Reviewgate — Security skill for Claude Code

Reviewgate

**Reviewgate intercepts your Claude Code or Codex agent's turn-end, runs an independent LLM review over the actual change, and requires an explicit outcome for every blocking finding.** It is the *checker* half of the agent loop, packaged so the writer can't grade its own homework. A clean PASS releases the turn; WARN-only policy, infrastructure deferral and bounded human escalation remain visibly distinct from PASS.

• 🐛 Catches real bugs before the agent says "done" — a heterogeneous panel (Codex · Gemini · Claude · OpenCode · OpenRouter · Ollama) reviews the actual diff, in-loop, every turn.
• 🚦 Never turns failure into green — a crash, timeout or quota outage is never reported as PASS. Reviewgate blocks, explicitly defers for a bounded window, or escalates to a human according to the configured policy.
• 📋 Leaves an audit trail — every finding and every fix/reject decision is written to files (.reviewgate/pending.md) a human (or CI) can inspect later — no chat-stream parsing, no flaky stdout scraping.

Reviewers run the official provider CLIs, so users on Claude Pro/Max, ChatGPT Plus/Pro and Gemini Advanced pay **$0 per review** within their subscription quotas (OAuth-first). OpenRouter reviewers use an API key and can target any hosted model by name.

[!WARNING] **Alpha.** Reviewgate runs provider CLIs on your working-tree diff. Reviewer **filesystem write isolation plus secret-path masking ships** (macOS Seatbelt, Linux bubblewrap) but is **opt-in** (`sandbox.mode`, default `off`). It is a denylist model, not a read allowlist: other host files may remain readable, and **network egress is not isolated**. Prefer your own code / trusted repos. See [Security](#security).

**Demo