Claude Code Review: Official, /code-review, Action or Kit?

There are four ways to get Claude to review code: the managed Code Review app (Team and Enterprise), /code-review (alias /review) in your terminal, the Claude Code GitHub Action in your own CI, or a kit you own. They differ in who pays, where the review runs and whether findings land as inline comments on the pull request. Ultrareview, a deeper cloud pass started from your terminal, sits between the first two.

Everything below was checked on 25 Oct 2026 against Anthropic’s Code Review, Code Review costs, /code-review, ultrareview and GitHub Actions docs.

The options side by side

Option	Who pays	Where it runs	Inline PR comments	Who can use it
Code Review (managed)	Your organization, through usage credits	Anthropic infrastructure	Yes, on every review	Team and Enterprise orgs on GitHub, once an Owner turns it on
/code-review	Your plan usage or API billing	Your Claude Code session	With --comment	Anyone, on any plan
Ultrareview (/code-review ultra)	3 free runs on Pro and Max, then usage credits	A cloud sandbox	Can post findings to a github.com PR	claude.ai sign-in required
GitHub Action with the code-review plugin	API key (or subscription token) plus GitHub Actions minutes	Your CI runners	With --comment	Anyone with a key, on GitHub
A kit you own, such as a subagent or skill	Your plan usage or API billing	Wherever you run Claude Code	Depends on the kit	Anyone

If you are on Pro or Max and work alone, start with /code-review. If your team is on Team or Enterprise and wants every pull request reviewed without maintaining a workflow, use the managed service. If you need control over triggers, model and prompt, use the GitHub Action.

1. Managed Code Review (Team and Enterprise)

An Owner of your Claude organization turns it on and installs the Claude GitHub App. After that, reviews run on Anthropic’s infrastructure in four stages: several agents read the diff and surrounding code in parallel, a verification step filters false positives, findings are deduplicated and ranked by severity, and the review posts inline comments, a summary and a check run named Claude Code Review.

What to know before you turn it on:

• It never approves or blocks. The check run does not conclude as a failure, so merging stays your call.
• It reads, it doesn’t run. Repository access is read-only, it doesn’t push commits, and it works from the diff and surrounding code without building or running anything.
• It focuses on correctness by default: bugs that would break production, not formatting. A REVIEW.md on the base or default branch changes what it flags. It is never read from the pull request’s own changes.
• Review levels: Quick, Standard (the default) and Deep. Deeper costs more.
• Triggers per repository: once when the PR opens, after every push, or only when someone with write access comments @claude review.
• Not available with Zero Data Retention, the HIPAA configuration, or customer-managed encryption keys.

What it costs

There is no flat price per review. Reviews are billed on tokens through usage credits, separately from your plan’s included usage, and charged to the organization rather than the developer. Cost per review scales with the review level, the size of the change, the complexity of the surrounding code and how many candidate issues need checking.

The biggest multiplier is the trigger. A repository you add starts at After every push, which multiplies cost by the number of pushes. Anthropic’s suggested pilot: set a monthly spend limit, switch a few repositories to Once after PR creation or Manual, read the Average cost column under Admin settings > Claude Code, and multiply by your monthly pull request count. Reviews are skipped, with a comment on the PR, once the spend limit or credit balance runs out.

2. /code-review in your terminal (any plan)

Run it in the Claude Code session where you work:

/code-review

With no target it reviews your branch’s commits ahead of upstream plus uncommitted changes. It runs as a background subagent with its own context window and reports findings in your conversation. It counts toward your plan’s usage or your API bill like the rest of the session.

Useful variations:

To review	Type
A pull request by number	/code-review 1234
One branch against another	/code-review main...my-feature
A path	/code-review src/auth
And apply the fixes	/code-review --fix
And post inline comments on the GitHub PR	/code-review --comment 1234
With more confidence, fewer findings	/code-review low

Effort levels run from low to max. At low the review reports only the findings it is most confident in; higher levels broaden coverage. It follows your CLAUDE.md but not REVIEW.md, which only configures the managed service. For a security-only pass over your branch, run /security-review.

Escalate to ultrareview

/code-review ultra (alias /ultrareview) runs a deeper multi-agent review in a cloud sandbox while you keep working. It is a research preview. It typically takes 15 to 25 minutes, needs a claude.ai sign-in, and is not available on Bedrock, Google Cloud or Microsoft Foundry.

Pro and Max accounts get 3 free runs, a one-time allotment that does not refresh. After that, each review bills as usage credits, typically $5 to $25 depending on the size of the change, and the launch dialog shows the estimate first. For CI or scripts, use the claude ultrareview subcommand, which waits for the findings and prints them; a claude -p '/code-review ultra' run exits before they arrive.

3. The Claude Code GitHub Action

The Action runs Claude in your own GitHub Actions runners. The quickest setup is /install-github-app inside Claude Code, which installs the GitHub App, stores your key as a repository secret and opens a pull request with the workflow. The docs’ review workflow installs Anthropic’s code-review plugin and runs it on each pull request:

name: Code Review
on:
  pull_request:
    types: [opened, synchronize, ready_for_review, reopened]
jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
      issues: read
      id-token: write
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 1
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          plugin_marketplaces: "https://github.com/anthropics/claude-code.git"
          plugins: "code-review@claude-code-plugins"
          prompt: "/code-review:code-review --comment ${{ github.repository }}/pull/${{ github.event.pull_request.number }}"
          claude_args: '--allowedTools "mcp__github_inline_comment__create_inline_comment"'

Keep the claude_args line: the Action starts the inline-comment tool only when --allowedTools names it. Without --comment, findings go to the workflow log instead of the PR. On public repositories, GitHub withholds secrets from fork pull requests, so reviews run only on branches in the same repository.

You pay twice here: GitHub Actions minutes for the runner and API tokens for Claude, or your subscription if you authenticate with CLAUDE_CODE_OAUTH_TOKEN. Set --max-turns in claude_args and a workflow timeout to cap a run. Our GitHub Actions guide covers secrets and triggers in depth.

4. A review kit you own

The first three options are Anthropic’s. The fourth is yours: a reviewer subagent or skill with your own checklist, versioned in your repo. That is the option to choose when you want the same fixed format on every review, or need it to work offline and on any git host.

Our PR Review kit is one example. It reviews your branch against its base with an eight-point checklist and writes REVIEW.md with path:line findings, without posting comments or touching your code. It suits a pre-PR check on any plan. If your organization also uses managed Code Review, don’t commit that report: a REVIEW.md at the repository root is the file the managed service reads as its instructions once it reaches your default branch. Add it to .gitignore.

Which one should you pick?

1. Solo on Pro or Max: /code-review before every PR, /code-review ultra for the risky ones while free runs last.
2. Team or Enterprise on GitHub: managed Code Review with Once after PR creation, plus /code-review locally.
3. Need your own triggers, model or GitLab: the GitHub Action, or Anthropic’s GitLab CI/CD integration.
4. Want a fixed format you control: a kit in your repo.

Whichever you use, Anthropic’s own note applies: AI review can miss bugs and security issues, and a review with no findings doesn’t mean the code is safe. Keep a human on the diff.