AI Code Review Checklist — Ship Better with AI Help

What it is

This is a structured checklist for reviewing code generated by AI assistants before merging it into production. It covers standard code review concerns (correctness, security, performance, maintainability) plus AI-specific pitfalls: hallucinated imports, phantom APIs that do not exist, outdated library versions, and subtle logic errors that compile but do not work.

The checklist targets any developer who uses AI coding tools and wants a systematic way to catch issues before they reach production.

How it saves time or tokens

AI-generated code often looks correct at first glance but contains subtle issues: imports for packages that do not exist, API calls using deprecated parameters, or test assertions that always pass. A structured checklist catches these systematically rather than relying on intuition.

The estimated token cost for this workflow is approximately 2,800 tokens. The checklist is reusable across projects and AI tools.

How to use

1. Copy the checklist into your code review process:

AI Code Review Checklist

Correctness

• [ ] Code compiles/runs without errors
• [ ] All tests pass (existing + new)
• [ ] No hallucinated imports or packages
• [ ] API calls use valid, current parameters

Security

• [ ] No hardcoded secrets or credentials
• [ ] Input validation on all user-facing endpoints
• [ ] SQL queries use parameterized statements

Performance

• [ ] No unnecessary loops or redundant queries
• [ ] Database queries use appropriate indexes
• [ ] No memory leaks in long-running processes

2. Run through the checklist for every AI-generated PR.

3. Customize with project-specific checks.

Example

Full Checklist

AI-Specific Checks

• [ ] Verify every import exists: pip install <package> or npm install <package>
• [ ] Check API signatures against official docs (AI may use outdated versions)
• [ ] Look for 'phantom functions' -- methods that sound right but do not exist
• [ ] Verify test assertions are meaningful (not assert True)
• [ ] Check for copy-paste artifacts from training data

Maintainability

• [ ] Code follows project conventions (naming, structure)
• [ ] Comments are accurate (AI comments often describe what code should do, not what it does)
• [ ] No unnecessary abstractions or over-engineering
• [ ] Error messages are helpful for debugging

Related on TokRepo

• AI Tools for Testing -- Automated testing tools to complement code review
• AI Tools for Coding -- AI coding assistants that generate the code you review

Common pitfalls

• Do not skip the checklist for 'simple' changes. AI makes the most insidious errors in straightforward code where reviewers let their guard down.
• Phantom APIs are the hardest to catch visually. Always verify imports and function calls against official documentation.
• AI-generated tests can give false confidence. Check that assertions actually test meaningful behavior, not just that the function runs without crashing.