copilotkit-review

Review CopilotKit v2 and AG-UI pull requests for runtime, identity, and thread regressions.

1|Updated Sep 15, 2026
One-click install
npx skills add https://github.com/amoai-tech/mdeai --skill copilotkit-review-amoai-tech
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: copilotkit-review
Source: https://github.com/amoai-tech/mdeai/tree/main/.claude/skills/copilotkit-review
Command: npx skills add https://github.com/amoai-tech/mdeai --skill copilotkit-review-amoai-tech

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Reviewing changes to CopilotKit v2 and AG-UI integrations is risky because stale API knowledge, broken imports, and identity/thread boundary bugs can silently break the MDE AI concierge runtime. This Skill provides a disciplined review checklist that verifies claims against installed package source and types instead of memory. ## Core Features & Use Cases - Runtime Invariant Checks: Preserves v2 imports such as @copilotkit/react-core/v2, the same-origin /api/copilotkit runtime, auth, rate limits, telemetry, and agent allowlists. - Identity and Thread Safety: Flags browser-supplied user, tenant, thread, or resource IDs used as authorization and requires deterministic denial proofs for cross-user failures. - Verified Finding Discipline: Requires each v2 API defect finding to include the exact changed import, a fix restoring the verified installed surface, and verification via targeted tests plus typecheck. - Use Case: When a PR upgrades @copilotkit/runtime or changes HITL interrupt handling, run this review to confirm streaming, interrupts, and Mastra agent tool-map keys still resolve against the installed 1.55.2 packages. ## Quick Start Review this pull request for CopilotKit v2 and AG-UI regressions using the copilotkit-review checklist.

Frequently Asked Questions about copilotkit-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review CopilotKit v2 pull requests for regressions?

Check changed imports against installed @copilotkit/react-core/v2 and runtime v2 surfaces, verify agent IDs and tool-map keys resolve to registered Mastra agents, and confirm streaming, interrupts, and HITL behavior match the installed package APIs. Run targeted CopilotKit tests and npm run typecheck to validate.

What should I check when upgrading @copilotkit/runtime versions?

Verify the same-origin /api/copilotkit runtime, auth, rate limits, telemetry, request context, and agent allowlists are preserved. Confirm v2 imports remain valid or that the PR completes an intentional migration consistently across all surfaces.

Can browser-supplied user or thread IDs be used for authorization?

No. Browser-supplied user, tenant, thread, run, page, or resource IDs are not authorization. Thread, connect, stop, and cancel behavior must not cross user or tenant boundaries, and findings require a deterministic User A to User B denial proof.

Why do CopilotKit provider props cause lost conversation state?

Unstable provider or runtime props trigger remounts that silently discard conversation state. Reviews must confirm provider props remain stable so threads persist across renders.

What are the limitations of memory-based CopilotKit API reviews?

Memory and stale examples do not reflect the pinned 1.55.2 packages. The review requires verifying every API claim against installed @copilotkit/* and @ag-ui/* source and types, then current official documentation, before blocking a change.