Claude Code Review is an Anthropic service that automatically reviews pull requests in GitHub repositories. Several agents read each change together with the surrounding code, a verification step drops false positives, and the findings arrive as comments on the affected lines, ranked by severity. According to Anthropic, Code Review left research preview and became generally available on 15 October 2026, for organizations on the Team and Enterprise plans. An Owner turns the service on in the admin settings and installs the Claude GitHub App. Billing is by tokens through usage credits, separate from your plan's included usage, with no flat price per review. A review never approves or blocks a pull request; the merge decision stays with your team. Without a Team or Enterprise account you can still get a review: with the /code-review command in your own Claude Code session, on any plan.
I have a house rule that fits this topic: whoever creates something does not correct it. Everything about Claude is collected on my Claude page. This article lays out what Anthropic offers for reviewing code, what it costs, and where the limits are.
Five ways to get a review from Claude
In the narrow sense, "Claude Code Review" means the managed service. Anthropic's docs, however, list five ways side by side, and the choice depends on your plan, your code host and who should trigger the review:
How Code Review works
According to the docs, a review runs in four stages on Anthropic's infrastructure. First, several agents examine the diff and the surrounding code in parallel. Then a separate step checks the candidates against the code and filters out false positives. Next, duplicate findings are merged and ranked by severity. Finally, the service posts line comments, a summary and a check run named "Claude Code Review" on the pull request. The check run never concludes as a failure.
By default, Code Review focuses on correctness, meaning bugs that would break production, not formatting or missing tests. Each finding carries one of three markers:
Two properties matter for judging it. The service only reads: inside a review, access to your repository is read-only, it pushes no commits, and it does not build or run your code but works by reading the diff and its surroundings. And Anthropic picks the model: the admin settings offer no model choice, only three review levels. "Quick" is the lightest, fastest and cheapest pass, "Standard" the default, "Deep" the most thorough, slowest and most expensive. An Owner sets the level for the organization and can give individual repositories their own. For general availability, Anthropic says most reviews now finish about three times faster than during the preview, around 6 to 10 minutes instead of around 20.
Requirements and setup
According to the docs, Code Review is available only under these conditions:
- Plan: Team or Enterprise. How the two differ is covered in Claude Enterprise or Team: Cost and GDPR.
- Code host: GitHub, including GitHub Enterprise Server and GitHub Enterprise Cloud with data residency. GitLab and other hosts are not supported by the service.
- Data retention: not available with Zero Data Retention, with the HIPAA configuration, or with customer-managed encryption keys (CMEK).
- Cloud providers: even if your team uses Claude Code through Amazon Bedrock, Google Cloud or Microsoft Foundry, you need a Claude organization on one of the two plans.
An Owner sets it up under "Admin settings > Claude Code" in the "Code review" section: flip the "Allow code review" switch, connect GitHub, install the Claude GitHub App for the repositories you want, select them, click "Finish". Installing the app needs an owner of the GitHub organization, and adding a repository needs write access to it. According to the docs, the app requests more permissions than a review uses, because other Claude features share it; read the permission list before you approve. To test, open a pull request that is not a draft; a check run should appear within a few minutes.
For each repository you decide when reviews run: once when a PR opens, after every push, or only on request. Newly added repositories start at "After every push", the setting with the most reviews. Independently of that, anyone with write access can comment @claude review on a pull request; @claude review always subscribes the PR to a review on every further push, @claude review stop ends the subscription. Drafts and pull requests from forks are skipped automatically.
Pricing: no flat price per review
Code Review is billed on token usage through usage credits, separately from your plan's included usage, and it is billed to the organization, not to the developer. Anthropic names no fixed price per review. According to the docs, what a review costs depends on the review level, the size of the change, the complexity of the surrounding code and how many candidate issues need verifying. How many reviews run is set per repository; "After every push" multiplies the cost by the number of pushes.
Anthropic recommends estimating cost with a small pilot before a wide rollout, and I consider that the most sensible approach:
- Set a monthly spend limit for the pilot.
- Turn on Code Review for a few representative repositories, with "Once after PR creation" or "Manual".
- After several reviews, read the "Average cost" column in the repositories table.
- Multiply that average by the number of pull requests per month, and for "After every push" also by the typical pushes per pull request.
You set the limit for the service at claude.ai/admin-settings/usage; it applies to the whole organization. When it is reached, the organization's overall limit is used up or the credit balance runs out, Code Review skips further reviews and leaves a comment on the pull request naming the reason. For eligible Enterprise organizations, Anthropic offers at least 10,000 US dollars in Code Review credits at launch, to be claimed by 15 January 2027 and expiring 30 days after claiming; terms apply. How the limits of the subscription itself work is covered in Claude Pro or Max: Limits Explained.
REVIEW.md and CLAUDE.md: steering what gets flagged
You steer what the service reports with two files in the repository. Code Review reads the CLAUDE.md, like every Claude Code session; I explain what belongs in it in my article on the CLAUDE.md. The REVIEW.md at the repository root applies to reviews only: which findings get which severity, which paths such as generated files are skipped, which extra checks your team wants. Further REVIEW.md files in subfolders add rules for changes under that path.
One security detail is spelled out in the docs: the service reads REVIEW.md from the base or default branch, never from the pull request's own changes. Whoever opens a pull request therefore cannot loosen the review rules in the same pull request. Anthropic recommends protecting the default branch for this reason.
/code-review in the terminal: a review on any plan
The /code-review command is part of Claude Code itself and, according to the docs, works on any plan. /review is an alias. Claude checks the changes on your branch for correctness bugs, depending on the model and effort also for simplifications, and reports the findings in the conversation. The review runs as a background subagent with its own context window and counts toward your plan's usage or API billing like the rest of the session.
/code-review # current branch plus uncommitted changes
/code-review high 1234 # pull request 1234 at high effort
/code-review main...feature # one branch against another
/code-review --fix # apply the findings to your working tree afterwards
/code-review --comment 1234 # post the findings as comments on the pull request
With --fix, the edits go through your permission mode. A detail for emergencies: edits from a background review sit outside your session's checkpoints, so /rewind does not fully undo them; use Git for that. The command reads your CLAUDE.md but not REVIEW.md, which belongs to the service only. For security questions there is also /security-review, which checks the diff against the default branch for risks such as injection or data exposure; more on that in my piece on Claude Code security.
Ultrareview is the thorough variant: /code-review ultra launches a fleet of reviewer agents in a cloud sandbox, and according to the docs each finding is independently reproduced and verified. Ultrareview is a research preview and requires a sign-in with a claude.ai account. Pro and Max include three free runs per account that do not refresh; after that, Anthropic says a review typically costs 5 to 25 US dollars in usage credits, depending on the size of the change. Before each run, Claude Code shows the estimated cost. For a branch, Claude Code uploads your repository state to the cloud; for a pull request on github.com, the sandbox clones it itself.
That leaves the code-review plugin from Anthropic's official plugin catalog, which also uses several agents and a scoring step against false positives. How to install and check plugins is in Claude Code Plugins: Install, Build, Trust. And if you want Claude in your own pipeline, use the Claude Code GitHub Action, set up with /install-github-app, with either an API key or a token from your Claude subscription.
Limits: what an AI review does not do
Anthropic writes it into the docs itself: Code Review may miss bugs, security vulnerabilities or other issues, and a review with no findings does not mean your code is error-free or secure. On top of that come the practical limits:
- No execution. The service reads code; it does not build or test it. Tests in CI are still needed.
- GitHub only. For GitLab, the options are GitLab CI/CD or
/code-review --comment, which attaches findings to a merge request as a note via the glab CLI.
- No merge gate out of the box. If you want to block on red findings, have your CI read the counts from a machine-readable line in the check run, which the docs describe.
- Data retention. Not with Zero Data Retention, HIPAA or CMEK, and no Ultrareview there either. If you need those, use
/code-review in your own session, your own CI or a reviewer of your own.
- Cost grows with activity. Many pushes in many repositories with "After every push" and the "Deep" level is the most expensive combination.
The creator is not the reviewer: why a second look counts
All five ways rest on the same reasoning: whoever built something is poor at finding their own mistakes in the same context. For me, that has become a fixed rule. Whoever creates something does not correct it. For text and code this means one tool writes and another reads it back. Claude Code builds something, Codex checks it with fresh eyes, or the other way around; I described that in Claude Code, Codex or Copilot: Which One?. What matters is not the vendor but the separation: the checker does not know the path to the result.
On my own website it looks like this: Ralf builds it, Sebastian writes the posts and measures, and Falk hunts for the security gaps, with evidence and a fix for every finding. Whatever goes out, I approve myself. How hand-overs like these between agents are written down instead of shouted across is covered in Orchestrating Multiple AI Agents.
For code, that means: do not run the review in the same session in which Claude wrote the code, and if you do, run it as a subagent with its own context, as /code-review does. A reviewer agent of your own with fixed checkpoints is quick to build; how is explained in Claude Code Subagents: Best Practices. And the last look before the merge stays with a person.
Frequently asked questions
How much does Claude Code Review cost?
There is no flat price. The service bills by tokens through usage credits, separately from your plan's included usage. The cost per review depends on the review level, the size of the change and the complexity of the code. Anthropic recommends a pilot with a spend limit, after which you read the average cost per repository.
Is Claude Code Review available on Pro or Max?
The managed service is not; it is reserved for Team and Enterprise. On Pro and Max you use /code-review in your session, which runs on any plan, and you get three free Ultrareview runs.
What is the difference between /review and /code-review?
None any more. Since version 2.1.223, /review has been an alias of /code-review. Before that, /review was a separate command for a single-pass, read-only review of a GitHub pull request.
Does Claude Code Review work with GitLab?
The service does not; it supports GitHub only. For GitLab there is Claude in GitLab CI/CD, or /code-review --comment on a merge request, which attaches the findings as a note via the glab CLI.
Does Claude Code Review replace human review?
No. According to Anthropic, a review can miss bugs, and it never approves a pull request. It is an additional reviewer that finds bugs before a person looks, not a replacement for that look.
Where to go from here
Start with the smallest step: run /code-review on your next branch and read the findings before you merge anything. If your team works on GitHub and has a Team or Enterprise plan, start the service with two repositories, "Once after PR creation" and a spend limit, and measure the average cost after a few weeks. How others build their reviewer roles and AI employees is what we discuss in my German-speaking community Claude Practitioners.
