跳到主内容
@wquguru
精选80Lenny's Newsletter(RSS)产品与增长

30分钟用Vercel Eve构建AI代码审查机器人

🎙️ How I AI: Build an AI code review bot in 30 minutes + Claude Code for normal people

原文
发到 X
推荐理由

给技术团队和产品负责人一套可复制的AI代码审查落地方法:风险评分维度、阈值、工具选型与人工交接设计,今天就能照着搭。

Build an AI code review bot in 30 minutes with Vercel Eve

使用 Vercel Eve 在 30 分钟内构建一个 AI 代码审查机器人

Listen now on YouTube • Spotify • Apple Podcasts

立即在 YouTube • Spotify • Apple Podcasts 收听

Brought to you by:

由以下机构提供:

WorkOS—Make your app enterprise-ready today

WorkOS——让您的应用今天就具备企业级就绪状态

Claire built an AI agent that reviews pull requests, scores their risk, auto-approves the safest ones, and sends anything questionable to Slack. In this episode, she breaks down how she built the entire thing in one Codex session using Vercel Eve, and why letting AI review AI-generated code may be a lot less risky than it sounds.

Claire 构建了一个 AI 代理,它可以审查拉取请求,评估其风险,自动批准最安全的请求,并将任何可疑请求发送到 Slack。在本集中,她详细介绍了如何使用 Vercel Eve 在一次 Codex 会话中构建整个系统,以及为什么让 AI 审查 AI 生成的代码可能比听起来风险要小得多。

Biggest takeaways:

最重要的收获:

  • You don’t need a human to review every AI-generated PR. That may sound reckless, but it’s increasingly looking like the smarter operating model. Intercom has already shown this can work at scale: PRs approved by its AI system move five times as fast as human-reviewed ones and have a lower revert rate. In other words, the AI-reviewed code isn’t just shipping faster—it’s less likely to need fixing after it reaches production.
  • The key is having a clear way to separate changes that can skip human review from ones that can’t. The risk model used here scores each PR across six dimensions: the size of the change, its blast radius, how easily it can be reversed, its data and security implications, its operational impact, and whether tests and CI have actually been completed. Anything below 24 points is classified as low risk and cleared by the agent; anything above 64 goes straight to a human for review. The exact numbers matter less than turning a vague judgment call into a repeatable system.
  • Vercel’s Eve may be the fastest way to deploy a serious internal AI agent across Slack and GitHub without spending weeks building infrastructure. It handles the annoying plumbing—connectors, refresh tokens, sandboxing, and routing across channels—so the actual work becomes writing instructions and skills in Markdown instead of babysitting OAuth flows.
  • A useful internal agent can now be built and deployed in a single Codex session, starting with a prompt that’s only a couple of sentences long. In this case, the initial ask was essentially: build a GitHub bot that waits for checks to pass; grades each PR as low, medium, or high risk; and automatically approves the low-risk ones. Everything after that was steering and refinement, not a giant up-front specification.
  • Browser use removes much of the configuration tax that makes agent setup feel harder than it should. Creating a Slack bot and GitHub app manually normally means clicking through endless permission screens, choosing scopes, and managing tokens. Codex handled almost all of that through the browser. The human’s job was mostly to click “save” and complete 2FA. What usually takes hours took minutes.
  • SOC 2 compliance and automatically approved PRs are not inherently at odds. The important part is making the process legible: the risk model needs to be reflected in the company’s code-review and security policies, every decision needs to be logged, and the resulting audit trail needs to be easy to query and defend. The security team’s role is to help design the right framework, not simply block automation because it feels unfamiliar.
  • The operational design matters just as much as the underlying technology. Merge Mommy doesn’t actually merge anything. Instead, it posts a gray check in GitHub as a signal, then sends a Slack message with the risk score and a note saying the PR is ready to approve and merge. That small handoff preserves human accountability for the final action while eliminating most of the cognitive work involved in reviewing a routine change.
  • Evals are what keep internal agents trustworthy after the novelty wears off. Intercom logs every PR review its agent produces and then has an engineer assess whether the score and recommendation were correct. That’s the same discipline strong teams already bring to customer-facing AI products. Internal agents may feel less visible, but when they touch something as important as the codebase, they need the same protection against regressions.
  • The surprising thing about building an Eve agent is how little “building” is actually involved. The full instructions for Merge Mommy fit on roughly a page: a few paragraphs, a handful of bullets, and a short skill file. There isn’t much framework-specific magic to learn. The core skill is simply being able to explain, clearly and precisely, what the agent should do.
  • 你不需要人工审查每一个 AI 生成的 PR。这听起来可能鲁莽,但越来越像是更明智的运营模式。Intercom 已经证明了这可以大规模运作:由其 AI 系统批准的 PR 比人工审查的 PR 速度快五倍,且回滚率更低。换句话说,AI 审查的代码不仅交付更快,而且在进入生产环境后需要修复的可能性也更小。
  • 关键在于有一种清晰的方法来区分可以跳过人工审查的更改和不能跳过的更改。这里使用的风险模型从六个维度对每个 PR 进行评分:更改的大小、影响范围、回滚的难易程度、数据和安全隐患、运营影响,以及测试和 CI 是否实际完成。低于 24 分的任何内容都被归类为低风险并由代理清除;高于 64 分的任何内容则直接交给人工审查。具体数字并不重要,重要的是将模糊的判断转化为可重复的系统。
  • Vercel 的 Eve 可能是在 Slack 和 GitHub 上部署一个严肃的内部 AI 代理的最快方式,而无需花费数周时间构建基础设施。它处理了令人头疼的管道问题——连接器、刷新令牌、沙箱和跨渠道路由——因此实际工作变成了用 Markdown 编写指令和技能,而不是盯着 OAuth 流程。
  • 现在,一个有用的内部代理可以在一次 Codex 会话中构建并部署,只需从一个只有几句话的提示开始。在这种情况下,最初的请求基本上是:构建一个 GitHub 机器人,等待检查通过;将每个 PR 评为低、中或高风险;并自动批准低风险的 PR。之后的一切都是引导和优化,而不是一个庞大的前期规范。
  • 浏览器使用消除了许多配置负担,这些负担让代理设置感觉比应有的更困难。手动创建 Slack 机器人和 GitHub 应用通常意味着要点击无数权限屏幕、选择作用域并管理令牌。Codex 通过浏览器处理了几乎所有这一切。人的工作主要是点击“保存”并完成双重验证。通常需要数小时的工作只需几分钟。
  • SOC 2 合规性和自动批准的 PR 并非天生矛盾。重要的是让流程清晰可见:风险模型需要反映在公司的代码审查和安全策略中,每个决策都需要记录,由此产生的审计跟踪需要易于查询和辩护。安全团队的角色是帮助设计正确的框架,而不是仅仅因为不熟悉就阻止自动化。
  • 操作设计与底层技术同样重要。Merge Mommy 实际上并不合并任何东西。相反,它在 GitHub 中发布一个灰色勾选作为信号,然后发送一条 Slack 消息,包含风险评分和一条说明,表示 PR 已准备好批准和合并。这个小小的交接保留了人类对最终行动的责任,同时消除了审查常规变更时的大部分认知工作。
  • 评估是保持内部代理在新鲜感消退后仍值得信赖的关键。Intercom 记录其代理产生的每次 PR 审查,然后让工程师评估评分和建议是否正确。这与强大团队对面向客户的 AI 产品已经采用的纪律相同。内部代理可能不那么显眼,但当它们触及像代码库这样重要的东西时,它们需要同样的防回归保护。
  • 构建 Eve 代理的令人惊讶之处在于实际涉及的“构建”工作如此之少。Merge Mommy 的完整指令大约只有一页:几段文字、几个要点和一个简短的技能文件。没有太多特定于框架的魔法需要学习。核心技能仅仅是能够清晰、精确地解释代理应该做什么。

Blog from this episode:

本集博客:

How I Built ‘Merge Mommy’: My AI Bot for Auto-Reviewing Pull Requests with Vercel Eve: https://www.chatprd.ai/how-i-ai/merge-mommy-vercel-eve-ai-bot-for-auto-reviewing-pull-requests

我如何构建“Merge Mommy”:我的 AI 机器人,使用 Vercel Eve 自动审查拉取请求:https://www.chatprd.ai/how-i-ai/merge-mommy-vercel-eve-ai-bot-for-auto-reviewing-pull-requests

Claude Code for normal people: skills, voice mode, and how to collaborate with AI

Claude Code 面向普通人:技能、语音模式以及如何与 AI 协作

Listen now on YouTube • Spotify • Apple Podcasts

立即在 YouTube • Spotify • Apple Podcasts 收听

Brought to you by

由以下赞助

  • Bolt.new—Turn your idea into a real product
  • Hyperagent—Deploy fleets of agents that handle real work
  • Bolt.new——将你的想法变成真正的产品
  • Hyperagent——部署处理实际工作的智能体集群

Grace Clarke is an AI educator and former marketing consultant who rebuilt her entire service business around Claude. In this episode, she walks through the three Claude skills that run her business: an hourly client pipeline, a proposal builder, and a voice guide that teaches Claude how she thinks. She also shows how she replaced Gmail with her own Claude-powered inbox, why she believes intent engineering matters more than prompt engineering, and how non-technical people can start building useful AI workflows without writing code.

Grace Clarke 是一位 AI 教育者和前营销顾问,她围绕 Claude 重建了整个服务业务。在本期节目中,她介绍了运行其业务的三个 Claude 技能:一个按小时计费的客户管道、一个提案构建器,以及一个教 Claude 如何思考的语音指南。她还展示了如何用自己基于 Claude 的收件箱取代 Gmail,为什么她认为意图工程比提示工程更重要,以及非技术人员如何在不编写代码的情况下开始构建有用的 AI 工作流。

Biggest takeaways:

最重要的收获:

  • You don’t need to be technical to build a business workflow with Claude. You need to be clear about what’s broken. Grace started by opening Claude Code and talking for a few minutes about everything driving her crazy: too many emails, client communication that didn’t feel warm enough, and 20 hours of admin every week. Claude helped turn that into an operating system for her business.
  • Intent engineering matters more than prompt engineering. Grace doesn’t spend time crafting the perfect prompt. She explains the problem, describes the outcome she wants, and asks Claude to come back with a proposal. Her philosophy is simple: the burden of figuring out what to do next shouldn’t always fall on the person. Give Claude enough context, and it should be able to study how you work and bring you strong ideas to react to.
  • Grace’s voice guide isn’t really a writing guide. It’s closer to a “think like Grace” file. It captures how she makes decisions, what she believes about teaching versus consulting, what good communication sounds like, and even the kinds of LinkedIn posts she never wants to resemble. Whenever she sees something that makes her cringe, she sends Claude a voice note and updates the guide.
  • Doing all of your email inside Gmail means almost none of that work compounds. Every response contains useful context: how a client communicates, what tone works with them, what they care about, and the history of the relationship. But if that context stays buried in Gmail, the AI never gets smarter from it. Grace moved her inbox workflow into Claude so every interaction can become useful context for the next one.
  • Grace has developed a surprisingly elegant way to move between Claude Code and Cowork. She uses Claude Code when she wants something proactive that will go figure things out. Then, when she wants a more visual and approachable environment, she has Claude Code create a Markdown handoff file and drops it into a new Cowork session. The result is a simple way to carry context from one environment to another without starting over.
  • 你不必具备技术背景就能用 Claude 构建业务工作流。你需要清楚哪里出了问题。Grace 一开始打开 Claude Code,花了几分钟谈论所有让她抓狂的事情:邮件太多、客户沟通不够温暖、每周 20 小时的行政工作。Claude 帮助将这些转化为她业务的运营系统。
  • 意图工程比提示工程更重要。Grace 不会花时间精心设计完美的提示。她解释问题,描述期望的结果,然后让 Claude 提出方案。她的理念很简单:弄清楚下一步该做什么的负担不应总是落在人身上。给 Claude 足够的上下文,它应该能够研究你的工作方式,并带来强有力的想法供你回应。
  • Grace 的语音指南实际上不是写作指南。它更接近一个“像 Grace 一样思考”的文件。它捕捉了她如何做决定、她对教学与咨询的看法、好的沟通听起来是什么样子,甚至包括她永远不想模仿的 LinkedIn 帖子类型。每当她看到让她反感的东西,她就会给 Claude 发送语音笔记并更新指南。
  • 在 Gmail 中处理所有邮件意味着这些工作几乎不会产生复利。每封回复都包含有用的上下文:客户如何沟通、什么语气对他们有效、他们关心什么,以及关系的历史。但如果这些上下文埋在 Gmail 中,AI 就永远不会从中变得更聪明。Grace 将她的收件箱工作流移入 Claude,这样每次互动都能成为下一次互动的有用上下文。
  • 格蕾丝开发了一种出人意料地优雅的方式,在Claude Code和Cowork之间切换。当她想要主动去弄清楚事情时,她会使用Claude Code。然后,当她想要一个更直观、更易用的环境时,她会让Claude Code创建一个Markdown交接文件,并将其放入新的Cowork会话中。结果是一种简单的方法,可以在不重新开始的情况下将上下文从一个环境带到另一个环境。

更进一步:量化金融体系

看懂新闻只是起点——沿量化金融路径,把它变成能交付的工程能力

进入量化体系 →

相似阅读

关联信息,但可能不是同一事件