Claude Code for Code Review: 3 Ways to Automate PR Reviews

"Claude Code can review code" undersells what's actually available — there are three genuinely different ways to plug it into a review workflow, built for three different situations: a quick local check before you push, a fully automated GitHub Actions pipeline you control, and a managed service that posts inline PR comments with zero infrastructure to maintain. This covers all three, with the actual setup steps and what to expect from each.

1. /code-review — Review a Diff Locally

The fastest option, and the one requiring zero setup: run /code-review in any Claude Code terminal session.

/code-review

By default it reviews your current branch's commits ahead of its upstream, plus any uncommitted changes in your working tree — so it needs something on the branch to actually report on. To review something else specifically, pass a target:

/code-review path/to/file.ts
/code-review 1234                    # a PR number
/code-review my-feature-branch
/code-review main...my-feature       # a ref range

Useful flags:

The review runs as a background subagent with its own context window, so it doesn't fill up your main conversation — findings arrive when it completes, and you keep working in the meantime. It reports both correctness bugs and cleanup opportunities (unnecessary complexity, duplicated logic, efficiency issues), and it respects your repository's CLAUDE.md the same way any Claude Code session does.

For a deeper, cloud-run review that examines your whole codebase context rather than just the local session, /code-review ultra escalates to Anthropic's cloud infrastructure — worth reaching for on a larger or higher-stakes PR than a quick local pass is built for.

2. GitHub Actions — Full Automation You Control

For teams who want review automation wired into CI, without relying on a managed dashboard, Claude Code GitHub Actions runs Claude directly inside your own workflows.

Quick setup: run /install-github-app in a Claude Code terminal session. It installs the Claude GitHub App on your repository and walks you through adding the workflow files and API key secret.

Manual setup, if you'd rather configure it by hand:

1. Install the Claude GitHub App — it requests read/write on Contents, Issues, and Pull requests
2. Add ANTHROPIC_API_KEY to your repository secrets
3. Copy a workflow file from the claude-code-action examples into .github/workflows/

A minimal review workflow that runs Anthropic's own code-review plugin on every new or updated pull request:

name: Code Review
on:
  pull_request:
    types: [opened, synchronize]
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          plugin_marketplaces: "https://github.com/anthropics/claude-code.git"
          plugins: "code-review@claude-code-plugins"
          prompt: "/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}"

You can also trigger Claude conversationally, on any issue or PR comment, without a dedicated review workflow:

@claude review this PR for security issues
@claude fix the TypeError in the user dashboard component

This path is the right fit when you want full control over the trigger conditions, the exact prompt, which model runs the review, or when you're on Amazon Bedrock or Google Cloud's Agent Platform rather than direct API access — both are supported with their own authentication setup.

3. Managed Code Review — Zero-Infrastructure Automatic Reviews

For Team and Enterprise plans, Claude Code offers a fully managed Code Review feature (currently in research preview) — no workflow files to write or maintain. An organization Owner enables it once, and it runs automatically on configured repositories.

How it works

A fleet of specialized agents analyzes each PR's diff in the context of your full codebase — different agents look for different issue classes (logic errors, security vulnerabilities, broken edge cases, regressions), then a verification step checks candidates against actual code behavior to filter out false positives before anything gets posted.

Findings are tagged by severity and never approve or block the PR automatically — your existing review process and branch protection rules stay exactly as they are:

Setup

An Owner goes to Claude Code admin settings, clicks Setup, installs the Claude GitHub App, and selects which repositories to enable. Per repository, a Review Behavior dropdown controls the trigger:

• Once after PR creation — review runs once, when a PR opens or is marked ready
• After every push — a fresh review on every push, auto-resolving comment threads when flagged issues get fixed (highest cost, most thorough)
• Manual — reviews only start when someone comments @claude review on a PR

Regardless of the configured trigger, you can always request one on demand:

@claude review           # runs once, doesn't change future-push behavior
@claude review always    # runs now, and subscribes the PR to push-triggered reviews going forward

Customizing what gets flagged

Two files shape what the managed reviewer checks, and they work differently:

CLAUDE.md — your existing general project instructions. Code Review reads these too, and flags newly introduced violations as nit-level findings.

REVIEW.md — review-only, and injected as the highest-priority instruction for every review agent, overriding the default calibration. This is the file to actually tune review behavior with:

# Review instructions

## What Important means here
Reserve Important for findings that would break behavior, leak data,
or block a rollback. Style and naming suggestions are Nit at most.

## Cap the nits
Report at most five Nits per review. If you found more, say
"plus N similar items" in the summary instead of posting them inline.

## Do not report
- Anything CI already enforces: lint, formatting, type errors
- Generated files and lockfiles

## Always check
- New API routes have an integration test
- Log lines don't include PII

This is the same customization mechanism the site's own ultrareview workflow builds on — a REVIEW.md lets a team codify what actually matters to them, instead of accepting a generic default.

Pricing

Each review averages $15-25, billed by token usage against your organization's usage credits — scaling with PR size and codebase complexity, and separate from your plan's included usage. Trigger choice directly drives cost: reviewing after every push multiplies spend by the number of pushes on a PR, while Manual mode incurs zero cost until someone explicitly requests a review.

Which Approach Should You Actually Use?

For most individual developers and small teams, /code-review locally covers the day-to-day case, with ultra as the escalation path for anything that warrants a closer look. The managed feature earns its cost on teams processing enough PR volume that consistent, zero-maintenance automated review pays for itself.

Related Resources

• Claude Code Tutorial for Beginners — install Claude Code and complete your first task, if you haven't yet
• What Are Claude Skills? The Complete Beginner's Guide — package your own repeatable review checklists as a Skill
• Claude Skills Marketplace — how to add and install — install a shared set of skills across your team
• Browse Claude Skills by profession — free skill libraries, including for software engineers