# How Deep Review Works

Deep Review is Aikido's agentic pull request reviewer. Instead of treating the diff as the full story, Aikido explores relevant code, reasons about the wider impact of a change, and posts feedback directly on your pull request.

It covers **both security and quality**. It can flag a missing access check, and a refactor that breaks pagination on large result sets, as long as the issue shows up in the impact of this pull request.

## Deep Review vs other PR checks

Pull requests can already receive comments from more than one Aikido check. They answer different questions:

| Check                                                                                                                                                                         | What it looks at                                                        | Cadence                   |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | ------------------------- |
| [SAST](https://help.aikidogov.us/code-scanning/scanning-practices/sast-by-aikido-supported-languages-and-security-focus) in [PR gating](https://help.aikidogov.us/pr-and-release-gating/aikido-ci-gating-functionality) | Known security patterns on the diff                                     | On new code, once enabled |
| [Code Quality](https://help.aikidogov.us/code-quality/code-quality-overview)                                                                                                                      | Quality rules on the changed lines                                      | On new code, once enabled |
| Deep Review                                                                                                                                                                   | Security and quality impact of the change, with context beyond the diff | Credits per PR            |

Deep Review does not replace SAST or Code Quality. Enable those in PR Checks and keep them on for every commit. Use Deep Review when you want to find complex issues that need more context than the diff.

For the full map, see [Which Aikido product should I use?](https://help.aikidogov.us/getting-started/which-aikido-product-should-i-use).

## Context beyond the diff

A diff shows what changed, but not always how that change interacts with the rest of your application. Deep Review pulls in relevant context from outside the changed lines before deciding whether to comment, so it can review changes that depend on existing behavior elsewhere in the codebase.

## Repository instructions

Deep Review checks `AGENTS.md`, `CLAUDE.md`, `.claude/`, and `.cursor/` for accepted risk. A risk those files already accept stays unreported, unless the pull request widens that risk.

Put standing guidance in `AGENTS.md` at the repository root: trust boundaries, intentional behavior, and accepted risks. See [Guide Agents with Repository Files](https://help.aikidogov.us/ai-and-dev-tools/guide-an-audit-with-repository-files).

Aikido also builds [memory](https://help.aikidogov.us/deep-review/memory) from replies on pull requests. Use `AGENTS.md` when you want to write the guidance yourself.

## Cross-repository context

If your application spans multiple repositories, you can [link related repositories](https://help.aikidogov.us/deep-review/link-repositories) to the repository under review. Deep Review can then use those repositories as additional context when reasoning about shared libraries, APIs, and services.

The number of repositories you can link depends on your Aikido plan.

## Feedback in your pull request

Aikido posts comments directly on your pull request when Deep Review has feedback to share. You don't need to leave your existing review workflow to see or discuss the results.

Deep Review also posts its own status check (**Aikido Security: Deep Review**). Whether that check fails follows the same [gating settings](https://help.aikidogov.us/deep-review/configure-deep-review#pr-check-gating) as the security review: the failure threshold, **Always Pass**, and **Always make the PR check green**.

When you fix an issue that a comment identifies, Aikido automatically resolves the comment. [Learn how Aikido manages comments after an issue is fixed](https://help.aikidogov.us/pr-and-release-gating/aikido-ci-gating-functionality/autofix-suggestions-and-inline-commenting-for-pr-checks#what-happens-to-comments-after-you-fix-an-issue).

### Reply in natural language

Reply to any Deep Review comment in plain language. You don't need to tag Aikido or use a special command format, and you can stay in the pull request without switching to the Aikido UI.

| What you say                   | Example                                                  | Outcome                                                                                                                    |
| ------------------------------ | -------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| **Ignore a finding**           | "This is a false positive, please ignore."               | Aikido ignores the finding.                                                                                                |
| **Share context or push back** | "This is intentional because we validate on the server." | Aikido stores this in [repository memory](https://help.aikidogov.us/deep-review/memory) for later reviews.                                                    |
| **Ask for a fix**              | "Can you fix this?"                                      | Aikido opens a pull request with the fix when [AutoFix](https://help.aikidogov.us/autofix-and-remediation/overview-aikido-autofix) is enabled. |
| **Ask for clarification**      | "Can you explain why this is a problem?"                 | Aikido replies to your question.                                                                                           |

## Exclude paths and files

Aikido already ignores a large set of paths out of the box. Deep Review skips common noise such as dependency folders, build output, generated files, lock files, binaries, and media, so you usually do not need extra configuration.

You can exclude more paths with a [`.aikido` file](https://help.aikidogov.us/code-scanning/scanning-practices/ignore-via-code-with-aikido-files). Deep Review respects those excluded paths as well.

If a pull request only changes excluded files, Aikido skips Deep Review and you are not charged.

## Credits

Deep Review costs **1 credit per pull request**. Additional reviews on the same PR (for example after new commits) don't cost extra. When you're out of credits, Deep Reviews are skipped.

You can also set a [monthly spending limit](https://help.aikidogov.us/deep-review/configure-deep-review#set-a-monthly-spending-limit) for Deep Review from [Wallet settings](https://app.aikido.dev/settings/wallet/settings). When the limit is reached, Deep Reviews that would charge a credit are skipped until the next calendar month.

{% hint style="info" %}
Curious what Deep Review would cost for your team? Our [estimator](https://app.aikido.dev/repositories/deep-review) gives you an idea based on your activity of the last 30 days.
{% endhint %}

Learn how to [configure Deep Review](https://help.aikidogov.us/deep-review/configure-deep-review).