How to Set Up Claude Code Review for GitHub Pull Requests

Introduction

Pull requests are where bugs are cheapest to catch, and also where human reviewers are slowest to arrive. Claude Code Review, Anthropic’s managed reviewer for GitHub, puts several Claude agents on every pull request: they read the diff alongside the surrounding code, verify each candidate finding against the code, and post what survives as ranked inline comments. It left research preview and became generally available on October 15, 2026, for Claude Team and Enterprise organizations. This guide walks you through the full setup, from the admin toggle to your first reviewed pull request.

Quick answer

An Owner turns on Code Review in Admin settings, installs the Claude GitHub App, picks repositories, and sets a review level and trigger for each. Then open a test pull request and look for the Claude Code Review check run.

Evidence

Three numbers explain why teams are adopting this now. First, speed: Anthropic says most reviews now finish in 6 to 10 minutes, about three times faster than the roughly 20 minutes they took during the research preview. Second, depth of signal: during the preview, the share of the Claude Code team’s own internal pull requests receiving substantive review comments rose from 16 percent to 54 percent. Third, scale: Claude writes about 90 percent of the Claude Code codebase, and from June to September 2026 the team’s merged pull requests more than doubled while the share that had to be reverted fell by more than 40 percent.

The pricing is usage based, not per seat. Reviews are billed on token usage through usage credits, separately from your plan’s included usage, and the charge lands on the organization, not on the developer who opened the pull request. During the research preview Anthropic quoted an average of $15 to $25 per review, with deeper levels, larger pull requests, and after-every-push triggers costing more. Eligible Claude Enterprise organizations can claim at least $10,000 in Code Review credits by January 15, 2027, but claimed credits expire 30 days after you claim them, so do not claim them before you are ready to spend them. All figures here are as of November 2026.

The most important guarantee is stated plainly in the official Code Review documentation: “A review never approves or blocks the pull request, so the decision to merge stays with your team.” That sentence sets the right mental model. Code Review is an extra reviewer that never sleeps, not a merge gate. Your human approvals, required checks, and branch protection rules still do the gating.

Prerequisites

• A Claude Team or Enterprise organization, and the Owner role in it. Only an Owner can turn Code Review on and change review levels.
• A GitHub organization where you can install GitHub Apps, or a GitHub admin willing to do the install step with you.
• Write access to each repository you want reviewed, from the GitHub account you connect to Claude.
• A test repository with a small, real pull request you can open to verify the first review.
• A monthly spend limit in mind before you enable anything. Usage credits are billed to the organization.

Check the exclusions before you start: Code Review is not available to organizations with Zero Data Retention enabled, with the HIPAA configuration applied, or using customer-managed encryption keys. It also needs a Claude organization on a Team or Enterprise plan even if your developers use Claude Code through Amazon Bedrock, Google Cloud, or Microsoft Foundry.

Step-by-step guide

Step 1: Confirm your organization qualifies

Open claude.ai and go to Admin settings, then Claude Code. If you do not see a Code review section, you are either not an Owner or your organization is on a plan that does not include it. If your organization uses Zero Data Retention or the HIPAA configuration, stop here and use the local /code-review command or the claude-code-action GitHub Action instead, both covered in step 8.

Step 2: Turn on Code Review

In Admin settings > Claude Code, find the Code review section and turn on Allow code review. This is an Owner-only action. Turning it on starts no reviews yet, it only unlocks the setup flow. If a Connect GitHub dialog opens, click Connect and authorize Claude with your GitHub account. GitHub Enterprise Server users pick their instance first. If you use GitHub Enterprise Cloud with data residency, enter your enterprise’s ghe.com hostname when prompted.

Step 3: Install the Claude GitHub App

If your repositories are not listed, click Install GitHub App. Choose the GitHub organization that owns the repositories, choose which repositories the app can access, and approve the permissions. Read the permission list before you accept it: the app requests read and write access to repository contents, issues, pull requests, Actions, Checks, and Workflows. That set looks broader than a review needs, because the same app is shared with other Claude features, and GitHub does not let you accept a subset of an app’s permissions. Inside a review, access to your repository is read-only, and a review never pushes commits.

Step 4: Select repositories and finish setup

Back in the admin page, select the repositories you want reviewed and click Continue, then Finish in the Code review is set up dialog. Do not close that dialog any other way, closing it early leaves Allow code review off and nothing is enabled. Start with one or two repositories, not the whole organization. A small rollout gives you real cost and noise data before you commit the whole codebase.

Step 5: Set the review level, trigger, and spend limit

Each repository gets two settings, plus one organization-wide cost control, and the defaults are not the cheapest ones.

Review level. Quick is a lighter pass, the fastest level at the lowest cost. Standard balances depth, speed, and cost, and is the default. Deep is the most thorough pass, takes the longest, and costs the most. An Owner sets one level for the organization and can override it per repository. A practical starting split: Quick for docs, config, and internal tools, Standard everywhere else, Deep for auth, billing, payments, and migrations, where one missed bug costs more than the extra review time.

Trigger. Choose once when a pull request opens, after every push, or only on request. A newly added repository defaults to after every push, which runs the most reviews and costs the most, so change it deliberately. For the first week, use once when a pull request opens, then switch repositories that benefit from re-review to after every push.

Spend limit. Set a monthly spend limit in the admin page before the second week, not after the first invoice. You can also turn Code Review on for every repository in a GitHub organization, including repositories added later, but that requires a spend limit set first, and the connected GitHub account must own the organization on github.com.

Step 6: Write a REVIEW.md file

Add a REVIEW.md file to the root of each repository. It tells the reviewer what to flag, at what severity, and what to skip, and it is auto-discovered with no configuration. Code Review reads it from the base or default branch, never from the pull request’s own changes, so a pull request cannot loosen the rules it will be judged by. Keep it short and specific. A good starting template:

# Review rules

## Always flag
- SQL injection, XSS, and auth bypass, as Important
- Unhandled errors on payment and refund paths, as Important
- New public functions without docstrings, as Important

## Never flag
- Formatting and import order, the linter already covers those
- Missing test coverage on migration scripts

## Skip
- `generated/` and `vendor/` directories
- Snapshot files under `__snapshots__/`

Claude also reads CLAUDE.md files in your directory hierarchy as project context, and flags newly introduced violations of them as nit-level findings. Use CLAUDE.md for guidance that also applies to interactive Claude Code sessions, and REVIEW.md for review-only rules that would clutter CLAUDE.md.

Step 7: Open a test pull request and verify

Open a test pull request that is not a draft, with a small, real change. Within a few minutes a check run named Claude Code Review should appear on the pull request. Each review runs in four stages on Anthropic infrastructure: several agents examine the diff and surrounding code in parallel, a verification step checks candidate findings against the code and filters out false positives, the rest are deduplicated and ranked by severity, and the review posts inline comments, a summary, and the check run back on GitHub. If the review finds nothing, the check run’s title reads Code review found no issues instead of posting findings.

Reply to a finding by commenting on the inline thread, or push a fix and let the trigger run a fresh review. Someone with write access can also start a review on demand by adding a top-level comment that begins with @claude review. Check the analytics dashboard at claude.ai/analytics/code-review after a few days to see review counts and costs per repository, and use it to decide which repositories deserve Deep and which should drop to Quick.

Step 8: Know the alternatives for everyone else

If your team is not on a Team or Enterprise plan, you can still get Claude reviews. Run /code-review inside your own Claude Code session on any plan, it reviews your current branch and follows your CLAUDE.md, though it does not officially read REVIEW.md. For full automation without the managed service, run Claude in your own CI with the claude-code-action GitHub Action, where you control triggers, models, and prompts, and pay with an API key plus Actions minutes. These routes trade control for zero maintenance against the managed service, so compare them before you commit. For a direct comparison with GitHub’s own reviewer, see our guide to requesting GitHub Copilot code review via API, and for the local command’s effort controls, see Claude Code subagent effort levels.

Troubleshooting

The repository list is empty after installing the app

The app was probably installed on the wrong GitHub organization, or with repository access limited to a set that does not include your repository. Open the GitHub App installation settings in GitHub, confirm the organization and the repository list, and widen access to all repositories or add the missing one. Then return to the admin page and refresh the list. If the repository still does not appear, confirm the GitHub account you connected to Claude actually has write access to it.

The check run never appears on a pull request

First, confirm the pull request is not a draft. Draft pull requests are never reviewed automatically, and converting a draft to a normal pull request is what starts the trigger. Second, check the repository’s trigger setting. If it is set to manual, no automatic review runs, and you need a top-level @claude review comment from someone with write access. Third, check that the pull request is not from a fork. Fork pull requests are only reviewed when someone with write access comments @claude review, and pushing new commits or clicking Re-run does not start another one.

The first invoice is far larger than expected

You are almost certainly running after every push on active repositories. Each push starts a fresh review, and a pull request with ten pushes costs roughly ten reviews. Switch busy repositories to once when a pull request opens, drop non-critical repositories to Quick, and set the monthly spend limit. Check the analytics dashboard for one repository dominating the spend, and exclude generated code and vendored directories in REVIEW.md so the reviewer does not burn tokens reading code your team did not write.

REVIEW.md changes in a pull request have no effect

This is by design. Code Review reads REVIEW.md from the base or default branch, never from the pull request’s own changes, so rules changed inside a pull request do not apply to that pull request. Merge the REVIEW.md change to the default branch first, then open a new pull request to see the new rules take effect. The same applies to CLAUDE.md guidance.

Findings feel noisy or miss the point

Narrow the scope instead of turning the service off. Add a skip list for generated files and snapshots, tell it explicitly what never to flag, and move the repository from Standard to Quick if most findings are nits. Give it two weeks of tuning: the first reviews on a new repository are always the noisiest.

FAQ

How long does a review take?

Anthropic says most reviews now finish in 6 to 10 minutes, about three times faster than the roughly 20 minutes they took during the research preview. Large pull requests and Deep reviews take longer. The check run appears on the pull request within a few minutes of the trigger, and findings arrive as the review completes.

What does Code Review actually check?

By default it focuses on correctness: bugs that would break production, not formatting preferences or missing test coverage. The agents look for logic errors, security vulnerabilities, and broken edge cases in the diff and the surrounding code, then a verification step drops likely false positives before anything is posted.

Does it work on GitHub Enterprise Server?

Yes. GitHub Enterprise Server is supported through a separate setup flow where you select your instance when connecting GitHub. GitHub Enterprise Cloud with data residency is also supported by entering your enterprise’s ghe.com hostname. The organization-wide rollout option, covering repositories added later, only works for organizations on github.com.

Can developers change the review level or trigger?

No. Only an Owner of the Claude organization can change a repository’s level or trigger. Developers can request reviews with @claude review and tune what gets flagged with REVIEW.md and CLAUDE.md, but level and trigger changes need an Owner.

What happens to my review data?

Reviews run on Anthropic infrastructure, not in self-hosted environments. A review works from reading the diff and the surrounding code, without building or running your code. Organizations with Zero Data Retention or the HIPAA configuration cannot use the service at all.

Conclusion

Claude Code Review is at its best as one layer in a review pipeline, not as a replacement for human review. Set it up on one repository with Standard level and the once-per-pull-request trigger, write a short REVIEW.md that names what your team actually cares about, set a spend limit, and let it run for two weeks before you roll it out wider. If your team also automates the rest of its pipeline, the complete n8n guide shows how to wire the same pull request events into notifications and triage, and the Claude Code MCP setup guide covers connecting Claude Code to the rest of your toolchain. Start small, tune the rules, and keep the merge decision where it belongs: with your team.

Frequently asked questions