Claude Code Review
Code Review brings Anthropic's multi-agent reasoning directly into your GitHub pull request workflows. Multiple parallel agents examine diffs, test candidate findings against surrounding source files to drop false positives, and post verified inline comments.
1. The 4-Stage Multi-Agent Review Pipeline
Unlike naive single-prompt code reviewers that generate noise on formatting and styling preferences, Claude Code Review operates across four distinct stages:
- 1. Find: Several specialist subagents inspect the diff and surrounding codebase in parallel, searching specifically for logic errors, race conditions, edge-case regressions, and security vulnerabilities.
- 2. Verify: A dedicated verification agent tests each candidate finding against the repository. If the code already handles the condition, or if the finding is a false positive, it is discarded immediately.
- 3. Rank: The remaining verified findings are deduplicated and ranked by severity:Critical (breaks production), High (incorrect behavior in edge cases), Medium, and Low.
- 4. Post: Results are published as inline GitHub review comments on the exact code lines concerned, accompanied by an executive summary and a GitHub check run.
Human Merge Authority: A review by Claude Code never automatically approves or blocks a pull request. The check run concludes neutrally, leaving the final merge decision entirely with your engineering team.
2. Review Levels: Quick, Standard & Deep
Organization Owners can configure the review depth on a repository-by-repository basis:
| Level | Thoroughness | Ideal Use Case |
|---|---|---|
| Quick | Lightweight pass with fastest response time and lowest cost. | Routine internal tooling, documentation repos, and low-risk services. |
| Standard (Default) | Balanced depth, comprehensive edge-case analysis, and verification. | Core product features, general backend services, and web applications. |
| Deep | Exhaustive multi-agent verification pass across complex dependency trees. | Financial transactions, cryptography, authentication modules, and mission-critical engines. |
3. Customizing Review Guidelines with REVIEW.md
By default, Code Review focuses on correctness—real bugs that would break production—rather than formatting preferences. To guide what gets flagged, create a REVIEW.md file in your repository root:
# Code Review Guidelines ## Scope Focus - Prioritize concurrency issues, database transaction leaks, and auth check bypasses. - Verify that every new database query includes index hints or pagination bounds. ## What to Ignore - Ignore CSS styling, Tailwind class ordering, and minor formatting quirks (enforced by Prettier). - Ignore test mock verbosity.REVIEW.md exclusively from the base or default branch (e.g. main), never from the pull request's untrusted changes, preventing unauthorized rule tampering.4. Comparing Ways to Get a Code Review
| Option | Execution Environment | Trigger Mechanism | Target Audience |
|---|---|---|---|
| GitHub App Code Review | Anthropic Cloud Infrastructure | Automatic on PR open/push, or @claude review comment | Teams & Enterprises on GitHub |
Terminal /code-review | Local developer machine | User runs /code-review in CLI session | Anyone on any plan |
| Local Custom Subagent | Local developer machine | claude invokes .claude/agents/reviewer.md | Custom review workflows |
| CI Runners (GitHub Actions) | Your self-hosted CI / GitHub Actions | CI workflow event with claude -p | Custom automated CI pipelines |
5. Creating a Local Read-Only Reviewer Subagent
If you want an independent second opinion before opening a PR, define a dedicated reviewer in .claude/agents/reviewer.md:
--- name: reviewer description: Reviews changed files against the requirements spec before opening a PR. tools: Read, Grep, Glob --- You are reviewing code you did not write. Compare the changed files against the spec, check that every requirement is implemented, and report only gaps that affect correctness. Skip style suggestions.Because the agent is restricted to Read, Grep, Glob, Claude Code deterministically guarantees it cannot alter your source files.