Every engineering team has review rules that no linter knows about. Refunds must post a ledger entry. Migrations can’t lock the orders table. Nobody logs a customer’s email. A general-purpose reviewer, human or AI, won’t catch these unless it knows them, and today they live in the heads of a few senior engineers who can’t review every pull request.
CodeAnt AI Custom Agents turn those rules into reviewers. Each custom agent is a set of review instructions your team writes once. CodeAnt AI runs it on every new pull request and update in the repositories you choose, next to its standard review, and posts its findings inline on the changed lines. To help teams get going, Custom Agents comes with a library of ready-made templates, including several for the parts of a pull request most reviews skim.
The examples in this post use Northwind Labs, a fictional company, so every repository, pull request and person in them is made up.
Northwind Labs’ custom agents, each reviewing the repositories it was built for.
Your rules, in plain Markdown
A custom agent is a Markdown document. There’s no rule syntax to learn and no config language. Teams describe what to review, the context a reviewer needs, and what counts as an issue, the same way they’d brief a new senior engineer. Existing review checklists can be imported as .md files.
Northwind’s Refund Safety Reviewer: the team’s refund rules, written once.
One agent, as many repositories as you need
Rules rarely belong to one repository. Money moves through payments, checkout, the gateway and identity at Northwind, so its Refund Safety Reviewer covers all four. Each agent can review one repository or many, and each can be switched on or off on its own.
One agent reviewing four Northwind repositories.
Focused on the files that matter
Include and exclude file patterns keep each agent on its own ground. The Refund Safety Reviewer only reads the refunds, ledger and chargebacks code, and skips tests and fixtures. A focused agent stays quiet on pull requests that aren’t its business.
Include and exclude patterns for the Refund Safety Reviewer.
Findings where developers already look
Custom agent findings appear as inline comments on the changed lines, headed Custom agent: and the agent’s name. Developers see your team’s rules applied in the pull request itself, not in a separate tool.
Start from a template
Writing good review instructions takes time, so Custom Agents comes with a growing library of ready-made templates. Every template is open to read before it’s used, MIT-licensed, and adapted from open-source agent skills. A template becomes your agent the moment you start from it: the instructions, name and file patterns are filled in, and your team can change any of them.
The template library. The templates covered below are highlighted.
An agent started from the GitHub Actions Security template, already scoped to workflow files.
The templates below cover the parts of a pull request that general review tends to skim: the files AI coding agents obey, CI workflows, logging and telemetry, database migrations, and personal data.
Agent Config Guard
Coding agents read files like CLAUDE.md, AGENTS.md, .cursorrules, Cursor rules, skills and MCP configs, and follow them with near system-prompt authority. An edit to one of these files is closer to code than to documentation, and attackers know it. In May 2026, the TrapDoor campaign opened pull requests that added poisoned .cursorrules and CLAUDE.md files to popular AI projects, with hidden instructions meant to get coding assistants to hunt for secrets.
Agent Config Guard catches hidden or invisible content, fetch-and-run steps dressed up as setup, instructions to read credentials or send data out, risky MCP and hook configuration, settings that remove approval prompts, and phrases that try to override earlier instructions.
A new Cursor rule in payments-service tells agents to pipe a remote script into a shell.
GitHub Actions Security
CI workflows run with tokens and secrets, and many can be triggered by anyone who opens a pull request from a fork. In early 2026, an automated attacker known as hackerbot-claw used pwn requests and script injection against public projects including Trivy and awesome-go.
GitHub Actions Security reports a finding only when a change shows the whole attack path: the trigger, the attacker-controlled input, and the step that runs it or exposes a secret. It covers pwn requests, expression injection, comment commands without an author check, missing or excessive permissions, leaked secrets, unpinned actions and AI agent steps that run on fork pull requests.
A preview workflow in checkout-web checks out fork code with a deploy token in scope.
Logging & Observability
Code you can’t observe is code you can’t operate. Logging & Observability checks how new code will run in production: secrets or personal data in logs and metrics, log lines built by string interpolation, swallowed errors, missing request ids, metric labels with unbounded values, latency recorded as an average, dropped trace context, and alerts that page on causes instead of symptoms.
A per-user metric label in api-gateway would create a new time series for every user.
A per-user metric label in api-gateway would create a new time series for every user.
Database Migration Safety
A bad deploy can be rolled back. A bad migration usually can’t. Database Migration Safety judges each migration against a production-sized table, knowing that old and new versions of the app run side by side during a rollout. It catches renames and type changes done in place, drops that ship with code that still reads the column, NOT NULL without a default, indexes built inline on existing tables, whole-table updates in one statement, and migrations with no way back.
A plain CREATE INDEX on the orders table would block writes during the deploy.
Personal Data Guard
Personal data rarely leaks through one big mistake. It leaks through a log line, a URL, a test fixture or a new vendor. Personal Data Guard follows how changed code collects, stores, moves and exposes personal data. It catches personal data in logs, URLs and file names, data sent to a new third party or another jurisdiction, data readable without an ownership check, plaintext storage, new stores with no retention or deletion path, erasure flows that don’t erase, and consent flags that are never checked. It cites GDPR where it helps and accounts for India’s DPDP Act.
The new account-deletion flow in identity-service logs the user’s email and phone number.
Rules that explain themselves
Every rule in these templates has an id, a severity, and four short parts: what to flag, what is not a violation, the fix, and why it matters. Findings cite the rule id, so a developer can see exactly which rule fired and why. The “not a violation” line tells the agent where to stay quiet, which keeps the noise down.
One rule from GitHub Actions Security, broken into its parts.
Available now
Custom Agents is available in CodeAnt AI under Settings, then Custom Agents, along with the full template library. Read more in the custom agents documentation.
Northwind Labs, its repositories, people and all code in this post are fictional examples.
