Claude Code Review GA review: a second reader that never presses merge
Anthropic's Code Review is out of preview for Team and Enterprise plans. It reads every pull request, comments inline, and never approves anything. Here's who should switch it on and what the bill depends on.
Verdict: worth turning on if your team (or the agency writing your code) is on Claude Team or Enterprise, hosts code on GitHub, and already has a person who owns the merge. It adds a careful second read on every pull request. It does not run your code, approve anything, or work under Zero Data Retention or HIPAA setups, and spend grows with every push unless you set it otherwise.
The short verdict
Anthropic moved Code Review out of research preview on October 15, 2026. If your developers are on a Claude Team or Enterprise plan and your code lives on GitHub, it is worth switching on for a month with a spend limit set, on the repositories where a missed bug costs real money.
The reason is simple. Coding agents have made it cheap to write code, and the review queue hasn't kept up. Someone still has to read the change. Code Review gives every pull request a careful first read before a person gets to it, then leaves the decision with that person. It never approves a pull request and never blocks one. Anthropic's docs are blunt about the limits too: a review with no findings doesn't mean the code is error-free or secure.
So the honest pitch is a second reader. That second reader is useful if you have someone who owns the merge. If nobody really owns the merge today, this tool won't create that person for you.
What happens on a pull request
Once an Owner of your Claude organization installs the Claude GitHub App and picks repositories, reviews start on their own. Per the docs, each review runs in four stages on Anthropic's infrastructure. Several agents read the diff and the code around it in parallel. A verification step checks the candidate findings against the code and throws out false positives. What survives is deduplicated and ranked by severity. Then the review posts inline comments on the lines concerned, a summary, and a check run named Claude Code Review.
A few details matter more than they look:
It reads, it doesn't run. A review works from the diff and the surrounding code without building or running anything. Your tests, your staging environment and your QA person still do the part where the code actually executes.
It can't push. Inside a review, repository access is read-only. It comments, it resolves its own earlier threads, and that's it.
The check never fails. The check run doesn't conclude as a failure, so a red flag from Claude won't stop a merge unless your own branch rules say so. A clean review is a reading, not a sign-off.
Instructions come from the base branch. You tune what it flags with a REVIEW.md (and CLAUDE.md) in the repository, and the review reads REVIEW.md from the base or default branch, never from the pull request's own changes. That means a change can't quietly rewrite the rules it's being reviewed against. Good design.
By default it focuses on correctness: bugs that would break production, not formatting or missing tests. Admins pick Quick, Standard (the default) or Deep for the organization and can override per repository. Anthropic says most reviews now finish in about 6 to 10 minutes, roughly three times faster than in preview. You don't choose the model; Anthropic does.
How the work moves
What a review does on one pull request
- Find
Several agents read the diff and the surrounding code in parallel.
- Verify
Candidate findings are checked against the code; false positives dropped.
- Rank
Remaining findings are deduplicated and ranked by severity.
- Post
Inline comments, a summary, and a check run that never fails the build.
- Decide
A person with merge rights reads it and decides. The review never approves.
A clean review is a reading, not a sign-off.
Who can turn it on, and who can't
The availability list is short and strict. You need a Team or Enterprise plan. Repositories have to be on GitHub, including GitHub Enterprise Server and Enterprise Cloud with data residency. GitLab and Bitbucket teams are out of this particular service.
It is not available if your organization has Zero Data Retention turned on or the HIPAA configuration applied, and it isn't covered by Anthropic's Business Associate Agreement. It isn't yet available with customer-managed encryption keys. If your developers use Claude Code through Amazon Bedrock, Google Cloud or Microsoft Foundry, you still need a Claude organization on one of those plans for this.
If any of that rules you out, Anthropic's own docs list the other routes: run /code-review in a Claude Code session on any plan, or run Claude in your own CI with GitHub Actions or GitLab CI/CD using an API key. Those run where you choose, which may be exactly what a regulated team needs.
What it costs, and how the bill grows
There is no flat per-review price. Code Review is billed on token usage through usage credits, separately from what your plan includes, and the bill goes to the organization, not the developer who opened the pull request. Cost per review rises with the review level, the size of the change, how tangled the surrounding code is and how many candidate issues need checking.
The setting to look at first is how often reviews run. A repository you add starts at After every push, which multiplies cost by every push to every pull request. Once after PR creation and Manual (someone types @claude review) are the cheaper modes. Drafts and forks are skipped automatically.
There's a spend limit for the whole organization at claude.ai/admin-settings/usage. When that limit, the organization's overall limit or the credit balance runs out, reviews are skipped and developers see a comment on the pull request saying why. That's better than a silent stop, but it means "we reviewed everything" can quietly turn into "we reviewed everything until the 19th." Someone should own that number.
Anthropic suggests piloting a few representative repositories on Once after PR creation, reading the average cost per review in the admin table, and multiplying by your monthly pull request count. Eligible Enterprise organizations can claim at least $10,000 in Code Review credits by January 15, 2027; credits expire 30 days after you claim them, so don't claim before you're ready to run the pilot.
Where it falls short, and the alternatives
It's a reader, not a test suite. It doesn't execute code, so anything that only shows up at runtime is outside what it can see.
Vendor numbers are vendor numbers. Anthropic's engineering blog says the share of its internal pull requests getting substantive review comments went from 16% to 54% during the preview. That's Anthropic measuring Anthropic. Your codebase, your reviewers and your bug history are the test that counts.
Regulated data is excluded. If you handle health data under a BAA, this service isn't for you as of October 16, 2026.
Ownership doesn't come in the box. Who reads high-severity findings? Can someone merge past one? Write those answers down before the first review lands.
Two alternatives worth weighing. Running Claude in your own CI keeps the work on your runners and works on GitLab, with more setup and more for you to maintain. Snyk launched Evo Agentic AppSec the same day, a set of security-focused agents that drive Snyk's existing scanners; its remediation agent is in open preview and most of the other agents are in experimental preview for select customers. It's narrower (security, not general correctness) and earlier.
Decision guide
Managed Code Review or Claude in your own CI
| Consideration | Code Review (managed) | Claude in your own CI |
|---|---|---|
| Where it runs | Anthropic infrastructure. | Your own CI runners. |
| Code hosts | GitHub, including Enterprise Server. | GitHub or GitLab. |
| Plans | Team or Enterprise only. | Anyone with an API key or cloud credentials. |
| Setup | Owner installs the app and picks repos. | You write and maintain the pipeline. |
| Regulated data | Not with ZDR, HIPAA config, BAA or CMEK. | Depends on your own provider setup. |
If someone else writes your code
Plenty of business owners don't run a dev team; they hire one. In that case the useful move is a short conversation with whoever writes your software. Ask whether they use automated review, at what level, and on which repositories. Ask who reads the findings and what happens to a high-severity one. Ask whether a clean check is ever treated as approval. And ask where the cost lands, because usage billing on your organization is your bill.
We build web applications that have to keep working after launch, so how changes get reviewed is part of the job. If you want a second opinion on your team's review process, or on whether this tool fits it, talk to us.
Related work: Howcast.
We build alongside the people doing the work.
Bring us the problem you’re thinking about.