Cloudflare reports that in the first 30 days, from March 10 to April 9, 2026, its internal AI code review system completed 131,246 review runs across 48,095 merge requests in 5,169 repositories. The average merge request was reviewed 2.7 times, and the median review completed in 3 minutes and 39 seconds. Engineers needed to "break glass" 288 times, or 0.6% of merge requests.
The post states: "We've been running this system internally across tens of thousands of merge requests. It approves clean code, flags real bugs with impressive accuracy, and actively blocks merges when it finds genuine, serious problems or security vulnerabilities."
Across its internal projects, the median wait time for a first review was often measured in hours. Third-party AI code review tools did not offer enough flexibility and customisation for an organisation the size of Cloudflare, and pasting a git diff into a basic prompt produced noisy results, so the team built a CI-native orchestration system around OpenCode, an open-source coding agent. It is one of the ways Cloudflare is improving its engineering resiliency as part of Code Orange: Fail Small.
When an engineer opens a merge request, up to seven specialised reviewers cover security, performance, code quality, documentation, release management, and compliance with the internal Engineering Codex. A coordinator agent deduplicates their findings, judges their severity, and posts a single structured review comment. The system is built from plugins, including a GitLab provider, Cloudflare AI Gateway configuration, Codex compliance checking and Braintrust tracing. The coordinator runs as an OpenCode child process started with Bun.spawn, and sub-reviewers are launched as separate sessions through the OpenCode SDK. Claude Opus 4.7 and GPT-5.4 are reserved for the coordinator, Claude Sonnet 4.6 and GPT-5.3 Codex handle the Code Quality, Security and Performance reviewers, and Kimi K2.5 handles the Documentation, Release and AGENTS.md reviewers. Circuit breakers and failback chains route around overloaded models, and model routing is fetched from a Cloudflare Worker backed by Workers KV. Each merge request is classified into a trivial, lite or full risk tier, which determines how many agents run, and if a human reviewer comments "break glass" the system forces an approval.
The average review costs $1.19 and the median $0.98, with trivial reviews averaging $0.20 and full reviews $1.68. The system produced 159,103 findings, processed approximately 120 billion tokens, and reached an 85.7% cache hit rate. Cloudflare engineers have landed over 45 pull requests upstream to OpenCode.