Read every pull request yourself.

Read only the ones that need you.

CC Auto Review is a macOS app that reviews GitHub pull requests with the Claude Code you already have. Findings sit beside the diff, every PR gets a risk score from 0 to 100, and you decide what gets posted.

Download for Apple siliconM1 and later, DMG Download for IntelDMG

Latest release, macOS 11 or later. Signed and notarized. Free and open source (MIT).

What CC Auto Review does, in 37 seconds. Screens use sample data.

@@ how a review runs @@

One pull request, from open to posted.

Open the PR. It already has a score.

Size, spread, sensitive paths, risky patterns and test gaps are counted from the diff alone. The same diff always gets the same number, and nothing written in the PR description can lower it.
Claude reads only what changed.

The changed files go into a temporary directory. There is no clone and no API key to set up. When Claude needs a caller or a type from elsewhere, a read-only helper fetches it from this PR's commits.
Findings land on the lines they are about.

A blocker or should has to state how the problem happens and what goes wrong. If it can't, it is downgraded to a question.
The score moves, with citations.

Claude can move the score by up to 20 points either way, citing file:line. A verified serious problem is an escalation, which raises it to at least 60. The server does the arithmetic.
You accept, reject or edit each one.

Nothing is posted yet. Ask Claude about a finding, or have it explain the code, and add what you find together to the draft.
Post it from your own account.

The PR head is checked again first. If it moved since the review, nothing is posted. Findings are translated right before posting when you post in another language.

Add coupon codes to checkoutacme/storefront #482 / sample data

42MEDIUM, from the diff

src/checkout/coupon.ts

18+export function applyCoupon(c: Coupon, total: number) {

19+ return c.kind === "percent" ? total * c.rate : c.value;

20+}

21+export async function findCoupon(db: Db, code: string) {

22+ const rows = await db.query(`SELECT * FROM coupons WHERE code = '${code}'`);

blocker

SQL injection through the coupon code

When it happens: A customer enters x' OR '1'='1 as the code.
Impact: Any coupon in the table is returned and applied.

AcceptRejectEdit

23+ return rows[0] ?? null;

24+}

AI has not run yet Post to GitHub

@@ risk score @@

Try the score on a real pull request.

Paste any public PR. This is the baseline scoring code from the app, running in your browser. The diff comes straight from GitHub's public API and goes nowhere else.

Or try a sample:

Paste a diff instead

This is the baseline, before any AI runs. In the app, Claude then adjusts it by up to ±20 and can escalate. A score is a way to decide who reads a PR first. It does not tell you the code is correct.

@@ autopilot, optional @@

Let it clear the queue. It keeps the risky ones for you.

Turn it on and the app works through your review requests on an interval: it approves or comments, waits for the author, and reviews again. Anything risky comes back to you with nothing posted.

5 review requests

acme/mobile-app #231Fix a typo in onboarding copyScore 4, no findings Approved
acme/storefront #474Cache product imagesScore 18, 2 findings, waiting for the author Commented
acme/infra #77Change the deploy workflowCI path rule. AI never called, nothing posted For you
acme/api #309Paginate order historyScore 27, 1 finding, waiting for the author Commented
acme/storefront #482Add coupon codes to checkoutScore 60, escalated, nothing posted For you

Sample data.

What comes back to you

Paths you list: CI, migrations, infra, secrets, auth, billing and crypto by default. These skip the AI entirely.
More than 1,000 changed lines. Lock files and dist/ don't count.
A risk score above 50, or any escalation.
Anything matching criteria you write in plain language, such as “breaking API changes”.
Still unresolved after 3 comment rounds.

Autopilot runs only while the app is open. Reviews it posts come from your GitHub account and say they are automated. It runs Claude Code automatically, so check Anthropic's terms before turning it on, or use an API key.

@@ what claude can touch @@

A pull request can't change the rules it's reviewed by.

Text in a PR can be written to steer a reviewer, so every review runs inside a short list of permissions.

+readthe PR's changed files and diff, in a temporary directory
+readCLAUDE.md, AGENTS.md and REVIEW.md, from the base branch
+fetchother files through remote-read: GET only, pinned to this PR's repository and commits
+writeone result file
−readanything else on your Mac
−rungit, arbitrary gh commands, other shell commands
−load.claude/, .mcp.json and CLAUDE.local.md from the PR
−sendusage data. The app has no telemetry

What this doesn't cover

Allow rules in your own Claude Code settings and a profile's extra tools still apply, so keep them narrow. PR text can still try to influence the review itself, so read what the app posts.

Where your code goes

The app talks to GitHub through gh and to Claude through claude, as you have them configured. Its server listens on 127.0.0.1 and only accepts requests carrying a token made at launch.

@@ also in the app @@

The rest of what it does.

Review profiles
Set perspectives, team guidelines, things not to report and a finding limit. Ships with Standard, Security focused and Quick. Preview shows exactly what Claude receives.
Earlier comments re-checked
Prior review comments are marked fixed, unfixed or unverified against the current code. An author saying “fixed it” doesn't count as evidence.
Your repository's conventions
Your CLAUDE.md, AGENTS.md and REVIEW.md are read, always from the base branch.
Watch a PR
When the author pushes or replies, the review runs again. Nothing is re-posted without you.
Profile routing
Use a different profile by repository, label or mention, such as @org/security.
A small native app
About 12 MB per CPU. Desktop notifications, and an English and Japanese interface.

@@ questions @@

Questions.

Do I need an API key?

No setup in the app. It runs your installed claude as you have configured it and stores no Claude credentials. GitHub access goes through your gh login.

What does it cost?

The app is free and MIT licensed. Reviews use your Claude Code plan or API account, and the review screen shows your usage.

Does it post anything without asking?

Not unless you turn on the autopilot. In a normal review, nothing reaches GitHub until you press post.

Do I need to clone my repositories?

No. Only the PR's changed files are fetched, into a temporary directory.

Does the autopilot keep running in the background?

No. It runs only while the app window is open.

Can I use it on Windows or Linux?

Not today. It is macOS only.

@@ download @@

Get CC Auto Review.

Download for Apple siliconM1 and later, DMG Download for IntelDMG

Latest release. All releases.

Open the DMG

Drag the app to Applications. It is signed with a Developer ID and notarized by Apple, and needs macOS 11 or later.

Install GitHub CLI

Get gh, then sign in with gh auth login.

Install Claude Code

Get Claude Code 2.1.314 or later. Older versions are refused because they cannot restrict file access.

Build from source

git clone https://github.com/karamage/cc-auto-review.git
cd cc-auto-review
bun install
bun run app:build   # src-tauri/target/release/bundle/macos/

Read only the ones that need you.

One pull request, from open to posted.

Open the PR. It already has a score.

Claude reads only what changed.

Findings land on the lines they are about.

The score moves, with citations.

You accept, reject or edit each one.

Post it from your own account.

Try the score on a real pull request.

Let it clear the queue. It keeps the risky ones for you.

What comes back to you

A pull request can't change the rules it's reviewed by.

What this doesn't cover

Where your code goes

The rest of what it does.

Review profiles

Earlier comments re-checked

Your repository's conventions

Watch a PR

Profile routing

A small native app

Questions.

Get CC Auto Review.

Open the DMG

Install GitHub CLI

Install Claude Code