Claude Code Review Is GA: Costs and Controls

Anthropic took Claude Code Review out of preview on October 15, 2026, and opened it to every Team and Enterprise organization with GitHub repositories. A research preview is fine for trying something out, but it's a hard sell to roll out across forty repositories when the vendor could pull it at any time. GA changes that calculation.

What's actually new here isn't that Claude can read a diff and find bugs. Plenty of tools do that. It's the admin surface underneath it: who turns it on, what it's allowed to touch, how thorough it is per repository, and how much it's allowed to spend before it stops running. That's the part worth walking through before you flip the switch.

What does Claude Code Review actually check?

A review runs on Anthropic's own infrastructure in four stages, and none of them touch your CI runners. Several agents read the pull request's diff alongside the surrounding code, looking for things like logic errors, security issues, and broken edge cases, not formatting or missing tests. A verification step then checks each candidate finding against the actual code and throws out the false positives before anything reaches you.

What survives verification gets deduplicated and ranked by severity, then posted back to the pull request. Every finding lands in one of three buckets:

Severity	What it means	What to do with it
Important	A bug that should be fixed before merging	Fix it, or explain in a reply why it's a false positive
Nit	A minor issue, worth fixing but not blocking	Fix it when convenient, or dismiss by resolving the thread
Pre-existing	A bug that was already in the codebase, not introduced by this PR	Track separately; it's not this PR's responsibility to fix

A review leaves three things on the pull request: inline comments on the lines concerned, a short summary in the review body, and a check run named Claude Code Review. When nothing's wrong, the check run's title reads "Code review found no issues," and that's the whole comment. Access during a review is read-only. Claude doesn't push commits, build your code, or run it; it works from the diff and the surrounding files.

How thorough should a review be?

Thoroughness and cost move together, so Anthropic gives you a dial instead of one fixed behavior. An Owner sets a default review level for the whole organization and can override it per repository, so a sandbox repo and your payments service don't have to run the same way.

Review level	What it trades
Quick	A lighter pass, the fastest and cheapest option
Standard	Balanced depth, speed, and cost (the default)
Deep	The most thorough pass, slowest and most expensive

There's a second dial, independent of review depth: how often a repository gets reviewed at all.

Review runs setting	When a review starts
Once after PR creation	On open, reopen, or marking a draft ready for review
After every push	On every push to the branch (the default for newly added repos, and the most expensive)
Manual (@claude review)	Only when someone comments @claude review on the pull request

Drafts and pull requests from forks skip automatic review no matter which setting you pick. If you need a review on one of those, comment @claude review yourself; that comment needs write access to the base repository, not the fork.

Who controls Code Review, and how?

Turning Code Review on is an Owner-only action, done at Admin settings > Claude Code > Code review on claude.ai, not through a workflow file in your repo. The Owner connects GitHub, installs the Claude GitHub App (which needs a GitHub organization owner to do, if that's not the same person), and picks which repositories get covered. You can also cover an entire GitHub organization in one step, though Anthropic requires a monthly spend limit to be set first, since that can raise spend significantly.

Developers don't need the Owner role to shape what gets flagged. Anyone with write access to a repository can commit REVIEW.md and CLAUDE.md files to tune what Claude checks for, though REVIEW.md only takes effect once it's merged to the default branch; Claude never reads it from the PR's own changes. That split matters: it means a developer can't quietly suppress a check by editing the rules inside the same PR that trips it.

On GitHub itself, three comment commands cover most day-to-day requests:

Command	What it does
@claude review	Starts one review, no subscription to future pushes
@claude review always	Starts a review and subscribes the PR to reviews on every later push
@claude review once	Same as @claude review

The Claude GitHub App is shared across several Claude features, including the GitHub Action and web auto-fix, so installing it grants a broader permission set than Code Review alone uses. If your organization needs a narrower scope just for custom automation, a separate custom GitHub App is possible for the Claude Code GitHub Action, but Code Review itself requires the official app.

What does Claude Code Review cost?

There's no flat per-review price, which is the first thing to set expectations on before a rollout. Code Review bills on token usage through usage credits, separately from whatever's included in your plan, and every charge goes to the organization's account, not the developer who opened the PR. That holds even if your developers normally use Claude Code through Amazon Bedrock, Google Cloud, or Microsoft Foundry for other work; Code Review costs still land on your Anthropic bill.

Three things drive the cost of any one review: the review level, the size of the diff, and how many candidate findings the verification step has to check. The review-runs setting then multiplies that per-review cost by how many times a given pull request gets reviewed, so After every push on a busy repo adds up fast compared to Once after PR creation.

Anthropic's own advice for estimating spend before a wide rollout is worth following directly:

1. Set a monthly spend limit for a small pilot group.
2. Turn on Code Review for a few representative repositories, set to Once after PR creation or Manual.
3. After several reviews run, read each repo's Average cost column in the admin page's Repositories table.
4. Multiply that average by how many pull requests the repo opens in a month, and again by typical pushes per PR if you're planning to use After every push.

To cap the downside, set a monthly spend limit at claude.ai/admin-settings/usage for the Code Review service specifically. Reviews stop running, with a comment on the PR explaining why, once that limit, your organization's overall spend limit, or your usage credit balance runs out. An analytics dashboard at claude.ai/analytics/code-review tracks the rest:

Section	What it shows
PRs reviewed	Daily count over a selected time range
Code Review cost	Spend so far this month
Feedback	Comments auto-resolved because a developer fixed the issue
Repository breakdown	Per-repo PRs reviewed, comments resolved, review runs, and estimated cost

One caveat worth flagging for anyone doing finance reconciliation: repository breakdown costs in that dashboard are estimated at list price, before discounts or credits, and only cover reviews Claude actually posted. For an invoice-accurate number, go to your Anthropic bill instead. Separately, eligible Enterprise organizations can claim at least $10,000 in Code Review credits through January 15, 2027 (terms apply, and Anthropic doesn't publish exact eligibility criteria in the announcement); claimed credits expire 30 days after you claim them, so don't claim before you're ready to spend.

That spend sits outside what CloudByte AI's Claude Code analytics tracks today. We follow your developers' own sessions, prompts, tokens, and cost on their machines, which is a different ledger from Code Review's separate usage-credit bill on Anthropic's infrastructure.

Does Code Review replace a human reviewer?

No, and Anthropic says so directly in its own documentation: Code Review "uses AI to review code and may miss bugs, security vulnerabilities, or other issues," and a clean pass "doesn't mean your code is error-free or secure." The check run reflects that design choice. It's named Claude Code Review, but it concludes as neutral or skipped, never as a failure, so it can't fail a required check on its own and can't block a merge by itself.

If you want Code Review findings to actually gate something, you build that yourself in CI by reading the check run's machine-readable summary line:

SEV='.output.text
  | split("bughunter-severity: ")[1]
  | split(" -->")[0] | fromjson'
gh api "repos/$OWNER/$REPO/check-runs/$ID" \
  --jq "$SEV"

That returns a count per severity, something like {"nit": 1, "normal": 2, "pre_existing": 0}, where normal holds the count of Important findings. A missing line means no verdict was reached (a failed, timed-out, or superseded review), not zero findings, so treat that case as "unknown" rather than "clean" in your script.

In practice, this is the honest way to think about what shipped: not a gate, but a fast first pass that catches a meaningful share of what a human reviewer would also catch, with the actual approve-or-reject decision staying exactly where it was. Pair it with an AI governance framework that already defines who owns that decision, and Code Review slots in as one more signal rather than a new authority.

Should your team turn it on?

If you're already paying for Team or Enterprise and your code lives on GitHub, the GA move removes most of the reason to wait. Start with the pilot Anthropic recommends: a spend limit, a handful of representative repos, Once after PR creation or Manual so you're not multiplying cost by every push, and a couple of weeks reading the Average cost column before you commit to After every push anywhere that matters.

The one thing I'd flag to any engineering leader evaluating this alongside other AI tooling in the stack: Code Review's spend, repos, and review levels live entirely in Anthropic's own admin console and analytics page, not in your broader AI usage picture. If your organization already tracks Claude Code mods and other new capabilities through a security and compliance program, add Code Review's admin settings to that same checklist. It's governed by an Owner role in the claude.ai admin console, even though its dashboard sits in a different place than the rest of your Claude Code usage.