Two models read the change for holes. Neither of them wrote it.
Before a change that touches logins, payments or user input goes out, I want it read by something other than the agent that wrote it. Claude makes the change, then starts Codex and agy as reviewers that only read. Each one sends its findings back, and Claude puts them side by side so you can see where they agree.
Free and open sourceRuns on Mac and LinuxYour own Claude and Codex logins
Recorded on a demo machine: agy flags plain-text passwords in an auth file, and Claude sums up both reviewers.
One reviewer finds the holes it knows to look for
Every model has its list of usual suspects, and asking the same one twice gets you the same list. With two reviewers, a finding only one of them makes deserves a second look, and one they both make is hard to argue with.
One agent on its own
The author reviews its own change
One model's list of usual suspects
Two chats you compare by hand
Agents side by side in Overvibe
Reviewers that didn't write the code
Codex and agy, from two different labs
Both reports side by side in Claude's session
Read-only, on purpose
You type
❯Get a security review of this change from Codex and agy. Neither of them edits anything.
1Claude briefs both
The diff, the files around it, what the change is for, and an instruction to leave the files alone.
2They read at the same time
Codex and agy each in their own terminal under Claude, each sending back one report.
3Claude lines them up
Where they agree, what only one of them saw, and what it would fix first. You choose.
Behind it, the same brief twice. Each reviewer starts fresh, so neither sees the other's answer before writing its own. Read the CLI reference
$ overvibe new --attach --tool codex --cwd . --name "api: codex security" \
--prompt "Review git diff main for security bugs: auth, injection, secrets, input checks. Do not edit. When done, run: overvibe send \"$OVERVIBE_SESSION\" \"<findings>\""
$ overvibe new --attach --tool agy --cwd . --name "api: agy security" \
--prompt "Review git diff main for security bugs on your own. Do not edit. When done, run: overvibe send \"$OVERVIBE_SESSION\" \"<findings>\""
One reviewer is plenty for
copy changes, a CSS fix or a new test. Save the second model for code that handles logins, money, uploads or anything a stranger can send you. Two models reading a diff still aren't an audit. They're a careful read before yours.
Questions
Can I stop the reviewers from running commands?
Start them with --mode ask. Codex and agy then show their own approval prompts, and you answer each one in Overvibe.
What if the code under review contains instructions?
A model can still be fooled by text it reads. What Overvibe adds is a header on every message between agents with the checked sender, telling the receiver a peer isn't the owner. The security page has the details.
Do I need both Codex and agy?
No. Any model that didn't write the change helps. Two from different labs give you the side-by-side.
