Claude Code as a code-review harness: what it does and what it still cannot do
Where an LLM helps with reviews, where it lies confidently, and how to fit it into a PR workflow without losing control.
I use Claude Code as an additional review pass, not as an approval authority. It is fast at tracing data flow across unfamiliar files, spotting repeated mistakes, and turning a vague concern into a specific line-level question. It is also capable of presenting a wrong conclusion with excellent confidence.
Where it helps
The strongest reviews begin with a narrow brief: inspect the diff, identify correctness or security regressions, and cite the exact code path. This keeps the model focused on evidence instead of style preferences.
It is particularly useful for:
- following a value through several modules;
- comparing a change with existing repository conventions;
- identifying missing error and empty states;
- drafting focused tests for a suspected edge case.
Where it fails
An LLM does not know production context that is absent from the repository. It can misread an intentional tradeoff, invent framework behavior, or recommend a broad refactor that increases the risk of a small pull request.
I treat every finding as a hypothesis. High-impact claims need a reproducer, a test, or primary documentation before they become requested changes.
A controlled review loop
My review prompt includes the pull request goal, the merge base, relevant constraints, and a request to rank only actionable findings. I then reproduce each finding locally and keep the human reviewer responsible for the final decision.
That arrangement is less magical than “AI reviews the code,” but much more useful: the model expands the search space while the engineer keeps control of evidence, scope, and approval.