Claude Code review: built-in options and cubic's plugin

Claude Code has its own review tools. The /code-review command reviews your diff for correctness bugs in your terminal, and Code Review, a managed service in research preview for Team and Enterprise plans, reviews pull requests on GitHub. Whichever tools you use, check the diff twice: once in your Claude Code session before you push, where Claude can fix the findings right away, and again on the pull request as the final pass. With cubic's Claude Code plugin, one skill runs a local review of your changes, and another pulls the pull request's review comments back into the session to fix them.

If you're still setting up Claude Code itself, start with our guide on how to use Claude Code. Claude Code wrote 78.1% of the AI-written code that cubic reviewed in the latest full week, according to Bug Bench's Claude Code page. That share describes code reviewed by cubic, not the whole market.

Claude Code's built-in review options

Anthropic offers four review options for Claude Code users. They differ in what they review and where they run:

Availability and cost differ too. /code-review and /security-review ship with Claude Code, and /code-review counts toward your normal usage. Ultrareview is a research preview that needs a claude.ai sign-in: Pro and Max include three free runs, and after that a review typically costs $5 to $25 in usage credits (ultrareview docs). Code Review is a research preview for Team and Enterprise plans, billed on token usage through usage credits rather than your plan's included usage, at an average of $15 to $25 per review (Code Review pricing).

Code Review runs specialized agents on Anthropic's infrastructure, checks their candidate findings against the code to filter out false positives, and posts the rest as inline comments tagged Important, Nit or Pre-existing. It doesn't approve or block a pull request. An Owner sets each repository to review once after a pull request opens, after every push, or only when someone comments @claude review, and a REVIEW.md file at the repository root tells it what to flag. The local /code-review follows your CLAUDE.md but doesn't read REVIEW.md; add --fix to apply its findings or --comment to post them on the pull request (Anthropic's Code Review docs).

To run Claude in your own CI instead, Claude Code GitHub Actions responds to @claude mentions in pull requests and issues, and can run a prompt on any GitHub event.

cubic, our AI code reviewer, works at both checkpoints with one set of team rules: the same custom agents and learnings apply to a local review in your Claude Code session and to the review on the pull request. The rest of this guide sets that up with cubic's Claude Code plugin.

Two places to review Claude Code's output with cubic

Both reviews read the same repository context: your custom agents, your team's learnings and your repository settings. The CLI loads them for the repository in your origin remote, reading cubic.yaml and linked instruction files from the default branch, so a rule you merge applies to local reviews too (Local CLI review docs).

What's in cubic's Claude Code plugin

The plugin bundles cubic's skills, namespaced slash commands and the connection to cubic's MCP server. According to cubic's skills docs, the plugin has six skills:

You rarely need a skill's name. Ask in plain words ("review my code with cubic", "loop until clean", "check cubic comments") and Claude can pick the matching skill. Name cubic when you ask for a review, because a plain request to review your changes can also start Claude Code's built-in /code-review. The plugin also adds commands you can type: /cubic:run-review [flags], /cubic:comments [pr-number], /cubic:wiki, /cubic:scan and /cubic:learnings.

Local reviews run through the cubic CLI. The pull request comment workflows use the GitHub CLI, signed in with gh auth login, and wiki, scan and learnings requests go through the MCP server, which you authorize with OAuth.

The skills and the MCP server were announced in cubic's Skills and MCP launch post. Our guide to Claude Code plugins explains how plugins, marketplaces and install scopes work in general.

Install the plugin and the cubic CLI

1. Install the CLI. On macOS and Linux:

   curl -fsSL https://www.cubic.dev/install | bash

   curl -fsSL https://www.cubic.dev/install | bash

   curl -fsSL https://www.cubic.dev/install | bash

   On Windows, the docs give npx @cubic-dev-ai/cli install -g. The installer also turns on AI attribution tracking, which tags AI-assisted commits with git notes for cubic's AI coding analytics. To skip it, set CUBIC_DISABLE_GIT_AI=true when you install.

2. Sign in by opening a terminal in your repository and running cubic. The first launch opens your browser; cubic auth login does the same thing explicitly.

3. Add cubic's marketplace and install the plugin from inside Claude Code:

   In a session, /plugin install opens the plugin's details before it installs anything, so you can read what it adds and choose a scope: you in every project, everyone on this repository, or you in this repository only (Anthropic's install docs).

4. Run /mcp, choose cubic and complete the browser sign-in.

5. Start a new session in the repository and ask: Use cubic's run-review skill to review my changes. With the CLI installed and signed in, Claude should run a local review, group the findings by priority and offer to fix them.

If you want only the MCP server, without the plugin, cubic's agent setup docs show how to connect it. To install the skills without the plugin, npx @cubic-plugin/cubic-plugin install --skills-only adds them, with their commands, to every coding agent it detects. In Claude Code those commands are unprefixed, as in /run-review.

Share the setup with your team

The plugin's README, in the mrge-io/skills repository, gives this block for a repository's committed .claude/settings.json:

{
  "extraKnownMarketplaces": {
    "cubic": {
      "source": {
        "source": "github",
        "repo": "mrge-io/skills"
      }
    }
  },
  "enabledPlugins": {
    "cubic@cubic": true
  }
}

{
  "extraKnownMarketplaces": {
    "cubic": {
      "source": {
        "source": "github",
        "repo": "mrge-io/skills"
      }
    }
  },
  "enabledPlugins": {
    "cubic@cubic": true
  }
}

{
  "extraKnownMarketplaces": {
    "cubic": {
      "source": {
        "source": "github",
        "repo": "mrge-io/skills"
      }
    }
  },
  "enabledPlugins": {
    "cubic@cubic": true
  }
}

Claude Code registers the marketplace from these entries only in a folder the contributor has trusted, and ignores them without a message in an untrusted one (Anthropic's plugin docs for teams). Each person still installs the CLI and signs in on their own machine, and completes the /mcp sign-in with their own cubic account.

What a review run looks like

Ask "review my code with cubic" or run /cubic:run-review. Without flags, the skill checks the working tree first: if it has uncommitted changes, the skill reviews those, and if it's clean, it reviews the branch against its base. Flags pass straight through to the CLI: -b main compares with main, -c HEAD~1 reviews a single commit, and -p "..." adds instructions for that run.

The skill waits for the review to finish, up to five minutes for a local review, then lists the findings by priority. P0 is critical, P1 high, P2 medium and P3 low, and each finding has a file, a line, a title and a description. A run on a change Claude just wrote might come back like this (an illustrative example, not a real finding):

The CLI's own text output groups findings the same way, with colored priority labels. cubic review --json returns one JSON object with an issues array, which is what the skill reads.

Fix findings in the same session

Answer with the numbers you want fixed. For each one, Claude reads the file and the code around it, checks that the finding is real, and fixes it the simplest way it can without refactoring unrelated code. When it decides a finding is a false positive, it explains why and skips it. Then run the review again before you push, so the fixes get checked too.

To hand the whole cycle to Claude, ask it to "loop until clean". The cubic-loop skill reviews, fixes, commits and reviews again, up to five iterations by default. It stops early when no issues remain or only P3 findings are left, and it skips P3 fixes unless you ask it to fix everything. When the branch already has an open pull request, the loop works in PR mode: it pushes, waits for cubic's PR review and fixes from those comments.

To make the routine part of every session, the CLI docs suggest adding this block to CLAUDE.md or AGENTS.md:

Claude reads CLAUDE.md at the start of every session, but treats it as context, not enforced configuration (Anthropic's memory docs). When a check has to run every time, attach it to an event with a hook; our guide to Claude Code hooks shows how.

Where cubic's review on the pull request fits

The CLI is faster and less thorough than the GitHub review, according to cubic's docs. The GitHub review uses a different model and review pipeline and may find issues the local review missed. Install the cubic GitHub App on the repository and new pull requests get reviewed automatically. For a pull request opened before the install, comment @cubic-dev-ai review this PR (quickstart). When you push new commits, cubic reviews only the changes since its last review and comments only on new issues (key features).

Back in Claude Code, ask it to "check cubic comments" or run /cubic:comments. The check-pr-comments skill waits for the review to finish, reads the unresolved review threads, applies and verifies the fixes worth making, then commits and pushes if code changed. It resolves the threads it handled, including findings it confirmed as false positives or already fixed, without posting replies by default. To see the findings without changing anything, ask:

You can also fix from GitHub: click Fix with cubic on a review comment, or tag @cubic-dev-ai in a reply that asks for a fix. The fix is pushed to your branch, or opened as a separate fix PR if you ask for one.

Auto-fix, in beta, works through the findings for you once it's on for the pull request, switched on either by someone with write access or by a repository setting. It checks whether each finding is real, fixes the real ones and runs your lint, type-check and tests where it can, pushes, and replies on every thread, asking you a question when it needs a decision.

A reply that tells cubic what to do differently, or a thumbs up or down on a comment, feeds its learnings, and local CLI reviews load the same learnings. Our guide to AI code review covers how AI review works and what it catches.

Claude Code security review

Claude Code has security checks of its own. /security-review analyzes the diff between your branch and origin's default branch for risks like injection, auth issues and data exposure, and needs an origin remote (Anthropic's commands reference). The security-guidance plugin, installed with /plugin install security-guidance@claude-plugins-official, has Claude review its own changes for common vulnerabilities while it works and fix what it finds in the same session (Anthropic's security guidance docs).

With cubic, security review uses the same two checkpoints, pointed at the code where a missed bug costs the most. Before you push, focus a local review on the risky parts with a prompt. The command accepts cubic CLI flags, and --base and --prompt combine:

/cubic:run-review --base main --prompt "Focus on authentication, authorization and input validation"

/cubic:run-review --base main --prompt "Focus on authentication, authorization and input validation"

/cubic:run-review --base main --prompt "Focus on authentication, authorization and input validation"

Rules your team always wants checked belong in custom agents. Each one is a name and a plain-language instruction, optionally limited to some paths with glob patterns. A security rule might read "Flag SQL built by string concatenation or template strings, and ask for a parameterized query" (an example, not a built-in rule). Custom agents run in both pull request reviews and local CLI reviews. For categories to write rules about, the OWASP Top 10 lists what it calls the most critical security risks to web applications, starting with broken access control.

On the pull request, request a cubic Ultrareview, which is separate from Claude Code's ultrareview, for changes to auth, payments, migrations or concurrency:

Ultrareview is a longer, multi-pass review on cubic's most capable review models, included on paid and trial plans. It usually takes about nine minutes and counts against your reviewed-lines allowance at three times the standard rate. In Automatic mode it can start on its own when a pull request opens or is marked ready for review, from file rules such as **/migrations/** or a policy that picks out high-risk PRs.

Pull request reviews check new diffs. For code written before you had review coverage, cubic's codebase scans (in beta, available by request) look across the whole repository for hardcoded secrets, known CVEs in dependencies, infrastructure-as-code misconfigurations, authentication bypasses and injection points. The handle-codebase-scan skill lets Claude list those findings and fix the ones you choose, checking each against your current checkout before it edits.

Which models in Claude Code produced fewer counted bugs

Bug Bench's Claude Code page ranks the models used inside Claude Code by relative bug rate: counted bugs per AI-attributed line in code reviewed by cubic, divided by the rate across all AI-attributed lines in the window. A rate of 1.00 is average, and lower is better. A counted bug is a cubic review finding on AI-written code that a developer upvoted or an AI coding agent addressed. Four models are ranked there:

Statistically tied means the two models' 95% confidence intervals overlap, so neither Fable 5.1 nor Sonnet 5.5 is clearly ahead. Sonnet 5.5's rate also rests on two weeks of data, against six weeks for Fable 5.1 (Bug Bench data). Every ranked model had a rate above 1.00, and only Opus 5.5 had no tie.

Bug Bench is observational, not causal. Teams choose their models, so a rate reflects the code each model was used for as well as the model. Fable 5.1's 1.09 means 9% more counted bugs than the all-model average.

On the Anthropic API, /model sonnet selects Sonnet 5.5, /model opus selects Opus 5.5 and /model fable selects Fable 5.1 (Anthropic's model configuration docs).

FAQ

Can Claude Code review a pull request?

Yes. Pass the PR number, as in /code-review 1234, and add --comment to post the findings on the pull request as inline comments. On Team and Enterprise plans, Code Review can review pull requests automatically, and commenting @claude review starts one on demand. cubic's GitHub App reviews pull requests too, and the plugin's check-pr-comments skill brings its comments back into your session to fix.

Which model runs the local review?

By default, cubic's included model. The run-review skill runs the cubic CLI, which reviews your changes with your custom agents and learnings, while Claude Code does the fixing. To use Claude models instead, run cubic auth connect claude-code, then pick the provider and model in the CLI: opus for the most thorough review, sonnet for everyday reviews, haiku for speed. Your own Claude Code install then makes every model call, on your existing plan.

Does cubic's plugin work in Claude Code on the web?

Not as a plugin you install yourself. Cloud sessions, including claude.ai/code, don't load plugins installed on your machine or turned on in the repository's .claude/settings.json. Use the CLI headless instead: add your personal cubic API key as CUBIC_API_KEY to a cloud environment only you use, install the CLI in the setup script with CUBIC_DISABLE_GIT_AI=true npm i -g @cubic-dev-ai/cli, allow the hosts the CLI docs list under network access, and have Claude run cubic review --json, which exits with code 1 when it reports findings. Reviews with an API key require a seat on an active subscription.

Do you need a paid cubic plan?

You start with a 7-day free trial, with no credit card required. After it, you can stay on the free plan, which includes 20 AI reviews a month, or pay per active developer seat (subscription docs). The free plan doesn't include the cubic CLI, so the plugin's local reviews need a paid plan or the trial. Local reviews have separate limits, and CLI usage is unlimited during the CLI's alpha, subject to rate limits. The pricing page lists the current plans.

Does cubic review GitLab or Bitbucket merge requests?

Not yet. The pull request review supports GitHub only, and the plugin's pull request comment workflows run through the GitHub CLI.