GitHub Copilot Code Review Max: The Beginner's Guide to Max Reviews and PR Approvals
CodexFuse Team · 2026-11-02T15:26:19.581Z · 20 min read min read
GitHub's Copilot code review Max runs several AI agents across models on your pull request, with approvals now GA. A beginner's guide to Lite/Balanced/Max, costs, and turn-on.
GitHub Copilot code review Max is the new highest-effort tier of GitHub's AI code reviewer, announced October 28, 2026, at GitHub Universe alongside generally available Copilot approvals — and if you are searching for how to use GitHub Copilot code review Max, the short version is this: you ask Copilot to review a pull request, pick the Max effort level, and several independent review agents across different models all examine your code at once, while an aggregation agent reconciles their findings into a single review. It is not a new model, and it is not the same thing as Copilot Fusion's Max effort level (more on that distinction below). This beginner's guide covers the mental model that makes the three effort levels click, what a Max review costs and returns, how Copilot approvals work, and the exact turn-on steps for developers and admins. If Copilot itself is new to you, start with our GitHub Copilot beginner guide — code review is one of its agent-powered features, and the basics there make everything below easier.
What Is GitHub Copilot Code Review Max, Exactly?
GitHub Copilot code review Max is the highest-effort review tier of Copilot's pull-request reviewer: instead of one model giving your code a pass, Max runs several independent review agents across models from different providers, and an aggregation agent reconciles their findings, resolves disagreements, and double-checks accuracy before combining everything into a single review. If your search was literally "what is Copilot code review Max" — or the shorter "copilot max code review" — that sentence is the whole answer, and everything below is the beginner's tour of what it implies.
The design rests on one observation GitHub stated in the launch announcement: each model has its own strengths and blind spots, so combining them helps catch issues a single model might miss. One model might be sharp on injection flaws and weak on concurrency; another might catch the race condition and miss the auth bypass. Max bets that an ensemble of reviewers beats any single reviewer — and then adds the aggregation agent as the editor-in-chief that resolves their disagreements before you ever see the review.
Max joins Lite and Balanced as the third review effort level, and it is in public preview as of this writing — GitHub says it is subject to change. It is available on the Copilot Pro, Pro+, Max, Business, and Enterprise plans. And one more fact worth knowing before you go further: GitHub says Max posted the highest F1 score on its own ReviewBench benchmark for high-severity issues — that is GitHub's own claim about GitHub's own benchmark, and independent reproduction is still pending, so treat it as a vendor result rather than settled science.
How Do You Use GitHub Copilot Code Review Max, Step by Step?
Seven steps take you from zero to your first Max review: check your plan, open the pull request, pick the effort level, request the review, wait for the agents, read the findings, and decide whether to turn on approvals.
- Check that your plan covers it. Max and the code-review feature need a Copilot Pro, Pro+, Max, Business, or Enterprise seat. If you are on a free plan or your org has not enabled the reviewer, the option will not appear.
- Open the pull request. Code review runs on PRs, not on commits or branches directly. Open the PR you want reviewed in the GitHub web UI.
- Choose the effort level. In the PR, under "Reviewers" in the right sidebar, Copilot appears as a reviewer. Before or when you request, you can select Lite, Balanced, or Max. Start with Max only on a risky change — auth logic, payment code, a shared library — not on a typo fix.
- Request the review. Next to Copilot under Reviewers, click Request. The agents start working: several independent models read the diff, and the aggregation agent reconciles their findings into one review.
- Wait longer than usual. Max is the most intensive review tier. GitHub's docs put a typical Max review at $1.50–$25 in AI credits (about $10 on average), versus about $1.50 for Balanced and $0.25 for Lite — more models means more time and more credits. Plan for that before you request it.
- Read the review comment. The review arrives as a PR review with inline comments labeled High, Medium, or Low severity, plus an overview comment showing which effort level was used and Copilot's approval assessment — whether it considers the PR ready to merge.
- Act on the findings. Where possible, feedback includes suggested changes you can apply with a couple of clicks, and "Fix with Copilot" can draft fix instructions. Push new commits for your fixes — and know that if Copilot had approved the PR, new commits dismiss that approval, so you can request a fresh review.
What Do the Three Effort Levels — Lite, Balanced, Max — Actually Do?
The Copilot review effort levels — Lite, Balanced, Max — are the only dial Copilot code review gives you: Lite gives a fast single-model pass, Balanced routes to a higher-reasoning model for longer analysis, and Max orchestrates several models at once for the most intensive review. That is the full set behind the query "copilot review effort levels lite balanced max": three tiers, one dial. Here is how GitHub's docs describe each tier, so you know exactly what you are choosing.
| Effort level | What GitHub says it does | Reach for it when | Typical cost |
|---|---|---|---|
| Lite | "Standard review. Provides fast, targeted feedback on common issues such as bugs, security vulnerabilities, and style inconsistencies." | Routine changes — a typo fix, a README update, a small refactor — where fast feedback beats exhaustive analysis | $0.05–$1 (about $0.25 avg) |
| Balanced | "Routes pull requests to a higher-reasoning model for longer analysis of complex logic, security-sensitive code, and cross-service changes." (GitHub's built-in default) | Security-sensitive code, multi-service PRs, or repos with strict quality standards | $0.25–$5 (about $1.50 avg) |
| Max | "The highest-effort review. Uses multiple high-reasoning models for the most intensive review of pull requests that require the most scrutiny." | High-risk or release-critical PRs — auth logic, payment flows, shared libraries, anything where a missed bug is expensive | $1.50–$25 (about $10 avg) |
Three honest consequences follow from this table. First, the default is Balanced — GitHub made Balanced the default for new and existing repositories and organizations on September 28, 2026, so most repos are already on it unless someone changed the setting. Second, cost scales with effort: a Max review costs roughly 40 times a Lite review on average, so the dial is really a risk dial — match the effort to the risk. Third, Max takes longer than Balanced or Lite, because several models have to finish and an aggregation agent has to reconcile them. If your team reviews fifty trivial PRs a day, Max on all of them is a slow and expensive mistake.
The effort choice has a clear precedence order, per GitHub's docs: a per-request choice wins first, then the effort level previously used on that PR, then the requestor's personal setting, then the repository default, then the organization default, and finally GitHub's built-in default (Balanced). Admins can also cap the maximum review effort level at the enterprise, organization, or repository level — so your org can decide that Max is available on the payment repo but not on the docs repo, and that choice is enforced.
How Much Does a Copilot Code Review Cost?
A Copilot code review costs AI credits for the model work plus GitHub Actions minutes for the agentic machinery: GitHub's docs put typical reviews at $0.05–$1 for Lite (about $0.25), $0.25–$5 for Balanced (about $1.50), and $1.50–$25 for Max (about $10), excluding Actions minutes. If you are budgeting, that is the table that matters.
Two components make up the bill. The first is AI credits, which pay for the model interaction — every model that reads your diff, and the aggregation agent that reconciles them, consumes credits. The second is GitHub Actions minutes, which pay for the agentic capabilities around the models. GitHub's cost estimates cover the credits only; Actions minutes are billed separately. Teams that run reviews on every PR of a busy monorepo should know both numbers before enabling, because a Max review on a 2,000-line diff is the most expensive thing in this table.
For context on the machine behind the minutes: those Actions runners are ordinary compute, and many teams run self-hosted runners to control where code gets processed and what it costs — our what VPS hosting is guide explains the kind of server those runners live on, if the self-hosted route is new to you.
How Does a Max Review Actually Work Under the Hood?
A Max review works as an ensemble: GitHub runs several independent review agents across models from different providers on your pull request, each agent reviews the code on its own, and then an aggregation agent reconciles their findings, resolves their disagreements, and double-checks accuracy before combining everything into a single review. You see one review; behind it, several models argued.
Why this architecture? Because models disagree the way human reviewers disagree. One catches the SQL injection, another flags the missing rate limit, a third worries about the naming. A single-model review inherits one model's blind spots. The ensemble approach gives you several sets of eyes, and the aggregation agent plays the senior reviewer who reads all the drafts, settles the conflicts, and writes the final verdict. It is the closest thing to a human review panel that GitHub's reviewer currently offers.
Now the honest caveat, stated once: the headline benchmark figure — GitHub says Max posted the highest F1 score on ReviewBench for high-severity issues — comes from GitHub's own benchmark, and independent coverage notes the widely repeated "ranks first" claim is third-party reported and could not be confirmed against a primary leaderboard. ReviewBench itself is real and public (GitHub published it in October 2026 with 219 PRs from 187 repos across 19 languages, plus a self-serve runner), but the self-inclusion caveat applies — one independent analysis found Copilot Code Review supplied 1,185 of the benchmark's 2,623 true-positive golden findings, meaning the benchmark partially grades GitHub on data GitHub itself produced. Take the "highest F1" line as a vendor claim, not an independent verdict.
How Do You Request a Copilot Review on a Pull Request?
You request a review the way you request any reviewer: on the pull request page, under "Reviewers" in the right sidebar, Copilot appears as a reviewer — click Request next to it. The review starts, and you can watch it work.
Before clicking, set the effort level if you want something other than the default. You select the effort under the Reviewers section where Copilot appears, and the precedence order from the previous section applies: your per-request choice beats the PR's previous effort, which beats your personal setting, which beats the repo and org defaults. Most developers set their personal default once and override per request on the risky PRs — the two-second version of the habit.
There is also an API route. You can request a review through the REST API by requesting copilot-pull-request-reviewer[bot] as a reviewer on the pull request — useful for bots, automations, or CI pipelines that want a review on every PR without a human click. The snippet below shows the shape of that request:
POST /repos/{owner}/{repo}/pulls/{pull_number}/requested_reviewers
{
"reviewers": ["copilot-pull-request-reviewer[bot]"]
}
If pull requests themselves are new territory, our GitHub beginner guide walks through the PR workflow — branches, reviews, and merges — that everything on this page assumes.
What Does a Max Review Return?
A Max review returns a standard GitHub PR review: inline comments on the diff, each labeled with a severity of High, Medium, or Low, plus an overview comment that shows which effort level was used and includes Copilot's approval assessment. By default it lands as a "Comment" review — visible, annotated, not blocking.
The inline comments are the meat: specific lines with specific problems, severity-graded so you triage the Highs first. Where Copilot can propose a fix, the feedback includes suggested changes you can apply with a couple of clicks — accept the suggestion and it lands in your branch. "Fix with Copilot" goes a step further: it can create a draft comment instructing the agent how to fix the issue, which is the agentic version of leaving a code-review comment for yourself.
The overview comment is the envelope: it tells you the effort level that ran (so you know whether this was a Lite skim or a Max deep-read) and the approval assessment — Copilot's judgment on whether the PR is ready to merge. That assessment is advisory by itself; it only becomes a real approval when Copilot approvals are turned on, which is the next section.
How Do Copilot Approvals Work?
Copilot approvals work like a human reviewer's approval: when turned on, every Copilot review includes an approval assessment in the PR overview comment, and if Copilot considers the PR ready to merge, its approval counts toward your repository's required approvals. If new commits are pushed after Copilot approves, the approval is dismissed — exactly as with a human — and you request a new review for a fresh approval.
Two things changed about approvals at Universe. First, they went generally available on October 28, 2026 — they had been in public preview since September 1, so this is graduation, not launch. Second, they remain off by default: nothing approves anything until an admin turns it on. Admins can enable approvals at the enterprise, organization, or repository level, and repository admins can choose which file paths Copilot is allowed to approve — so you can let it approve docs and tests while keeping auth code under human-only review.
| Approvals question | The answer, per GitHub |
|---|---|
| Is it on by default? | No — approvals are off by default and admin-gated at the enterprise, org, or repo level. |
| Does the assessment alone approve? | No — the approval assessment is advisory; it counts toward required approvals only when approvals are turned on. |
| What happens when I push new commits? | Copilot's approval is dismissed, just like a human reviewer's. Request a new review for a fresh approval. |
| Can I limit which files it may approve? | Yes — repository admins can choose which file paths Copilot is allowed to approve. |
| Can admins limit Max itself? | Yes — admins can set a maximum review effort level to decide where Max is available. |
The pairing of Max with approvals is the headline habit of this launch: run your deepest review tier on the repos where approval matters most, and let the approval count when the review is clean. That is GitHub's "merge with confidence" pitch in one sentence — a Max review plus a Copilot approval on a security-sensitive PR is the strongest signal the feature currently produces.
How Do You Enable Copilot Approvals?
You enable Copilot approvals as an admin, not as a contributor: an enterprise, organization, or repository admin turns approvals on in the repository's settings, optionally restricting which file paths Copilot may approve. Contributors never see an "approve me" button — the feature arrives through policy.
The sensible enable order for a team: turn approvals on for one repository first, restrict the approvable paths to low-risk areas (docs, tests, config — not auth or payments), let the team watch the approval assessments for a week, then widen the paths and the repos. Because new commits dismiss a Copilot approval, the workflow stays safe by default: a sneaky post-approval change cannot ride a stale AI approval into main. If you have ever lost an afternoon to a human reviewer approving, then a force-push landing after, you will recognize the shape of this safeguard — our Git beginner guide covers the push and commit mechanics that make it work.
One administrative power deserves its own line: admins can cap the maximum review effort level, deciding where Max is available. The practical policy most teams will land on is Balanced everywhere, Max on the repos where a missed bug costs real money, Lite where speed matters more than depth — and approvals on only where a human reviewer plus an AI assessment is the bar you want to set.
When Should You Use Max Instead of Balanced or Lite?
Use Max when the cost of a missed bug exceeds the cost of the review: authentication and authorization code, payment and billing logic, cryptography, shared libraries consumed across services, and release-critical or migration PRs. Use Balanced for security-sensitive or multi-service code in general; use Lite for routine, low-risk changes.
The decision is risk times blast radius. A one-line copy fix in a README has near-zero blast radius — Lite. A refactor of the session-handling library every service imports has enormous blast radius — Max. A new endpoint with auth checks sits in the middle — Balanced, escalated to Max if the endpoint touches money or personal data. Most teams will find that five to ten percent of their PRs deserve Max, the majority deserve Balanced, and Lite covers the churn.
Seven beginner mistakes show up again and again with the new tiers — the table below collects them so you can skip the tuition:
| Mistake | Why it hurts | Do this instead |
|---|---|---|
| Running Max on every PR | About $10 and extra wait per review, times hundreds of PRs, buys you nothing on typo fixes | Reserve Max for high-risk or release-critical PRs; Balanced is the default for a reason |
| Assuming Max means "perfect review" | An ensemble still misses things; Max is still in public preview and subject to change | Treat Max as the strongest AI signal, not a substitute for human review on critical code |
| Turning on approvals for all file paths at once | An AI approval on auth or payments code you have not watched it assess is a policy you cannot defend | Start with docs and tests, watch a week of assessments, then widen the paths |
| Forgetting new commits dismiss approvals | A teammate pushes a fix after Copilot approved and wonders why the check is red again | Teach the team: push after approval means requesting a fresh review — same as human approvals |
| Confusing Code Review Max with Copilot Fusion Max | They are different Universe launches: one is a review effort tier, the other is a model-routing effort tier | Code Review Max reviews PRs; Fusion Max routes chat and coding prompts — say the sentence once and move on |
| Ignoring the cost dial | $1.50–$25 per Max review plus Actions minutes adds up on a busy monorepo | Let admins cap the maximum effort per repo; monitor AI-credit spend like any other infra line |
| Treating the ReviewBench headline as independent proof | It is GitHub's own benchmark; independent reproduction is still pending | Cite it as a vendor claim, and judge Max on your own PRs' findings instead |
How Does Max Relate to the Other New Copilot Launches?
Max relates to the other Universe launches by lane: Code Review Max is the review lane, Copilot Fusion is the model-routing lane, and Copilot Projects is the multi-repo workspace lane — different features, never rivals. One sentence of disambiguation each is all you need.
Copilot Fusion is the router in the model picker that picks which models serve your chat and coding prompts across effort levels Standard, High, and Max — a different Max from the review one. Our GitHub Copilot Fusion walkthrough covers it in full. If you read "Max" and pictured the Fusion router, that is the confusion to drop.
The pre-Max coverage still matters too: independent guides like aicodereview.cc's complete guide cover the base code-review feature — setup, agentic architecture, costs, the approvals-off-by-default era — from before the October 28 Max launch, so they document Lite and Balanced accurately but say nothing about Max. Read them for the base feature's history; read this page for the new tier and approvals.
And for the agent-model context behind the ensemble: a Max review orchestrates several models the way an agent framework orchestrates tools — our Claude Code walkthrough shows the agentic coding world these review agents come from, if you want the bigger picture.
Sources
Every fact on this page comes from a page fetched on November 2, 2026. Claims marked as GitHub's own are vendor claims, not independently verified.
GitHub Changelog, "Copilot code review: Merge with confidence with Max and approvals," October 28, 2026 — https://github.blog/changelog/2026-10-28-copilot-code-review-merge-with-confidence-with-max-and-approvals/ — the launch announcement: Max as third effort level in public preview, the multi-agent architecture quote, plans, approvals mechanics, the dismissal rule, per-path approval control, and admin effort caps.
GitHub Docs, "About Copilot code review" (agent capabilities concepts) — https://docs.github.com/en/copilot/concepts/agent-capabilities/agent-powered-workflows-and-operations/code-review — effort-level descriptions (Lite/Balanced/Max), usage guidance per tier, the cost ranges and two-component billing, Max's public-preview status, and the Balanced default.
GitHub Docs, "Use Copilot code review" (how-to) — https://docs.github.com/en/copilot/how-tos/use-copilot-agents/use-code-review — how to request a review from the Reviewers bar, effort-level selection and precedence, the REST API reviewer name copilot-pull-request-reviewer[bot], inline severity labels, suggested changes, and Fix with Copilot.
GitHub Changelog, "Copilot code review can now approve pull requests," September 1, 2026 — https://github.blog/changelog/2026-09-01-copilot-code-review-can-now-approve-pull-requests/ — approvals' public-preview origin, confirming the October 28 graduation to general availability.
aicodereview.cc, "GitHub Copilot Code Review: The Complete Guide" (verified October 19, 2026) — https://aicodereview.cc/blog/github-copilot-code-review/ — the pre-Max complete guide; ReviewBench details (219 PRs from 187 repos, 19 languages, public dataset and runner at review-bench.ai), the unconfirmed-leaderboard note, and the self-inclusion caveat.
WebProNews, "GitHub Enterprise Includes Copilot Universe 2026" (via search, October 2026) — https://www.webpronews.com/github-enterprise-includes-copilot-universe-2026/ — second-hand report of the ReviewBench highest-F1 claim, attributed to GitHub's announcement.
Pondero.ai news and vibe.cerridan.com (via search, October 2026) — corroboration that Balanced became the default effort level on September 28, 2026.
Frequently Asked Questions
Is GitHub Copilot code review Max free?
No. Max is the highest-effort review tier and the most expensive: GitHub's docs put a typical Max review at $1.50–$25 in AI credits (about $10 on average), plus GitHub Actions minutes for the agentic machinery. It is available on Copilot Pro, Pro+, Max, Business, and Enterprise plans, and it is currently in public preview.
What is the difference between Lite, Balanced, and Max in Copilot code review?
Lite is a fast single-model pass for common issues ($0.05–$1); Balanced routes to a higher-reasoning model for longer analysis of complex or security-sensitive code ($0.25–$5) and is GitHub's default; Max runs several independent review agents across models from different providers plus an aggregation agent that reconciles their findings ($1.50–$25). Match the tier to the risk of the change.
How do you enable Copilot approvals on pull requests?
An admin enables approvals at the enterprise, organization, or repository level in settings — Copilot pull request approvals are off by default. Repository admins can then choose which file paths Copilot is allowed to approve. Once on, Copilot's approval counts toward required approvals, and new commits dismiss it, just like a human reviewer's approval.
Does Copilot code review Max replace human reviewers?
No. Max is the strongest AI review signal GitHub currently offers, but it is in public preview, its headline benchmark is GitHub's own claim, and ensembles still miss things. The intended pattern is AI review plus human review — with approvals counting toward required approvals only where an admin has allowed it.
Is Copilot code review Max the same as Copilot Fusion Max?
No. They are two different launches from GitHub Universe 2026 that happen to share the word "Max." Code Review Max is a review effort tier for pull requests; Copilot Fusion Max is an effort tier of the model router in the Copilot chat model picker. Different features, different pages.
