Second Look

In small teams, people who are not engineers now ship features written by AI tools, and one engineer has to review all of it. Second Look is a tool for that engineer: it does the first pass on each pull request, and the engineer confirms, rejects, or rewrites every finding before the author sees anything.

Try it

Everything below works without an account.

• Playground: https://second-look-review.vercel.app. Pick an example (C#, EF Core, React, or a prompt-injection attempt) and go through the same four steps as a real review: the pull request arrives and the first pass runs, you confirm or reject each finding, you choose who fixes it and publish, and you see what the author gets on GitHub. Nothing is posted from the playground. Or paste your own code.
• Real pull requests after review, read-only: https://second-look-review.vercel.app/example. Two pull requests on a sample C# service, each through two rounds. On GitHub: CSV export, sent back to the author with a fix prompt, and column rename, taken over by the reviewer.
• The tool reviewing its own code: pull requests #3 to #7 in this repository. It found a flaw in its own eval, a setup script that failed on the documented path, and a crash that the build and the tests had both missed.

To run the whole flow with real pull requests, use fieldops-platform-sample, a small multi-tenant ASP.NET Core service. It has a script that opens a prepared pull request and one that pushes its fix. Anyone added to that repository as a collaborator can do this: they install nothing and none of their own repositories are involved. See scripts/walkthrough.

How it works

flowchart LR
    PR[Pull request] -->|webhook| Review[AI first pass]
    Review -->|pending findings| Dash[Reviewer dashboard]
    Dash -->|confirm / reject / edit| Publish[Publish]
    Publish -->|send back with a fix prompt| PR
    Publish -->|or: reviewer takes over| PR
    PR -->|new commit| Review

1. A pull request is opened. A GitHub App receives the event and fetches the diff, the changed files, and the team's .second-look.md rules from the main branch.

2. The AI does the first pass. The reviewer's dashboard shows it live: fetching the diff, reading files, the model reviewing. Findings come back in a fixed schema and are stored as pending. Nothing is posted to the pull request.

3. An engineer decides. Findings sit inline in the diff. Confirm, reject, or rewrite each one; each is one click, and a decided finding folds to one line so what is left stands out. A reason for a rejection is optional and one more click. j k n move between findings and c r e act on them. To add something the first pass missed, hover a line, click the +, and write the finding yourself. Publish stays disabled, and says why, until every finding has a decision.

4. The engineer publishes and chooses who fixes it.

   • Send back to the author. One GitHub review with the confirmed findings, a plain-English summary, and a prompt the author can paste into their AI tool. The prompt is in the review body under "Fix these with your AI tool". It lists each finding with its file and lines and tells the tool to change nothing else.
   • I will fix it myself. The author is told they do not need to do anything. The reviewer gets a checkout command and a prompt written for an engineer's coding agent.

5. A check run blocks the merge while a confirmed finding is critical, and passes otherwise. It stays in progress until a human publishes, so a pull request cannot go green on the AI's word alone.

6. A fix is pushed and the pull request is reviewed again. The new review knows what the reviewer decided last time. Findings they rejected are not raised again, and each finding that was sent gets a verdict: fixed, still there, or cannot tell.

7. The decisions are added up. The dashboard's insights page shows the share of first-pass findings that reviewers confirmed, by severity and category, the reasons for rejections, what reviewers had to add themselves, and how long authors wait for a reviewer. Where reviewers keep rejecting a kind of finding, it suggests a line for .second-look.md so the first pass stops raising it. It reads stored decisions and calls no model.

This is the beginning of the README. Read the rest at the original. Read the full README ↗