AI Backend and API Code Review

Backend code reviews tend to fall into the trap of reviewing what is in front of the reviewer rather than what should be in front of them. The reviewer reads the diff and approves it because it looks right. The diff was right; the surrounding code that should have changed alongside it was not in the diff. The auth middleware was not added to the new route. Validation was not extended to the new field. Pagination is missing on the new list endpoint. Rate limiting is configured for the existing routes but not the new one. Each gap is invisible from the diff alone.

The /spine-review skill applies the production-readiness checklist to the body of work being reviewed. REST conventions matched to the rest of the API. Auth and authz coverage on every protected route. Input validation on every user-supplied field. Error handling for the failure modes that can actually occur. Pagination on every list endpoint. Rate limiting calibrated to the route's risk profile. Test coverage on the critical paths. The output is the production-readiness review the team would otherwise do by hand if they had the time.

What the review covers

Seven categories. Convention adherence (HTTP method, status codes, error envelope, casing). Auth coverage (every protected route has the middleware applied). Validation (every input field validated against a schema). Error handling (every documented failure has a clear response shape). Pagination (every list endpoint paginates with a documented strategy). Rate limiting (calibrated to route risk: stricter on auth, looser on read). Test coverage (critical paths covered with integration tests).

How /spine-review works

The skill reads the body of work being reviewed and the surrounding API surface. It compares the new routes and changes against the conventions in place, the auth pattern, the validation library, the pagination convention, the rate limit configuration, and the test strategy. Findings are produced with severity, file references, and proposed fixes.

Tonone's /spine-review skill reviews backend code against production readiness criteria: REST conventions, auth, validation, error handling, pagination, rate limiting, and test coverage.

Related skills

Install

/spine-review ships with the Spine agent in Tonone for Claude Code. Install Tonone, invoke against the body of work, and the skill produces the review.