This MCP server lets AI assistants safely interact with GitHub PRs, CI, and Slack through typed, guarded tools.
Analyze GitHub PR file changes and classify them (features, fixes, docs, etc.)
Suggest a PR template based on change analysis
Summarize GitHub Actions CI results for a PR
Post sanitized status comments/updates on a PR
Send validated Slack notifications to allowed channels
Notify Slack about deployment success/failure
Create follow-up GitHub issues from PR context
Access team PR guidelines and CI escalation policy resources
Analyze PR diffs, suggest templates, update PR status, and create follow-up issues.
Summarize CI runs and update PR status based on GitHub Actions results.
Send deployment status and custom alerts via Slack.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@MCP PR Workflow Server Analyze PR #42 and notify Slack on CI failure"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server that connects AI assistants to GitHub PRs, CI, and Slack — with guardrails. Built in TypeScript for teams that want automated PR triage and deployment notifications without giving an LLM unbounded access to repos or chat.
Problem | PR review, CI follow-up, and Slack alerts are repetitive; AI can help, but only if integrations are scoped and safe. |
Solution | An MCP server that exposes PR/CI/Slack actions as typed tools, with validation, allowlists, and secret redaction on every outbound path. |
Stack | TypeScript · MCP SDK · Octokit · Slack Web API · Zod |
Quality | 84 unit tests across 11 files · Vitest · typed tool dispatch |
Run locally |
|
Related MCP server: Agentic MCP Server
Integration design — Third-party APIs (GitHub, Slack) wrapped as a small, testable tool surface for LLM clients.
Security-by-default — Repo allowlists, channel allowlists, input validation, prompt-injection checks, and secret redaction before anything leaves the process.
Reliable server behavior — Unknown tools and validation failures return MCP errors (isError: true) instead of crashing the server.
Separation of concerns — Tool registration, request dispatch, security, and resources live in focused modules with dedicated tests.
MCP fluency — Tools, resources, and prompts implemented against the Model Context Protocol spec.
flowchart LR
Client[AI Client / Claude Desktop] -->|stdio MCP| Server[MCP Server]
Server --> Dispatch[runtime.dispatchToolCall]
Dispatch --> PR[PR Tools]
Dispatch --> CI[CI Tools]
Dispatch --> Slack[Slack Tools]
Dispatch --> Issues[Issue Tools]
PR --> GitHub[GitHub API]
CI --> GitHub
Issues --> GitHub
Slack --> SlackAPI[Slack Web API]
Dispatch --> Security[validation · allowlist · sanitize]
Security --> DispatchRequest flow: Client calls a tool → input is validated → repo/channel allowlists are enforced → external API runs → response is sanitized → result returned (or structured error).
Designed for least privilege when an LLM can trigger side effects:
Control | Behavior |
Repository allowlist | GitHub tools only run against repos in |
Slack channel allowlist | Posts are limited to |
Input validation | Owner, repo, PR numbers, titles, and message lengths validated before use. |
Prompt injection defense | User-supplied PR text, issue bodies, Slack messages, and prompt args scanned for instruction-override patterns. |
Secret redaction | Tokens and sensitive patterns stripped from PR comments, Slack messages, and tool responses. |
No credential leakage | Env vars and channel IDs are never returned via tools or resources. |
Startup fails fast if required configuration is missing or invalid.
Tool | Purpose |
| Classify PR diff (features, fixes, docs, etc.) |
| Recommend a PR template from analysis |
| Summarize GitHub Actions run status |
| Post a sanitized comment on a PR |
| Send a validated Slack message |
| Deployment success/failure alert |
| Open a GitHub issue from PR context |
Resource | Purpose |
| Team PR guidelines |
| CI failure escalation policy |
git clone <repo-url>
cd MCP-PR-Workflow-Server
npm install
cp .env.example .env # fill in tokens and allowlists
npm test # 84 tests
npm run build
npm startRetrieve GITHUB_TOKEN from https://github.com/settings/personal-access-tokens. Repository permissions: Read access to actions, code, and metadata Read and Write access to deployments, issues, and pull requests
GITHUB_TOKEN=github...
SLACK_BOT_TOKEN=xoxb-...
SLACK_CHANNEL_ID=C12345678
ALLOWED_REPOS=your-org/your-repo,another-org/another-repoOpen Claude Desktop and click your profile name or the menu to open Settings.
Go to the Developer tab and click Edit Config. This opens the claude_desktop_config.json file.
Add your MCP server details inside the mcpServers JSON object.
{
"mcpServers": {
"pr-workflow": {
"command": "node",
"args": ["/absolute/path/to/MCP-PR-Workflow-Server/dist/index.js"],
"env": {
"GITHUB_TOKEN": "your_github_token",
"SLACK_BOT_TOKEN": "xoxb-your-token",
"SLACK_CHANNEL_ID": "C12345678",
"ALLOWED_REPOS": "your-org/your-repo"
}
}
}
}src/
├── index.ts # MCP server + handler registration
├── runtime.ts # Startup checks + tool dispatch
├── tools/ # GitHub, CI, Slack, issue tools
├── resources/ # Team config resources
├── prompts/ # Workflow prompts
└── security/ # Validation, allowlists, sanitizationAnalyzes GitHub Actions workflow runs for a PR and provides a formatted summary.
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | ||
| owner | Yes | ||
| pull_number | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden. It states that the tool analyzes workflow runs, which suggests a read-only operation, but it does not disclose specifics such as what data is accessed, how the summary is generated, potential side effects, authentication requirements, or failure behaviors. There is limited insight beyond the basic function.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One concise sentence communicates the core purpose and output, with no wasted words. However, it may be too sparse, lacking details that would be useful, but for what it is, it is efficiently written.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations, no output schema, and only a terse description, the tool is underdocumented. The description gives only a high-level view and omits details about the summary structure, edge cases, required permissions, or how the results are obtained, leaving significant gaps for an agent to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no per-parameter descriptions (0% coverage), so the description must compensate. The description mentions 'PR' and 'GitHub Actions', which implicitly clarifies that pull_number refers to the pull request and owner/repo identify the repository, but it doesn't explicitly describe the parameters or their expected formats. The parameter names are fairly self-evident in this GitHub context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool's function: analyzing GitHub Actions workflow runs for a pull request and generating a formatted summary. This distinguishes it from sibling tools like analyze_file_changes or update_pr_status, which focus on different resources or actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used when a formatted summary of CI results for a PR is needed, but it provides no explicit guidance on when to use this tool over alternatives, nor does it mention any exclusions or prerequisites. This is minimal inferred usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Analyzes file changes in a GitHub PR to determine the type of changes made.
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | The name of the repository. | |
| owner | Yes | The owner of the repository. | |
| pull_number | Yes | The number of the pull request. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool analyzes file changes but does not reveal whether it performs a read-only GitHub API call, any side effects, limitations, or what the output contains. This is a significant gap for a tool with no annotation support.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, focused sentence with no filler. It is front-loaded with the action and presents the purpose efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema or annotations, so the description must explain what the tool returns or any relevant behavior. It fails to clarify the output format (e.g., a list of change types, a summary, a classification) or any edge cases like large PRs or rate limits. The description is minimal for a tool that likely produces a meaningful analysis.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with each parameter (owner, repo, pull_number) already described in the schema. The description adds no supplementary parameter semantics, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Analyzes') and identifies the resource ('file changes in a GitHub PR') and the outcome ('determine the type of changes made'). It clearly distinguishes from sibling tools like analyze_ci_results, which focuses on CI results.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool—when analyzing file changes in a GitHub PR. However, it does not mention when not to use it or suggest alternatives, so it lacks explicit exclusionary guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Creates a follow-up GitHub issue for tasks identified during the PR process.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | ||
| repo | Yes | ||
| owner | Yes | ||
| title | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavior. It states the action ('Creates') but does not mention authentication requirements, idempotency, or what happens upon issue creation. This is a significant gap for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the action and resource, with no redundant information. It earns a top score for conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations and no output schema, the description covers the core purpose but omits usage context, prerequisites, and side effects. It provides slightly more context than a bare mutation statement by mentioning the PR process, but still lacks completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%; the description does not explain any parameter. While parameter names like owner, repo, title, and body are self-evident, the description adds no additional meaning about formatting, constraints, or optionality.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Creates') and resource ('follow-up GitHub issue'), and specifies the context ('tasks identified during the PR process'), clearly distinguishing it from sibling tools which focus on analysis and notifications.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly indicates the tool is for creating follow-up issues during PR review, which separates it from sibling tools like analyze_file_changes or send_slack_notification. However, it lacks explicit guidance on when not to use it or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Sends a formatted deployment status message (success/failure) to Slack.
| Name | Required | Description | Default |
|---|---|---|---|
| status | Yes | ||
| details | No | ||
| project | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses the core action but lacks side-effect context such as formatting behavior, required Slack integration, or failure modes. The brief description does not add behavioral transparency beyond the literal action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with the verb, no redundant information. Ideal length for a simple tool description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, but with no annotations and no parameter descriptions, the overall context is thin. The description covers the primary purpose but fails to clarify parameter usage or how this relates to sibling tools, leaving moderate gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description only hints that status accepts success/failure (redundant with the enum). It does not explain the semantics of 'project' or 'details', leaving parameters underdocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool sends a formatted deployment status message to Slack, specifying the action (send), resource (deployment status), and recipient (Slack). This distinguishes it from the generic sibling send_slack_notification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like send_slack_notification. The description implies use for deployment status updates but does not state exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Sends a generic notification message to a Slack channel.
| Name | Required | Description | Default |
|---|---|---|---|
| message | Yes | The message to send. | |
| channel_id | No | The Slack channel ID. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description bears the full burden of behavioral disclosure. It only says 'Sends a generic notification message,' which restates the core function without explaining behavior like what happens if channel_id is omitted, whether a default channel is used, error handling, rate limits, or message formatting. This leaves significant gaps for a tool that sends external messages.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no fluff or redundant information. It is appropriately sized for the tool's simplicity, though it could have packed in more useful details without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no annotations, no output schema, and only two parameters, the description is too sparse to be fully useful. It fails to explain the channel resolution behavior, whether the message is formatted, potential failures, or the relationship with the notify_deployment_status sibling. This leaves key context missing for safe and correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents both parameters with clear descriptions (message and channel_id). The tool description adds no additional meaning or context about the parameters, so the baseline score of 3 applies given the 100% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Sends') and resource ('Slack channel'), and the word 'generic' differentiates it from more specific sibling tools like notify_deployment_status. However, it does not explicitly name any sibling, so it doesn't fully distinguish them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus the more specific notify_deployment_status. The word 'generic' implies use for non-specific notifications, but this is not stated clearly, and there are no exclusions or alternative recommendations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Suggests an optimal PR template based on the analysis of file changes.
| Name | Required | Description | Default |
|---|---|---|---|
| analysis | Yes | The analysis string from analyze_file_changes. | |
| project_context | No | Optional project context/guidelines. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It indicates the operation is non-mutating by using 'suggests', but it does not explain any dependencies, required authorizations, or what happens with the suggestion (e.g., if it is saved or only returned). The brief phrasing leaves significant gaps for the agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded and directly states the core purpose. Every word contributes value, and there is no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter tool, the description is adequate but not complete. It does not explain what the suggested template looks like or how it is returned, and since there is no output schema, the description should have filled this gap. It also lacks explicit prerequisites beyond the implied analysis input.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema parameter description coverage is 100%, with 'analysis' described as 'The analysis string from analyze_file_changes' and 'project_context' as 'Optional project context/guidelines'. The description adds no additional parameter meaning, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'suggests' with the resource 'PR template' and specifies the basis as 'analysis of file changes', which distinguishes it from siblings like analyze_file_changes and update_pr_status. It is specific, actionable, and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool should be used after analyze_file_changes by referencing 'analysis of file changes', but it does not explicitly state when to use it or provide alternatives/exclusions. There is no guidance on when not to use this tool or what other tools might be more appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Updates a pull request with CI results or other process updates.
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | ||
| owner | Yes | ||
| message | Yes | ||
| pull_number | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must carry the full burden. It says 'updates' but does not disclose whether this posts a comment, sets a status check, overwrites existing data, or requires specific permissions. This lack of detail is significant for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one concise sentence, front-loading the core action and resource. It wastes no words, though the brevity sacrifices important details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 4 required parameters, no annotations, and no output schema, the description is too sparse to fully inform an agent. It does not clarify the mechanism of 'updating' (comment, status, etc.) or the impact on existing data, leaving critical context missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It vaguely references 'CI results' which likely maps to 'message', but it does not explain owner, repo, pull_number, or message. The parameter names are self-explanatory, but the description adds little semantic value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool updates a pull request with CI results or process updates, giving a specific verb and resource. It distinguishes from siblings like analyze_ci_results (which analyzes) and send_slack_notification (which notifies), though it doesn't explicitly name them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like analyze_ci_results or notify_deployment_status. The description implies usage through 'CI results or other process updates' but does not state when to prefer this over siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.0analyze_ci_resultsanalyze_file_changescreate_follow_up_issuenotify_deployment_statussend_slack_notificationsuggest_templateupdate_pr_statusScored across 7 tools
Most tools have clearly distinct purposes: analyzing file changes, analyzing CI, updating PR status, and creating issues are distinct. However, send_slack_notification and notify_deployment_status both send Slack messages, which could cause confusion for an agent despite the latter being more specific.
All tool names follow a consistent verb_noun pattern using snake_case (e.g., analyze_file_changes, suggest_template, create_follow_up_issue). There are no mixed conventions or vague verbs, making the pattern predictable.
Seven tools is within the ideal 3-15 range and each tool serves a distinct step in the PR workflow. The count feels well-scoped without being excessive or too thin.
The tool set covers the main PR workflow: analyzing changes, suggesting templates, analyzing CI, updating status, sending notifications, and creating follow-ups. Minor gaps exist, such as no direct way to fetch PR details or comment on a PR, but the core lifecycle is reasonably covered.
Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.
A Model Context Protocol (MCP) application for automated GitHub PR analysis and issue management.…
Screens public GitHub repos and PRs to generate risk maps, findings, and merge-readiness signals.
Plan Salesforce deploys, open pull requests and trigger pipelines from your AI client.
