Sentry's AI Agent goes head-to-head with Semgrep bot in a real PR review
zeeg · x · 2026-11-04
- Sentry founder David Cramer shared a screenshot of an amusing bot standoff on a PR: Semgrep flagged zod usage at line 63 as a high-severity reachable vulnerability, and Sentry's AI agent "sentry-junior" pushed back point by point.
- The agent argued the flagged line is an output schema for data the tool builds itself, not untrusted input, and that mcp-core already resolves patched zod 4.6.7.
- It then traced the remaining old zod copies to exact pins inside Cloudflare dev tooling (@cloudflare/vitest-plugin pins zod 4.6.5; miniflare via an older plugin pins zod 3.22.3, which has no patched 3.x release), recommending a separate deps PR rather than riding on this one.
- A fun AI-circle moment that also showcases an agent doing genuine dependency analysis and code-review reasoning in production.
Related event: Two CI Bots Argue With Each Other in Sentry PR(2 posts)→
More from coding & agent
- AI/ML API ships an MCP that auto-runs Google Ads campaigns for ~$0.61 per run — heyshrutimishra · 2026-11-04
- Turning Suno tracks into lyric videos with Claude Code supervising Pokee Isaac — Kyrannio · 2026-11-04
- Pokee Isaac ships official Claude Code integration with model routing and MCP tools — Kyrannio · 2026-11-04
- Codex computer use plagued by keystroke repetition bug, user reports — SEO · 2026-11-04
- Excalidraw ships improved MCP: text fixes, better perf, Mermaid support — Vjeux · 2026-11-04
- Google's Jules coding agent shuts down Nov 11; user pens farewell with an agent-written book — Free-Stage-5975 · 2026-11-04