# MCP PR Workflow Server

<img width="780" height="325" alt="MCP-Server-1" src="https://github.com/user-attachments/assets/c2f67840-bc8e-4259-81ac-0f7f8d71a563" />
<img width="734" height="543" alt="MCP-Server-2" src="https://github.com/user-attachments/assets/8889992b-e8d0-46ce-a2c0-8e1f1bc6039d" />
<img width="760" height="667" alt="MCP-Server-3" src="https://github.com/user-attachments/assets/5bc9d063-3c64-44db-91c9-86e60974c3b1" />
<img width="775" height="672" alt="MCP-Server-4" src="https://github.com/user-attachments/assets/522167af-d625-459c-9b59-e85437d664c9" />
<img width="733" height="541" alt="MCP-Server-5" src="https://github.com/user-attachments/assets/e7b5e9fd-7d79-47b3-b544-457480256d11" />
<img width="746" height="240" alt="MCP-Server-6" src="https://github.com/user-attachments/assets/86d10c49-4e4b-4306-ae58-76ce6f74b7ac" />
<img width="781" height="278" alt="MCP-Server-7" src="https://github.com/user-attachments/assets/7fe08e44-ead4-40ad-b917-90973908cb91" />
<img width="778" height="679" alt="MCP-Server-8" src="https://github.com/user-attachments/assets/957e7b0a-1494-4377-8028-290b7518b8db" />

This MCP server provides tools and resources to streamline GitHub PR workflows, monitor CI/CD, and notify teams via Slack.

## Features

- **PR Analysis**: Automatically analyze file changes and suggest templates.
- **CI Monitoring**: Summarize GitHub Actions runs and update PR status.
- **Slack Notifications**: Send deployment status and custom alerts.
- **Follow-up Tasks**: Create GitHub issues directly from the PR context.

## Setup

1. **Install dependencies**:
   ```bash
   npm install
   ```

2. **Configure environment variables**:
   Create a `.env` file based on `.env.example`:
   ```bash
   GITHUB_TOKEN=your_github_token
   SLACK_BOT_TOKEN=xoxb-your-token
   SLACK_CHANNEL_ID=C12345678
   ALLOWED_REPOS=your-org/your-repo,another-org/another-repo
   ```

3. **Build the project**:
   ```bash
   npm run build
   ```

4. **Run tests**:
   ```bash
   npm test
   ```

5. **Run the server**:
   ```bash
   npm start
   ```

## Usage in Claude Desktop

Add the following to your `claude_desktop_config.json`:

```json
{
  "mcpServers": {
    "pr-workflow": {
      "command": "node",
      "args": ["/path/to/mcp-pr-workflow-server/dist/index.js"],
      "env": {
        "GITHUB_TOKEN": "your_github_token",
        "SLACK_BOT_TOKEN": "xoxb-your-token",
        "SLACK_CHANNEL_ID": "C12345678",
        "ALLOWED_REPOS": "your-org/your-repo"
      }
    }
  }
}
```

## Tools

- `analyze_file_changes`: Analyze PR diffs.
- `suggest_template`: Suggest PR templates.
- `analyze_ci_results`: Formats CI status.
- `update_pr_status`: Adds comments to PRs.
- `send_slack_notification`: Generic Slack alerts.
- `notify_deployment_status`: Success/failure alerts.
- `create_follow_up_issue`: Create GitHub issues.

Unknown tool names and validation failures are returned as MCP tool errors (`isError: true`) rather than crashing the server.

## Resources

- `team://config/guidelines`: PR guidelines.
- `team://config/escalation`: CI failure policy.

## Security

- **Repository allowlist**: GitHub tools only operate on repositories listed in `ALLOWED_REPOS`.
- **Slack channel allowlist**: Slack tools only post to `SLACK_CHANNEL_ID`. A `channel_id` argument is rejected unless it matches that value.
- **Input validation**: Owner, repo, PR numbers, titles, and message lengths are validated before use.
- **Prompt injection protection**: User-supplied PR comments, issue text, Slack messages, and prompt arguments are scanned for instruction-override patterns.
- **Secret redaction**: Tokens, keys, and other sensitive patterns are redacted from outbound PR comments, Slack messages, and tool responses.
- **No credential exposure**: Environment variables and channel IDs are never returned through tools or resources.