Claude Code is good at finishing what you asked, and at finishing a few things you didn't. Its PRs are usually complete, well-described and larger than a person would write for the same task. This page is the practical version: what its output looks like, how to recognize it, a checklist tuned to its habits, and how Firetrail plugs into Claude Code so the review starts in the same terminal the code came from.
updated September 4, 2026 · every fact links to where we checked it
From reviewing a lot of them, ours included. Your mileage depends on the prompt and the CLAUDE.md.
It plans, then executes the whole plan: the feature, its tests, the types, the docs, the knowledge file. More files than the task strictly needed, and every one of them plausible.
It fixes the lint warning it noticed, renames the helper it disliked, tightens a type on the way past. Each is defensible. Together they turn one deliverable into three.
Written from the plan, not from the diff. Steps it dropped or added mid-way don't always make it in, and a change it considered routine (a timeout, a retry, a default) often goes unmentioned.
Mock-heavy tests, assertions on structure, and when a test is in the way it may weaken the test rather than fix the code. Read the tests it changed, not only the ones it added.
It follows CLAUDE.md closely. It cannot know the rules nobody wrote down: how your tenancy scoping works, which feature flag pattern is current, which table must never get a synchronous migration.
By default its commits carry a “Generated with Claude Code” line and a Co-Authored-By: Claude trailer. git log --grep='Co-Authored-By: Claude' finds them. Configurable, so treat absence as unknown.
The general method is on the AI-generated code page; this is the version tuned to Claude Code.
List every claim in the description and find it in the code. Then list everything in the code that isn't in the description. That second list is the review.
where Firetrail does this for you
Intent drift (Pro and up) does exactly this reconciliation and shows the evidence for each undisclosed change in the PR comment and the app.
If it shipped the feature plus the cleanup plus the dependency bump, that is three reviews and one revert. Ask Claude Code to split it; it's good at that when told which pieces go where.
where Firetrail does this for you
On Business, Firetrail has already written the Rework plan by the time you read the comment. In the checkout: rework PR 412 with Firetrail, or /mcp__firetrail__rework 412. Claude Code shows the plan, asks, then opens one draft PR per step.
Look for mocks of the unit under test, assertions that mirror the implementation, and any existing test it modified. A weakened assertion is the highest-value finding in most Claude Code PRs.
where Firetrail does this for you
Patch coverage estimates which added lines the PR's tests reach; the Test Relevance check asks whether the changed behavior is tested at all; Mike (QA) lists the missing cases when he is in the project's lineup.
Claude Code will happily bump a version, add an environment variable, or write a migration to make the feature work. These are the files with blast radius; read them before the feature code.
where Firetrail does this for you
Global Config Change and Package Update flag these on every plan, and Sarah (SRE) reviews deploy safety and rollback when she is in the project's lineup.
Retries added, timeouts raised, error handling that swallows exceptions, defaults changed so a test would pass. Search the diff for retry, timeout, rescue, catch, default.
where Firetrail does this for you
These usually surface as intent drift or in Bob's (backend) and Sarah's (SRE) findings.
In the checkout, ask Claude Code to explain the three riskiest hunks and why each is safe. Then check the explanation against the code. If you can't follow it, neither will the person debugging it.
where Firetrail does this for you
The PR Quiz (Pro and up) turns the top risk drivers into questions with three plausible readings; taking it is recorded on the PR.
Tenancy scoping, server-side permission checks, IDs you can change, secrets, HTML from user input. Claude Code follows the most common pattern, and the most common pattern is not always the safe one.
where Firetrail does this for you
Rick and Priya review every PR of a project that has them in its lineup, on any plan. security audit PR 412 with Firetrail runs the five checks on the PR's files and the code paths they reach, from Claude Code itself.
Firetrail runs an MCP server. Connect Claude Code to it once (create a personal token on the MCP page in the app, then run the one-line claude mcp add command it shows you) and Firetrail's analysis is available in any checkout of a connected repository.
claude mcp add firetrail --transport http https://api.firetrail.dev/mcp \ --header "Authorization: Bearer $FIRETRAIL_TOKEN"
Then, in plain English or as slash commands:
review brief for PR 412 with Firetrail (or /mcp__firetrail__review_brief 412): one page with the endpoints and their contracts, the schema diff, the change mix, intent drift with evidence, the review team's findings, coverage, the key changes per file and a wireframe of every screen. Claude Code reads the diff for the parts Firetrail can't see; Firetrail renders and hosts the page. Every plan.security audit this repository with Firetrail (or /mcp__firetrail__security_audit): Claude Code walks every route handler and deploy file for the five failures, reports only what it verified, and Firetrail renders a page that ranks what to fix first. Every plan.rework PR 412 with Firetrail (or /mcp__firetrail__rework 412): Claude Code fetches Firetrail's plan for the better version of the PR, shows it, and after you confirm opens one draft PR per step on new branches. It never touches the original branch. Business.For a team, a checked-in .mcp.json at the repository root gives everyone the server when they open the repo; each person exports their own FIRETRAIL_TOKEN, so no token lands in git. Firetrail never reads your working tree and never writes to your repository; the MCP answers with per-PR output only. Setup details are in the Firetrail MCP docs.
Both exist and both are worth knowing about. They don't do the same thing.
Claude Code Review · Anthropic
REVIEW.md; triggered on PR open, on every push, or with @claude review.claude-code-action for GitHub Actions and a local /code-review command, if you want to run the review yourself.Firetrail · change-impact intelligence
If your organization is on Claude Team or Enterprise, running Claude Code Review for the lines and Firetrail for the change is a sensible pair. If it isn't, a bot like CodeRabbit or Greptile fills the first role.
No, and it doesn't try. It scores the change the same way for every author. If you need to know, Claude Code's default commit trailer is the reliable signal; teams can disable it.
Yes. Firetrail is an MCP server; connect it once with a personal token and ask in plain English for a Review Brief, a Security Audit or a Rework plan of any analyzed PR. The slash commands /mcp__firetrail__review_brief, /mcp__firetrail__security_audit and /mcp__firetrail__rework are Claude Code's names for the same three things.
No. Claude Code Review is Anthropic's managed line-level reviewer with a verification step, available on Claude Team and Enterprise. Firetrail's review team is ten named personas that each judge the whole change and land on a verdict. One finds bugs on lines; the other says whether the PR is a good change.
It's useful as a first pass, and cheap. But it shares the blind spots of the model that wrote the code, which is exactly why Anthropic's product adds verification and why a different reviewer, human or tool, is worth having on the merge decision.
No. The MCP answers with per-PR output (plans, findings, evidence, the brief). Claude Code reads your checkout, on your account, and hands Firetrail only what a brief or audit needs. Firetrail never reads your working tree and never writes to your repository.
A brief or audit on a PR that's already analyzed costs nothing extra. If the PR hasn't been analyzed, or has new commits since, Firetrail analyzes it first and that counts like any other PR on your plan. The work Claude Code does locally runs on your own subscription.
Two minutes to set up. Then “review brief for PR 412 with Firetrail” and you'll understand the whole PR before you open GitHub.