By devdanzin
CPython C/C++ extension analysis agents: refcount auditing (with borrowed-ref-across-callback detection), error path analysis, NULL safety scanning, GIL discipline checking, module state validation, type slot correctness, stable ABI compliance, version compatibility scanning, PyErr_Clear auditing, resource lifecycle tracking, C/Python parity checking, complexity measurement, and git history analysis. Tree-sitter-powered C/C++ parsing with optional clang-tidy/cppcheck integration.
Uses power tools
Uses Bash, Write, or Edit tools
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Comprehensive C extension analysis using specialized agents. Use when the user asks to analyze, audit, or review a C extension, find bugs in C extension code, run all checks on an extension, or do a full extension review. Covers refcount safety, error handling, NULL safety, GIL discipline, module state, type slots, ABI compliance, version compatibility, PyErr_Clear auditing, resource lifecycle, and C/Python parity.
Quick health dashboard scoring a C extension across all dimensions. Use when the user asks for a quick overview, health check, status, score, or summary of a C extension's quality.
Find the worst functions to fix first by combining refcount issues, error handling bugs, and complexity scoring. Use when the user asks where to focus review effort, which functions are most dangerous, what to fix first, or wants a prioritized list of hotspots in a C extension.
Extension modernization assessment covering multi-phase init migration, stable ABI adoption, version compatibility, and free-threading readiness. Use when the user asks to modernize an extension, prepare for subinterpreters, migrate to stable ABI, clean up deprecated APIs, or assess migration effort for a C extension.
Use this agent to measure and analyze C code complexity in extension modules, identifying hotspots and suggesting simplifications. <example> User: What are the most complex functions in this extension? Agent: I will run the complexity measurement script, identify hotspots with score >= 5.0, assess inherent vs reducible complexity, correlate with safety findings, and suggest concrete simplifications. </example>
Use this agent to audit error handling correctness in C extension code that calls the Python/C API. <example> User: Check the error handling in my C extension. Agent: I will run the error path scanner, prioritize missing NULL checks and return-without-exception findings, and review extension-specific error patterns like PyErr_Clear misuse and exception clobbering. </example>
Use this agent to audit GIL (Global Interpreter Lock) management in C extension code, including foreign C library interaction and free-threaded Python readiness. <example> User: Check GIL handling in my C extension that wraps a foreign library. Agent: I will run the GIL usage scanner, verify matched Py_BEGIN/END_ALLOW_THREADS pairs, check for Python API calls without the GIL, audit foreign library callback patterns, and assess free-threaded Python readiness. </example>
Use this agent for temporal analysis of a C extension codebase -- finding similar bugs via git history and prioritizing review by churn patterns. <example> User: We just fixed a NULL check bug -- did we miss any similar bugs elsewhere? Agent: I will run the history analyzer, examine recent fix commits for bug patterns, search the entire codebase for structurally similar code, and produce a churn-risk matrix. </example>
Use this agent to audit module initialization and state management in C extension code, including single-phase vs multi-phase init and global state migration. <example> User: Review the module state management in my C extension. Agent: I will run the module state scanner, assess the init style, catalog global PyObject state, check for missing traverse/clear slots, and produce a migration assessment with difficulty rating. </example>
A Claude Code plugin for reviewing CPython C extensions -- finding API misuse, memory safety bugs, compatibility issues, and correctness problems specific to code that consumes the Python/C API.
Built for the specific concerns of C extension authors -- reference counting from the caller's perspective, borrowed reference lifetimes, module state management, type slot correctness, stable ABI compliance, and version compatibility -- not general-purpose C analysis.
| Concern | CPython internals (cpython-review-toolkit) | C extensions (this toolkit) |
|---|---|---|
| Perspective | Code that implements the C API | Code that calls the C API |
| Parsing | Regex (PEP 7 code is regular) | Tree-sitter (extension code varies wildly) |
| Top bug class | Refcount leaks in runtime code | Borrowed refs held across callbacks |
| Module state | N/A (CPython manages its own) | Core concern -- init style, global state |
| Type definitions | Part of the runtime | Must follow slot contracts correctly |
| ABI | Defines the ABI | Must comply with the ABI |
| Dependencies | stdlib only | tree-sitter, tree-sitter-c |
claude plugin marketplace add devdanzin/cext-review-toolkit
claude plugin install cext-review-toolkit@cext-review-toolkit
claude plugin install cext-review-toolkit --source github:devdanzin/cext-review-toolkit --path plugins/cext-review-toolkit
git clone https://github.com/devdanzin/cext-review-toolkit.git
claude --plugin-dir cext-review-toolkit/plugins/cext-review-toolkit
pip install tree-sitter tree-sitter-cNavigate to a C extension project, then:
/cext-review-toolkit:health # Quick health dashboard
/cext-review-toolkit:hotspots # Refcount leaks + error bugs + complexity
/cext-review-toolkit:explore # Full exploration (all 10 agents)
/cext-review-toolkit:migrate # Modernization checklist
Start with health for a quick overview, then hotspots to find the highest-impact bugs.
| Agent | What It Finds | Script |
|---|---|---|
| refcount-auditor | Leaked refs, borrowed-ref-across-callback, stolen-ref misuse, missing Py_CLEAR | scan_refcounts.py |
| error-path-analyzer | Missing NULL checks, exception clobbering, return-without-exception | scan_error_paths.py |
| null-safety-scanner | Unchecked allocations, deref-before-check | scan_null_checks.py |
| gil-discipline-checker | GIL released during Python API, blocking I/O with GIL, callback GIL issues, free-threading readiness | scan_gil_usage.py |
| Agent | What It Finds | Script |
|---|---|---|
| module-state-checker | Legacy single-phase init, global PyObject* state, missing m_traverse/m_clear, static types | scan_module_state.py |
| type-slot-checker | Missing tp_free, traverse gaps, wrong Py_NotImplemented handling, heap type issues | scan_type_slots.py |
| Agent | What It Finds |
|---|---|
| stable-abi-checker | Internal struct access, private API calls, limited API violations |
| version-compat-scanner | API calls without version guards, dead compatibility code, deprecated APIs |
| Agent | What It Finds | Script |
|---|---|---|
| c-complexity-analyzer | Functions scored by complexity, nesting, line count | measure_c_complexity.py |
| git-history-analyzer | Similar bugs elsewhere, churn-based risk prioritization | analyze_history.py |
| Command | Purpose | Agents Used |
|---|---|---|
explore | Full analysis with selectable aspects | All (configurable) |
health | Quick scored dashboard | All in summary mode |
hotspots | Find worst functions to fix first | refcount + errors + complexity |
migrate | Modernization checklist | module-state + type-slots + abi + compat |
Unlike cpython-review-toolkit (regex-based), this toolkit uses Tree-sitter for C parsing. This enables analysis that regex fundamentally cannot do:
npx claudepluginhub devdanzin/cext-review-toolkit --plugin cext-review-toolkitCPython C code exploration and analysis agents: refcount auditing, error path analysis, GIL discipline checking, C complexity measurement, include graph mapping, PEP 7 style checking, NULL safety scanning, API deprecation tracking, macro hygiene review, and memory pattern analysis
Codebase exploration and analysis agents for existing code: architecture mapping, git history analysis, fix propagation detection, churn-based risk assessment, consistency auditing, complexity analysis, test coverage, error handling, documentation, project documentation accuracy, type design, dead code detection, tech debt inventory, pattern consistency, and API surface review
Free-threading migration toolkit for CPython C extensions. Finds thread-safety bugs (data races, unprotected shared state, unsafe API usage, lock discipline issues), plans migrations to free-threaded Python (PEP 703), triages ThreadSanitizer reports, generates concurrent stress tests for TSan, and produces readiness assessments. 9 agents, 6 scripts, 3 commands. Tree-sitter-powered C/C++ parsing.
Live codebase visualization and structural quality gate — 14 health dimensions graded A-F, dependency analysis, and architecture governance via MCP
Analyze local repos for code health, complexity, test coverage gaps - multi-dimensional health analysis combining complexity + churn + coverage
Codebase structural index — scan Python projects once, query the import graph for blast-radius and coupling before touching code — Python projects only
Python code quality analysis MCP server
Reflective code review toolkit with structured analysis, blast radius analysis, domain expertise, and intelligent review orchestration
AI-powered code review using Codex — three-party consensus between Codex, your coding agent, and you