Menu
Comprehensive Convex code review checklist for production readiness. Use when auditing a Convex codebase before deployment, reviewing pull requests, or checking for security and performance issues in Convex functions.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Building AI agents and assistants with Convex. Use when implementing chat interfaces, AI assistants, tool-calling agents, RAG (retrieval-augmented generation), conversation threads, or integrating LLMs like OpenAI/Anthropic.
File uploads, storage, and serving in Convex. Use when implementing file uploads, generating upload URLs, serving files, managing file metadata, or building file-based features like avatars, attachments, or media galleries.
Database migrations and schema evolution in Convex. Use when adding new fields, changing data structures, backfilling data, renaming fields, or performing zero-downtime schema changes.
Realtime subscriptions and optimistic updates in Convex. Use when implementing live data updates, optimistic UI, pagination with realtime, presence indicators, typing indicators, or any feature requiring instant data synchronization.
Best practices for Convex actions, transactions, and scheduling. Use when writing actions that call external APIs, using ctx.runQuery/ctx.runMutation, scheduling functions with ctx.scheduler, or working with the Convex runtime vs Node.js runtime ("use node").
Scheduled functions and cron jobs in Convex. Use when setting up recurring tasks, cleanup jobs, data syncing, scheduled notifications, or any background automation that runs on a schedule.
| name | convex-review |
| description | Comprehensive Convex code review checklist for production readiness. Use when auditing a Convex codebase before deployment, reviewing pull requests, or checking for security and performance issues in Convex functions. |
query, mutation, action have args validatorsreturns validatorsv.any() for sensitive dataSearch: query({, mutation({, action({ - check each has args: AND returns:
ConvexError for user-facing errors (not plain Error){ code: "NOT_FOUND", message: "..." }Search: throw new Error should be throw new ConvexError
ctx.auth.getUserIdentity() where neededrequireAuth, requireRole)Search: ctx.auth.getUserIdentity should appear in most public functions
ctx.runQuery, ctx.runMutation, ctx.runAction use internal.* not api.*ctx.scheduler.runAfter uses internal.* not api.*crons.ts use internal.* not api.*Search: api. in convex directory - should not be used for scheduling/running
ctx.db.get, patch, replace, delete include table name as first argSearch: db.get(, db.patch( - first arg should be quoted string
.filter() on queries (use .withIndex() or filter in code).collect() only with bounded results (<1000 docs)Search: \.filter\(\(?q, \.collect\(
by_foo + by_foo_and_bar).withIndex()Review: schema.ts index definitions
Date.now() in query functionsctx.scheduler, ctx.db.*)ESLint: no-floating-promises
"use node"; if using Node.js APIsctx.runAction only when switching runtimesctx.runMutation/ctx.runQuery (combine for consistency)convex/model/)convex/lib/auth.ts| Issue | Regex | Fix |
|---|---|---|
.filter() | \.filter\(\(?q | Use .withIndex() |
| Missing returns | handler:.*async without returns: | Add returns: |
| Plain Error | throw new Error\( | Use ConvexError |
| Missing table name | db\.(get|patch)\([^"'] | Add table name |
Date.now() in query | Date\.now\(\) | Remove from queries |
api.* scheduling | api\.[a-z] | Use internal.* |