Code review with Claude Code

With CodePanel, Claude Code is the agent on the other side of the review. It pushes, waits for the panel's review of that commit over MCP, fixes or disputes each finding with evidence, rates every one, and stops when nextAction is done. Setup is in Claude Code. This page covers the loop itself and the Claude Code settings that hold it in place.

CodePanel's own repository runs on this loop, and the examples below come from its pull requests. How it went on 112 of them is in Agentic code review.

How Claude gets the review

The plugin's codepanel skill drives the loop. Each push is reviewed 60 seconds after it lands, so Claude does not trigger a review. It waits for the commit it pushed:

wait_for_review  repo: owner/name  pr: 123  headSha: <git rev-parse HEAD>

Without headSha, the wait can return the previous commit's review, and Claude fixes findings already fixed. A wait that runs out returns status: timeout, and Claude calls again. In Claude Code the call itself can also fail first, with "The operation timed out": Claude Code's docs give each request to an HTTP MCP server a 60-second limit by default, and the wait's own default is ten minutes. On CodePanel's PR 187 in October 2026, every wait set to 60 seconds or more failed that way (60, 90, 120 and 240) when the review outlasted it, while waits set to 45 returned status: timeout as designed. That is one pull request, and the limit may differ by Claude Code version. So have Claude pass timeoutSeconds: 45, and call again on timeout or a failed call, stopping to report after 5 in a row.

Then get_review returns the review as data, and Claude acts on payload.nextAction rather than the comment's prose. The actions are listed in The review loop. Line numbers refer to payload.reviewedSha, the commit that was reviewed, not the one just pushed.

Fixing and disputing

The skill has Claude open each finding's line at the reviewed commit and decide whether it is true before touching code. Real problems are fixed and pushed. A finding the code contradicts is disputed with evidence, as on PR 177:

/feedback F3 down false-positive tools/eval/disputes.ts reads --concurrency through whole("concurrency", 4) --agent claude-code

The orchestrator read the code and withdrew it: "tools/eval/disputes.ts line 186 passes whole("concurrency", DEFAULT_CONCURRENCY) to runCases".

Disputes also go against Claude. On PR 99, which added a provider whose model list comes in pages, a reviewer found that the list stopped at 20 pages and still reported success. Claude called it not worth fixing:

/feedback F3 down not-worth-fixing collectModelPages and its 20-page cap predate this PR and apply to every provider; 20 pages of 100 is far above Workers AI's ~100 text models, and failing key validation outright at the cap would be worse for users than a long list --agent claude-code

The orchestrator upheld it: "The loop at line 53 exits at 20 pages with a next URL still pending and returns ok:true (lines 62-63), so a truncated list is returned as complete." Claude fixed it and rated again, which replaces the earlier rating:

/feedback F3 up fixed collectModelPages now returns an error when MAX_MODEL_PAGES is reached with a next page still pending, so a truncated list is never cached; its test asserts the failure --agent claude-code

When unsure, ask_reviewer costs less than a wrong fix or a wrong dispute, and a concession withdraws the finding.

Rating and stopping

Claude gives one rating per finding, with a reason, always under one agent name. rate_finding takes up to 50 at once. Pass agent: "claude-code" to it as well: without one it falls back to the MCP client's own name, which may not match the name on Claude's /feedback lines. Claude Code often posts through your own GitHub login with gh pr comment. Then each /feedback line needs --agent claude-code, because without it the rating counts as yours, and your rebuttal closes the finding with no check.

At done, Claude calls set_review_rounds with stop, so a later push, such as a merge of the base branch, starts no round.

What sets the number of rounds, and what ends a loop, is in Agentic code review. The docs suggest a cap of 2 or 3 automatic rounds.

Settings that hold the loop in place

The skill tells Claude what to do. Four settings stop it from skipping a step.

Scopes. When Claude Code opens CodePanel's consent page from /mcp, untick repos:write, panel:write and budget:write, so the session holds only read and reviews:write. Agentic code review says why.

Permissions. Allow the CodePanel tools so the loop never waits on a prompt, and deny commands that bypass the gate or rewrite what was reviewed. The plugin's tools are named mcp__plugin_codepanel_codepanel__*; a server added with claude mcp add as codepanel gives mcp__codepanel__*. The deny lines are from CodePanel's own settings. They match the command's text, so they stop the usual spellings, not every route. The required check below is what enforces the gate:

{
  "permissions": {
    "allow": ["mcp__plugin_codepanel_codepanel", "mcp__codepanel"],
    "deny": [
      "Bash(gh pr merge*--admin*)",
      "Bash(git push --force*)",
      "Bash(git push * --force*)",
      "Bash(git push -f*)",
      "Bash(git push * -f*)",
      "Bash(git push +*)",
      "Bash(git push * +*)",
      "Bash(git * push * --force*)",
      "Bash(git * push * -f*)",
      "Bash(git * push * +*)"
    ]
  }
}

A Stop hook. Pull requests stall when Claude ends its turn while the review is still running, since nothing brings the session back. A Stop hook that reads the CodePanel status on the current commit sends Claude back once with the next step (Claude Code hooks for code review).

The required check. Require the CodePanel status in the branch ruleset and turn on auto-merge. GitHub merges once every finding at or above the gate level is answered and CI passes, whether or not Claude is still running (Merge gate).

Claude Code in GitHub Actions

CodePanel is a GitHub App, so reviewing needs no workflow. Two cases involve Actions:

• Claude opens pull requests from a workflow. Pull requests by bot accounts are not reviewed automatically, and a bot's /review is ignored. Have the workflow call trigger_review after each push, on a token with read and reviews:write from the CodePanel account that connected the repository, then wait as above: wait_for_review with headSha and timeoutSeconds: 45. Later pushes to a bot's pull request are skipped too.
• The gate as a workflow. Merge gate has one that fails while gate.blocking is true.

Run it on a pull request

In a Claude Code session on a branch with an open pull request, give Claude this:

Run the CodePanel review loop on this branch's pull request. Wait for the
review of `git rev-parse HEAD` with timeoutSeconds 45, calling again on
timeout or failure, and stopping to report after 5 such calls in a row.
Then fix each real finding, dispute a wrong one with file:line evidence,
and rate every finding as claude-code, until get_review's nextAction is
done. Then stop the rounds and list what you fixed and what you disputed.

Claude Code features for the review loop

Each row was checked on 2026-10-17 against the maker's docs it cites. A feature with no row is one those docs don't describe.