How Anthropic's Claude Code team reviews agent-written code, and what to copy

Anthropic's layered, risk-tiered review playbook for agent-written PRs, decoded for GitHub teams weighing Code Review or a DIY version.

Picture a tech lead at a 20-person SaaS company. Half her team now directs Claude Code sessions instead of typing, and the pull request queue has roughly tripled. Review still works the old way: a senior engineer reads every diff line by line before approving. The queue backs up, approvals get faster and shallower, and the bugs that slip through show up as Friday reverts. In the postmortem, nobody can say which check should have caught them.

On October 15, 2026, the Claude Code team at Anthropic published how it reviews code at agent volume. The headline claim: from June to September, merged pull requests to Claude Code's codebase more than doubled while the share that had to be reverted fell by more than 40 percent. The method isn't skipping review. The team says it moved most of the reading to machines, tiered human approvals by risk, and invested in fast rollback. The same day, Anthropic made its Code Review product generally available on Team and Enterprise plans, according to The Next Web and Unite.AI. @bibryam on X called the post a must-read.

Keep one thing in mind throughout: these are Anthropic's numbers about Anthropic's repos.

What it is

Two different things shipped: a playbook and a product.

The playbook, per Anthropic's post, is a stack of layers. Each maps to a piece of our tech lead's pain:

The post is candid about one failure. Agent author and agent reviewer can keep each other busy: one CLI PR went through more than fifty rounds overnight, and about 59% of what the reviewer kept flagging was code present since its first pass. Per CellCog's summary, the fix included asking the author to rethink after three rounds and reviewing only the new diff on later passes, which lifted first-round passes from 65% to 78%.

The product, Code Review for Claude Code, lets admins pick Quick, Standard or Deep per repo, per @ClaudeDevs. The key difference from Anthropic's internal setup, flagged by a DEV Community post: the product never approves or blocks a PR, and its check run never concludes as a failure. Blocking is your job.

Alternatives, described only from the comparison pages we have:

Treat all of these benchmarks with care. Two are run by competing vendors, and AIMultiple tested November 2025 versions.

Who it's for

Pick up the product if you're on a Claude Team or Enterprise plan, your code lives on GitHub, and agents are inflating your PR volume. Unite.AI reports it's unavailable with Zero Data Retention, the HIPAA configuration or customer-managed encryption keys, and isn't covered under Anthropic's BAA. Those orgs should skip it.

Pick up the playbook regardless of vendor. Risk tiers, "the change sets the tier, not the author," and per-commit approvals are process, not product. Skip the zero-human tier if you lack solid tests, CI and feature flags. That's our analysis: no source tests the approach in low-coverage or regulated codebases.

Solo devs on individual plans get the local /code-review and /security-review commands and the open-source GitHub Action; the DEV Community post says /code-review runs on any plan.

Before and after

Before:

  1. An agent or engineer writes the change.
  2. Open a PR and wait for a colleague.
  3. A human reads every line.
  4. Merge, then find out in production.

After, per Anthropic's post:

  1. The agent runs tests or a build and shows the output.
  2. A fresh-context subagent reviews the diff, and optional local skills hunt bugs and simplify.
  3. On the PR: CI, Claude bug review and security review. Every finding is fixed or closed with a reason.
  4. A classifier sets 0, 1 or 2 human approvals. The person who prompted the agent counts as one.
  5. The merge queue re-checks against main, and the change ships behind a flag, then from the latest channel to stable.
  6. Any incident becomes an eval case the reviewer runs against daily.

Try it

Smallest step, any plan: run /code-review locally in a Claude Code session (per DEV Community). Anthropic's post also points to the /security-review command and an open-source security review GitHub Action. Add a short REVIEW.md at your repo root. The Claude Help Center says Code Review auto-discovers it.

For the managed product on Team or Enterprise, the Help Center describes these steps. An Owner enables Code Review, installs the Claude GitHub App, selects repos and picks a trigger per repo: once after PR creation, after every push, or manual. A test PR should show a check run named Claude Code Review. On Manual, comment @claude review at the start of a top-level PR comment. Reviews average $15–25 each, billed separately through usage credits, and the after-every-push trigger multiplies that.

To make findings block merges like Anthropic's internal repos do, DEV Community offers two routes. One is GitHub branch protection's "require conversations resolved" rule, which also blocks on nits and human comments. The other is a gh script that gates on open Important findings, which its author says he hasn't run against a live check.

The sources don't describe a turnkey way to reproduce the full setup with hooks or the claude-code GitHub Action.

Where it breaks

Sources