Building a Multi-Agent Workflow for Automated Code Reviews using LangGraph

LangGraph is the only way I've found to stop AI agents from looping infinitely or hallucinating their way into a dead end when doing complex tasks like code reviews. Standard linear chains fail because code review is inherently iterative—you find a bug, the AI tries to fix it, but the fix introduces a regression, requiring another look.

I built a three-agent system to automate my PR checks: a Security Auditor, a Performance Specialist, and a Final Gatekeeper. The core logic relies on a state graph where the "state" is the current version of the code and a list of flagged issues.

Here is how I structured the graph logic to prevent the "AI yes-man" effect where agents just agree with each other:

from typing import TypedDict, List
from langgraph.graph import StateGraph, END

class ReviewState(TypedDict):
    code: str
    comments: List[str]
    iterations: int
    status: str

# Define the nodes
def security_agent(state: ReviewState):
    # Prompt: "Act as a security expert. Find OWASP vulnerabilities."
    # Logic: Append findings to state['comments']
    return {"comments": security_agent.invoke(state['code']), "status": "reviewed"}

def performance_agent(state: ReviewState):
    # Prompt: "Analyze time/space complexity. Look for N+1 queries."
    return {"comments": performance_agent.invoke(state['code']), "status": "reviewed"}

def gatekeeper(state: ReviewState):
    # Logic: If comments contain "CRITICAL", route back to developer (or fixer agent)
    if any("CRITICAL" in c for c in state['comments']):
        return "needs_fix"
    return "approve"

workflow = StateGraph(ReviewState)
workflow.add_node("security", security_agent)
workflow.add_node("performance", performance_agent)
workflow.add_node("gatekeeper", gatekeeper)

workflow.set_entry_point("security")
workflow.add_edge("security", "performance")
workflow.add_edge("performance", "gatekeeper")

workflow.add_conditional_edges(
    "gatekeeper",
    lambda x: x,
    {"needs_fix": "security", "approve": END}
)

The "gotcha" with this setup is the context window. If you feed the entire codebase into every node, you'll hit token limits or get diluted attention. I solved this by using a pre-processing step that extracts only the "diff" and the relevant dependency files.

To make the agents actually useful and not just output "Looks good!", I use these specific configuration tips:

Strict Personas in System Prompts
I force the Security Auditor to find at least one potential edge case. If it can't find any, it must explain why the code is safe. This stops the agent from being lazy.

State Management
I track an iterations counter in the ReviewState. If the loop between the gatekeeper and the auditors hits 3 cycles without resolution, the graph forces an END and flags it for a human. This prevents the dreaded "infinite loop of minor nitpicks."

The "Critic" Loop
Instead of just having agents report bugs, I added a step where the Performance agent reviews the Security agent's suggestions. Often, a security fix kills performance. Having them "argue" in the graph state before the gatekeeper sees it results in much higher quality PR comments.

The productivity gain is massive. I've shifted from spending 30 minutes manually scanning for silly mistakes to spending 5 minutes reviewing a consolidated report of "High Confidence" issues flagged by the agents. It turns the code review process from a hunt for bugs into a verification of findings.