International Journal of Scientific Research and Engineering Development

Security review of pull requests (PRs) remains manual, inconsistent, and dependent on reviewer expertise, creating a bottleneck in modern DevSecOps pipelines. Single-agent LLM reviewers, while easy to deploy, conflate detection, explanation, and prioritization inside one undifferentiated reasoning pass, making them prone to confirmation bias and inconsistent output across repeated runs. This paper proposes a multiagent architecture — the AppSec Review Agent — that decomposes PR security review across five cooperating agents: an Orchestrator, three deterministic specialist agents (static analysis, dependency-CVE lookup, secret scanning), and an LLM Reasoning Agent supported by a three-tier memory system. Agents communicate through the Model Context Protocol (MCP), a standardized client-server tool-calling layer, rather than bespoke point-to-point integrations. We present the complete system architecture, agent interaction sequence, communication protocol, memory architecture, deployment architecture, coordination algorithms, and a tagged case-study protocol for reporting agent behaviour consistently across evaluations. A worked case study demonstrates the pipeline end-to-end on a deliberately vulnerable code sample. Full benchmark-scale quantitative evaluation is scoped as an immediate next phase and is described here as a concrete, reproducible protocol rather than presented as completed results.

Jahnavi Somaraju, Sreevathsa Ganesh P R, "A Multi-Agent Architecture for Autonomous Security-Focused Code Review in GitHub Pull Requests" International Journal of Scientific Research and Engineering Development, V9(4): Page(162-169) May-June 2026. ISSN: 2581-7175. www.ijsred.com. Published by Scientific and Academic Research Publishing.