Multi-Agent Code Analysis in Action
Watch how three specialized agents work together to analyze code from different angles — security, performance, and quality.
How It Works
Security Specialist
Analyzes code for vulnerabilities:
- •SQL Injection risks
- •Hardcoded secrets
- •XSS vulnerabilities
- •Resource leaks
Performance Specialist
Identifies performance bottlenecks:
- •Time complexity issues
- •Memory leaks
- •Inefficient queries
- •Blocking operations
Quality Specialist
Recommends improvements:
- •Code readability
- •Maintainability
- •Design patterns
- •Best practices
Code Under Analysis
import sqlite3
def get_user_data(user_id):
conn = sqlite3.connect(':memory:')
query = f"SELECT * FROM users WHERE id = {user_id}" # ⚠️ SQL Injection
cursor = conn.cursor()
cursor.execute(query)
result = cursor.fetchall()
return result
def process_users():
users = get_user_data(1)
for user in users:
for item in range(1000): # ⚠️ O(n*m) complexity
print(f"Processing {user} - {item}")
return users
def save_api_key():
api_key = "sk-1234567890abcdef" # ⚠️ Hardcoded secret
with open('config.txt', 'w') as f:
f.write(api_key)This code intentionally contains security vulnerabilities, performance issues, and quality problems.
Key Findings
Critical: SQL Injection
The Problem: Using f-strings to build SQL queries allows attackers to execute arbitrary SQL by passing malicious input like 1 OR 1=1; DROP TABLE users;--
Impact: Complete database compromise, data theft, or destruction
✓ Secure solution:
query = "SELECT * FROM users WHERE id = ?" cursor.execute(query, (user_id,)) # Parameters passed separately
High: O(n*m) Complexity
The Problem: The inner loop iterates 1000 times per user without functional purpose.
Impact: For 100 users, this is 100,000 unnecessary iterations burning CPU cycles.
✓ Optimized solution:
for user in users:
print(f"Processing {user}") # Process once, not 1000xCritical: Hardcoded Secret
The Problem: API key hardcoded directly in source code and saved to plaintext file.
Impact: Secret exposed in version control history, shared repositories, code reviews.
✓ Secure solution:
api_key = os.getenv('API_KEY')
if not api_key:
raise ValueError("API_KEY env var not set")Orchestration Concepts Demonstrated
Parallel Analysis
Specialized Context
Complementary Output
Synthesis Ready
How to Build This Pattern
Step 1: Define Specialized Agents
Create agent definitions with focused expertise
# ~/.claude/agents/security-reviewer.md --- type: general --- You are a security specialist. Analyze code for: - SQL Injection risks - Hardcoded secrets - Authentication issues - XSS vulnerabilities
Step 2: Spawn Subagents in Parallel
Use the Agent tool to run each specialist independently
const securityAgent = Agent({
prompt: "Analyze this code for security issues",
subagent_type: "general-purpose"
});
const performanceAgent = Agent({
prompt: "Analyze this code for performance",
subagent_type: "general-purpose"
});
const qualityAgent = Agent({
prompt: "Analyze this code for quality",
subagent_type: "general-purpose"
});
// All run in parallel
await Promise.all([
securityAgent,
performanceAgent,
qualityAgent
]);Step 3: Synthesize Results
A coordinator agent collects and summarizes findings
const coordinator = Agent({
prompt: `
You have three analysis reports:
SECURITY REPORT:
${securityFindings}
PERFORMANCE REPORT:
${performanceFindings}
QUALITY REPORT:
${qualityFindings}
Synthesize these into one comprehensive report.
`,
subagent_type: "general-purpose"
});