agentic-sdlc-mcp

Review PR Against SDLC Standard

review_pr_against_standard

Read-onlyIdempotent

Assess pull requests against Agentic SDLC standards, including basic checks, strict reviews, and security-focused scans, and optionally validate CODEOWNERS ownership.

Instructions

Review a pull request against Agentic SDLC standards.

Standards:

basic: Core checks (tests, description, draft status, commit count)
strict: basic + large diff detection, missing docs
security-focused: strict + mature secret-scanner CI evidence + supplemental patch heuristics, .env files, lockfile changes, dist files

Ownership check (independent of standard, runs when checkOwnership is true and a CODEOWNERS file exists): Matches changed files against .github/CODEOWNERS (or CODEOWNERS / docs/CODEOWNERS), and flags any matched owner who is neither the PR author, a requested reviewer, nor an actual reviewer.

Args:

owner, repo: Repository coordinates.
pullNumber (number): The PR to review.
standard: "basic" | "strict" | "security-focused". Default: "basic".
checkOwnership (boolean, default: true): Enable the CODEOWNERS ownership check.

Returns: Sorted findings by severity, test coverage signal, ownership routing gaps, release risk, and conclusion.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`repo`	No	GitHub repo. Falls back to GITHUB_REPO.
`owner`	No	GitHub owner. Falls back to GITHUB_OWNER.
`standard`	No	Review standard: 'basic', 'strict', or 'security-focused'.	basic
`workType`	No	Optional explicit work type. When omitted, it is inferred from PR metadata and paths.
`pullNumber`	Yes	The pull request number to review.
`checkOwnership`	No	Check changed files against .github/CODEOWNERS and flag owners who were neither requested nor have reviewed. Requires read access to repo contents and PR reviewers/reviews.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`title`	Yes
`errors`	Yes
`findings`	Yes
`hasTests`	Yes
`standard`	Yes
`workType`	Yes
`conclusion`	Yes
`pullNumber`	Yes
`releaseRisk`	Yes
`policyDigest`	Yes
`policySources`	Yes
`trustBoundary`	No
`policyDegraded`	Yes
`codeownersFound`	Yes
`totalChangedLines`	Yes
`workTypeReasoning`	Yes
`appliedPolicyRules`	Yes
`testCoverageSignal`	Yes
`workTypeConfidence`	Yes
`ownershipRoutingGaps`	Yes
`secretScannerEvidence`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedv1.9.0Jul 29, 2026

addedOutput schema / properties / trustBoundary

Added value: +{
+  "additionalProperties": false,
+  "properties": {
+    "callerAndRepositoryContent": {
+      "const": "untrusted",
+      "type": "string"
+    },
+    "instructionHandling": {
+      "const": "never_execute",
+      "type": "string"
+    },
+    "permissionHandling": {
+      "const": "never_expand",
+      "type": "string"
+    },
+    "secretHandling": {
+      "const": "never_reveal",
+      "type": "string"
+    }
+  },
+  "required": [
+    "callerAndRepositoryContent",
+    "instructionHandling",
+    "secretHandling",
+    "permissionHandling"
+  ],
+  "type": "object"
+}

Changed17 schema fields changedv1.8.0Jul 13, 2026

addedInput schema / properties / workType

Added value: +{
+  "description": "Optional explicit work type. When omitted, it is inferred from PR metadata and paths.",
+  "enum": [
+    "docs",
+    "feature",
+    "bugfix",
+    "refactor",
+    "security",
+    "release",
+    "infra"
+  ],
+  "type": "string"
+}

addedOutput schema / properties / appliedPolicyRules

Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "id": {
+        "type": "string"
+      },
+      "source": {
+        "const": "repository",
+        "type": "string"
+      }
+    },
+    "required": [
+      "id",
+      "source"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedOutput schema / properties / findings / items / properties / dimension

Added value: +{
+  "enum": [
+    "intent",
+    "scope",
+    "evidence",
+    "ownership",
+    "policy",
+    "fallback",
+    "security"
+  ],
+  "type": "string"
+}

addedOutput schema / properties / findings / items / properties / paths

Added value: +{
+  "items": {
+    "type": "string"
+  },
+  "type": "array"
+}

addedOutput schema / properties / findings / items / properties / reason
```
Added value: +{
+  "type": "string"
+}
```

changedOutput schema / properties / findings / items / required

Previous value: -[
-  "severity",
-  "category",
-  "description"
-]New value: +[
+  "severity",
+  "category",
+  "description",
+  "suggestion",
+  "dimension",
+  "paths",
+  "reason"
+]

addedOutput schema / properties / ownershipRoutingGaps

Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "owner": {
+        "type": "string"
+      },
+      "paths": {
+        "items": {
+          "type": "string"
+        },
+        "type": "array"
+      }
+    },
+    "required": [
+      "owner",
+      "paths"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedOutput schema / properties / policyDegraded
```
Added value: +{
+  "type": "boolean"
+}
```
addedOutput schema / properties / policyDigest
```
Added value: +{
+  "type": "string"
+}
```

addedOutput schema / properties / policySources

Added value: +{
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "blobSha": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ]
+      },
+      "digest": {
+        "type": "string"
+      },
+      "kind": {
+        "enum": [
+          "default",
+          "repository"
+        ],
+        "type": "string"
+      },
+      "path": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ]
+      },
+      "ref": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ]
+      }
+    },
+    "required": [
+      "kind",
+      "path",
+      "ref",
+      "blobSha",
+      "digest"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedOutput schema / properties / releaseRisk

Added value: +{
+  "enum": [
+    "low",
+    "moderate",
+    "high",
+    "critical"
+  ],
+  "type": "string"
+}

addedOutput schema / properties / secretScannerEvidence

Added value: +{
+  "anyOf": [
+    {
+      "additionalProperties": false,
+      "properties": {
+        "degraded": {
+          "type": "boolean"
+        },
+        "providers": {
+          "items": {
+            "enum": [
+              "gitleaks",
+              "trufflehog",
+              "secretlint",
+              "detect-secrets",
+              "github-secret-scanning"
+            ],
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "reason": {
+          "type": "string"
+        },
+        "signals": {
+          "items": {
+            "additionalProperties": false,
+            "properties": {
+              "appId": {
+                "anyOf": [
+                  {
+                    "maximum": 9007199254740991,
+                    "minimum": -9007199254740991,
+                    "type": "integer"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              },
+              "name": {
+                "type": "string"
+              },
+              "provenanceVerified": {
+                "type": "boolean"
+              },
+              "provider": {
+                "enum": [
+                  "gitleaks",
+                  "trufflehog",
+                  "secretlint",
+                  "detect-secrets",
+                  "github-secret-scanning"
+                ],
+                "type": "string"
+              },
+              "source": {
+                "enum": [
+                  "check_run",
+                  "commit_status"
+                ],
+                "type": "string"
+              },
+              "state": {
+                "enum": [
+                  "passing",
+                  "failing",
+                  "pending",
+                  "skipped"
+                ],
+                "type": "string"
+              },
+              "trusted": {
+                "type": "boolean"
+              },
+              "url": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              }
+            },
+            "required": [
+              "name",
+              "provider",
+              "source",
+              "appId",
+              "trusted",
+              "provenanceVerified",
+              "state",
+              "url"
+            ],
+            "type": "object"
+          },
+          "type": "array"
+        },
+        "status": {
+          "enum": [
+            "passing",
+            "failing",
+            "pending",
+            "unverified"
+          ],
+          "type": "string"
+        },
+        "verified": {
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "status",
+        "verified",
+        "degraded",
+        "providers",
+        "signals",
+        "reason"
+      ],
+      "type": "object"
+    },
+    {
+      "type": "null"
+    }
+  ]
+}

addedOutput schema / properties / testCoverageSignal

Added value: +{
+  "enum": [
+    "adequate",
+    "missing",
+    "not_required",
+    "insufficient_evidence"
+  ],
+  "type": "string"
+}

addedOutput schema / properties / workType

Added value: +{
+  "enum": [
+    "docs",
+    "feature",
+    "bugfix",
+    "refactor",
+    "security",
+    "release",
+    "infra"
+  ],
+  "type": "string"
+}

addedOutput schema / properties / workTypeConfidence

Added value: +{
+  "enum": [
+    "high",
+    "medium",
+    "low"
+  ],
+  "type": "string"
+}

addedOutput schema / properties / workTypeReasoning
```
Added value: +{
+  "type": "string"
+}
```

changedOutput schema / required

Previous value: -[
-  "pullNumber",
-  "title",
-  "standard",
-  "conclusion",
-  "findings",
-  "hasTests",
-  "totalChangedLines",
-  "codeownersFound",
-  "errors"
-]New value: +[
+  "pullNumber",
+  "title",
+  "standard",
+  "conclusion",
+  "findings",
+  "hasTests",
+  "totalChangedLines",
+  "codeownersFound",
+  "workType",
+  "workTypeConfidence",
+  "workTypeReasoning",
+  "releaseRisk",
+  "testCoverageSignal",
+  "ownershipRoutingGaps",
+  "errors",
+  "secretScannerEvidence",
+  "policyDigest",
+  "policySources",
+  "appliedPolicyRules",
+  "policyDegraded"
+]

First observedv1.5.0Jul 9, 2026

TDQS

A4.3/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=true, openWorldHint=true, idempotentHint=true, and destructiveHint=false. The description adds value by explaining the ownership check behavior and the return value structure (sorted findings by severity, etc.). There is no contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured. It starts with the main purpose, uses bullet points for standards, explains the ownership check in a paragraph, and then lists args and return value. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the 6 parameters, 100% schema coverage, annotations, and an output schema, the description provides sufficient context. It explains the standards, ownership check, parameter defaults, and return value. No major gaps are present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage, so parameters are well-documented. The description adds extra context: default values for standard and checkOwnership, explanation of the ownership check, and that workType is optional and inferred. This provides more meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool reviews a pull request against Agentic SDLC standards. It enumerates the three standards (basic, strict, security-focused) and mentions the ownership check. This distinguishes it from sibling tools like quality_gate_status or create_pr_summary, which have different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly state when to use this tool versus alternatives. It implies usage by listing what the tool does (review against SDLC standards), but it lacks explicit guidance on when not to use it or which sibling tools might be more appropriate for related tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server