What AI code reviewers miss, and the checks I built for it

Description and use

Healthkit is a Python code review toolkit that measures rule effectiveness, focuses on pattern detection, and complements with behavior checks via Schemathesis, improving the reliability of AI-generated code reviews.

Problem

AI-generated code often contains subtle bugs that automated reviewers miss, leading to regressions and security issues.

Outcome

Healthkit reduced false positives, caught real bugs, and clarified that a clean run means "nothing it knows about" rather than safety.

Workflow

• 1. Measure rule effectiveness on a human-reviewed module (45 findings, 9 true positives).
• 2. Design rules around patterns, project knowledge, and behavior.
• 3. Build healthkit with deterministic rules, AI advisory only.
• 4. Run healthkit review on changed lines with "healthkit review --base main".
• 5. Flag any rule or # noqa changes for human approval.
• 6. Use healthkit api to test API routes for crashes and access leaks.
• 7. Iterate rules based on measured precision and coverage.

Evidence

A careful human review of one module had produced 45 findings.

Source

The first score was 29 of 45. It looked great. Then we read every hit by hand. Most were coincidences: an unused import that happened to sit inside a behaviour fix, findings inside routes the fix deleted anyway. Counting only the hits where the rule pointed at the actual problem: 9 of 45, about 20%.

Source

healthkit can never judge whether the logic is right, whether it is secure, or whether the design is right. A clean run means "nothing it knows about", never "safe".

Source

healthkit api sends good and bad input to every route of an API (via Schemathesis) and treats any server error as a finding. On the test project it found six real crashes, none of which had a rule.

Source