Claude Code Review: How It Works, What It Costs, and What It Won't Catch
Anthropic's pull-request reviewer left research preview on 15 October. It is a good tool for the change in front of it. It is not an audit of the codebase behind it, and the difference matters most when you inherited that codebase.
Oct 20, 2026
Claude Code Review has been generally available to Claude Team and Enterprise organizations since 15 October 2026. Several agents read each GitHub pull request alongside the surrounding code, a verification step drops false positives, and the findings land as inline comments ranked by severity. It never approves or blocks a merge. There is no flat price: reviews are billed on token usage, and the cost depends on the review level you pick (Quick, Standard or Deep) and the size of each change. Below: how it works, who can use it, how to estimate the bill, and the one thing a pull-request reviewer, however good, can't tell you.
What changed on 15 October
From Anthropic's announcement:
- Out of research preview, for Claude Team and Enterprise organizations.
- Faster: "most reviews now finish about 3x faster (~20 minutes down to 6-10 minutes) compared to during preview."
- Three review levels: admins choose Quick, Standard (the default) or Deep, per repository.
- Credits: "Eligible Claude Enterprise organizations can claim at least $10,000 in Code Review credits by January 15, 2027." They expire 30 days after you claim them, so claim them when you are ready to use them.
How a review works
From the Code Review docs, a review runs on Anthropic's infrastructure in four stages:
- Find: several agents examine the diff and the surrounding code in parallel.
- Verify: a verification step checks candidate findings against the code and filters out false positives.
- Rank: what remains is deduplicated and ranked by severity.
- Post: inline comments on the lines concerned, a summary, and a check run named "Claude Code Review" that never concludes as a failure.
By default it focuses on correctness: "bugs that would break production, not formatting preferences or missing test coverage." You steer it with a REVIEW.md and your CLAUDE.md files, and REVIEW.md is always read from the base branch, never from the pull request being reviewed, so a pull request can't rewrite its own review instructions.
Inside a review, access to your repository is read-only and nothing is pushed. And one detail worth keeping in mind for what follows: a review works "from reading the diff and the surrounding code, without building or running your code."
Who can use it
| Requirement | What the docs say |
|---|---|
| Plan | Claude Team or Enterprise. An Owner turns it on |
| Code host | GitHub, including GitHub Enterprise Server and Enterprise Cloud with data residency |
| Not available with | Zero Data Retention, the HIPAA configuration (not covered by the BAA), or customer-managed encryption keys |
| On Bedrock, Vertex or Foundry | You still need a Claude organization on one of those plans, and reviews are billed on your Anthropic bill |
Not on GitHub, or not on those plans? Anyone can run /code-review locally in Claude Code, and you can run Claude in your own GitHub Actions or GitLab CI/CD pipeline with an API key.
What it costs, and how to estimate it
Anthropic publishes no per-review price. From the costs page, each review's cost scales with the review level, the size of the change, the complexity of the surrounding code, and how many candidate issues need verifying.
The setting that moves the bill most is when reviews run. A repository you add starts at After every push, which runs a review on each push and multiplies cost by the number of pushes per pull request. The other options are Once after PR creation and Manual (someone comments @claude review).
Anthropic's own advice is the right one:
- Set a monthly spend limit for Code Review first.
- Turn it on for a few representative repositories, set to run once per pull request or on request.
- After several reviews, read the average cost per review per repository in the admin settings.
- Multiply by your pull requests per month, and again by pushes per pull request if you keep "After every push".
When the budget runs out, reviews are skipped and the pull request gets a comment saying why. So a spend limit doesn't break anything; it just stops reviewing.
What a pull-request reviewer can't tell you
A pull-request reviewer answers: is this change safe to merge? It is very good at that, and at 6 to 10 minutes per review it is fast enough to run on everything.
It doesn't answer: is this codebase safe to build on? That question comes up when you inherit software: the freelancer stopped replying, the agency relationship ended, you acquired a company and its app, or the app was generated with an AI tool and nobody can evolve it. Then the risks are mostly not in the next diff:
| Question | AI review of each pull request | Code audit of the codebase |
|---|---|---|
| Will this change break production? | Yes, that is its job | Not the point |
| Is the architecture sound for the next two years? | No, it sees one change at a time | Yes |
| Are the dependencies and runtime still supported? | Only if the diff touches them | Yes, all of them |
| Does it build, deploy and run as documented? | No, it doesn't build or run code | Yes |
| Is there test coverage on the critical paths? | Not flagged by default | Yes |
| Do you own the source code, and the hosting and domain? | No | Yes, checked first |
| What will it cost to fix? | No | Yes, a costed estimate per item |
Anthropic puts the limit plainly: "A review with no findings doesn't mean your code is error-free or secure." That is true of every AI reviewer, ours included.
How we review our own code: from CodeRabbit to a self-hosted reviewer
Every pull request we open gets an AI review before a person decides to merge it. We have done it two ways, and what we learned answers most of the questions a team asks before turning on Claude Code Review.
Before: CodeRabbit
From 2025 until June 2026, CodeRabbit reviewed our pull requests. It was a managed service: install the GitHub app, and every pull request got a review, round after round, until CodeRabbit approved it. Our merge rules required one approving review, and CodeRabbit's approval was what satisfied it.
It earned its place. Two catches stay with us. On a client's quoting platform, CodeRabbit flagged a race condition in the approval flow: two people approving the same quote at the same moment could both succeed. On a password-reset form, it caught that a server error showed the user a misleading "password too short" message. Neither was a style nit. Both would have reached production.
It also taught us how to work with an AI reviewer. Treat every finding as a claim to check, not an order. Fix the real ones, and reply with a reason when a finding is wrong. On one mail-ingestion pull request it raised fourteen findings: we fixed eleven and pushed back on three, each with a reason. That habit carried over unchanged.
Why we moved
The reviews were good. The wait was not. CodeRabbit was slow, and as our volume of pull requests grew we kept hitting its rate limits: a pull request ready to merge sat waiting for a review that was queued or throttled, and the round after each fix waited again. For a team that ships many small pull requests a day, the reviewer had become the slowest step between finished code and production.
Speed was the trigger. Three other things made self-hosting the answer rather than another vendor:
- Control. A review tool reads every line of code we write, including client code. We wanted it to run on our own infrastructure, with our configuration, on an image we pin and update when we choose.
- Billing in our own cloud account. Paying per token through Google Cloud, next to the rest of our infrastructure, instead of a separate subscription per seat.
- A merge gate we define. We wanted to decide exactly what blocks a merge, and the answer turned out to be much less than "anything the reviewer says".
Now: PR-Agent on our own cluster
In June 2026 we deployed the open-source PR-Agent on our production Kubernetes cluster as a GitHub app. It authenticates to Google's Vertex AI with a workload identity, so there is no API key to leak, and its GitHub secrets are mounted as a file the pod reads, never stored as an environment variable. We ran it next to CodeRabbit for the first weeks so the team could compare both on the same pull requests, then removed CodeRabbit.
On every new pull request, PR-Agent writes the description, posts a review guide (key issues, security concerns, an effort estimate) and posts code suggestions. Our organization's merge rules make one check required on every repository: it goes red only when the review reports a security concern. Everything else, style, structure, suggested refactors, is advisory. A reviewer that blocks on opinions teaches people to click past it; one that blocks only on security gets read.
What running it ourselves taught us
The bill is real, and it is mostly thinking. By July the reviewer was the largest AI line on our cloud bill. We made two changes that leave every single review as deep as before: a re-review after a push now covers only the new commits (the team had asked for it anyway, because full re-reviews were noisy), and the most expensive step, regenerating code suggestions, runs when the pull request opens and on request, not on every push. Even after both, the next 30 days came to about $310, 97% of our Vertex AI spend, and 92% of the output tokens were the model's reasoning, not the comments anyone reads. You pay for what the model thinks, not for what it writes.
Model upgrades come with trade-offs. We started on Gemini 2.5 Pro, pinned to a European region so diffs stayed in the EU. In August we moved to Gemini 3.1 Pro, which no European regional endpoint serves, so the regional pin went. That was a deliberate trade: keeping diffs in the EU was a design choice for our own code, not a contractual commitment to a client. The newer model is a preview, so a generally available model sits in the fallback slot.
Review speed is part of your shipping speed. Since the move, the queue is ours: no vendor rate limit sits between a finished pull request and its review, and the limits left are our own model quota and budget, which we set. When you evaluate any reviewer, Claude Code Review included, time it on a busy day, not on a quiet one. Anthropic's 6 to 10 minutes per review is a good number; what matters is what it looks like when your whole team pushes at once, and what happens when a spend limit is reached (Code Review skips the review and says so on the pull request).
Choosing the reviewer is only half of it. Most of the work is the gate, the trigger rules and the cost controls around it. Claude Code Review gives you the same levers as switches: review levels, when reviews run, a monthly spend limit. That is the right design. Set them on day one, not after the first bill.
Would we use Claude Code Review? It was in research preview when we made our choice, and it is GitHub-only and runs on Anthropic's infrastructure, which is the managed model we moved away from. For a team without the appetite to run a reviewer, it is a strong default, and the way to evaluate it is how we evaluated ours: on a few repositories, next to what you have, on the same pull requests. We are running that kind of side-by-side test on coding agents right now: Mistral Large 4 in Vibe vs Claude Code.
What we do for an inherited codebase
All of that is review of code we already know. For an inherited codebase, we do the other half: a fixed-price code audit at €2,500 (about $2,900), two to five days depending on size. We read the code, map the architecture, check dependencies, tests, deployment and ownership, and deliver a report that says what is sound, what needs work and what each fix costs. If the conclusion is that the project shouldn't be taken over, we say so and you keep the report. The audit and takeover are priced here.
What we don't do: we don't resell Claude plans or set up Code Review as a standalone service. If you want it on your repositories, an Owner of your Claude organization turns it on by following Anthropic's setup guide.
Related: Vibe coding security: what to check before you ship, The real cost of a vibe-coded app, and Technical due diligence.
Read next: When an AI agent deleted the production database, Claude connectors explained.