AI code review: how AI pull request reviewers work and how the main tools compare

AI code review uses an LLM-based agent to read a code change, usually a pull request, along with the surrounding code, and post comments on likely bugs, security problems and broken team rules before a human merges it. The main tools today are Anthropic's Claude Code Review, GitHub Copilot code review, OpenAI's Codex review and Cursor Bugbot.

All four work in a similar way and share the same limit: they comment, and people decide. This guide explains how AI reviewers work, how the main tools differ, and how to get useful reviews instead of noise.

How does AI code review work?

Most AI reviewers follow the same pipeline:

1. Trigger. A pull request opens, a new commit is pushed, or someone posts a comment such as @claude review, @codex review or bugbot run.
2. Gather context. The agent reads the diff and the code around it. GitHub's docs say Copilot's review "analyzes your entire repository to better understand the context of code changes."
3. Analyze. One or more agents look for issues. Anthropic's Code Review uses several agents that "examine the diff and the surrounding code in parallel."
4. Filter. Good tools check their own findings before posting, since false positives are the main complaint about AI review.
5. Post. Findings arrive as inline comments on the lines concerned, often with a summary.

Anthropic's Code Review docs spell out a clear version of this as four stages: Find, Verify ("a verification step checks the candidate findings against the code and filters out false positives"), Rank (findings are "deduplicated and ranked by severity"), and Post.

Under the hood, this is an AI coding agent with read access to your repository and a narrow job.

What are the main AI code review tools?

Plans, prices and limits change often. Each linked guide covers setup and billing for that tool.

How does Claude Code Review work?

Code Review is Anthropic's managed pull request reviewer "For Team and Enterprise plans," on GitHub repositories. "Several agents read each change alongside the surrounding code, looking for issues such as logic errors, security vulnerabilities, or broken edge cases." By default it "focuses on correctness: bugs that would break production, not formatting preferences or missing test coverage."

Each repository can review once when a PR opens, after every push, or only on request, and anyone with write access can comment @claude review. An Owner picks a review level: Quick, Standard (the default) or Deep. A review reads code without building or running it, and "never approves or blocks the pull request, so the decision to merge stays with your team."

Outside the managed service, the /code-review command runs in your own Claude Code session on any plan. See Claude Code review for all the options.

How does GitHub Copilot code review work?

GitHub's Copilot code review docs describe it this way: "Copilot reviews your pull requests, identifies issues, and suggests fixes you can apply in a couple of clicks." It uses agentic context gathering and tool use across the repository.

"By default, Copilot only reviews a pull request if you assign it to the pull request," and only once unless it is set to review each push. You can also configure automatic reviews. Copilot's reviews "do not count toward required approvals" by default, though admins can enable Copilot approvals. Each review consumes AI credits, and its agentic context gathering and tool use run on GitHub Actions runners, which use Actions minutes unless you use self-hosted runners.

See Copilot code review for setup.

How does Codex review work?

OpenAI's Codex reviews pull requests on GitHub when you comment @codex review, or automatically if you turn on automatic reviews. According to the Codex GitHub integration docs, "In GitHub, Codex flags only P0 and P1 issues so review comments stay focused on high-priority risks." GitLab merge request support is in beta.

Locally, /review in the Codex CLI "starts a dedicated reviewer that reads the selected diff and reports prioritized, actionable findings without changing your working tree," per the Codex code review docs. See Codex review for the commands.

How does Cursor Bugbot work?

Cursor's Bugbot docs say it "reviews pull requests and identifies bugs, security issues, and code quality problems." It runs automatically on each PR update, or when someone comments cursor review or bugbot run. It supports GitHub, GitLab, Bitbucket and Azure DevOps Services.

Bugbot can also fix what it finds: "Bugbot Autofix automatically spawns a Cloud Agent to fix bugs found during PR reviews." Billing is usage-based. See Cursor Bugbot for rules and pricing.

How do you tell an AI reviewer what matters?

Out of the box, AI reviewers apply general standards. To make them check your team's rules, and stop flagging what you don't care about, commit an instruction file:

• Claude Code Review: REVIEW.md holds review-only rules; CLAUDE.md holds project rules that reviews also enforce. Anthropic's customization docs show how to cap nits, skip generated files and add checks.
• Copilot: "Use .github/copilot-instructions.md for repository-wide rules specific to Copilot."
• Codex: add a ## Code Review Rules section to the AGENTS.md nearest the code it governs.
• Bugbot: "Create .cursor/BUGBOT.md files to provide project-specific context for reviews."

A short REVIEW.md in the style of Anthropic's example:

# Review instructions

## Do not report
- Anything CI already enforces: lint, formatting, type errors
- Generated files under src/gen/

## Always check
- New API routes have an integration test
- Log lines don't include email addresses or request bodies

Report at most five Nits per review.

Two tips recur across vendors. OpenAI recommends starting with two or three concise rules and keeping deterministic checks such as lint in CI. Anthropic suggests requiring evidence for some findings, for example a file:line citation, to cut false positives.

What are the limits of AI code review?

Every vendor says to keep humans in the loop:

• Anthropic: "A review with no findings doesn't mean your code is error-free or secure."
• GitHub: "Copilot is not guaranteed to spot all problems or issues in a pull request," and "Always validate Copilot's feedback carefully."

Other practical limits:

• Noise. Without instructions, reviewers may flag style issues your team ignores. Severity filters and nit caps help.
• Missing context. The reviewer sees code, not the product decision behind it. Put the why in the PR description.
• Prompt injection. A pull request can contain text aimed at the reviewer. Anthropic's Code Review reads REVIEW.md from the base or default branch, "never from the pull request's own changes," so a pull request cannot rewrite the rules it is reviewed against. See prompt injection in coding agents.
• Cost. Managed reviewers bill per review or per usage, and deeper reviews cost more.

Can you run AI code review yourself?

Yes, and it is often the best first step. Claude Code's /code-review and Codex's /review both review your local changes before anyone else sees them. You can also run Claude in your own CI with GitHub Actions, or write a reviewer as a subagent or skill, such as the code review skill.

A plain prompt works too: paste a diff and ask for bugs only, ranked by severity, each with a file and line. Our code review prompts and security review prompts give you starting points. Kipt keeps prompts and Agent Skills as Markdown in a private GitHub repo you own, so the review prompt or skill your team settles on stays in one place, and you can install the skills into Claude Code or Codex with one command.

What should you read next?

Pick the tool that matches your code host and plan, then read its guide: Claude Code review, Copilot code review, Codex review or Cursor Bugbot. Whichever you choose, write a short instruction file in the first week so reviews match your team's standards.