Claude Code Review: How to Review Code with Claude

Claude Code review means asking Claude to check your changes for bugs before you merge, and the quickest way to start is to type /code-review in a Claude Code session. That command works on every plan. For a deeper pass, /code-review ultra sends the change to a fleet of reviewer agents in the cloud. /security-review looks only for security holes. And on GitHub you can have Claude review pull requests through GitHub Actions or through Anthropic's managed Code Review service for Team and Enterprise plans.

Everything below comes from the Claude Code docs, checked November 7, 2026. Command names and prices change, so check there if something here looks out of date.

The review options at a glance

How to use /code-review

/code-review is a bundled skill. Run it with no arguments and Claude reviews your branch's commits ahead of its upstream branch, plus any uncommitted changes. If the branch has no upstream, it compares against main.

/code-review

In a terminal session the review runs as a background subagent with its own context window, so your conversation stays clean. The findings land in the chat when it's done. /review is an alias.

Pick an effort level

Put an effort level first: low, medium, high, xhigh or max.

/code-review high

At low, the review reports only the findings it's most confident in, so you see fewer false positives. From medium up through max, it widens coverage and reports more. If you don't type a level, Claude Code reuses the last level you typed, even from an earlier session, and tells you so. If you've never typed one, it uses the session's current effort.

Point it at something else

Type a target after the level and any flags:

Flags worth knowing

• --fix asks Claude to apply the findings to your working tree after the review. Edits still go through your permission mode.
• --comment posts the findings on the GitHub pull request as inline comments, or on a GitLab merge request as one note through the glab CLI.
• --max-findings <n> reports up to that many findings. Use --max-findings all for every finding and --max-findings default to go back to the normal limit.

For example, to review pull request 1234 at high effort and post the results on it:

/code-review high --comment 1234

One thing to watch with --fix: a background review's edits sit outside your session checkpoints, so /rewind won't undo them. Use git to revert them if you need to.

The review follows your CLAUDE.md, so put your project's rules there. Our CLAUDE.md examples show what a good one looks like. If you want a reviewer with your own checklist, you can write one as a custom subagent or a skill.

How to run ultrareview in the cloud

Ultrareview is the deep version. It runs as a cloud session on Anthropic's infrastructure and launches a fleet of reviewer agents against your branch or pull request. Each finding is independently reproduced and verified before you see it, so the report focuses on real bugs rather than style notes. It's a research preview, so the feature and pricing can change.

/code-review ultra

With no arguments it reviews your current branch against the default branch, including uncommitted and staged changes. Other ways to call it:

/code-review ultra develop
/code-review ultra 1234
/code-review ultra check my auth changes

The first compares against develop. The second reviews pull request 1234 on github.com (run /web-setup first to connect your GitHub login). The third reviews your branch and keeps your words as a note for the findings. /ultrareview is an alias.

Before it launches, Claude Code shows the scope, your remaining free runs and the estimated cost, and asks you to confirm. A review typically takes 5 to 15 minutes. Use /tasks to watch or stop it. Add --fix to have Claude apply the findings when they come back, or --post on a pull request to preselect posting them as one comment from your GitHub account.

Limits to know:

• A branch review covers up to 500 changed files and 8,000 changed lines by default.
• It needs a claude.ai sign-in. It isn't available on Amazon Bedrock, Google Cloud's Agent Platform or Microsoft Foundry, or for orgs with Zero Data Retention or the HIPAA configuration. In those cases /code-review ultra runs a local review instead.

What ultrareview costs

A run counts once the cloud session starts, even if you stop it early. Run /usage-credits to check your usage-credits setting.

Run it from a script or CI

Use the claude ultrareview subcommand. It waits for the review to finish and prints the findings to stdout:

claude ultrareview
claude ultrareview 1234
claude ultrareview 1234 --json --timeout 30

--json prints the raw findings and --timeout sets the wait in minutes (45 by default). Don't use claude -p '/code-review ultra' here, because it exits before the findings arrive. Our headless mode guide covers scripted runs.

How to run /security-review

/security-review checks the changes on your current branch for security vulnerabilities. It reviews the diff between your branch and origin's default branch and looks for risks like injection, auth problems and data exposure.

/security-review

It needs an origin remote. Run it on any branch that touches login, payments, file uploads, user input or anything that stores personal data. It's a separate pass from /code-review, which focuses on correctness.

Don't confuse it with /simplify, which looks for cleanups and applies them but doesn't hunt for bugs.

How to review pull requests with GitHub Actions

The Claude Code GitHub Action (anthropics/claude-code-action@v1) runs Claude inside your own GitHub workflows. You need admin access to the repository. The quick way to set it up is from inside Claude Code:

/install-github-app

It needs the GitHub CLI installed and signed in with gh auth login. The command installs the Claude GitHub App, saves your credential as a repository secret (ANTHROPIC_API_KEY for an API key or CLAUDE_CODE_OAUTH_TOKEN for a subscription token) and opens a pull request with the workflow files. If you select the review workflow, Claude posts each review on the pull request as inline comments, or as one summary comment when it finds nothing.

Once it's merged, you can also mention Claude in any PR comment:

@claude review this PR for missing error handling

Each run uses GitHub Actions minutes plus tokens, or your Claude subscription if you use an OAuth token. Set --max-turns in claude_args and add workflow timeouts to cap spend. Our Claude Code with GitHub guide covers the wider GitHub setup.

How the managed Code Review service works

Code Review is Anthropic's hosted pull request reviewer for Team and Enterprise plans on GitHub. No workflow files are needed. An Owner turns it on in Admin settings, then Claude Code, then the Code review section on claude.ai, installs the Claude GitHub App and picks repositories.

Several agents search the diff in parallel, a verification step drops false positives, and the rest are ranked and posted. You get inline comments, a summary and a check run named Claude Code Review. Findings are marked Important (fix before merging), Nit (minor) or Pre-existing (a bug the PR didn't introduce). A review never approves or blocks a pull request, and the check run never fails.

Each repository has a Review runs setting: once after PR creation, after every push (the default for new repositories, which runs the most reviews), or manual. Anyone with write access can comment on a pull request to ask for one:

@claude review
@claude review always
@claude review stop

The first runs one review, the second also reviews each later push, and the third stops that. Automatic reviews skip drafts and forks, so comment there.

There's no flat price. Reviews bill on token usage through usage credits, separately from plan usage, and cost scales with the review level, the size of the change and how often reviews run. Set a monthly spend limit for the Claude Code Review service at claude.ai/admin-settings/usage. To tune what gets flagged, commit a REVIEW.md at the repository root with rules such as "report at most five nits" or paths to skip. Note that the local /code-review command reads CLAUDE.md but not REVIEW.md.

A simple review workflow before you merge

Here's a routine that uses the options in order of cost:

1. While you work, run /code-review at low or medium after each chunk of changes. Fix what it finds.
2. Before you open the PR, run /code-review high on the whole branch. If the branch touches auth, payments or user data, run /security-review too.
3. For a big or risky change, run /code-review ultra before merging. Use the free runs for your largest pull requests.
4. On the pull request, let GitHub Actions or the Code Review service post inline comments so your teammates see the same findings.
5. Merge once the important findings are fixed and a person has read the diff. An AI review with no findings doesn't mean the code is bug-free, and the docs say so plainly.

Wrapping up

Start with /code-review, since it works on any plan at no extra cost. Add /security-review for sensitive code and save ultrareview for changes where a missed bug would hurt. Move the review onto GitHub when more than one person ships to the repo.

New to Claude Code? Start with how to install it, and see how much Claude Code costs before you turn on usage credits. To build client projects with this workflow, the Claude Code for agencies course walks through it, and members share their review setups in the Claude Code community.

FAQ

Does Claude Code have a code review command?

Yes. Type /code-review in a Claude Code session to review your branch for correctness bugs. /review is an alias. Add an effort level such as /code-review high, a target such as a PR number, or --fix to apply the findings.

Is Claude Code review free?

/code-review and /security-review count toward your normal plan usage or API billing, with no extra charge. Ultrareview gives Pro, Max and Ultra accounts 3 free runs, then typically costs $5 to $25 per review in usage credits. The Code Review service bills the organization for token usage.

What is ultrareview in Claude Code?

A deep code review that runs in a cloud sandbox. A fleet of reviewer agents explores your change and each finding is verified before it's reported. Start it with /code-review ultra. It takes about 5 to 15 minutes.

Can Claude review GitHub pull requests automatically?

Yes, in two ways. The Claude Code GitHub Action runs a review workflow on your own runners and works with an API key or a subscription token. The managed Code Review service reviews pull requests on Anthropic's infrastructure for Team and Enterprise organizations.

What's the difference between /code-review and /security-review?

/code-review looks for correctness bugs, the kind that break behavior. /security-review looks for vulnerabilities such as injection, auth issues and data exposure in the diff against origin's default branch. Run both on sensitive changes.

Can Claude fix the problems it finds in a review?

Yes. Add --fix, as in /code-review --fix, and Claude applies the findings to your working tree through your permission mode.