Uses the OpenAI API to power AI-driven code review, security vulnerability analysis, and code quality improvement suggestions.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Code Review MCP Server review this pull request for security vulnerabilities and code quality"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
AI-powered code review MCP server for automated pull request analysis.
Code Review: Automated PR review with actionable feedback
Security Analysis: Identify security vulnerabilities in code
Improvement Suggestions: Get code quality improvement recommendations
MCP Compatible: Works with any MCP client (Claude, Cursor, etc.)
Related MCP server: code-review-mcp-server
npm install -g code-review-mcpSet your OpenAI API key:
export OPENAI_API_KEY="your-api-key-here"Configure in your MCP client:
Add to claude_desktop_config.json:
{
"mcpServers": {
"code-review": {
"command": "node",
"args": ["/path/to/code-review-mcp/index.js"],
"env": {
"OPENAI_API_KEY": "your-api-key-here"
}
}
}
}Add to .cursor/mcp.json:
{
"mcpServers": {
"code-review": {
"command": "node",
"args": ["/path/to/code-review-mcp/index.js"],
"env": {
"OPENAI_API_KEY": "your-api-key-here"
}
}
}
}Review code changes and provide feedback.
Parameters:
diff (required): The code diff to review
context (optional): Additional context about the changes
Example:
{
"diff": "--- a/file.js\n+++ b/file.js\n@@ -1,3 +1,5 @@\n+// New function\n+function add(a, b) {\n+ return a + b;\n+}",
"context": "Added new utility function for arithmetic operations"
}Analyze code for security vulnerabilities.
Parameters:
code (required): The code to analyze
language (optional): Programming language
Example:
{
"code": "const query = `SELECT * FROM users WHERE id = ${userId}`;",
"language": "javascript"
}Suggest code quality improvements.
Parameters:
code (required): The code to analyze
focus (optional): Focus area (performance, readability, best_practices, all)
Example:
{
"code": "function processData(data) { return data.filter(x => x).map(x => x * 2); }",
"focus": "performance"
}This MCP server can be used by AI agents to automatically review code:
// Example: AI agent using the MCP server
const review = await mcpClient.callTool({
name: "review_code",
arguments: {
diff: prDiff,
context: "Feature: user authentication"
}
});
console.log(review.content[0].text);For enterprise use cases, contact us for:
Custom review rules and guidelines
Integration with CI/CD pipelines
Team-specific coding standards
Priority support
On-premise deployment
MIT
ContentForge Press
GitHub Issues: https://github.com/contentforge-press/code-review-mcp/issues
Email: support@contentforge.press
Run a one-shot review without an MCP client:
# Review a diff file
reviewpilot-mcp --review pr.diff
# With context
reviewpilot-mcp --review pr.diff --context "PR #123: auth feature"
# Security scan a source file
reviewpilot-mcp --security src/app.js --language javascriptCopy examples/github-action/reviewpilot.yml to .github/workflows/. Every PR gets an automated review comment.
Variable | Required | Default | Purpose |
| yes | — | API key |
| no | OpenAI | Any OpenAI-compatible endpoint (gateways, local servers) |
| no |
| Model used for review |
Use a local or cheaper model by pointing OPENAI_BASE_URL and REVIEW_MODEL at an OpenAI-compatible server.
Analyze code for security vulnerabilities
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | The code to analyze | |
| language | No | Programming language |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It implies a read-only analysis but does not disclose what the analysis returns (severity levels, CWE identifiers, fix suggestions), whether it is static or heuristic, or any limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. It is efficient, though arguably under-specified for a tool with an undocumented return shape.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description should explain the analysis output and usage context, but it does neither. For a security analysis tool with two parameters and siblings to disambiguate from, this is a significant gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both the code and language parameters are already documented in the schema. The description adds no extra semantics, syntax, or format guidance beyond that, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (Analyze) and a specific scope (security vulnerabilities), which is clearer than the tautological title. However, it offers no differentiation from the siblings review_code and suggest_improvements, leaving the agent to guess which analysis tool applies.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no indication of when to use this tool versus the sibling tools review_code or suggest_improvements. The agent gets no context on the intended scenario, prerequisites, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Review code changes and provide feedback
| Name | Required | Description | Default |
|---|---|---|---|
| diff | Yes | The code diff to review | |
| context | No | Optional context about the changes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does not disclose the nature of the feedback (comments? structured findings? pass/fail?), whether it's a read-only analysis, or what the response contains. With no output schema either, this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with no wasted words, front-loaded on the action. It is efficient, though its brevity stems partly from under-specification rather than tight editing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations and no output schema, the description should explain what the review produces and how it differs from sibling analysis tools. Neither is present, leaving the agent guessing about scope and return shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters (diff, context) are already documented in the schema. The description adds no format, size, or content guidance beyond that, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a recognizable verb+resource ('Review code changes'), but 'review' is broad and the phrase 'provide feedback' is generic filler. It does nothing to distinguish this tool from siblings like analyze_security or suggest_improvements, which plausibly cover overlapping ground.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus the two siblings, nor any prerequisites or exclusions. An agent must infer the boundary from names alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Suggest code quality improvements
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | The code to analyze | |
| focus | No | Focus area (performance, readability, best_practices) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It does not state whether the tool is read-only, whether it modifies or returns code, whether it needs repository access, or what form the suggestions take, leaving the agent with essentially no behavioral signal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single short sentence with no redundancy, which is superficially efficient. But it is under-specified rather than genuinely concise, and the brevity comes at the cost of any actionable detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With two parameters, no output schema, and no annotations, the description needed to explain return behavior and usage context, and it does neither. An agent knows only the rough function and nothing about what it will get back or when to pick this over its siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, including an enum for focus, so the schema already documents both parameters fully. The description adds no additional meaning about the focus values or the expected code input, which meets the baseline-3 expectation when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (suggest) and resource (code quality improvements), so the basic purpose is legible. However, it is nearly indistinguishable from the sibling review_code and does nothing to separate itself from analyze_security, so an agent cannot confidently route between them from the text alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no when-not-to-use, and no mention of the sibling tools review_code or analyze_security. The agent is left to infer entirely when improvement suggestions are preferable to a code review or a security analysis.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.1.1analyze_securityreview_codesuggest_improvementsScored across 3 tools
review_code is broad and overlaps with suggest_improvements (both provide code quality feedback) and partially with analyze_security. The descriptions help but do not fully draw clear boundaries between general review and targeted analysis.
All three tools follow a consistent verb_noun snake_case pattern: review_code, analyze_security, suggest_improvements. The convention is predictable and readable.
Three tools is reasonable for a focused code-review server, with each targeting a distinct analysis angle. It is slightly thin for a full code-review workflow (e.g., no diff retrieval or comment posting), but not problematic.
The surface covers three common analysis types but lacks lifecycle operations such as fetching code changes, retrieving diffs, or posting review comments. These gaps may force agents to combine with other tools to complete a review workflow.
A Model Context Protocol (MCP) application for automated GitHub PR analysis and issue management.…
AI-native git hosting — repos, PRs, issues, CI gates, and AI code review over MCP (60 tools).
Screens public GitHub repos and PRs to generate risk maps, findings, and merge-readiness signals.
Scan any public GitHub MCP-server repo for security issues. 37 MCP-specific L1 rules, 8 languages.
