SpyBara
Go Premium

code-review.md 2026-10-21 23:02 UTC to 2026-10-22 22:58 UTC

This page contains 23 additions and 23 deletions.

2026
Thu 1 23:59 Fri 2 22:59 Sat 3 23:57 Mon 5 23:58 Tue 6 23:59 Wed 7 23:59 Sat 10 23:01 Wed 14 22:58 Thu 15 23:58 Tue 20 23:00 Thu 22 22:58 Fri 23 22:59 Sun 25 23:58 Fri 30 23:01

Code Review

Catch bugs in GitHub pull requests with Code Review: Claude reviews each change, verifies its findings, and comments inline. For Team and Enterprise plans

With Code Review, Claude reviews the pull requests in your GitHub repositories. Several agents read each change alongside the surrounding code, looking for issues such as logic errors, security vulnerabilities, or broken edge cases. A verification step checks findings against the code before they're reported.

Findings arrive as inline comments on the lines concerned, ranked by severity, with a summary and a check run on the pull request. A review never approves or blocks the pull request, so the decision to merge stays with your team.

Diagram of a review in four stages. A pull request on GitHub goes to several agents that search in parallel on Anthropic infrastructure. A verification step drops false positives, the remaining findings are deduplicated and ranked by severity, and the review posts inline comments, a summary, and a check run back on GitHub.

[!NOTE]

Code Review uses AI to review code and may miss bugs, security vulnerabilities, or other issues. A review with no findings doesn't mean your code is error-free or secure.

To turn on Code Review, an Owner of your Claude organization follows Set up Code Review. Claude can also review code without this service. Run /code-review in your Claude Code session on any plan, or compare all the options.

Availability

Check that your organization qualifies before you set up Code Review:

  • Plans: Team and Enterprise
  • Code hosts: repositories hosted on GitHub, including GitHub Enterprise Server and GitHub Enterprise Cloud with data residency. For data residency, have an Owner follow the GitHub Enterprise Server admin setup and enter your enterprise's ghe.com hostname.
  • Data retention: Code Review isn't available to organizations with Zero Data Retention enabled or with the HIPAA configuration applied, and isn't covered under Anthropic's Business Associate Agreement (BAA).
  • Encryption keys: Code Review isn't yet available for organizations that use customer-managed encryption keys (CMEK).
  • Cloud providers: you need a Claude organization on one of these plans even if your developers use Claude Code through Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry

Set up and use Code Review

Pick the page for what you need to do:

Set up Code Review

Check the requirements, install the Claude GitHub App, and choose repositories, a review level, and when reviews run

Customize Code Review

Tune what gets flagged with REVIEW.md and CLAUDE.md files in your repository

Read and request reviews on a pull request

Read the findings and their severities, and request another review with a comment

Troubleshoot Code Review

Fix a review that didn't start, failed, or was skipped for budget

Code Review costs and usage

See how reviews are billed, estimate spend, set the monthly spend limit, and track review activity

How reviews work

By default, Code Review focuses on correctness: bugs that would break production, not formatting preferences or missing test coverage. To change what it flags, add guidance files to your repository.

A review runs on Anthropic infrastructure in four stages:

  1. Find: several agents examine the diff and the surrounding code in parallel.
  2. Verify: a verification step checks the candidate findings against the code and filters out false positives.
  3. Rank: the findings that remain are deduplicated and ranked by severity.
  4. Post: the review posts its results on the pull request.

Each review leaves these on the pull request:

  • Findings: inline comments on the lines concerned, with a summary in the review body
  • A check run: named Claude Code Review, with the findings listed in its details. The check run doesn't conclude as a failure.
  • When it finds nothing: the check run's title reads Code review found no issues, and Claude posts the same short note on the pull request

Code Review chooses the Claude models that reviews run on, and its admin settings don't offer a model choice. To make reviews more or less thorough, change the review level.

After an Owner turns on Code Review, each repository has a setting for when reviews run: once when a pull request opens, after every push, or only on request. Whichever it is, someone with write access to the repository can comment @claude review on a pull request to start a review.

Review levels

The review level sets how thorough each review is, and a more thorough review costs more:

  • Quick: a lighter pass. The fastest level, at the lowest cost.
  • Standard: balanced depth, speed, and cost. The default level.
  • Deep: the most thorough pass. Takes the longest and costs the most.

An Owner chooses one level for the organization and can give an individual repository its own, such as Quick for a routine codebase and Deep for a critical one. For what else drives the cost of each review, see Code Review costs and usage.

What a review can access

A review reaches your repository through the Claude GitHub App that an Owner installs during setup:

  • Where it runs: on Anthropic infrastructure, in a managed environment. Reviews don't run in self-hosted environments.
  • What it reads and writes: inside a review, access to your repository is read-only, and a review doesn't push commits. On the pull request, it posts comments and the check run, resolves its own earlier comment threads, and can react to a comment command with 👀. The app itself holds a broader permission set that other Claude features share.
  • How it examines your code: a review works from reading the diff and the surrounding code, without building or running your code.

Who controls a review

Compare ways to get a review

To find the options open to you, check the Who can use it column against your plan and code host:

Option What starts a review Where it runs Who can use it
Code Review Pull request activity, as each repository is set, or an @claude review comment Anthropic infrastructure Organizations on a Team or Enterprise plan with GitHub repositories, once an Owner turns it on
/code-review You run the command on your branch Your Claude Code session Anyone, on any plan
Ultrareview You start it from Claude Code A cloud sandbox Requires signing in with a claude.ai account. See Ultrareview for where it isn't available
Claude in your own CI, with GitHub Actions or GitLab CI/CD Your pipeline's events, such as every pull request or merge request Your own CI runners Anyone with a Claude API key or cloud provider credentials, on GitHub or GitLab
Your own reviewer, as a subagent or skill You or Claude invoke it during a session Wherever you run Claude Code Anyone who writes one