As software developers, writing clean, secure, and highly optimized code is always the goal. However, manual code reviews can be exhausting, and it is easy to overlook subtle performance leaks or security risks before pushing a commit. While web-based AI interfaces like ChatGPT or Gemini are helpful, constantly copying and pasting files into a browser disrupts your coding workflow.

The modern solution is to bring the AI directly into your terminal.

In this comprehensive tutorial, you will learn how to build a custom, local AI Code Reviewer using Python and the Google Gemini API. By the end of this guide, you will have a lightweight terminal utility that scans any local source code file, catches hidden bugs, checks for security flaws, and outputs a formatted Markdown code audit directly to your system.




Prerequisites

Before we dive into the code, ensure you have the following ready on your machine:

  1. Python 3.9+ installed on your system.
  2. A basic understanding of writing scripts and working with terminal commands.
  3. A code editor (like VS Code or Notepad++).




Step 1: Secure Your Google Gemini API Key

To communicate with Google’s AI models, you need an API key.

  1. Head over to the Google AI Studio dashboard.
  2. Sign in with your Google account and click on Get API Key.
  3. Create a new key in a new or existing Google Cloud project.
  4. Copy the key to your clipboard.



Essential Security Rule: Never Hardcode API Keys

Hardcoding your API key directly into your Python script is a massive security risk, especially if you plan to share your code on GitHub. If your key leaks, others can abuse your API quota. Instead, we will store it securely as an Environment Variable on your Windows system.



How to set an Environment Variable in Windows:

  1. Open your Start menu, search for "Environment Variables", and click Edit the system environment variables.
  2. Click the Environment Variables... button at the bottom right.
  3. Under User variables, click New....
  4. Set the Variable name to: GEMINI_API_KEY
  5. Set the Variable value to your actual copied key string.
  6. Click OK on all windows to save changes.

(Note: If you have a Command Prompt window already open, close it and open a new one so Windows can load the new environment variables.)




Step 2: Set Up Your Project Environment

Create a clean directory on your computer specifically for this project. Open your terminal or Command Prompt, navigate to your desired directory, and execute the following commands:


bash

mkdir ai-code-reviewer
cd ai-code-reviewer

Use code with caution.


Next, initialize a Python virtual environment to keep your dependencies isolated, then activate it:


bash

# Create the virtual environment
python -m venv venv

# Activate it on Windows
venv\Scripts\activate

Use code with caution.


Now, we need to install the official Google GenAI SDK. Google updated its official SDK libraries recently, replacing the older google-generativeai package with the modern google-genai library. Install it using pip:


bash

pip install google-genai

Use code with caution.





Step 3: Write the Python Code Reviewer Script

Create a new file named review.py in your project folder. Open it in your text editor and paste the following complete Python implementation:


python

import os
import sys
from google import genai
from google.genai import types

def read_target_file(file_path):
    """Safely reads the contents of the target source code file."""
    if not os.path.exists(file_path):
        print(f"❌ Error: The file '{file_path}' does not exist.")
        sys.exit(1)
        
    try:
        with open(file_path, 'r', encoding='utf-8') as file:
            return file.read()
    except Exception as e:
        print(f"❌ Error reading file: {e}")
        sys.exit(1)

def run_ai_code_review(file_name, code_content):
    """Sends the source code to Gemini API with targeted instructions."""
    # Ensure the environment variable is present
    if not os.environ.get("GEMINI_API_KEY"):
        print("❌ Error: GEMINI_API_KEY environment variable not found.")
        print("Please set your API key before running this script.")
        sys.exit(1)

    print(f"🚀 Initializing Gemini client and analyzing '{file_name}'...")
    
    # Initialize the modern Google GenAI Client
    client = genai.Client()

    # Crafting a precise system instruction ensures professional, structural output
    system_prompt = (
        "You are an elite principal software engineer and expert security auditor. "
        "Your task is to thoroughly review the provided code file. "
        "Structure your response clearly using the following Markdown headers:\n"
        "1. ## 🔍 Code Overview: Brief summary of what the code does.\n"
        "2. ## 🛠️ Bugs & Logical Flaws: Critical functional errors (if any).\n"
        "3. ## 🔒 Security Vulnerabilities: Data leaks, missing validations, or flaws.\n"
        "4. ## ⚡ Performance Optimizations: Efficiency bottlenecks or resource leaks.\n"
        "5. ## 💡 Refactored Version: A clean, complete rewritten version of the code implementing your suggestions."
    )

    user_prompt = f"Please review the following source code file named '{file_name}':\n\n```\n{code_content}\n```"

    try:
        # Utilizing gemini-2.5-flash for rapid, cost-effective code analysis
        response = client.models.generate_content(
            model='gemini-2.5-flash',
            contents=user_prompt,
            config=types.GenerateContentConfig(
                system_instruction=system_prompt,
                temperature=0.2, # Low temperature ensures focused, logical feedback instead of creative drift
            )
        )
        return response.text
    except Exception as e:
        print(f"❌ Gemini API Call Failed: {e}")
        sys.exit(1)

def main():
    # Ensure a file argument was passed via terminal
    if len(sys.argv) < 2:
        print("💡 Usage: python review.py <path_to_source_file>")
        sys.exit(1)
        
    target_file = sys.argv[1]
    
    # 1. Read code
    code_content = read_target_file(target_file)
    
    # 2. Query Gemini
    review_results = run_ai_code_review(os.path.basename(target_file), code_content)
    
    # 3. Output results
    print("\n" + "="*50)
    print("✨ AI CODE REVIEW REPORT ✨")
    print("="*50 + "\n")
    print(review_results)

if __name__ == "__main__":
    main()

Use code with caution.





Step 4: Testing Your Code Reviewer

To see our script in action, let's create a intentionally bad, flawed script to feed into our reviewer. Create a temporary file named test_script.py in your folder and add this vulnerable, unoptimized code:


python

import os

# Intentionally bad code for testing
def login_user(username, password):
    # SECURITY FLAW: Hardcoded SQL injection risk / sensitive information logged
    print("Attempting login for user: " + username + " with password: " + password)
    
    # PERFORMANCE FLAW: Unnecessary nested loops slowing down execution
    for i in range(1000):
        for j in range(1000):
            pass
            
    # LOGICAL FLAW: Unreachable block
    return True
    print("Login successful!")

Use code with caution.


Now run your code reviewer against this flawed script by passing it as a command-line argument:


bash

python review.py test_script.py

Use code with caution.




The Output Expectation

Within moments, your terminal will light up with a beautifully structured Markdown review. The script will highlight the massive security vulnerability (printing raw passwords), identify the performance lag (the empty nested loops executing a million useless passes), point out the unreachable print statement after the return line, and present a perfectly refactored version of your function.




Deep Dive: How the Code Works

Let's break down the engineering choices that make this script efficient and professional:



1. The Modern genai.Client()

Unlike the legacy google.generativeai setup which forced manual configuration structures (genai.configure(api_key=...)), the brand-new SDK automatically checks your operating system environment variables for GEMINI_API_KEY. By instantiating client = genai.Client(), the backend securely authenticates without exposing strings in your text document.



2. Prompt Engineering via system_instruction

Instead of mixing instructions with the code content inside the main prompt, we pass a specialized system_instruction inside the model configuration block. This forces the model to assume a specific persistent persona (an Elite Principal Software Engineer) and enforces rigid formatting boundaries. This ensures your terminal outputs predictable headers instead of unpredictable paragraphs.



3. Temperature Control

We set the model's temperature to 0.2. In generative AI, a high temperature (like 0.9) causes creative variability—ideal for poetry or creative writing. For code compilation and safety diagnostics, we require rigid, deterministic, and highly logical analysis. A low temperature minimizes "hallucinations" and keeps the feedback practical.




Conclusion & Next Steps

You have built a highly responsive, locally managed AI Code Reviewer that reads file structures directly from your local environment. This tool completely eliminates code leakage risks associated with copy-pasting to random online formatters while organizing your engineering pipeline.

Want to expand this project? Here are three awesome ways to scale up this Python script:

  • Export to Markdown File: Modify the main() function to write review_results directly to a local REVIEW.md file rather than printing it directly to the terminal shell.
  • Pre-commit Automation: Hook this script into your local Git system to prevent commits if your AI agent detects high-security threat classifications.
  • Multi-file Support: Adjust the sys.argv routing to crawl whole directories and generate full-scale project-wide health metrics.