Code Review

Catch bugs in GitHub pull requests with Code Review: Claude reviews each change, verifies its findings, and comments inline. For Team and Enterprise plans

With Code Review, Claude reviews the pull requests in your GitHub repositories. Several agents read each change alongside the surrounding code, looking for issues such as logic errors, security vulnerabilities, or broken edge cases. A verification step checks findings against the code before they're reported.

Findings arrive as inline comments on the lines concerned, ranked by severity, with a summary and a check run on the pull request. A review never approves or blocks the pull request, so the decision to merge stays with your team.

[!NOTE]

Code Review uses AI to review code and may miss bugs, security vulnerabilities, or other issues. A review with no findings doesn't mean your code is error-free or secure.

To turn on Code Review, an Owner of your Claude organization follows Set up Code Review. Claude can also review code without this service. Run /code-review in your Claude Code session on any plan, or compare all the options.

Availability

Check that your organization qualifies before you set up Code Review:

• Plans: Team and Enterprise
• Code hosts: repositories hosted on GitHub, including GitHub Enterprise Server and GitHub Enterprise Cloud with data residency. For data residency, have an Owner follow the GitHub Enterprise Server admin setup and enter your enterprise's ghe.com hostname.
• Data retention: Code Review isn't available to organizations with Zero Data Retention enabled or with the HIPAA configuration applied, and isn't covered under Anthropic's Business Associate Agreement (BAA).
• Encryption keys: Code Review isn't yet available for organizations that use customer-managed encryption keys (CMEK).
• Cloud providers: you need a Claude organization on one of these plans even if your developers use Claude Code through Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry

Set up and use Code Review

Pick the page for what you need to do:

[card] Set up Code Review

Check the requirements, install the Claude GitHub App, and choose repositories, a review level, and when reviews run

[card] Customize Code Review

Tune what gets flagged with REVIEW.md and CLAUDE.md files in your repository

[card] Read and request reviews on a pull request

Read the findings and their severities, and request another review with a comment

[card] Troubleshoot Code Review

Fix a review that didn't start, failed, or was skipped for budget

[card] Code Review costs and usage

See how reviews are billed, estimate spend, set the monthly spend limit, and track review activity

How reviews work

By default, Code Review focuses on correctness: bugs that would break production, not formatting preferences or missing test coverage. To change what it flags, add guidance files to your repository.

A review runs on Anthropic infrastructure in four stages:

1. Find: several agents examine the diff and the surrounding code in parallel.
2. Verify: a verification step checks the candidate findings against the code and filters out false positives.
3. Rank: the findings that remain are deduplicated and ranked by severity.
4. Post: the review posts its results on the pull request.

Each review leaves these on the pull request:

• Findings: inline comments on the lines concerned, with a summary in the review body
• A check run: named Claude Code Review, with the findings listed in its details. The check run doesn't conclude as a failure.
• A note in place of findings: posted when the check run's title reads Code review found no issues

Code Review chooses the Claude models that reviews run on, and its admin settings don't offer a model choice. To make reviews more or less thorough, change the review level.

After an Owner turns on Code Review, each repository has a setting for when reviews run: once when a pull request opens, after every push, or only on request. Whichever it is, someone with write access to the repository can comment @claude review on a pull request to start a review.

Review levels

The review level sets how thorough each review is, and a more thorough review costs more:

• Quick: a lighter pass. The fastest level, at the lowest cost.
• Standard: balanced depth, speed, and cost. The default level.
• Deep: the most thorough pass. Takes the longest and costs the most.

An Owner chooses one level for the organization and can give an individual repository its own, such as Quick for a routine codebase and Deep for a critical one. For what else drives the cost of each review, see Code Review costs and usage.

What a review can access

A review reaches your repository through the Claude GitHub App that an Owner installs during setup:

• Where it runs: on Anthropic infrastructure, in a managed environment. Reviews don't run in self-hosted environments.
• What it reads and writes: inside a review, access to your repository is read-only, and a review doesn't push commits. On the pull request, it posts comments and the check run, resolves its own earlier comment threads, and can react to a comment command with 👀. The app itself holds a broader permission set that other Claude features share.
• How it examines your code: a review works from reading the diff and the surrounding code, without building or running your code.

Who controls a review

• Who can start one: where reviews run automatically, opening or pushing to a pull request starts a review, except on drafts and forks. After some pushes, Code Review keeps the earlier result instead. A comment command starts one only when it comes from a person with write access to the repository.
• Which instructions it follows: REVIEW.md from the base or default branch and never from the pull request's own changes.

Compare ways to get a review

To find the options open to you, check the Who can use it column against your plan and code host:

Related resources

• GitHub Enterprise Server: use Code Review with a self-hosted GitHub instance
• GitHub App permissions: the full permission set the Claude GitHub App requests
• How Anthropic secures its AI-native software development lifecycle: how automated review fits as one layer of Anthropic's secure development process