AiCodeReview.Analyzer 1.1.0

AiCodeReview.Analyzer

Automatic AI-powered code review on every build — surfaced as compiler warnings directly inside Visual Studio.

What is it?

AiCodeReview.Analyzer is a Roslyn diagnostic analyzer that hooks into the C# compiler pipeline. Every time you build, it reviews your code using AI and surfaces actionable feedback inline in Visual Studio as compiler warnings — no extra tools, no copy-paste, no browser.

Not a SonarQube replacement. It is a powerful shift-left complement — it catches bugs, vulnerabilities, and code smells before commit so fewer issues reach your Sonar quality gate.

Install

dotnet add package AiCodeReview.Analyzer

Or search AiCodeReview.Analyzer in Visual Studio - NuGet Package Manager and click Install.

Setup

Set your AI API key as an environment variable before building:

PowerShell (current session)

$env:AI_CODE_REVIEW_KEY = "your-api-key"

System-wide (recommended for team use)

[System.Environment]::SetEnvironmentVariable("AI_CODE_REVIEW_KEY", "your-api-key", "User")

GitHub Actions / CI

env:
  AI_CODE_REVIEW_KEY: ${{ secrets.AI_CODE_REVIEW_KEY }}

If AI_CODE_REVIEW_KEY is not set the analyzer silently skips — your build is never broken.

Optional — use a custom endpoint

To point the analyzer at a different AI backend, set:

$env:AI_CODE_REVIEW_URL = "your-chat-completions-endpoint"

Works with Azure OpenAI, Ollama, or any OpenAI-compatible API.

Diagnostic IDs

Real example output

Class1.cs(122): error   AICR002: SQL injection via string concatenation in query (S3649)
Class1.cs(154): error   AICR002: Weak cryptographic algorithm MD5 - use SHA256 or Argon2 (S4790)
Class1.cs(71):  error   AICR001: Infinite recursion - no base case - stack overflow risk (S2259)
Class1.cs(58):  error   AICR001: Condition always true - role != Admin || role != User (S2583)
Class1.cs(26):  warning AICR006: Cognitive complexity exceeds threshold (S3776)

Recommended team setup

Developer writes code
        |
        v
AiCodeReview.Analyzer  —  catches issues BEFORE commit, instant feedback in VS
        |
        v
Git commit / PR
        |
        v
SonarQube CI scan      —  enforces rules, gates, metrics, compliance (authoritative)

Auto-apply to every project in a solution

Drop a Directory.Build.props at your repo root — every project gets reviewed with no .csproj changes needed:

<Project>
  <ItemGroup Condition="'$(MSBuildProjectName)' != 'AiCodeReview.Analyzer'">
    <PackageReference Include="AiCodeReview.Analyzer" Version="1.0.9">
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
      <PrivateAssets>all</PrivateAssets>
    </PackageReference>
  </ItemGroup>
</Project>

Control severity via .editorconfig

[*.cs]
dotnet_diagnostic.AICR001.severity = error
dotnet_diagnostic.AICR002.severity = error
dotnet_diagnostic.AICR003.severity = warning
dotnet_diagnostic.AICR004.severity = warning
dotnet_diagnostic.AICR005.severity = suggestion
dotnet_diagnostic.AICR006.severity = warning
dotnet_diagnostic.AICR007.severity = error

Suppress for a specific block:

#pragma warning disable AICR001
public void MyMethod() { }
#pragma warning restore AICR001

Requirements

License

MIT (c) ravikalluri