CodeRabbit vs Claude Code: Honest 2026 Comparison

Compare CodeRabbit vs Claude Code across 14 dimensions, from $24/mo seats to roughly $0.36 per pull request in tokens. Seven documented failure modes below trace to vendor docs. Last verified 19 August 2026; re-check pricing and changelog claims against vendor pages before you buy.

The 60-second verdict on CodeRabbit vs Claude Code

These two tools do not compete for the same slot. CodeRabbit is a repo-side quality gate that runs when a pull request opens, with nobody at the keyboard. Claude Code is a developer-side agent that reviews while a human or another agent is still in the session. Most teams are not choosing between them. They are deciding whether the second one earns its cost on top of the first.

Pick CodeRabbit when review must happen unattended: PR opens, the bot posts inline comments, branch protection can block the merge. CodeRabbit states it installs on GitHub, GitLab, Bitbucket and Azure DevOps repos (vendor claim).

Pick Claude Code when review happens before a PR exists. The developer asks for a review of uncommitted work and applies fixes in the same session. The /ultrareview command can fetch a GitHub PR without cloning it, but a third-party analysis reports it posts no inline comments and triggers no automation (Hightower, Medium).

Cost anchor: CodeRabbit is free for open source, roughly $12/mo per developer on Lite and $24/mo per developer on Pro. Claude Code review draws on the Anthropic subscription or API budget the developer already has (aistack.sh snapshot; verify against vendor pricing pages).

The trap: a review nobody reads is worth zero. One Hacker News operator describes their agent missing actionable comments “buried among 15 CodeRabbit suggestions” (HN 46656759).

What each tool actually is, and why the category label is wrong

The aggregator sitting at #9 for this query files Claude under “LLMs” and CodeRabbit under “Coding agents”, then compares them on price (aistack.sh). Most CodeRabbit vs Claude Code writing repeats that error: a $20/mo chat subscription is not the comparable unit for a per-seat review bot.

The honest axis is who is in the loop when the review runs.

The repo loop is event-triggered. A push or PR fires it, no human is present, and the output has to be durable and addressable: a comment anchored to a line, in a thread that survives a force-push, attached to a merge decision someone can audit later. The workstation loop is triggered by a person or an agent at a terminal, in an editor like VS Code or a JetBrains IDE. Output is ephemeral, immediately actionable, and dies with the scrollback.

That distinction determines whether findings can block a merge, whether they leave an audit trail, whether cost scales with seats or tokens, and who is on the hook for acting on a finding.

Both ends are converging. CodeRabbit shipped a CLI and an official Claude Code plugin (docs); Anthropic shipped PR-fetching review inside the CLI. That is why this search query exists.

CodeRabbit: what it does, in specifics

CodeRabbit launched publicly on Hacker News in July 2023 offering line-by-line, context-aware feedback (Show HN 36663669). The PR bot is still the core product. What changed is that it now reaches into the terminal.

The CLI exposes three review modes, per CodeRabbit’s integration docs:

• coderabbit review for human-readable terminal output
• --agent for structured output designed for agent integrations to consume
• --light for a lighter local pass during active development

Scope controls materially change what comes back. CodeRabbit analyses tracked changes by default, so brand-new untracked files are invisible unless you pass --include-untracked. The default base branch is main; teams on a develop or master trunk must pass --base or review against a nonsense diff. There are separate uncommitted and committed modes (docs).

Context injection is the underrated feature. coderabbit review -c CLAUDE.md passes the same standards file Claude Code reads, so both reviewers grade against one written spec instead of two implicit ones.

Platform direction tells you where the vendor thinks the pain now is. On 13 August 2026 CodeRabbit shipped Triage, a cross-repository queue that recommends which PR to review next and which to close, framed explicitly around agent-generated pull requests (changelog). The bottleneck is no longer “review this diff.” It is “which of these 40 machine-authored diffs deserves a human at all.”

CodeRabbit states it has more than 17,000 customers and has raised $143 million, including a $16 million Series A in August 2024 and a $60 million Series B a year later (company blog). Vendor-stated figures. Neither says anything about review quality.

Claude Code: four different things people mean by “Claude Code review”

“Claude Code review” names at least four workflows with different outputs, costs and independence properties.

Mode	Trigger	Output surface	Posts PR comments?	Cost basis
In-session review	You ask the agent to review the diff it just wrote	Terminal, same session	No	Session tokens
/review, /security-review	Slash command against a working diff	Terminal	No	Session tokens
/ultrareview	Slash command; can fetch a GitHub PR without cloning	Terminal	Reported: no inline comments, no automation hooks [third-party]	Not publicly documented
GitHub Action / @claude mention	CI event or PR mention	The pull request itself	Yes	API tokens per run

/ultrareview characterisation from Hightower’s Medium analysis, which reports it as cloud-backed parallel multi-agent review shipped in v2.1.111. Which models the parallel agents dispatch is not publicly specified. Check Anthropic’s release notes for current behaviour.

In-session review is the cheapest and the least independent. The same model that made the mistake is grading the work.

The CI-triggered GitHub Action, built on Anthropic’s claude-code-action runner, is the only Claude Code mode that genuinely competes with CodeRabbit’s loop. It is also the mode every comparison page skips, which is how you get articles claiming Claude Code cannot comment on PRs at all. Any benchmark claim is close to meaningless unless the writer names which of the four ran.

CodeRabbit vs Claude Code head-to-head across 14 dimensions

Every cell is tagged by evidence type. CodeRabbit cells come from docs.coderabbit.ai or the company blog. Nothing is filled from a competitor’s comparison page.

Dimension	CodeRabbit	Claude Code
Trigger model	PR/push event, or CLI invocation [docs]	Human or agent in session; CI event via GitHub Action [docs]
Runs with no human present	Yes [docs]	Only via GitHub Action / @claude [docs]
Inline PR comments	Yes, line-anchored threads [docs]	GitHub Action path only; /ultrareview reportedly not [practitioner report]
Merge blocking	Yes, via branch protection on the check [docs]	Only if the Action is wired to a required check [docs]
Monorepo / multi-repo	Triage adds a cross-repo queue, shipped 13 Aug 2026 [docs]	Repo-scoped to the working directory [docs]
VCS support	GitHub, GitLab, Bitbucket, Azure DevOps [vendor claim]	GitHub-native for the Action; CLI is VCS-agnostic locally [docs]
Latency	7 to 30+ minutes depending on scope [docs]	Not publicly documented; /ultrareview reported as optimised for quick reviews [practitioner report]
Applies fixes	Suggests; agent applies via --agent handoff [docs]	Yes, edits files directly in session [docs]
Cost basis	Per developer seat, flat [vendor pricing]	Tokens consumed, variable [vendor pricing]
Free tier	Free for open source [vendor claim]	Included in Pro/Max subscription limits; API billed per token [vendor pricing]
Config file	.coderabbit.yaml; accepts -c CLAUDE.md [docs]	CLAUDE.md [docs]
Data handling	Third-party service with repo-wide VCS app permissions [docs]; retention specifics not publicly documented in the integration docs	Local process under the developer’s own credentials [docs]
Agent-consumable output	Yes, --agent structured mode [docs]	Native; it is the agent
Audit trail	Durable in the PR thread [docs]	Terminal scrollback unless the Action posts to the PR [docs]
Who is accountable for a finding	The PR author, via a thread that stays open until resolved	Whoever is at the terminal right now

That last row is the one no other page has, and it is the row that decides procurement.

Review depth and the false-positive tax

First, the disclosure: no controlled benchmark was run for this article. No seeded-bug corpus, no blind grading, no measured catch rate. What follows is documented behaviour, structural reasoning and sourced operator commentary. A protocol you can run yourself is at the end.

The failure mode that kills adoption is not missed bugs. It is noise. As one commenter put it: “It’s very easy to build a basic code review tool. It’s hard to build one that developers won’t ask you to turn off because of false positives” (HN 48407573).

Signal dilution hits agent-driven workflows harder than human ones. The operator at HN 46656759 describes an agent that would “miss actionable comments buried among 15 CodeRabbit suggestions” and “declare victory while threads were still unresolved.” A human skims 15 comments and instinctively discounts twelve. An agent polling CI in a loop has no such instinct. It cannot triage by vibes.

The counter-evidence deserves equal weight. “We use CodeRabbit at work, which catches good stuff,” reads one reply in an Ask HN thread on whether humans still review code (HN 49299798). Another operator reports mixed feelings, worried that people treat the tool as a substitute for judgement rather than an input to it (HN 49348963).

The structural difference is straightforward. A diff-scoped reviewer sees the changed lines plus whatever context it retrieves. An agent with repo access can open arbitrary files, follow a call chain, and run the test suite. Genuine advantage, available only if the operator grants those permissions and pays for the tokens and CI minutes it burns.

Set against that: correlated blind spots. When the same model writes the code and grades it, the errors it is disposed to make are the errors it is disposed to miss. That is the strongest argument for keeping a second, differently-configured reviewer in the loop, whichever vendor you pick, and it is absent from the current top 10.

One number circulating on this SERP: “>99% bug detection accuracy (less than 1% false positives),” published at valuestreamai.com. No methodology, no dataset, no sample size, published by a firm selling $15k - $120k+ custom agent builds. The same page lists “Anthropic Claude 5 (Fennec)” and “DeepSeek V4 Pro” in its technical stack and misspells the product as “Clause Code Review.” Treat it as marketing for a third product.

Documented failure modes

Every row traces to a primary source. Re-check against the CodeRabbit changelog before relying on it.

Symptom	Documented cause	Fix	Source
Review finds nothing on a brand-new file	Tracked changes are analysed by default	Pass --include-untracked	docs
Review flags the whole branch as changed	Default base is main; trunk is develop/master	Pass --base develop	docs
Review appears to hang	Runs documented at 7 to 30+ minutes depending on scope	Review smaller changesets; use --light or uncommitted scope	docs
YAML, Terraform and docs go unreviewed	Product “focuses on code files, not docs or configuration”	Cover config with dedicated linters/policy checks	docs
Claude Code doesn’t act on findings	Handoff fragility between the two tools	Four documented remedies: say “fix the issues found by CodeRabbit” explicitly; wait for review completion; ask “show me the CodeRabbit findings”; iterate one issue at a time	docs
/coderabbit:review not recognised	Marketplace not added or plugin not installed	Add the marketplace, install the plugin	docs
Review fails with an auth error	coderabbit auth status failing, or CLI not on PATH inside Claude Code’s environment	Re-authenticate; confirm PATH in the agent’s environment	docs

Two deserve emphasis. The 7-to-30-minute range is CodeRabbit’s own figure with its own mitigation, which makes large-PR review a known weak spot rather than bad luck. And the docs-and-config exclusion bites hard if your production incidents come from a misindented Helm chart or a Kubernetes manifest, as many do.

A caution for anyone planning to replace the bot with a local script: “the whole idea of e.g. CodeRabbit is that it allows to review PRs autonomously. making it local defeats the purpose” (HN 49346133). If unattended review was the reason you bought, moving it to the workstation removes the reason.

Security and data handling

Any PR-triggered LLM reviewer has the same structural exposure: untrusted content from a fork’s diff reaches a model holding repo-scoped credentials. That is a property of the category, not an accusation against a vendor. Prompt injection through a pull request body or a source comment is the obvious vector, and it maps to OWASP LLM Top 10 entry LLM01.

A commenter names Kudelski Security’s published research on exploiting CodeRabbit as the specific reason they stopped using it (HN 48407573). This article summarises that citation rather than the underlying research. Read Kudelski’s write-up and CodeRabbit’s response before drawing conclusions about the attack class or its remediation status.

The trust boundaries differ in kind, not in severity:

• CodeRabbit is a third party holding a VCS app installation with repo-wide read and comment-write permissions across your org.
• Claude Code runs on a developer’s machine with whatever local credentials, SSH keys and network access that machine already has.

Different risk. Not less risk. A compromised local agent has your ~/.aws directory; a compromised review app has your source.

On procurement: CodeRabbit states that Anthropic customers can apply existing spend commitment toward CodeRabbit through the Claude Marketplace (vendor claim). That changes purchasing friction and nothing about data handling.

The one ranking page that raises security answers “is my code safe?” with “Yes. We offer On-Premise and Private Cloud deployments” (valuestreamai), a pitch for a third product in response to a question about two others.

SOC 2 Type II status, GDPR posture, retention windows and training-use policies change. Read them from each vendor’s current trust page, not from any comparison article, this one included.

The real cost model

Derived from published list pricing. Assumptions stated. Not measured spend. Starting inputs come from the aistack.sh snapshot dated 2026-05-05; re-verify against coderabbit.ai/pricing and anthropic.com/pricing before you budget:

• CodeRabbit: free for OSS, ~$12/mo per dev (Lite), ~$24/mo per dev (Pro)
• Claude Pro: $20/mo; Claude Max: $100/mo and $200/mo
• Claude Sonnet 4.5 API: $3 per million input tokens, $15 per million output
• Claude Opus 4.5 API: $5 per million input tokens, $25 per million output

The $24 seat figure is corroborated from the other direction. A developer building an alternative cites “$24/mo per seat” as precisely the cost he was trying to avoid (HN 47271100).

Token assumptions, stated openly so you can substitute your own: a moderate PR review consuming 60,000 input tokens and producing 4,000 output tokens costs $0.18 + $0.06 = $0.24 per pass at Sonnet 4.5 list rates. Assume 1.5 passes per PR including one re-review: ~$0.36 per PR.

Team	PRs/dev/mo	PRs/mo	CodeRabbit Pro (seats)	Agent review (tokens, derived)
5 devs	4	20	$120	~$7
5 devs	15	75	$120	~$27
20 devs	8	160	$480	~$58
60 devs	8	480	$1,440	~$173
60 devs	15	900	$1,440	~$324

Seat pricing is volume-insensitive. Token pricing is volume-linear. At these assumptions the CodeRabbit vs Claude Code cost comparison favours tokens in every scenario, and the crossover arrives only when per-PR token cost climbs: bigger diffs, deeper repo exploration, multi-agent passes, Opus 4.5 instead of Sonnet 4.5. Quadruple the per-PR figure to $1.44 and the 60-dev, 15-PR case lands near $1,300, level with seats.

That is the honest shape of it. CodeRabbit’s cost is predictable and agent review’s is not. A team that lets agents read the whole repo on every review can burn a seat-price equivalent without noticing. Prompt caching at $0.30 per million cached-read tokens cuts the repeated-context portion by 90%, which matters when the same 40,000-token repo map reloads on every pass.

Now the debunk. The valuestreamai page prices “Claude Code Review” at “$15 to $25 per PR” with no derivation (source). Run the arithmetic at published Sonnet rates. Spending $15 on one review needs roughly 5 million input tokens: a 200,000-token context window filled 25 times over, on a single pull request. The figure measures nothing.

Two costs no page prices at all: reviewer-minutes spent triaging false positives, the largest real expense in a noisy setup, and GitHub Actions wall-clock on those 7-to-30-minute runs, billed at $0.008 per Linux minute above the free allotment. Teams on Jenkins or CircleCI pay the same wall-clock somewhere else.

Speed, latency and where the wait actually hurts

CodeRabbit documents reviews taking 7 to 30+ minutes depending on scope (docs). That range is fine in the repo loop. The PR is open, the author has moved to the next ticket, and a comment arriving 20 minutes later costs nothing.

In the workstation loop it is brutal. The developer is blocked or context-switching, and an agent sits in a polling loop burning tokens on “is it done yet.”

/ultrareview is reported as parallel multi-agent review with zero setup, optimised for quick turnaround (Hightower). No published latency figure exists to compare against CodeRabbit’s.

CodeRabbit’s own mitigations: use --light during active development, scope to uncommitted changes, split large features into smaller branches, and set the correct --base. The anti-pattern is putting a 30-minute review on the blocking path for a one-line change. Tier by diff size instead: --light under 50 changed lines, full review above it, and a required check only on branches touching auth, payments or migrations.

Team workflow: comments, blocking, ownership and queues

Inline comments are not cosmetic. A line-anchored comment survives a force-push into a thread, produces a resolvable unit of work, and records who dismissed what. Terminal output produces none of that, which is why /ultrareview’s reported lack of inline comments matters for a team and barely matters for a solo developer.

Compliance follows the same logic. If you need “a review happened” to be provable nine months later, the review has to live in the VCS. Scrollback is not evidence.

The newer problem is triage. CodeRabbit’s Triage release ships a cross-repository queue that answers which PR to review next, how deeply, and which to recommend closing (changelog). When agents open most of your PRs, volume decouples from human capacity. Fifty diffs land, six matter, and finding those six is the bottleneck.

CodeRabbit DX staff are also publicly soliciting feedback on a new review interface called Change Stack (HN 49335907). The interaction model is still moving, worth knowing before you standardise a 60-person org on it.

Practical division of labour, so the same issue isn’t flagged twice: put naming, structure and house style in CLAUDE.md and enforce it pre-commit in the workstation loop. Leave cross-file consistency and security findings to the PR gate. Wire CODEOWNERS so security-relevant paths still require a named human, whatever the bots say. Our CLAUDE.md standards file guide covers the format itself.

Running CodeRabbit inside Claude Code

The “vs” query usually has an “and” answer. CodeRabbit ships an official Claude Code plugin: add the marketplace, install the plugin, authenticate the CLI, then trigger reviews with /coderabbit:review or plain language like “review my code” (official install steps).

--agent mode is the architecturally important piece. It emits structured data an agent consumes reliably, the same design goal behind the Model Context Protocol, instead of terminal prose the agent has to parse loosely and sometimes misreads.

The loop: Claude Code writes, CodeRabbit reviews through a different pipeline, Claude Code applies fixes, re-review.

The benefit is independence. The reviewer is not the author, so correlated blind spots break. The risk is that an agent optimising to satisfy a reviewer can produce a change that silences the finding without fixing the cause. A null check that swallows the bug will close the comment.

Expect the documented handoff failure. Claude Code frequently does not act on findings unless told to, and the docs list four remedies: say “fix the issues found by CodeRabbit” explicitly, wait for the review to complete, ask “show me the CodeRabbit findings,” and iterate one issue at a time.

Use one standards file. Pass coderabbit review -c CLAUDE.md so both sides grade against the same written rules.

The guardrail nobody writes down: decide in advance which severity levels the agent may auto-fix and which require a human. Without that rule you get an agent grinding through stylistic nits at full token price while a real finding sits at position 14.

For Anthropic-committed enterprises, the Claude Marketplace path means the spend can come off an existing commitment. If you would rather run review in CI, see our Claude Code GitHub Action setup.

Which should you choose? Five team profiles

The CodeRabbit vs Claude Code answer changes with headcount and PR volume.

Solo dev / side project. Claude Code review alone, plus CodeRabbit’s free OSS tier if the repo is public. Drop Claude Code review if you accept its findings without reading them.

Open-source maintainer taking drive-by PRs. CodeRabbit is the stronger fit: free for OSS, runs with nobody present, and at high contributor volume triage beats depth. Drop it if the noise drives contributors away, which is specific and observable.

2 to 10 dev startup, everyone runs Claude Code. Start with Claude Code review. Add CodeRabbit when PRs start merging that nobody read end to end. Drop CodeRabbit if six weeks in, its findings are all things CLAUDE.md could have prevented pre-commit.

Regulated or compliance-bound team. PR-native review with a durable audit trail is non-negotiable. Terminal-only review does not satisfy an auditor. Drop the terminal reviewer if it duplicates PR findings without catching anything earlier.

Heavy agent-driven team, agents open most PRs. Both, plus triage. This is the scenario Triage targets and the pain described in HN 46656759, where an agent declared victory with threads still open. Drop the extra layer if your merge queue never exceeds what one reviewer can read in a morning.

What practitioners actually say, and what nobody has measured

The Hacker News commentary clusters into four themes:

• Agent-workflow friction. Findings buried in volume, agents declaring premature success (46656759)
• False positives as the make-or-break variable. The thing that gets a tool turned off (48407573)
• Seat cost driving DIY builds. $24/mo per seat cited as the trigger (47271100)
• Mixed but net-positive in production. “Catches good stuff” (49299798) alongside worry that teams substitute the tool for judgement (49348963)

DeepSource (YC W20) put the market context bluntly when launching its Autofix Bot: “AI coding agents have made code generation nearly free, and they’ve shifted the bottleneck to code review” (HN 46237358).

The rest of the field you will look at next: Greptile, Cursor Bugbot (HN 49340049), Qodo Merge, GitHub Copilot code review, GitLab Duo, Amazon CodeGuru, Graphite Diamond, Codacy, Sourcery, Snyk Code, Semgrep, and SonarQube and CodeQL for deterministic static analysis. Local and OSS reviewers are discussed at HN 46723478. Our AI code review tools roundup sizes each against the same 14 dimensions, and the CodeRabbit vs Greptile vs Bugbot piece runs the three PR-native bots against each other.

What is not known: no public, reproducible, independent benchmark of CodeRabbit vs Claude Code on a shared bug corpus exists. This page did not run one. A credible one would need a seeded-bug corpus with known ground truth, diff sizes held constant, both reviewers configured by someone with no stake in the result, and blind grading of every finding as true positive, false positive or noise. SWE-bench Verified and Defects4J are the closest public starting points, and neither was built for review. Until that exists, discount every accuracy percentage you see, both vendors’ included.

A 30-minute protocol you can run instead. Pick five already-merged PRs from your own repo that later produced an incident or a hotfix. Run both reviewers over each. Count how many findings would have caught the actual defect, and how many you had to read to get there. That ratio, on your codebase, in your language, beats any vendor number. If noise is the worry, our false positive rate method turns that count into a tracked metric.

Frequently Asked Questions

Is CodeRabbit free?

CodeRabbit is free for open-source repositories, with paid tiers for private ones: roughly $12/mo per developer on Lite and $24/mo on Pro according to a third-party snapshot. Check coderabbit.ai/pricing directly, since aggregator snapshots go stale.

Can you use CodeRabbit and Claude Code together?

Yes. Add the marketplace, install the official plugin, authenticate the CLI, then trigger with /coderabbit:review. Use --agent for structured output Claude Code can act on and -c CLAUDE.md to share one standards file (docs). Expect to say “fix the issues found by CodeRabbit” explicitly.

What is Claude Code ultrareview?

/ultrareview is a slash command reported as shipping in Claude Code v2.1.111: cloud-backed parallel multi-agent review, able to fetch a GitHub PR without cloning it. The reported trade-off is no GitHub-native inline comments and no automation hooks (Hightower, Medium). Check Anthropic’s release notes for current behaviour.

Can Claude Code post review comments on a GitHub pull request?

Only through the GitHub Action or @claude mention path, which writes directly to the pull request. The CLI slash commands output to your terminal only. This is the most confused point in the whole comparison, so check the official docs for whichever path you intend to use.

Why does a CodeRabbit review take so long?

CodeRabbit documents reviews taking 7 to 30+ minutes depending on scope. Its own mitigations: review only uncommitted changes, use --light during active development, set the correct --base branch, and split large features into smaller branches (docs).

Which is better for catching real bugs, CodeRabbit or Claude Code?

No independent benchmark exists on a shared bug corpus, so any page quoting “>99% accuracy” is repeating an unsourced vendor figure. Structurally, a diff-scoped reviewer running a separate pipeline is more independent of the model that wrote the code, while a repo-aware agent can follow call chains and run tests. Run both over five past incident PRs and count.

Do I still need CodeRabbit if my team already uses Claude Code?

Keep it if you need review with no human present, inline threads that survive force-pushes, a merge gate, or a durable audit trail. Drop it if every PR is read end to end by a human anyway and the seat cost outweighs the marginal catch rate.

What are the main CodeRabbit alternatives?

Greptile and Cursor Bugbot (HN 49340049) for PR-native AI review, GitHub Copilot code review, GitLab Duo and Qodo Merge for platform-adjacent options, DeepSource’s Autofix Bot for hybrid static analysis plus AI (HN 46237358), Sourcery for Python-heavy teams, and SonarQube, CodeQL and Semgrep for deterministic analysis. Local reviewers exist (HN 46723478), with the caveat that local-only review “defeats the purpose” of autonomous PR review (HN 49346133).

Is it safe to give an AI code reviewer access to a private repo?

Not a yes-or-no question. Any PR-triggered LLM reviewer processes untrusted diff content while holding repo-scoped permissions, a genuine attack surface for prompt injection. A practitioner cites Kudelski Security’s CodeRabbit exploitation research as their reason for churning (HN 48407573). Our PR reviewer threat model walks the injection paths.

Related reading

• AI code review tools
• CodeRabbit review and pricing
• Claude Code GitHub Action
• CodeRabbit vs Greptile vs Bugbot
• CLAUDE.md standards file
• AI review false positives
• Static analysis vs agentic review
• Prompt injection in CI
• AI tooling cost per developer

Changelog

• 19 Aug 2026. First publication. Pricing sourced to a third-party snapshot pending vendor-page verification. Latency, scope-control and failure-mode rows sourced to docs.coderabbit.ai/cli/claude-code-integration. Triage release per docs.coderabbit.ai/changelog. /ultrareview behaviour flagged as third-party-reported pending confirmation against Anthropic release notes.