Anthropic has taken Code Review out of research preview. It is now generally available for Claude Team and Enterprise organizations. It reads pull requests in your GitHub repositories and leaves inline comments ranked by severity. Anthropic says most reviews now finish in 6 to 10 minutes, down from about 20 during the preview.
For a business that owns some code, even if it is only the glue between a CRM, a billing tool and a form, the question is not whether AI review is clever. It is whether it earns its cost on the code you actually ship.
We read Anthropic's general availability announcement, the Code Review docs, the customization page, the costs page and the setup article on October 16, 2026. We have not run Code Review on our own repositories for this post, so nothing below is a measured result.
The short answer
It makes sense if you are on a Team or Enterprise Claude plan, your code is on GitHub, several people open pull requests, and a missed bug costs real money, such as a webhook handler that writes to your books. It is a poor fit for a solo developer with a handful of changes a month, for repositories outside GitHub, and for any organization that needs zero data retention or a HIPAA configuration.
What Anthropic says it does
Several agents read each pull request alongside the surrounding code, looking for logic errors, security problems and broken edge cases. A verification step checks candidate findings against the code before they are reported. Findings are ranked, deduplicated and posted as inline comments with a summary and a check run.
Three facts in the docs matter more than the marketing:
- A review never approves or blocks a pull request. The merge decision stays with your team, and the check run does not conclude as a failure.
- Reviews are read-only and run on Anthropic's infrastructure. They work from reading the diff and nearby code, without building or running your code.
- Anthropic states that Code Review may miss bugs and security problems, and that a review with no findings does not mean the code is error-free or secure.
Levels, triggers and cost
Admins pick Quick, Standard (the default) or Deep, and can set a different level per repository. Each repository also has a trigger: once when a pull request opens, after every push, or only when someone with write access comments @claude review.
Billing is by token usage through usage credits, separate from plan usage. Anthropic's setup article and product page say reviews average $15 to $25 each, scaling with change size, code complexity and how many issues need verification. The trigger matters a lot. Review on every push multiplies the cost by the number of pushes. Anthropic's docs say admins can set a monthly spend limit for the service, and that reviews are skipped when the limit, the organization limit or the credit balance runs out.
Anthropic also says eligible Enterprise organizations can claim at least $10,000 in Code Review credits by January 15, 2027, that credits expire 30 days after you claim them, and that terms apply.
Who cannot use it
Per the docs: it requires a Team or Enterprise plan and GitHub-hosted code (including GitHub Enterprise Server and Cloud with data residency). It is not available for organizations with zero data retention enabled or the HIPAA configuration, and is not covered by Anthropic's Business Associate Agreement. It is not yet available with customer-managed encryption keys. If your team uses Claude Code through a cloud provider, you still need a Claude organization on one of those plans for this service.
If you are in healthcare, that HIPAA line alone may settle the question. Our guide to HIPAA and AI tools covers what to ask a vendor.
Where this fits in a real business
These are uses we would set up. They are designs, not customer results.
1. Webhook and sync handlers. Code that receives events from a payment, form or CRM provider fails in boring ways: no signature check, no duplicate protection, no retry limit. A REVIEW.md rule that says to flag any handler without signature verification and a stored event ID gives the reviewer a specific thing to look for. Our post on webhook idempotency is a good source for those rules.
2. MCP servers and agent tools. If you build tools that an AI agent can call, the review rules can ask for explicit permission checks, input validation and no secrets in logs. See securing a production MCP server and lessons from building seven MCP servers.
3. Internal tools. A small team with one developer and a contractor gets a second reader on every change without scheduling one.
4. Contractor pull requests. If an outside developer builds an integration for you, review on open gives you a first pass before your own person looks.
What to set up
- 1Start on one repository with Standard level and review once when a pull request opens. Add push-triggered review only if the cost is acceptable.
- 2Set the monthly spend limit before the first review runs.
- 3Write a REVIEW.md at the repository root. The docs say it holds review-only rules: what to always flag, what to skip, and how to rank severity. They also say Code Review reads it from the base or default branch, never from the pull request itself, so merge changes to it first and protect that branch. Put guidance you want in both the service and local use in CLAUDE.md, because the local /code-review command reads CLAUDE.md and not REVIEW.md.
- 4Keep your tests and human review. Treat the AI comments as one input. See testing before production.
- 5Review the app's permissions with whoever owns your GitHub organization before installing it.
What to watch for
- Cost creep from push-triggered reviews on busy branches.
- False comfort. No findings is not a clean bill of health.
- Noisy comments. If people start ignoring them, tighten REVIEW.md or lower the level.
- Skipped reviews when the spend cap is reached, which can look like a pass if nobody notices.
- Data handling. Code goes to Anthropic's infrastructure for review, so confirm that fits your contracts.
When it is not worth it
If your team is one person, a careful self-review and good tests cost nothing. If most of your integration code is configuration inside a no-code platform, there is no pull request to review. If your code lives outside GitHub, the service does not apply, though Anthropic's docs list other ways to get a review, such as the local /code-review command on any plan or Claude in your own CI. And if you have no tests, buy those first. A reviewer that reads but cannot run the code is a weak substitute.
How this fits implementation work
OrchestriAI does not resell Claude or run code review as a service. We build and maintain the code that often needs it. Custom development covers internal tools and automation code. Systems integration covers the connections between your tools, where webhook and sync bugs live. MCP development covers servers that agents call. Part of the long-term cost is upkeep, which we cover in automation maintenance costs. If you are not sure which code or process to fix first, the free automation audit is a no-cost place to start.
Independence and limitations
OrchestriAI is an independent implementation provider. Product names are used for identification only. OrchestriAI is not affiliated with, endorsed by, or sponsored by Anthropic or GitHub. This article summarizes Anthropic's public documentation as of October 16, 2026. Plans, pricing, credits and supported hosts can change, so confirm them with Anthropic before you turn it on. This is not a security certification or a compliance conclusion.
