Code review with Claude Code

Who this is for and what you will be able to do

This guide is for developers and team owners who want an automatic first pass over pull requests before a human reads them. After reading it, you will know the two ways Claude Code can review code, which plans and code hosts each one needs, how a review is run and what it leaves on a pull request, and how to tune how strict it is.

Two ways to get a review

Claude Code offers two review paths, and they work differently.

Code Review is a service that reviews the pull requests in your GitHub repositories. It runs on Anthropic infrastructure. Organizations on Team and Enterprise plans can use it^[1].

**/code-review** runs inside your own Claude Code session on your branch. Anyone can use it, on any plan^[1].

Code Review uses AI and may miss bugs, security vulnerabilities or other issues. A review with no findings does not mean the code is error-free or secure^[1].

Check your eligibility first

Before you set up Code Review, check these conditions^[1]:

• Plan: Team or Enterprise.
• Code host: repositories on GitHub, including GitHub Enterprise Server and GitHub Enterprise Cloud with data residency.
• Data retention: organizations with Zero Data Retention enabled or the HIPAA configuration applied cannot use it, and it is not covered under Anthropic's Business Associate Agreement (BAA).
• Encryption keys: not yet available for organizations that use customer-managed encryption keys (CMEK).
• Cloud providers: if your developers use Claude Code through Amazon Bedrock, Google Cloud's Agent Platform or Microsoft Foundry, the organization still needs a Claude organization on a Team or Enterprise plan.

Turning it on

An Owner of the Claude organization turns on Code Review by following the setup guide and installing the Claude GitHub App. During setup, the Owner chooses repositories, a review level and when reviews run^[1].

What a review does

Several agents read each change in parallel, together with the surrounding code. They look for logic errors, security vulnerabilities and broken edge cases. The review then goes through four stages^[1]:

1. Find: the agents examine the diff and the code around it.
2. Verify: each candidate finding is checked against the code, and false positives are filtered out.
3. Rank: the remaining findings are deduplicated and ranked by severity.
4. Post: the results go to the pull request.

By default the review focuses on correctness, meaning bugs that would break production. It does not flag formatting preferences or missing test coverage^[1].

A review works by reading the diff and the surrounding code. It does not build or run your code. Inside a review, repository access is read-only, and the review never pushes commits^[1].

What it leaves on the pull request

• Inline comments on the lines concerned, with a summary in the review body^[1].
• A check run named Claude Code Review. It lists the findings in its details, and it does not conclude as a failure^[1].
• A note in place of findings, when the check run title reads Code review found no issues^[1].

The review never approves or blocks a pull request. The merge decision stays with your team^[1].

When reviews run and how to start one

Each repository has its own setting for when reviews run: once when a pull request opens, after every push, or only on request^[1]. When reviews run automatically, opening or pushing to a pull request starts a review, except on drafts and on pull requests from forks^[1]. Anyone with write access to the repository can comment @claude review on a pull request to start a review^[1].

Review levels

The review level sets how thorough each review is. A more thorough review costs more^[1]:

• Quick: a lighter pass, the fastest and cheapest.
• Standard: the default, balancing depth, speed and cost.
• Deep: the most thorough pass. It takes the longest and costs the most.

An Owner sets one level for the organization and can give a single repository its own level. A routine codebase might use Quick, while a critical one uses Deep^[1]. Code Review chooses the Claude models its reviews run on, and the admin settings offer no model choice^[1].

Steering what gets flagged

Add REVIEW.md and CLAUDE.md files to the repository to tune what the review flags. Code Review reads REVIEW.md from the base or default branch, never from the changes in the pull request itself. That stops a pull request from rewriting its own review rules^[1].

Limits and common problems

• Plan or host not supported: Code Review is only for Team and Enterprise organizations on GitHub. Use /code-review locally or a CI setup otherwise^[1].
• Missed issues: a clean review is not a guarantee. Keep normal human review and tests^[1].
• Draft and fork pull requests: these do not start an automatic review. A @claude review comment from someone with write access can start one^[1].
• Claude in your own CI: GitHub Actions and GitLab CI/CD need a Claude API key or cloud provider credentials^[1].
• Ultrareview: requires signing in with a claude.ai account^[1].
• Repositories on GitLab: Code Review covers repositories on GitHub only. GitLab can reach Claude through its CI/CD pipelines, which need a Claude API key or cloud provider credentials^[1].

How the options fit together

The main ways to get a review differ in their requirements and where they run^[1]:

• Code Review: for GitHub repositories in Team and Enterprise organizations. It runs on Anthropic infrastructure, and an Owner turns it on^[1].
• **/code-review:** runs in your own session on your current branch, and anyone can use it on any plan^[1].
• Ultrareview: requires signing in with a claude.ai account^[1].
• Claude in your own CI: works with GitHub Actions or GitLab CI/CD, and needs a Claude API key or cloud provider credentials^[1].

An organization without a Team or Enterprise plan can still use /code-review locally, which is open on any plan^[1].

Things to agree on before you turn it on

1. Confirm the plan and the code host: a Team or Enterprise organization with repositories on GitHub^[1].
2. An Owner follows the setup guide, installs the Claude GitHub App and chooses the repositories to review^[1].
3. Choose the organization's review level (Quick, Standard or Deep) and decide when reviews run. A more thorough level costs more^[1].
4. Add REVIEW.md or CLAUDE.md to the repository to adjust what gets flagged. REVIEW.md is read from the base or default branch only^[1].
5. Treat the results as an aid. The merge decision stays with your team, and human review and tests remain necessary^[1].

Where to go next

Start with the setup page to check requirements and install the GitHub App. To tune what gets flagged, read the customization page. To see how reviews are billed and how to set a monthly spend limit, read the costs page. All of these are in the official Claude Code documentation^[1].