Claude Code Review: Setup, Pricing, REVIEW.md & How It Works

Claude Code Review is now a product, not a prompt. On October 15, 2026 Anthropic took Code Review out of research preview and made it generally available for Team and Enterprise plans. Reviews are about 3x faster than in preview (roughly 20 minutes down to 6–10), findings are shorter, and admins can pick Quick, Standard or Deep per repository. Everything below comes from the Claude Code docs and Anthropic's announcements.

This guide is kept by a Sumus AI Employee and updated when Anthropic changes Code Review. It is written for engineering leads and developers deciding how to get Claude to review their PRs.

How Claude Code Review works

By default Code Review focuses on correctness: bugs that would break production, not formatting or missing tests. Each review runs on Anthropic infrastructure in four stages:

1. Find. Several agents examine the diff and the surrounding code in parallel.
2. Verify. A verification step checks candidate findings against the code and filters out false positives.
3. Rank. Remaining findings are deduplicated and ranked by severity.
4. Post. Inline comments land on the lines concerned, with a summary and a check run. When nothing is found, the check run reads "Code review found no issues."

A review never approves or blocks the PR; the merge decision stays with your team, and the check run doesn't conclude as a failure. Access to the repository is read-only, a review doesn't push commits, and it works by reading code, not building or running it. Code Review picks the Claude models itself; there is no model setting.

Why Anthropic built it

Anthropic says code output per engineer grew 200% in a year and review became the bottleneck. In the research preview post, it reported that before Code Review 16% of its PRs got substantive review comments; after, 54% did. On PRs over 1,000 changed lines, 84% got findings, averaging 7.5 issues; on PRs under 50 lines, 31% did, averaging 0.5. Engineers marked less than 1% of findings incorrect.

How to set up Claude Code Review

1. An Owner of your Claude organization opens Admin settings > Claude Code on claude.ai and turns on Allow code review.
2. A GitHub organization owner installs the Claude GitHub App and links it to the Claude organization.
3. Add repositories (you need write access to each from the connected GitHub account).
4. Pick a review level for the organization and override it per repo where needed.
5. Set Review runs per repo: Once after PR creation, After every push (the default for added repos, and the most expensive), or Manual (@claude review).

Developers need nothing else: once enabled, reviews run on new PRs automatically. Drafts and PRs from forks are skipped by automatic reviews, but someone with write access can comment @claude review to start one, or @claude review always to subscribe a PR to a review on every push.

Review levels: Quick, Standard, Deep

• Quick: a lighter pass, fastest and cheapest.
• Standard: balanced depth, speed and cost. The default.
• Deep: the most thorough pass; takes longest and costs most. Use it for critical codebases.

Customize what Claude flags with REVIEW.md

Code Review reads two files from your repo (customization docs):

• CLAUDE.md holds project-wide rules Claude Code reads for every task. Violations become findings.
• REVIEW.md holds review-only rules: what counts as Important, what to skip, what to always check. Put it at the repo root; subdirectory files add checks for that path.

Useful instructions from Anthropic's example: reserve Important for broken behavior, data leaks and non-backward-compatible migrations; cap nits at five per review; skip generated files, lockfiles and anything CI already enforces; always check that new API routes have an integration test and that queries are scoped to the caller's tenant. To cut false positives, require a file:line citation for behavior claims.

• REVIEW.md is read from the base or default branch, never from the PR's own changes. Protect that branch.
• You can include up to eight other root files with a line like @review-security.md, under 150,000 bytes combined.
• The local /code-review command reads CLAUDE.md but not REVIEW.md, so put rules you want in both places in CLAUDE.md.

Claude Code Review pricing and spend limits

Anthropic suggests a pilot: set a monthly spend limit, turn on a few representative repos in Once or Manual mode, read the Average cost column in admin settings, then multiply by monthly PRs (and pushes per PR if you use After every push). When the Code Review limit, the org spend limit or the credit balance runs out, reviews are skipped and the PR gets a comment naming the cause. Activity and cost show up at claude.ai/analytics/code-review.

Code Review isn't available with Zero Data Retention, the HIPAA configuration or customer-managed encryption keys, and isn't covered by the BAA.

Code Review vs /code-review vs GitHub Actions

• Managed Code Review if you are on Team or Enterprise with GitHub and want every PR reviewed with no CI work.
• /code-review if you want a pre-push check on your own branch on any plan.
• Ultrareview for a deeper cloud-sandbox review you start from Claude Code.
• Claude GitHub Actions or GitLab CI/CD if you use GitLab, need your own runners, or pay through an API key or cloud provider. Anthropic calls the managed service more thorough and more expensive than the open-source Action.
• A custom subagent or skill if you want a reviewer tuned to one workflow.

Where Sumus fits

Claude Code Review covers the PR. The work around it still needs an owner: chasing stale PRs, summarizing what merged this week, tracking review spend against budget and nudging authors on unresolved findings. That is work a Sumus AI Employee does in your team's group chat, running on models like Claude Opus 5.5.

What we're watching

• Whether Code Review adds GitLab or Bitbucket after GitHub-only GA.
• Real per-review costs at Deep level once Enterprise launch credits expire.
• Whether Pro and Max plans get the managed service.