Security review for the pull requests Claude Code work becomes.
Claude Code writes the change in your terminal, and the pull request it becomes can open without the agent's name on it. Aevral, the AI security reviewer for GitHub pull requests, reviews the diff within your plan's allowance and gives you a copy-paste fix prompt with each finding.
In plain words
Picture a colleague who writes code at the desk next to yours: you watch the files change, you run the tests, and nothing ships until you say so. That is the default shape of Claude Code, Anthropic's coding agent in your terminal. The same tool can also work away from your desk: a cloud run that pushes a branch for you to review, or a GitHub Action that answers @claude in a pull request comment. This page is about the pull request that Claude Code work becomes, and who reads it for security before it merges.
How Claude Code work reaches a pull request
From Anthropic's own documentation. Each line is in our words, with the quote it rests on underneath.
Claude Code reads your codebase, edits files, and runs commands as an agentic coding tool.
“Claude Code is an agentic coding tool that reads your codebase, edits files, runs commands, and integrates with your development tools. Available in your terminal, IDE, desktop app, and browser.”
It runs on several surfaces: the terminal, IDE extensions, a desktop app, and the web.
“Claude Code runs on several surfaces: the terminal, IDE extensions, a desktop app, and the web.”
The terminal is the full-featured CLI: Claude Code works directly in your terminal, where it edits files, runs commands, and manages your project from the command line.
“The full-featured CLI for working with Claude Code directly in your terminal. Edit files, run commands, and manage your entire project from the command line.”
The Claude Code GitHub Action runs Claude Code inside your repository's workflows; mention @claude in a pull request or issue comment and Claude analyzes the code, implements changes, and pushes commits.
“Claude Code GitHub Actions is a GitHub Action that runs Claude Code inside your repository's workflows. Mention @claude in a pull request or issue comment to have Claude analyze code, implement changes, and push commits.”
In interactive mode the workflow waits for the mention: Claude waits for the trigger phrase, @claude by default, in an issue or pull request comment, then responds to that request.
“when the workflow provides no prompt input, Claude waits for the trigger phrase, @claude by default, in an issue or pull request comment, in a pull request review, or in the body or title of a newly opened issue, then responds to that request”
A cloud session is a Claude Code session that runs on cloud infrastructure instead of on your machine.
“A cloud session is a Claude Code session that runs on cloud infrastructure instead of on your machine.”
Claude Code docs, Claude Code in the cloud (cloud sessions), read
When a cloud task reaches a stopping point, Claude pushes its branch to GitHub: you review the diff, leave inline comments, create a PR, or send another message to keep going.
“when Claude reaches a stopping point, it pushes its branch to GitHub. You review the diff, leave inline comments, create a PR, or send another message to keep going”
Pushing the branch does not end the task: PR creation and further edits happen within the same conversation.
“The session doesn't close when the branch is pushed. PR creation and further edits all happen within the same conversation.”
Claude Code docs, web quickstart (the conversation continues), read
Claude Code's own security tooling is not this page
Code Review is Claude's managed pull-request review: findings arrive as inline comments on the lines concerned, ranked by severity, with a summary and a check run on the pull request.
“Findings arrive as inline comments on the lines concerned, ranked by”
Claude Code also has a /security-review command that runs a single pass over your branch.
“/security-review runs a single pass over your branch, and Code Review reviews pull requests.”
Claude Code docs, the Claude Security plugin (other security tools), read
The Claude Security plugin scans your codebase for vulnerabilities in a Claude Code session and turns findings into changes you review and apply.
“Install the Claude Security plugin to scan your codebase for vulnerabilities in a Claude Code session and turn findings into patches you review and apply.”
There is also a hosted Claude Security product, available on the Enterprise plan.
“see the Claude Security product, available on the Enterprise plan”
Claude Code docs, the Claude Security plugin (the hosted product), read
Why it matters: the pull request may not say Claude wrote it
Most Claude Code work never becomes an agent pull request: the default loop runs in your terminal, Claude edits files and runs commands there, and a human reviews, commits, pushes and opens the pull request.
GitHub sees a pull request from your team, with nothing marking the code as agent-written. A policy that reviews only the pull requests an agent opened has nothing to review on those repositories.
Aevral reads the diff the same way either way: it reviews a pull request when it is opened or reopened and when new commits are pushed, within your plan's review allowance, looking for access control, business logic and injection problems among its classes.
When the work does arrive from Claude itself, the pull request is not frozen when it opens.
A cloud session pushes a branch and the pull request continues in the same conversation: the docs describe Claude watching the pull request and automatically responding to CI failures and review comments, which requires the Claude GitHub App on your repository.
The diff under review can therefore change after the review runs, and a new push can change what an endpoint allows.
Aevral reviews a pull request when it is opened or reopened and when new commits are pushed, within your plan's review allowance, looking for access control, business logic and injection problems among its classes.
What the vendor's docs say
Claude clones the repository into an isolated virtual machine, makes changes, and pushes a branch for you to review.
“Claude clones the GitHub repository you select into an isolated virtual machine, makes changes, and pushes a branch for you to review.”
Claude can watch a pull request after it opens and automatically respond to CI failures and review comments; the docs tie that watch to the Claude GitHub App being installed on your repository.
“Claude can watch a pull request and automatically respond to CI failures and review comments. Claude subscribes to GitHub activity on the PR, and when a check fails or a reviewer leaves a comment, Claude investigates and pushes a fix if one is clear. Auto-fix requires the Claude GitHub App to be installed on your repository.”
Claude Code docs, Claude Code in the cloud (Auto-fix pull requests), read
Where Aevral fits: a copy-paste handoff
Aevral reviews a Claude Code pull request like any other pull request on a repository where the Aevral GitHub App is installed: when it is opened or reopened and when new commits are pushed, within your plan's review allowance.
A finding is an inline comment on the added line, next to an advisory Check that never blocks the pull request.
Each finding carries a Fix with your agent prompt.
A human copies the prompt and gives it to Claude Code, in the terminal where you already run it, or, where the repository runs the Claude Code GitHub Action, as a pull request comment that mentions @claude.
Whatever Claude pushes in response is reviewed again when it reaches the pull request, and your repository's own review and merge rules decide what ships.
After setup, test the Claude Code GitHub Action by tagging @claude in an issue or PR comment.
“After setup, test the Claude Code GitHub Action by tagging @claude in an issue or PR comment.”
How the prompt is built and how to use it well: handing a finding to your coding agent.
Setup, the two human clicks
Two clicks, both yours: install the GitHub App, then log in to the console with GitHub. An agent cannot install the App or finish the login for you; it can read this page and the agent-setup prompt instead.
- Install the GitHub App: https://github.com/apps/aevral
- Log in to the console: https://app.aevral.com/login
- Official agent-setup prompt: https://docs.aevral.com/agent-setup/prompt.md
What this page does not claim
- Aevral is not affiliated with, endorsed by, or a partner of the company behind Claude Code. There is no integration between the two products: Aevral does not call Claude Code, and Claude Code does not call Aevral.
- Aevral never commits, pushes, applies or merges a change. The Fix with your agent prompt is text a human copies; what the agent does with it goes through your repository's own review and merge rules.
- PR review looks for a list of classes on the diff and leaves at most five findings per review. A finding is a lead with evidence, not a verdict, and a quiet review is not proof that the code is safe.
- The boxed statements about Claude Code come from the vendor's own documentation, each with the quote it rests on and the date it was read. The paragraphs around them are Aevral's reading of what those facts mean for a security review. Vendor products change; the vendor's docs win over this page.
- This page does not say Claude Code always opens the pull request: in the terminal loop, the pull request is the human's, and GitHub does not mark the code as agent-written.
- Aevral does not start Claude Code runs, install the Claude Code GitHub Action, or reply to @claude on anyone's behalf.
Sources
- https://code.claude.com/docs/en/overview, read
- https://code.claude.com/docs/en/github-actions, read
- https://code.claude.com/docs/en/claude-code-on-the-web, read
- https://code.claude.com/docs/en/web-quickstart, read
- https://code.claude.com/docs/en/code-review, read
- https://code.claude.com/docs/en/claude-security, read
Read next