AI code review with three specialists, one confirmed list.
CrossCheck is an AI code review plugin for Claude Code. It runs three focused reviewers on your changes in parallel: security, accessibility and performance. Each reads the changed code with its own checklist, and Claude confirms every finding against the code before reporting it. You get a short list with a severity, the file and line, and a fix. The accessibility reviewer measures color contrast with the HueProof MCP server instead of guessing.
01See it work
CrossCheck, in real use.
3 screens from real runs of CrossCheck. Every value shown is what the tool returned; click a screen to open it full size.
02How it works
Three specialists, one confirmed list.
Each reviewer reads the same change with its own checklist. Claude then reads the code at every cited line and keeps only what it can confirm.
- 01ScopeUncommitted changes, a branch against its base, or any base you name.
- 02Review in parallelSecurity, accessibility and performance reviewers, each with its own checklist.
- 03ConfirmEach finding checked against the code at the cited line; anything unconfirmed is dropped.
- 04One listSeverity, area, file and line, problem and fix. You choose what gets fixed.
03Checklists
A code review checklist for each reviewer.
What each reviewer looks for. The accessibility reviewer measures color contrast with the HueProof MCP server instead of estimating it.
- Injection: SQL, command, template
- Access control and IDOR
- XSS and CSRF
- SSRF and open redirects
- Secrets in code
- Weak hashing, tokens and randomness
- Unsafe deserialisation
- Risky dependencies
- Names and labels for controls
- Semantic elements and roles
- Keyboard access and visible focus
- Form errors and instructions
- Motion and reduced motion
- Target sizes and zoom
- Contrast, measured by HueProof
- N+1 queries
- Missing indexes and pagination
- Unbounded work and loops
- Blocking I/O on hot paths
- Missing timeouts
- Memory growth
- Bundle size and rendering
04Security
OWASP Top 10 and IDOR.
Broken access control has been first on the OWASP Top 10 since 2021, and IDOR, where changing an id in a request reaches someone else's data, is its most common form. It is the finding CrossCheck rated high in a real review of a calendar feed:
// A person's upcoming shifts as a calendar feed.
- router.get('/people/:id/calendar.ics', async (req, res) => {
+ router.get('/people/:id/calendar.ics', requireSelfOrManager, async (req, res) => {
const person = await db.people.find(req.params.id);
const shifts = await db.shifts.forPerson(person.id, { from: new Date() });
res.type('text/calendar').send(toIcs(person.name, shifts));
});05Performance
N+1 queries, found in review.
One query for a list, then one more for each item in it: 41 queries for a team of 40. The same review found one in the team feed, with no end date either.
const people = await db.people.inTeam(teamId);
const shifts = [];
for (const p of people)
shifts.push(...await db.shifts.forPerson(p.id, {
from: new Date(),
}));const shifts = await db.shifts.inTeam(teamId, {
from: new Date(),
to: addDays(new Date(), 90),
});06Install
Install CrossCheck.
Install CrossCheck from the Dude Lemon marketplace inside Claude Code. Includes the HueProof server.
/plugin marketplace add https://plugins.dudelemon.cloud/marketplace.json/plugin install crosscheck@dudelemonRun both commands inside Claude Code. The first adds the Dude Lemon marketplace once; the second installs the plugin.
07What it adds
What the plugin adds to Claude Code.
/crosscheck:review- Reviews uncommitted changes, a branch against its base, or any base you name; "only security" runs one reviewer.
security-reviewer- Injection, access control and IDOR, XSS, CSRF, SSRF, secrets, weak hashing and tokens, unsafe deserialisation, risky dependencies.
accessibility-reviewer- WCAG 2.2 AA names, semantics, keyboard and focus, forms, motion, targets and zoom, and measured contrast through HueProof.
performance-reviewer- N+1 queries, missing indexes and pagination, unbounded work, blocking I/O, timeouts, memory growth, bundle size and rendering.
08Try it
Use it as you work.
Hooks work on their own; commands run when you type them in Claude Code.
- /crosscheck:review
- /crosscheck:review main
- /crosscheck:review only accessibility
FAQ
CrossCheck, answered
Anything we have not answered here, ask us directly. A senior engineer replies.
Does it change my code?
Not until you choose. The reviewers are read-only; after the report, Claude fixes only the findings you pick.
Why confirm findings again?
Reviewers can be wrong. Claude reads the code at each cited line and drops anything it cannot confirm, so the list stays short and real.
What does HueProof receive?
Only color values to measure, never your code.
Is CrossCheck free?
Yes. CrossCheck is free and MIT licensed.
How do I install CrossCheck?
In Claude Code run /plugin marketplace add https://plugins.dudelemon.cloud/marketplace.json, then /plugin install crosscheck@dudelemon.
How is CrossCheck different from other AI code review tools?
It runs inside Claude Code on your machine, splits the review across three specialists, and confirms every finding against the code before reporting it, so the list stays short and real.