Engineering Agent

The engineering agent is responsible for code quality, architecture review, security audits, and technical-debt management. It has direct access to the codebase, so it can deliver concrete, actionable feedback.

Implementing the Dev Agent

// src/agents/dev.ts
import { query } from "@anthropic-ai/claude-agent-sdk";
import { AgentResponse } from "../shared/types";
import { extractText, log } from "../shared/utils";

const DEV_SYSTEM_PROMPT = `You are a senior software architect with 15 years of experience.
You evaluate code quality, security, performance, and scalability in balance.
Whenever you find a problem, you always propose a concrete fix alongside it.
You judge against OWASP Top 10, the SOLID principles, and clean-code guidelines.`;

export async function runDevAgent(task: string): Promise<AgentResponse> {
  log("DEV", `Starting task: ${task.slice(0, 40)}...`);

  const response = await query({
    prompt: `${DEV_SYSTEM_PROMPT}\n\n---\n\n${task}`,
    options: {
      maxTurns: 15,
      tools: ["Read", "Glob", "Grep", "Bash"]
    }
  });

  const result = extractText(response);
  const hasCritical = result.includes("Critical") ||
    result.includes("critical") ||
    result.includes("security vulnerability");

  log("DEV", `Task complete (critical issues: ${hasCritical ? "yes" : "no"})`);

  return {
    department: "dev",
    result,
    confidence: "high",
    escalationNeeded: hasCritical,
    actionItems: extractCodeActionItems(result)
  };
}

function extractCodeActionItems(text: string): string[] {
  const items: string[] = [];
  const lines = text.split("\n");

  for (const line of lines) {
    if (line.match(/^(TODO|FIX|CRITICAL|SECURITY|FIX NEEDED):/i)) {
      items.push(line.trim());
    }
  }

  return items.slice(0, 10);
}

Key Engineering Workflows

1. Automated PR Code Review

> Engineering: review the recent changes in src/api/auth/.
  Focus on: security issues, API design consistency

Example agent response:

## PR Code Review Results

### 🔴 Critical (fix immediately)
1. src/api/auth/login.ts:47
   User input injected directly into a SQL query → SQL injection risk
   Fix: use a parameterized query

### 🟡 Major (fix within the next sprint)
2. src/api/auth/jwt.ts:23
   JWT secret is hardcoded → move it to an environment variable

### 🟢 Suggested improvements
3. src/api/auth/middleware.ts
   Duplicated auth-middleware code → could be extracted into a shared function

2. Technical-Debt Analysis

async function analyzeTechDebt(rootDir: string) {
  return runDevAgent(
    `Analyze the technical debt in the ${rootDir} codebase.

    Items to analyze:
    1. Collect TODO/FIXME/HACK comments and classify by priority
    2. Identify functions with high cyclomatic complexity (>10)
    3. Modules with insufficient test coverage
    4. Deprecated package dependencies
    5. Duplicated code patterns

    Output: classification by severity + estimated fix effort (SP)`
  );
}

3. Security Audit

async function securityAudit(targetDir: string) {
  return runDevAgent(
    `Audit ${targetDir} for security vulnerabilities against the OWASP Top 10.

    Items to review:
    - A01: Broken access control
    - A02: Cryptographic failures
    - A03: Injection (SQL, XSS, XXE)
    - A04: Insecure design
    - A05: Security misconfiguration
    - A06: Vulnerable or outdated components

    For each vulnerability: include location, severity, attack scenario, and fix code`
  );
}

4. Architecture Review

async function architectureReview(requirement: string) {
  return runDevAgent(
    `Review the system architecture for the following requirement and propose improvements.

    Requirement:
    ${requirement}

    Current architecture analysis:
    - Strengths and weaknesses of the current structure
    - Scaling bottlenecks
    - Single points of failure (SPOF)
    - Opportunities to split into microservices

    Improvement recommendations:
    - Short term (1 month): changes you can apply immediately
    - Mid term (3 months): incremental refactoring
    - Long term (6 months): architecture migration roadmap`
  );
}

Engineering Agent Automation Pipeline

A GitHub Actions workflow that runs a code review automatically whenever a PR is opened:

# .github/workflows/ai-code-review.yml
name: AI Code Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  ai-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get changed files
        id: changed
        run: |
          git diff --name-only origin/main...HEAD > changed_files.txt
          echo "files=$(cat changed_files.txt | tr '\n' ',')" >> $GITHUB_OUTPUT

      - name: Run AI Review
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          node scripts/ai-review.js "${{ steps.changed.outputs.files }}"

      - name: Post Review Comment
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const review = fs.readFileSync('review-result.md', 'utf8');
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: review
            });

Getting the Most Out of the Engineering Agent

• Before a code review, use Glob to pin down just the changed files and pass only those
• Automate security audits as a recurring biweekly run
• Wire up Slack/email alerts when critical issues are found