Complete Guide to Claude Code for PR Review (2026)

Claude Code can inspect a change before it leaves a laptop, inside a team-owned GitHub Actions job, or through Anthropic's managed pull-request service. The name is the same, but the models, permissions, billing and places your code is sent differ. Choose a local session for your own first pass, the Action for a workflow you control, or managed review for shared GitHub feedback without maintaining that workflow.

What I like about a terminal agent like Claude Code for review work is that project instructions, hooks, and agent workflows help keep the work consistent with repository rules. Give Claude specific checks to make, and have a person verify the findings before release.

For dedicated bots and other agent options, see the AI code review guide.

Claude Code Review at a Glance

Claude Code review paths.

Path	Runs In	Billing	Trade-off
Local review	Claude Code session	Plan or API usage	Manual and private
Claude Code Action	GitHub runner	Chosen provider	Team owns workflow
Managed Code Review	Anthropic service	Usage credits	Hosted verification; variable cost

Which Claude Code Review Option Should You Use?

Use local Claude Code review to check your own changes, Claude Code Action when your team wants control over its CI workflow, and managed Code Review when a Team or Enterprise organisation wants Anthropic to run GitHub reviews. Ultrareview adds a separate cloud review option started from Claude Code.

Managed Code Review

Anthropic's managed-review documentation describes a service for Team and Enterprise organisations. An admin installs the Claude GitHub App, selects repositories, and chooses when reviews run.

The service reads the diff and surrounding codebase, posts inline comments, and creates a Claude Code Review check. Its check concludes as neutral, or skipped when an automatic review has no file changes; it never concludes as a failure. Teams wanting a merge gate must parse the severity data in their own CI or keep an existing required approval.

Managed review suits a pull request that needs surrounding repository context without the team maintaining a custom action. Charges depend on token usage, and Anthropic processes the code on its servers. Quick, Standard and Deep review levels trade depth against time and cost; Standard is the default. The hosted service reads code without building or running it.

Claude Code Action

The official Claude Code Action documentation says the Action runs on the team's GitHub Actions runner. It can review a pull request, answer questions, or perform specific coding tasks based on the event and prompt.

Authentication can use Anthropic directly, Amazon Bedrock, Google Vertex AI, or Microsoft Foundry. Anthropic's current GitHub Actions guide also documents workload identity federation for short-lived credentials, which avoids storing a long-lived Anthropic API key.

The Action gives a team more control over the runner, event, prompt, model provider, and token permissions. Your team must also maintain it. Someone must pin the action safely, review permission changes, prevent untrusted text from steering privileged work, and watch provider spend.

Local Review

Local review happens inside the same Claude Code environment used to inspect and change the repository. A developer can ask Claude to review the current diff, run the /code-review command before pushing, or focus a pass on one contract such as tenant isolation.

/review is now an alias of /code-review, which takes an effort level, applies findings with --fix, and posts them to a GitHub pull request or GitLab merge request with --comment.

Anthropic also offers ultrareview, a research-preview cloud pass started with /code-review ultra. It runs a fleet of reviewer agents for roughly 5 to 10 minutes and independently verifies each finding. Pro and Max accounts get three one-time free runs, and later runs typically cost $5 to $25 in usage credits.

A local /code-review pass is the smallest trial because it adds no GitHub App and no new organisation-wide trigger. Without --comment, the command returns findings to the developer rather than posting them to the pull request. Local here describes the workflow, not where model inference runs.

Local review also has the widest variation. The result depends on the selected model, session instructions, available tools, permission mode, and context already in the conversation. Record the exact diff and review request if the team wants to compare runs fairly.

How Does Managed Claude Code Review Work?

Managed Claude Code Review uses several agents to inspect the diff and nearby code in parallel. Each looks for a different failure class. A verification stage checks candidate findings against the code, removes duplicates, ranks the rest, and posts surviving items by severity.

Anthropic currently labels findings Important, Nit, or Pre-existing. Important means a bug worth fixing before merge, while Nit covers a minor issue. Pre-existing marks a problem already present in the repository so the current pull request does not take false blame.

The service can run once when a pull request opens, after every push, or by comment. Anthropic's docs list these triggers:

Review Trigger	Run Behavior	Billing and Rerun Effect
Initial PR creation	Single opening review	One billed run
Every push	Reviews each update	Multiplies by pushes
@claude review	Single requested review	No push subscription
@claude review once	Same one-shot behaviour	No push subscription
@claude review always	Reviews and subscribes	Future pushes run

Since July 2026, the bare command is a safer one-shot control for long-running pull requests. Use @claude review always only when later pushes should trigger fresh reviews and charges. The explicit once form remains an alias for the bare command.

How Much Does Claude Code Review Cost?

Claude Code review costs depend on how you run it. Local sessions use your plan or API allowance, the Action uses your configured provider and runner, and managed review charges separate token-based usage credits. Ultrareview has its own cloud-review charges.

Billing Path	Current Price	Applies to Workload
Claude Pro	About $17/month, billed as $200 upfront annually; $20/month, billed monthly	Local Claude Code
Claude Max	From $100/mo	Higher plan usage
Managed review	Variable token-based usage credits	Each review run
Ultrareview	$5 to $25 after free runs	Each cloud review

Claude Code Action follows the chosen provider's model and runner billing. Local plan usage competes with the developer's other Claude work. During the trial, track the full review bill and time spent checking comments. A subscription price and the cost of one managed run are not directly comparable.

How Do You Configure Claude Code Review Rules?

Configure Claude Code’s local review with CLAUDE.md and managed review with REVIEW.md. CLAUDE.md supplies broader project context. REVIEW.md supplies managed-review instructions at the repository root, with optional subdirectory files for more specific checks.

Anthropic gives REVIEW.md directly to the agents that find and verify findings, and the agents that rank and report them consult it before settling severity. Put the rules you want enforced directly in the file. A compact backend example can look like this:

# Review instructions

## Important findings
- Unscoped tenant queries
- PII in logs or errors
- Migrations without a rollback path

## Skip
- Generated files and lockfiles
- Formatting and type errors caught by CI

## Evidence
- Cite the source path and call chain
- Suppress a claim that cannot be verified

Each rule describes a requirement that should still apply after functions are renamed. The skip list protects reviewer time from low-value generated content. Requiring evidence makes the agent show how files affect each other before a developer investigates.

Set a nit cap if prose, config, or tests attract endless polish. Another useful rule suppresses fresh nits after the first review so a one-line fix does not start a new style loop. Keep business and architecture context in CLAUDE.md, where it also helps ordinary Claude Code sessions.

Managed review reads REVIEW.md from the base or default branch, never from the pull request's proposed changes. Merge instruction changes first. Severity-lowering, exclusions and nit caps depend on the protected-default-branch rules in Anthropic's documentation; a file in an unprotected branch is not an equivalent control. Local /code-review reads CLAUDE.md, not REVIEW.md.

What Can Claude Code Review Catch?

Claude Code Review looks for logic errors, security flaws, broken edge cases, and regressions that need surrounding code. A changed permission check may look safe in the diff while a caller passes the wrong identity. A migration may compile while an older worker still expects the prior schema.

The extra check on each finding is a key reason to consider managed review. A plausible comment must survive another inspection step before it reaches the pull request. That reduces the chance of developers spending time on an unchecked guess, although Anthropic does not promise that every surviving comment is correct.

Local review can use tools from the active session. It may run a targeted test, inspect a type, search all call sites, or compare behaviour with a requirement file. Name the expected behaviour in the prompt and ask Claude to cite the code that supports its finding.

What Are the Limits of Claude Code Review?

Claude Code Review can miss unstated requirements, misread code and produce incorrect findings even after verification. It can trace a pricing calculation and miss that the formula violates a sales contract. It can judge a local change safe even when that change breaks an operational runbook stored elsewhere.

Managed review carries queue time and variable cost. Every-push triggers can turn a busy pull request into several bills. A failed run ends neutrally, and Anthropic retries only some interrupted reviews on its own, so the lack of a blocking check cannot be read as a clean review.

REVIEW.md can create its own noise when it grows into a second handbook. Conflicting rules, stale path names, and long lists weaken the checks that matter. Review the file when responsibilities move between modules, and delete rules your CI checks now enforce.

Where Does Claude Code Review Process Your Code?

Managed Claude Code Review processes code on Anthropic infrastructure and is unavailable with Zero Data Retention, HIPAA configuration or customer-managed encryption keys. It is not covered by Anthropic's Business Associate Agreement. The GitHub App asks for repository contents plus pull-request and issue permissions. Start with selected repositories and confirm the organisation's retention and access settings.

The Action runs on a team runner, yet model requests still leave for the configured provider. Review the runner image, outbound network, secrets, logs, checkout behaviour, and token permissions. Workload identity can remove a stored API key. Your team still owns the other controls.

Keep review read-only during the first trial. A workflow that can post a finding needs less authority than one that can push a fix. Separate those jobs, and require a developer to verify the issue before any write-enabled task runs.

Security prompts should name the authorised repository, defensive purpose, expected evidence, and excluded actions. That context helps the model understand the task and gives the human reviewer a clear standard for rejecting an unsafe detour.

Pull-request text, source comments, fixtures, and generated files can contain instructions that compete with the workflow prompt. Treat them as untrusted data, keep privileged rules in reviewed configuration, and require tool evidence for claims that cross file or service boundaries.

Test the Review Mode You Plan to Use

Use the hub's four-week method for the common sample and outcome labels. Start locally on one clean diff and one known defect, recording the model, instructions, files available, findings, and checks run.

The next step is choosing one shared review mode. A team that already owns GitHub Actions can try the Action with read-only permissions. A Team or Enterprise organisation can enable managed review on one repository with @claude review once.

1. Limit scope: One repository and manual triggers.
2. Add rules: A few relevant checks in REVIEW.md for managed review, or CLAUDE.md for local review.
3. Measure: Verified defects, false positives, cost, and triage time.
4. Trigger check: Compare one-shot commands with @claude review always and record the extra push-triggered runs.

Keep tests, static analysis, and required human approval in place throughout the pilot. Recheck REVIEW.md after several pull requests and remove any rule that produces repeated guesses.

Record failed and neutral runs alongside successful ones. A review process that completes only on small diffs can look accurate while disappearing on the changes that need it most. Completion rate, queue time, and cost belong beside accepted findings in the rollout decision.

My Verdict

Claude Code is strongest when each review mode has a distinct job. Use /code-review for a private developer pass, the Action for a team-owned runner and provider, and managed review for costly pull requests that justify multi-agent verification. A short REVIEW.md sharpens the hosted review; accountable approval stays with a person.

Frequently Asked Questions

How long does managed Claude Code Review take?

Managed Claude Code Review completion time varies with the review level, change size and verification work. Quick, Standard and Deep levels trade review depth against time and cost. Check the run status rather than treating an unfinished review as a clean result.

Which model does managed Claude Code Review use?

Anthropic does not name one fixed model for managed Claude Code Review, and its admin settings do not offer a model selector. Choosing a model in a local Claude Code session does not select the model for the managed service.

Can Claude Code review run on a team runner?

Claude Code Action can run a review on your GitHub Actions runner, while managed Claude Code Review runs on Anthropic infrastructure. The Action still sends model requests to the provider you configure; running the job yourself does not make model processing local.