
│ │  └──────────────┘  └──────────────┘  └──────────────┘                 │  │
│ └────────────────────────────────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────────────────────────────┘

Agent Specifications

Tier 1: Strategic Coordinator

Code Architect

The Code Architect is the strategic coordinator for all code review efforts.

AttributeValue
ModelOpus 4.5
Command/code
Fileconfigs/claude/agents/code/architect.md

Responsibilities:

  • Assess overall code quality and architecture
  • Route to appropriate specialist agents
  • Synthesize findings across domains
  • Provide prioritized remediation roadmap

When to Use:

  • Comprehensive code review
  • Cross-cutting concerns (security + performance + quality)
  • Major feature reviews
  • Pre-merge gates for critical code

Tier 2: Domain Specialists

Code Reviewer

General-purpose code review with modes.

AttributeValue
ModelSonnet 4.5 (quick: Haiku)
Command/code review, /code quick
Fileconfigs/claude/agents/code/reviewer.md

Modes:

  • Quick (Haiku): Critical issues only, <50 LOC
  • Standard (Sonnet): Security, performance, quality
  • Deep (Sonnet→Opus): Architecture, patterns, edge cases

Coverage:

  • Security (OWASP Top 10 basics)
  • Performance (N+1, memory, algorithms)
  • Quality (complexity, duplication, naming)
  • Tests (coverage, edge cases)

Performance Reviewer

Deep performance analysis.

AttributeValue
ModelSonnet 4.5
Command/code perf
Fileconfigs/claude/agents/code/performance.md

Coverage:

  • Database queries (N+1, missing indexes)
  • Memory patterns (leaks, allocation)
  • Algorithmic complexity
  • Caching strategies
  • Connection pooling
  • Async/queue patterns
  • Observability instrumentation

Accessibility Reviewer

WCAG/A11y compliance specialist.

AttributeValue
ModelSonnet 4.5
Command/code a11y
Fileconfigs/claude/agents/code/accessibility.md

Coverage:

  • WCAG 2.1 AA compliance
  • ARIA patterns
  • Keyboard navigation
  • Screen reader compatibility
  • Color contrast
  • Focus management

Unique Value: Only AI tool with deep A11y analysis.


REST API Reviewer

REST API design specialist.

AttributeValue
ModelSonnet 4.5
Command/code api
Fileconfigs/claude/agents/code/api-rest.md

Coverage:

  • RESTful conventions
  • HTTP methods and status codes
  • Pagination patterns
  • Error response format
  • Versioning strategy
  • Rate limiting

GraphQL API Reviewer

GraphQL schema design specialist.

AttributeValue
ModelSonnet 4.5
Command/code api --graphql
Fileconfigs/claude/agents/code/api-graphql.md

Coverage:

  • Schema design
  • Query complexity
  • N+1 prevention (DataLoader)
  • Authorization patterns
  • Naming conventions
  • Deprecation strategy

Test Writer

Comprehensive test generation.

AttributeValue
ModelSonnet 4.5
Command/code tests
Fileconfigs/claude/agents/code/test-writer.md

Coverage:

  • Mutation-first approach
  • Property-based testing
  • Visual regression testing
  • Contract testing (Pact)
  • E2E patterns
  • Test data generation

Code Simplifier

Complexity reduction specialist.

AttributeValue
ModelSonnet 4.5
Command/code simplify
Fileconfigs/claude/agents/code/simplifier.md

Coverage:

  • Cyclomatic complexity reduction
  • Extract method opportunities
  • Dead code removal
  • Abstraction simplification
  • Before/after metrics

Tier 3: Supporting Agents

Documentation Writer

Documentation generation. /code docs MUST route to the documentation family’s documentation-writer subagent: the code family defines no documentation agent of its own.

AttributeValue
Agent namedocumentation-writer
ModelSonnet (frontmatter model: sonnet)
Command/code docs
Fileconfigs/claude/agents/docs/writer.md

Output:

  • API documentation
  • README sections
  • Code comments
  • Architecture diagrams (Mermaid)

Why: documentation already has a dedicated agent family, so the code family delegates instead of carrying a second definition that would drift from it. The code family therefore holds exactly eight agents, and /code docs is a cross-family route: an installation that omits agents/docs/writer.md leaves the subcommand with no agent to invoke, so installers MUST copy that file alongside the eight code agents.


Language-Specific Review Checklists

Code agents MUST apply language-specific checks based on the file type being reviewed.

Python Review Checklist

CategoryCheckSeverity
Type SafetyType hints on public APIsSHOULD
Type Safetytyping.Optional for nullable paramsSHOULD
Type Safetyfrom __future__ import annotations (3.7+)MAY
Asyncasync def without await callsHigh
AsyncBlocking calls in async functionsHigh
Asyncasyncio.run() inside running event loopCritical
Resource MgmtContext managers for file/DB handlesMUST
Resource MgmtUnclosed resources in exception pathsHigh
PerformanceMutable default argumentsHigh
PerformanceString concatenation in loopsMedium
Performancelist() where generator sufficientLow
Securitypickle with untrusted dataCritical
Securityeval() or exec() with user inputCritical
SecuritySQL string formatting (not parameterized)Critical
TestingMissing pytest.mark.asyncio for async testsMedium
Testingmock.patch without autospec=TrueLow

Go Review Checklist

CategoryCheckSeverity
ErrorsIgnoring error returns (_ = fn())High
ErrorsNaked panic() in library codeCritical
Errorslog.Fatal() in library codeHigh
ConcurrencyData races (shared state without sync)Critical
ConcurrencyGoroutine leaks (unbounded spawning)High
ConcurrencySending on closed channelCritical
ConcurrencyMissing defer mu.Unlock() patternHigh
Resource MgmtMissing defer resp.Body.Close()High
Resource MgmtMissing defer rows.Close()High
PerformancePassing large structs by valueMedium
PerformanceString concatenation in loopsMedium
Performanceappend() without pre-allocation hintLow
SecurityUnvalidated user input in sql.QueryCritical
Securityunsafe package without justificationHigh
Testingt.Parallel() missing for independent testsLow
TestingTable-driven tests without subtestsLow

Rust Review Checklist

CategoryCheckSeverity
Safetyunsafe without safety commentMUST FIX
Safetyunwrap() in library codeHigh
Safetyexpect() without context messageMedium
SafetyRaw pointer dereference patternsCritical
AsyncHolding Mutex across .awaitCritical
AsyncBlocking in async contextHigh
Asynctokio::spawn without error handlingMedium
LifetimesUnnecessary 'static boundsMedium
LifetimesMissing lifetime elision opportunitiesLow
Performanceclone() where borrow sufficientMedium
Performancecollect() before filter()Medium
PerformanceBox<dyn Trait> where generic sufficientLow
Error Handlinganyhow in library (vs thiserror)Medium
Error HandlingUnused Result (missing ? or handling)High
TestingMissing #[should_panic] for panic testsLow
TestingNo proptest for invariant-heavy codeMAY

TypeScript Review Checklist

CategoryCheckSeverity
Type Safetyany type usageHigh
Type SafetyNon-null assertions (!) without justificationMedium
Type SafetyMissing return types on public APIsSHOULD
Type Safetyas casts without type guardsMedium
AsyncMissing await on PromiseCritical
AsyncFloating Promises (not awaited or .catch)High
Asyncasync function without awaitMedium
ReactMissing dependency in useEffect deps arrayHigh
ReactState mutation instead of setStateCritical
ReactMissing key prop in listsHigh
ReactuseCallback/useMemo without dependenciesHigh
PerformanceInline function in JSX propsLow
PerformanceRe-renders from new object/array literalsMedium
SecuritydangerouslySetInnerHTML without sanitizationCritical
Securityeval() or Function() usageCritical
TestingMissing act() wrapper for state updatesMedium
TestingwaitFor without assertion insideMedium

Severity Levels

All findings use RFC 2119 severity levels:

LevelKeywordMeaningAction Required
CriticalMUST FIXSecurity vulnerability, data loss riskBlock merge
HighMUSTSignificant bug or issueFix before merge
MediumSHOULDImprovement neededFix soon
LowMAYMinor enhancementConsider
InfoN/AObservation onlyAwareness

Output Format

All code agents MUST use this output format:

## Code Review: [Brief Title]

| Metric | Value |
|--------|-------|
| **Review Effort** | [1-5] |
| **Risk Level** | Low / Medium / High / Critical |
| **Change Size** | XS / S / M / L / XL |

### 🔴 Critical (must fix before merge)

- [ ] **[Category]**: [description] (`file:line`) — **[confidence]%**

  **Evidence**: [how we know this is an issue]

  **Before**:
  ```[lang]
  [problematic code]
  ```

  **After**:

  ```[lang]
  [fixed code]
  ```

  **Why**: [explanation]

### 🟡 Warning (should fix)

### 🔵 Suggestion (consider)

### ✅ Positive Observations

### Summary

[1-2 sentence overall assessment]

Cost Optimization

AgentModelEst. Cost/InvocationVolume
Code ArchitectOpus$0.50Per PR (major)
Code ReviewerSonnet$0.20Per PR
Code Reviewer QuickHaiku$0.02Per commit
Performance ReviewerSonnet$0.25On request
Accessibility ReviewerSonnet$0.20Frontend PRs
API ReviewersSonnet$0.20API changes
Test WriterSonnet$0.30On request
Code SimplifierSonnet$0.25Post-feature
Documentation WriterSonnet$0.20On request

Estimates assume Claude API list prices — Opus 4.5 at $5/$25, Sonnet 4.5 at $3/$15 and Haiku 4.5 at $1/$5 per million input/output tokens — over a PR-sized context: roughly 10K in and 2K out for quick mode, 20K in and 8K out for one specialist, 40K in and 12K out for the Opus coordinator. Teams MUST re-derive them from their own provider’s price list.

Cost by Mode:

ModeTypical CostUse Case
/code quick~$0.02Every commit
/code review~$0.20PR review
/code~$0.80Full assessment

Model Lifecycle

Every route MUST name an exact API model ID in the frontmatter of the subagent or skill that runs it, and that ID MUST be active on the provider the team bills through.

  • The Haiku route used by /code quick MUST pin claude-haiku-4-5-20251001. It is active on the Claude API, with a tentative retirement not sooner than 15 October 2026.
  • claude-3-5-haiku-20241022 (Haiku 3.5) MUST NOT be used. It was deprecated on 19 December 2025 and retired on the Claude API on 19 February 2026; requests to retired models fail.
  • Those dates cover Anthropic-operated platforms only — the Claude API, Claude Platform on AWS, and Microsoft Foundry. Amazon Bedrock and Google Cloud set their own retirement schedules and still serve Haiku 3.5, so teams on a partner platform MUST take the lifecycle date from that platform’s own model table.
  • Changing a model changes what the agent reports and what it costs. Teams MUST re-run the role’s evaluation and re-derive the estimates above before adopting a replacement.

Why: a retired ID is not a quality trade-off, it is an outage. The model deprecations table gives current status and replacement IDs, and pricing marks Haiku 3.5 as retired except on Bedrock and Google Cloud.

Workflow Examples

Example 1: Standard PR Review

sequenceDiagram
    participant Dev as Developer
    participant CA as Code Architect
    participant CR as Code Reviewer
    participant PR as Performance
    participant TW as Test Writer

    Dev->>CA: Opens PR
    CA->>CA: Analyze changes
    CA->>CR: Route to Code Reviewer
    CA->>PR: Performance-sensitive code detected
    CR-->>CA: 1 High, 3 Medium findings
    PR-->>CA: 1 N+1 query warning
    CA->>Dev: Consolidated Report
    Dev->>TW: "/code tests"
    TW-->>Dev: Generated tests
    Dev->>CA: Re-review
    CA-->>Dev: ✅ Approved

Example 2: Frontend Review with A11y

sequenceDiagram
    participant Dev as Developer
    participant CA as Code Architect
    participant CR as Code Reviewer
    participant A11y as Accessibility

    Dev->>CA: PR with React components
    CA->>CR: Code review
    CA->>A11y: Frontend detected
    CR-->>CA: Code quality OK
    A11y-->>CA: Missing ARIA labels
    CA->>Dev: A11y findings
    Dev->>Dev: Fix issues
    Dev->>CA: Re-review
    CA-->>Dev: ✅ Approved

Configuration

Install the Code Agent Family

Claude Code discovers subagents and slash commands by file location, not by a settings key. Installing the family means copying the definitions into a directory Claude Code scans; there is nothing to switch on afterwards.

A project install SHOULD be preferred, because the definitions are then version-controlled with the code they review:

# Run from the root of the project that will be reviewed.
# CREFFT points at a clone or unpacked release of this repository.
CREFFT="${CREFFT:-$HOME/src/crefft}"

mkdir -p .claude/agents/code .claude/agents/docs .claude/commands
cp "$CREFFT"/agents/code/*.md .claude/agents/code/
cp "$CREFFT"/agents/docs/writer.md .claude/agents/docs/
cp "$CREFFT"/commands/code.md .claude/commands/code.md

The result:

project/
├── .claude/
│   ├── agents/
│   │   ├── code/
│   │   │   ├── accessibility.md   # accessibility-reviewer
│   │   │   ├── api-graphql.md     # graphql-api-reviewer
│   │   │   ├── api-rest.md        # rest-api-reviewer
│   │   │   ├── architect.md       # code-architect
│   │   │   ├── performance.md     # performance-reviewer
│   │   │   ├── reviewer.md        # code-reviewer
│   │   │   ├── simplifier.md      # code-simplifier
│   │   │   └── test-writer.md     # test-writer
│   │   └── docs/
│   │       └── writer.md          # documentation-writer, for /code docs
│   └── commands/
│       └── code.md                # /code
└── AGENTS.md

Copy the eight code agents and agents/docs/writer.md: /code docs delegates to the documentation family, so an install that skips that file advertises a subcommand with no agent behind it.

Why the subdirectories are safe: Claude Code scans .claude/agents/ recursively and takes a subagent’s identity from its name frontmatter field, not from its path, so code/ and docs/ are organization only and do not change how an agent is invoked.1

Installation Scopes

ScopeLocationUse when
Project.claude/agents/, .claude/commands/The team shares the family
Personal~/.claude/agents/, ~/.claude/commands/Every project on one machine
Sessionclaude --agents '<json>'One-off trials and CI scripts
PluginThe plugin’s agents/ and skills/ directoriesFleet-wide distribution

Project definitions win over personal ones of the same name, and managed settings or --agents outrank both. Skills resolve the other way: a personal skill overrides a project skill of the same name. Plugin agents are namespaced as plugin-name:agent-name, so an explicit invocation MUST use the scoped identifier.1 2

A session-scoped install saves nothing to disk and is RECOMMENDED for trying a definition before committing it:

claude --agents '{
  "code-reviewer": {
    "description": "crefft standard code review. Use after code changes.",
    "prompt": "You are the crefft code-reviewer agent. Report findings by severity.",
    "tools": ["Read", "Grep", "Glob", "Bash"],
    "model": "sonnet"
  }
}'

For new work, a skill SHOULD be preferred over a command file: custom commands have been merged into skills, .claude/skills/code/SKILL.md and .claude/commands/code.md both provide /code, and the skill wins when both exist. A skill directory also carries supporting files and controls whether Claude may invoke it without being asked.2

Verify, Update, and Remove

Restart Claude Code after creating .claude/agents/ for the first time: a running session does not pick up an agents directory that did not exist when it started. Then confirm the install:

ls .claude/agents/code .claude/agents/docs .claude/commands
grep -h '^name:' .claude/agents/code/*.md .claude/agents/docs/writer.md

Nine name: lines MUST appear — the eight code agents and documentation-writer. Duplicate names in one directory are resolved by filesystem read order rather than a documented precedence, so keep them unique; /doctor reports duplicates.1

Update by re-running the copy against a newer pinned release, and remove by deleting the same paths:

# Update: pin an explicit release tag, then re-copy over the installed files.
git -C "$CREFFT" fetch --tags
git -C "$CREFFT" tag --list          # pick the release to pin
git -C "$CREFFT" checkout v2.9.0
cp "$CREFFT"/agents/code/*.md .claude/agents/code/
cp "$CREFFT"/agents/docs/writer.md .claude/agents/docs/
cp "$CREFFT"/commands/code.md .claude/commands/code.md

# Remove.
rm -rf .claude/agents/code .claude/agents/docs/writer.md .claude/commands/code.md

What settings.json Does Not Do

.claude/settings.json MUST NOT be used to enable or install this family. The settings schema has no agents key: the top-level agent key it does define selects one agent for the main thread and does not register anything. Settings change runtime behavior — permissions, hooks, sandboxing, plugin enablement — for definitions that are already installed:

{
  "permissions": {
    "deny": ["Agent(Explore)"]
  }
}

Why: the schema accepts additional properties, so an invented block such as "agents": {"code": {"enabled": true}} validates, is silently ignored, and leaves a team believing review is switched on when no agent or command has been installed at all. Deny the Agent tool outright to stop delegation entirely, or name a subagent to block just that one.1

Best Practices

DO

  • MUST run /code review on all PRs
  • MUST run /code a11y on frontend changes
  • MUST address Critical and High findings before merge
  • SHOULD use /code quick for rapid iteration
  • SHOULD run /code tests for new features
  • MAY use /code simplify after feature completion

DON’T

  • MUST NOT ignore Critical findings
  • MUST NOT skip review for “small” changes
  • SHOULD NOT rely solely on quick mode for final review
  • SHOULD NOT skip A11y review for user-facing changes

See Also

References


Last Updated: 2025-01-02 Version: 1.0.0

Footnotes

  1. Create custom subagents — discovery locations, scopes, frontmatter fields, and permission rules. ↩ ↩2 ↩3 ↩4

  2. Extend Claude with skills — skill locations and the merge of custom commands into skills. ↩ ↩2