A Claude Code plugin for reviewing CPython C extensions -- finding API misuse, memory safety bugs, compatibility issues, and correctness problems specific to code that consumes the Python/C API.

Built for the specific concerns of C extension authors -- reference counting from the caller's perspective, borrowed reference lifetimes, module state management, type slot correctness, stable ABI compliance, and version compatibility -- not general-purpose C analysis.

claude plugin marketplace add devdanzin/cext-review-toolkit
claude plugin install cext-review-toolkit@cext-review-toolkit

claude plugin install cext-review-toolkit --source github:devdanzin/cext-review-toolkit --path plugins/cext-review-toolkit

git clone https://github.com/devdanzin/cext-review-toolkit.git
claude --plugin-dir cext-review-toolkit/plugins/cext-review-toolkit

• Claude Code installed and running
• Python 3.10+ for the analysis scripts
• tree-sitter and tree-sitter-c: pip install tree-sitter tree-sitter-c

Navigate to a C extension project, then:

/cext-review-toolkit:health       # Quick health dashboard
/cext-review-toolkit:hotspots     # Refcount leaks + error bugs + complexity
/cext-review-toolkit:explore      # Full exploration (all 10 agents)
/cext-review-toolkit:migrate      # Modernization checklist

Start with health for a quick overview, then hotspots to find the highest-impact bugs.

Unlike cpython-review-toolkit (regex-based), this toolkit uses Tree-sitter for C parsing. This enables analysis that regex fundamentally cannot do:

• Borrowed reference lifetime tracking: Detect when a borrowed ref survives across a call back into Python -- the #1 extension-specific bug pattern
• Type slot cross-referencing: Connect a PyTypeObject/PyType_Spec to its struct definition and slot function implementations
• Accurate scope analysis: Distinguish file-scope static variables from local ones, track variable assignments within functions

The toolkit auto-detects C extensions in diverse project layouts:

• setup.py with ext_modules
• pyproject.toml with setuptools, meson-python, or scikit-build
• meson.build with py.extension_module()
• CMakeLists.txt with pybind11 or Python3 library targets
• Fallback: any .c file containing #include <Python.h>

Every finding is tagged:

If available, the toolkit can use:

• clang-tidy with compile_commands.json for deeper data-flow analysis
• cppcheck for buffer overflow and uninitialized variable detection

These are never required -- the Tree-sitter-based analysis is the baseline.

1. /cext-review-toolkit:health              -> Quick overview
2. /cext-review-toolkit:hotspots            -> Where are the bugs?
3. /cext-review-toolkit:explore . refcounts errors deep  -> Deep dive on safety

1. /cext-review-toolkit:explore . compat abi  -> What needs to change?
2. /cext-review-toolkit:migrate               -> Full migration checklist

1. /cext-review-toolkit:migrate               -> What to modernize
2. /cext-review-toolkit:explore . module-state type-slots deep  -> Detailed guidance

1. /cext-review-toolkit:explore . all deep    -> Full analysis
2. Focus on FIX findings
3. Re-run on specific files after fixes

• Tree-sitter, not a compiler: Cannot resolve macros, follow pointer aliasing, or track through complex preprocessor conditionals. Reports candidates with expected 20-40% false positive rate; agents confirm or dismiss each finding.
• Single-file scope for scripts: Scripts analyze each function independently. Cross-function reference ownership transfer is tracked only at the API boundary level.
• External tools are optional: Without compile_commands.json, no clang-tidy or cppcheck integration. The Tree-sitter analysis is comprehensive but has inherent limits.
• Struct-to-type matching is heuristic: Connecting a PyTypeObject to its backing struct uses name matching and tp_basicsize analysis. Unusual naming or indirection may cause mismatches.

Danzin

MIT -- see LICENSE for details.