Skip to main content
With Code Review, Claude reviews the pull requests in your GitHub repositories. Several agents read each change alongside the surrounding code, looking for issues such as logic errors, security vulnerabilities, or broken edge cases. A verification step checks findings against the code before they’re reported. Findings arrive as inline comments on the lines concerned, ranked by severity, with a summary and a check run on the pull request. A review never approves or blocks the pull request, so the decision to merge stays with your team. Diagram of a review in four stages. A pull request on GitHub goes to several agents that search in parallel on Anthropic infrastructure. A verification step drops false positives, the remaining findings are deduplicated and ranked by severity, and the review posts inline comments, a summary, and a check run back on GitHub. Diagram of a review in four stages. A pull request on GitHub goes to several agents that search in parallel on Anthropic infrastructure. A verification step drops false positives, the remaining findings are deduplicated and ranked by severity, and the review posts inline comments, a summary, and a check run back on GitHub.
Code Review uses AI to review code and may miss bugs, security vulnerabilities, or other issues. A review with no findings doesn’t mean your code is error-free or secure.
To turn on Code Review, an Owner of your Claude organization follows Set up Code Review. Claude can also review code without this service. Run /code-review in your Claude Code session on any plan, or compare all the options.

​
Availability

Check that your organization qualifies before you set up Code Review:
  • Plans: Team and Enterprise
  • Code hosts: repositories hosted on GitHub, including GitHub Enterprise Server and GitHub Enterprise Cloud with data residency. For data residency, have an Owner follow the GitHub Enterprise Server admin setup and enter your enterprise’s ghe.com hostname.
  • Data retention: Code Review isn’t available to organizations with Zero Data Retention enabled or with the HIPAA configuration applied, and isn’t covered under Anthropic’s Business Associate Agreement (BAA).
  • Encryption keys: Code Review isn’t yet available for organizations that use customer-managed encryption keys (CMEK).
  • Cloud providers: you need a Claude organization on one of these plans even if your developers use Claude Code through Amazon Bedrock, Google Cloud’s Agent Platform, or Microsoft Foundry

​
Set up and use Code Review

Pick the page for what you need to do:

Set up Code Review

Check the requirements, install the Claude GitHub App, and choose repositories, a review level, and when reviews run

Customize Code Review

Tune what gets flagged with REVIEW.md and CLAUDE.md files in your repository

Read and request reviews on a pull request

Read the findings and their severities, and request another review with a comment

Troubleshoot Code Review

Fix a review that didn’t start, failed, or was skipped for budget

Code Review costs and usage

See how reviews are billed, estimate spend, set the monthly spend limit, and track review activity

​
How reviews work

By default, Code Review focuses on correctness: bugs that would break production, not formatting preferences or missing test coverage. To change what it flags, add guidance files to your repository. A review runs on Anthropic infrastructure in four stages:
  1. Find: several agents examine the diff and the surrounding code in parallel.
  2. Verify: a verification step checks the candidate findings against the code and filters out false positives.
  3. Rank: the findings that remain are deduplicated and ranked by severity.
  4. Post: the review posts its results on the pull request.
Each review leaves these on the pull request:
  • Findings: inline comments on the lines concerned, with a summary in the review body
  • A check run: named Claude Code Review, with the findings listed in its details. The check run doesn’t conclude as a failure.
  • When it finds nothing: the check run’s title reads Code review found no issues, and Claude posts the same short note on the pull request
Code Review chooses the Claude models that reviews run on, and its admin settings don’t offer a model choice. To make reviews more or less thorough, change the review level. After an Owner turns on Code Review, each repository has a setting for when reviews run: once when a pull request opens, after every push, or only on request. Whichever it is, someone with write access to the repository can comment @claude review on a pull request to start a review.

​
Review levels

The review level sets how thorough each review is, and a more thorough review costs more:
  • Quick: a lighter pass. The fastest level, at the lowest cost.
  • Standard: balanced depth, speed, and cost. The default level.
  • Deep: the most thorough pass. Takes the longest and costs the most.
An Owner chooses one level for the organization and can give an individual repository its own, such as Quick for a routine codebase and Deep for a critical one. For what else drives the cost of each review, see Code Review costs and usage.

​
What a review can access

A review reaches your repository through the Claude GitHub App that an Owner installs during setup:
  • Where it runs: on Anthropic infrastructure, in a managed environment. Reviews don’t run in self-hosted environments.
  • What it reads and writes: inside a review, access to your repository is read-only, and a review doesn’t push commits. On the pull request, it posts comments and the check run, resolves its own earlier comment threads, and can react to a comment command with 👀. The app itself holds a broader permission set that other Claude features share.
  • How it examines your code: a review works from reading the diff and the surrounding code, without building or running your code.

​
Who controls a review

​
Compare ways to get a review

To find the options open to you, check the Who can use it column against your plan and code host: