Claude Code Review: CCDV-F Developer Exam Guide

Using Claude for code review is among the most-searched developer workflows of 2026, and it maps directly to skills the CCDV-F exam tests across multiple domains. This guide covers what claude code review means in practice, which exam domains it touches, how to build review pipelines that hold up under scenario questions, and how to allocate study time sensibly across 53 items in 120 minutes.

Which CCDV-F domains test code review skills?

Code review with Claude spans four of the eight CCDV-F exam domains. Domain 2 (Applications and Integration, 33.1%) carries the most weight and covers building review integrations against the Claude API. Domain 1 (Agents and Workflows, 14.7%) covers agentic review pipelines. Domain 6 (Prompt and Context Engineering, 11.0%) covers writing review prompts that produce consistent, structured findings. Domain 8 (Tools and MCPs, 10.6%) covers connecting Claude to your repository toolchain via file-read tools and MCP servers.

Domain 2's 33.1% share means the exam rewards candidates who can wire up a working integration, not just describe one. Code review is a natural test vehicle: it requires API calls, structured output parsing, and error handling all in one scenario. A candidate who has built a working review integration has exercised the majority of Domain 2 task statements in a single project.

What does a production claude code review integration look like?

A minimal integration calls the Messages API with the diff as context and a system prompt that enforces a structured output schema.

import anthropic

client = anthropic.Anthropic()

SYSTEM_PROMPT = (
    "You are a code reviewer. "
    "Return findings as JSON only. "
    "Schema: {findings: [{severity: high|medium|low, file: str, line: int, description: str}]}"
)

def review_diff(diff: str) -> str:
    response = client.messages.create(
        model="claude-sonnet-5",
        max_tokens=4096,
        system=SYSTEM_PROMPT,
        messages=[
            {"role": "user", "content": f"Review this diff:\n\n{diff}"}
        ]
    )
    return response.content[0].text

The CCDV-F exam focuses on practical judgement, so scenario questions will ask whether this design handles edge cases: what happens when the diff exceeds the context window, when the model returns prose instead of JSON, or when the API returns a 429 rate-limit error.

A 429 response should trigger exponential backoff, not an immediate retry. A malformed JSON response should be retried with an explicit correction instruction: "your previous response was not valid JSON; return only the JSON object." Both retry patterns appear in Domain 2 scenario questions.

For large diffs, splitting by file or hunk is the correct approach. The per-file and cross-file pass pattern models this decomposition: one agent per file for finding isolation, a synthesis agent for cross-file concerns such as shared state bugs. This also solves the context window problem directly: a 10,000-line change cannot fit in a single context window, but each individual file usually can.

How does Claude Code's built-in review command work?

Claude Code ships a /code-review slash command that runs a multi-agent review of the current branch diff or a named PR number. It handles context window management internally and returns findings grouped by severity.

For the CCDV-F exam, Domain 3 (Claude Code, 3.1%) covers these mechanics. Key facts:

• /code-review targets the working diff by default; pass a PR number to target a specific pull request
• Effort levels (low, medium, high, max) control review depth and token cost
• --fix applies findings to the working tree; --comment posts them as inline PR comments
• The command respects CLAUDE.md instructions, so repository-specific review standards propagate automatically to every team member

Claude Code Configuration & Workflows covers CLAUDE.md setup in depth, including how to encode review checklists as persistent instructions that all team members inherit without copying prompt text into each session.

What prompt engineering does the CCDV-F exam test for code review?

Domain 6 (Prompt and Context Engineering, 11.0%) tests whether candidates can write review prompts that produce consistent, actionable output. Three patterns appear in scenario questions:

Schema-first output. Asking Claude to return JSON with an explicit schema (severity, file, line, description) makes downstream parsing deterministic. Asking for "a list of issues" without a schema produces prose that breaks automated pipelines. The exam penalises designs that parse free text.

Criteria-first prompts. Leading with explicit review criteria before presenting the code reduces hallucinated findings. A prompt specifying "check only for null-pointer dereferences, SQL injection, and unclosed file handles" outperforms a generic "review this code for bugs" in both precision and token cost.

Context injection. Injecting the repository's coding standards or a CLAUDE.md excerpt into the system prompt anchors findings to project conventions rather than generic best practices.

System: You are reviewing Python code for the payments service.
Standards: PEP 8, no bare except clauses, all database queries parameterised.
Return findings as JSON only. No prose.

User: <diff content here>

Prompt Engineering & Structured Output covers these patterns and their exam-question variants, including how to handle the tradeoff between a long, detailed system prompt and the token cost it adds to every review request.

Which Claude model should a code review pipeline use?

Domain 5 (Model Selection and Optimisation, 16.8%) tests cost and performance tradeoffs. For code review scenarios, the exam distinguishes three cases:

The exam consistently penalises over-engineering. Choosing Opus for a routine style check is as wrong as choosing Haiku for a security audit of authentication code. The correct answer is always proportionate to the stakes and the scope of the review.

def select_review_model(review_type: str) -> str:
    match review_type:
        case "style":
            return "claude-haiku-4-5-20251001"
        case "security" | "logic":
            return "claude-sonnet-5"
        case "architecture":
            return "claude-opus-5"
        case _:
            return "claude-sonnet-5"

How do agentic review pipelines differ from single-call reviews?

Domain 1 (Agents and Workflows, 14.7%) tests multi-step review architectures. The CCDV-F exam draws a clear distinction between three approaches:

Sequential pipelines. A diff-parser agent passes structured output to a security agent, which passes to a style agent, which passes to a synthesis agent. Each pass has a narrow focus, reducing the attention dilution that degrades single-pass reviews of large diffs. Fixed sequential pipelines are the exam's preferred pattern for deterministic, auditable review workflows where every step is traceable.

Parallel agents. A security agent and a performance agent run concurrently, and their findings are merged in a synthesis step. Faster wall-clock time, but the synthesis step must deduplicate overlapping findings and resolve contradictions before surfacing results.

Agentic loops. A review agent iterates until a quality threshold is met. Useful for complex refactors, but prone to runaway costs without a hard iteration cap. The exam treats uncapped loops as an anti-pattern in regulated environments.

For a code review pipeline in financial services or healthcare, the exam consistently rewards a fixed sequential pipeline with a human review gate before any merge action. An autonomous loop that can approve and merge without human intervention fails the proportionality test the exam applies to high-stakes scenarios.

What security risks appear in code review exam scenarios?

Domain 7 (Security and Safety, 8.1%) is small in weight but its scenarios are distinctive. For code review pipelines, the exam tests three risks:

Prompt injection via diff content. A commit that embeds adversarial instructions inside a comment or string literal is a prompt injection attempt. Code content fed to Claude must be wrapped or delimited, not concatenated directly into the system prompt as raw text.

Blast radius containment. A review agent with write access to a production branch can approve and merge code autonomously. The exam rewards designs that minimise blast radius: read-only tools for the review pass, a separate human-gated step for any write action.

Credential exposure. A review agent that logs the full Messages API request may expose secrets embedded in source files. Sensitive diffs should be sanitised before being sent, or log output scoped to the structured findings only.

The Tool Design & MCP Integration concept library covers scoping and permission patterns that reduce blast radius across all tool-using agents, including the tool-choice configuration options that prevent agents from calling tools outside their intended scope.

How should CCDV-F candidates prioritise code review study?

Domain 3 (Claude Code) carries 3.1% of the CCDV-F exam, roughly 1 to 2 questions out of 53. Deep study of Claude Code command syntax yields diminishing returns compared to the same time spent on Domain 2 or Domain 5.

A prioritised study path for code review topics, ordered by exam weight:

1. Domain 2 (33.1%): Claude API integration, streaming responses, structured output parsing, retry and error handling
2. Domain 5 (16.8%): Model selection proportionate to review stakes and diff complexity
3. Domain 1 (14.7%): Sequential vs parallel agents, synthesis patterns, iteration caps for loop-based architectures
4. Domain 6 (11.0%): Schema-first prompt design, criteria-before-code patterns, context injection
5. Domain 8 (10.6%): Tool descriptions for file access, MCP integration, error propagation via the isError flag
6. Domain 7 (8.1%): Prompt injection defence, blast radius minimisation, credential sanitisation
7. Domain 3 (3.1%): Claude Code /code-review command and CLAUDE.md configuration (light coverage only)

The CCDV-F exam has 53 items scored on a 100 to 1000 scale with a passing score of 720, and costs $125 per attempt. Candidates who have built and debugged a working review integration report that Domain 2 scenario questions feel familiar. Those who studied only documentation find the same questions require significant inference under time pressure.