Claude Code Review: multi-agent GitHub PR reviews with verified findings

When AI writes code many times faster, the bottleneck moves to review: more PRs, bigger PRs, more tired reviewers. Code Review is Claude Code's managed service: each GitHub PR is read by several agents in parallel, findings are verified against the code before posting, and they appear as comments on the relevant lines, ranked by severity. A review never approves or blocks a merge; the decision stays with your team.

The four stages of a review

1. Find: several agents read the diff and surrounding code in parallel.
2. Verify: each finding is checked against the code to filter out false positives.
3. Rank: deduplicate and sort by severity.
4. Post: inline comments, a summary and a check run named Claude Code Review (it never concludes as "failure").

By default, reviews focus on correctness: bugs that would break production, not style or missing tests. Reviews read code; they don't build or run it.

Three review levels

An Owner picks the level for the organisation and can set one per repository.

When do reviews run?

• Each repo picks one of three: when a PR opens, after every push, or only on request.
• Anyone with write access can comment @claude review to request a review at any time.
• Draft PRs and PRs from forks aren't reviewed automatically.

Customising with REVIEW.md

Add a REVIEW.md (alongside CLAUDE.md) to the repo to tune what gets flagged, for example:

# REVIEW.md
- Every new endpoint must check permissions via the requireRole() middleware
- SQL queries must be parameterised, never string-concatenated
- Ignore the src/generated/ folder

An important safety point: REVIEW.md is read from the base or default branch, never from the PR's own changes. A PR can't rewrite the review rules to slip through.

Availability

• Team and Enterprise plans, repos on GitHub (including GitHub Enterprise Server). An Owner installs the Claude GitHub App and turns the feature on.
• Not available for organisations with Zero Data Retention, the HIPAA configuration, or customer-managed encryption keys.
• Reviews run on Anthropic infrastructure with read-only repo access and never push commits.

Comparing the ways to review with Claude

Risks and caveats

• The docs are explicit: AI review can miss bugs and vulnerabilities. No findings doesn't mean the code is safe.
• Reviewing after every push on a busy repo can add up; set a monthly spend limit.
• AI comments don't replace human reviewers for design decisions and business context.

How to apply it

• Dev: Run /code-review locally before opening a PR; fix issues first, then let Code Review run on the PR.
• Tech Lead: Deep for critical repos, Quick for internal ones; write REVIEW.md from production bugs you've already hit.
• PM: Track serious findings fixed per sprint as a quality metric, alongside review cost.