I just ask Claude code to do a code review of PR X and it spawns a sub-agent. No hidden commands or anything special.

If I hint it might be security sensitive code, it bumps the effort level and burns my usage.

But it works quite well.

The findings are often debatable or unreachable states but it does find stuff and improves the overall quality I find.

What's funny though is that it almost always inevitably finds something wrong, even if you just ran it in another window and fixed everything it found. There is really a point of diminishing returns.