Code Review for Claude Code: setup, REVIEW.md and /code-review

Which option fits?

Turn on managed Code Review

1. As an Owner of your Claude organization, open Admin settings > Claude Code on claude.ai and click the Allow code review switch. Reviews run on Anthropic infrastructure, so you add no workflow files.
2. Click Connect to link your GitHub account, then Install GitHub App for the Claude GitHub App if your repositories aren't listed (this needs a GitHub organization owner).
3. Select repositories and click Finish.
4. Open a non-draft test pull request. A check run named Claude Code Review should appear within a few minutes.

Review level (one default for the organization, overridable per repository): Quick is the fastest and cheapest, Standard is the default, Deep is the most thorough and costs the most.

When reviews run (per repository): once after the pull request is opened, after every push, or manual. A newly added repository starts at after every push, which runs the most reviews. In manual mode, anyone with write access can comment @claude review, or @claude review always to subscribe that pull request to reviews on each push. Automatic reviews skip drafts and forks.

A review never approves or blocks a pull request, and inside a review the app reads your repository without pushing commits. It works from the diff and surrounding code, without building or running your code.

Tune what it flags

• CLAUDE.md is read as project context: a change that breaks one of its rules becomes a finding.
• REVIEW.md at the repository root holds review-only instructions: what is Important versus Nit, what to skip, what to always check. A REVIEW.md in a subdirectory adds checks for changes under that path.
• It is read from the pull request's base or default branch, never from the pull request's own changes, so merge changes to it first and protect the default branch.
• The local /code-review command reads CLAUDE.md but not REVIEW.md. Put guidance you want in both places in CLAUDE.md.

# Review instructions

Reserve Important for findings that would break behavior, leak data,
or block a rollback. Style and naming are Nit at most.

Report at most five Nits per review.

## Do not report
- Anything CI already enforces: lint, formatting, type errors
- Generated files under `src/gen/` and any `*.lock` file

## Always check
- New API routes have an integration test

Run it locally on any plan

/code-review                      # your branch's commits ahead of upstream, plus uncommitted changes
/code-review 1234                 # a pull request by number
/code-review main...my-feature    # one branch against another
/code-review src/auth --fix       # also apply the findings (edits go through your permission mode)
/code-review --comment            # post findings to the GitHub pull request

/review is an alias. You can pass an effort level (low reports fewer, higher-confidence findings; medium through max broaden coverage) and --max-findings <n> (v2.1.288+). It counts toward your plan's usage or API billing like the rest of the session. /code-review ultra runs the cloud ultrareview where it is available.

What it costs, and what it can't do

• Managed Code Review has no flat price. It is billed on token usage through usage credits, to your organization, separately from plan usage. Cost scales with review level, change size and how often reviews run. Set a monthly limit at claude.ai/admin-settings/usage, and see activity at claude.ai/analytics/code-review.
• Not available to organizations with Zero Data Retention or the HIPAA configuration, or that use customer-managed encryption keys.
• Anthropic's docs warn it can miss bugs and security issues: a review with no findings doesn't mean the code is error-free.

How Anthropic says its own team does it

A post on the claude.dev blog dated October 15, 2026, by Addy Osmani, Morgan Westlee Lunt and Qing Wang, describes the Claude Code team's layered process. These are the post's claims, not documented product behaviour: before a pull request, Claude runs tests and a subagent reviews the diff with fresh context; every pull request gets required CI plus an AI review whose findings are verified by other agents and tagged Important, Nit or Pre-existing; open findings block the merge; human approval scales with risk (none for low risk, one person for medium, two for high, set by a classifier); and changes ship behind flags. It says humans still decide what to build and review risky code such as billing and the auto-updater, and that an agent's approval doesn't count as a person's. It also reports figures, such as pull requests getting substantive review comments rising from 16% to 54% when the reviewer launched; they are Anthropic's own and we haven't verified them.