mcpField
C
convex-reviewer

convex-reviewer

github.com/get-convexTesting & quality6931.3k installsUpdated 1d ago
Repository

About convex-reviewer

convex-reviewer is a Convex-specific code review skill for developers. It checks security, authorization, validators, performance, and schema design, then groups findings by severity with reasons and fixes.

Key features

  1. 01Security and authorization checks
  2. 02Validator and schema review
  3. 03Query performance checks
  4. 04Severity-ranked findings with fixes

Use cases

  1. 01Reviewing Convex code before merging
  2. 02Finding authorization and data-access risks
  3. 03Checking query patterns and validators

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/get-convex/agent-skills --skill convex-reviewer

After installing, type/convex-reviewerin Claude Code to confirm it loaded.

Details

From the project README

Convex Code Reviewer

Structured review of Convex code for security, authorization, validators, performance, and schema design. Applies a Convex-specific checklist and flags anti-patterns with severity (Critical / Important / Suggestion).

Workflow

  1. First pass — Security: verify all public functions check ctx.auth.getUserIdentity(), verify resource ownership before reads/writes, confirm no client-provided user IDs are trusted, confirm scheduled functions target internal.* not api.*.
  2. Second pass — Performance: confirm no .filter() on DB queries (withIndex required), verify all foreign-key fields have indexes, confirm no Date.now() in query handlers, confirm .collect() is not used on unbounded queries.
  3. Third pass — Code quality: confirm args and returns validators on every public function, no any types, promises are awaited, arrays in documents are bounded (<8192 elements).
  4. Report findings grouped by severity; explain why each issue matters and suggest a fix.

Rules

  • Flag missing auth checks as Critical — any unauthenticated public mutation is a data-loss risk.
  • Flag .filter() on DB queries as Important — it is a full table scan.
  • Flag Date.now() in query handlers as Important — it breaks reactivity.
  • Flag missing args or returns validators as Important.
  • Flag scheduling to api.* (not internal.*) as Important.
  • Always explain why a change is needed, not just what to change.

Comments

Markdown supported