Skip to main content
Glama
pgf3712

ReviewLens MCP Server

by pgf3712

ReviewLens MCP

A secure, explainable MCP server for AI-assisted GitHub pull-request review.

ReviewLens exposes seven typed, read-only tools that collect evidence from pull requests. It separates deterministic evidence collection from model interpretation, treats repository content as untrusted data, and includes a credential-free simulated provider and web demo.

ReviewLens MCP product walkthrough

Why it exists

AI review assistants often collapse retrieval, interpretation, and action into one opaque step. ReviewLens keeps those concerns separate so tool calls are auditable, contracts are testable, and no model can mutate a repository through this server.

Related MCP server: pr-forge

Product tour

The deterministic demo completes a realistic pull-request review without requiring a GitHub token. It exposes the collected evidence, related tests, risk level, and any instruction-like content found in untrusted repository data.

Simulated pull-request review with structured evidence

The tool surface is intentionally small: seven operations with explicit inputs and one responsibility each. The architecture keeps MCP at the adapter boundary and isolates review logic from GitHub access.

ReviewLens tools and architecture

The security model is visible rather than implied: least privilege, bounded evidence, untrusted-content handling, and explicit failures. A restrained pixel-art signature connects the project to its creator without competing with the engineering content.

ReviewLens security model and creator signature

Quick start — demo mode

python -m venv .venv
# Windows: .venv\Scripts\activate
# macOS/Linux: source .venv/bin/activate
python -m pip install -e ".[dev]"
pytest
reviewlens-demo

Open http://127.0.0.1:8000. The demo always uses deterministic fixture data.

Run the MCP server

reviewlens-mcp

The default transport is stdio.

Tools

Tool

Purpose

list_pull_requests

List open pull requests

get_pull_request

Fetch PR metadata

get_pull_request_files

Collect changed files and patches

get_pull_request_diff

Return a bounded, redacted diff

search_repository_code

Search repository code

find_related_tests

Locate tests connected to changed paths

build_review_report

Assemble deterministic structured evidence

Live mode

Copy .env.example to .env, set REVIEWLENS_MODE=live, and optionally configure a fine-grained token or GitHub App installation token with read-only Contents and Pull requests permissions. Tokens remain server-side.

Architecture and security

See docs/architecture.md, docs/security.md, and docs/adr/. The MVP contains no write-capable provider method, MCP tool, or demo endpoint.

Verification

ruff check .
mypy src
pytest

Documentation

  • Spanish: README.es.md

  • Recording guide: docs/demo-recording.md

  • Limitations: docs/limitations.md

Author

Built by Paula García Fernández.

Copyright © 2026 Paula García Fernández. All rights reserved. The repository is viewable as a personal portfolio and technical demonstration; reuse requires prior written permission. See COPYRIGHT.md. Audio is intentionally absent from v1.

Available Tools

7 tools
build_review_reportC

Build deterministic structured evidence; never asks an LLM for a verdict.

ParametersJSON Schema
NameRequiredDescriptionDefault
repoYes
ownerYes
numberYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses one meaningful trait — deterministic output with no LLM verdict — but omits whether the tool is read-only, what permissions or auth are required, whether it mutates the repository, and what 'structured evidence' actually contains.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single short sentence with no wasted words, so it is concise. However, it is too terse for a tool with three required parameters and a complex output schema, and it is not structured to front-load the tool's purpose or usage context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The presence of an output schema reduces the need to explain return values, but the description still fails to provide purpose specifics, usage guidance, or parameter semantics in the absence of annotations and schema descriptions. It is not complete enough for an agent to confidently select and invoke this tool over siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for three required parameters (owner, repo, number), and the description adds no parameter details at all. An agent gets no help understanding expected formats or value meanings beyond the bare parameter names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a verb ('Build') and a vague resource ('deterministic structured evidence'), but never says what the evidence is for or that it relates to a pull request review report. The name and schema imply a PR context, but the description alone leaves the exact output ambiguous and does not distinguish the tool from siblings like get_pull_request or find_related_tests.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no prerequisites, and no mention of alternative sibling tools. The single sentence describes an implementation trait rather than routing the agent to this tool instead of another.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_pull_requestC

Get typed pull-request metadata.

ParametersJSON Schema
NameRequiredDescriptionDefault
repoYes
ownerYes
numberYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure, and it says nothing about authentication requirements, rate limits, or what 'typed' metadata entails. The presence of an output schema relieves it of describing the return shape, but the mutation/auth/permission context is entirely absent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single short front-loaded sentence with zero waste, but it is terse to the point of under-specification rather than genuine conciseness. The brevity is achieved by omitting information the agent needs rather than by efficient phrasing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema covers return values, so that gap is acceptable, but with no annotations, 0% parameter coverage, and a crowded set of same-PR siblings, the definition leaves too much unspecified for an agent to route or invoke confidently. It covers only the bare minimum of what the tool is.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across all three required parameters (owner, repo, number), and the description adds no semantics for any of them. It does not clarify that 'number' is the PR number or the expected owner/repo formats, leaving the agent to infer everything from parameter names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb (Get) and resource (pull-request metadata), which is enough to distinguish it from list_pull_requests and search_repository_code. However, 'typed' is unexplained jargon and nothing distinguishes it from siblings like get_pull_request_diff or get_pull_request_files, which also fetch data for a single PR.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus the five siblings, several of which operate on the same PR (diff, files, review report). No prerequisites, no mention of when the metadata view is preferable over the file or diff views.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_pull_request_diffC

Get a bounded, redacted unified diff.

ParametersJSON Schema
NameRequiredDescriptionDefault
repoYes
ownerYes
numberYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full disclosure burden, and it does add meaningful behavioral context: the diff is "bounded" and "redacted", telling the agent output may be truncated and sanitized. However, it omits any mention of permissions, size limits, or pagination behavior that a mutating-adjacent read tool would warrant.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single short sentence with zero waste, which is structurally clean, but the brevity borders on under-specification rather than efficient conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return values need not be explained, but the definition still leaves three undocumented parameters, no usage routing, and no annotations to lean on. For a 3-parameter tool with no structured behavioral coverage, this is inadequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for three required parameters (owner, repo, number), and the description does not describe any of them. An agent gets no meaning for what these parameters expect beyond their bare names in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a verb+resource ("Get a ... unified diff") but only the tool name ties it to pull requests; the description itself never mentions a PR, owner, repo, or number. It distinguishes itself somewhat with the qualifiers "bounded, redacted", but an agent reading only the description cannot fully identify the target resource.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use or when-not-to-use guidance and no mention of sibling tools like get_pull_request_files or get_pull_request, which also surface PR content. The agent must infer usage from the tool name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_pull_request_filesC

Get changed files and patches for a pull request.

ParametersJSON Schema
NameRequiredDescriptionDefault
repoYes
ownerYes
numberYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It does disclose the return nature ('changed files and patches'), which is useful, but says nothing about pagination, size limits, permissions, or truncation behavior for large PRs — significant omissions for a list-style read tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single efficient sentence with the core resource front-loaded and no wasted words. It is appropriately sized, though brevity here partly reflects missing detail rather than tight editing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation and safety is implied by the 'Get' verb. However, with zero annotations and zero parameter documentation, the description leaves too much unsaid about scope, limits, and how it differs from sibling retrieval tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate and does not. owner, repo, and number are self-evident names, but the description adds no meaning about expected formats, whether number is a PR index, or any constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Get') and resource ('changed files and patches for a pull request'), so an agent knows exactly what comes back. It doesn't differentiate itself from the very similar sibling get_pull_request_diff, which is the main gap preventing a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this over get_pull_request_diff, get_pull_request, or build_review_report, all of which overlap in scope. The agent is left to infer the distinction between 'files/patches' and 'diff' entirely on its own.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_pull_requestsC

List open pull requests without changing the repository.

ParametersJSON Schema
NameRequiredDescriptionDefault
repoYes
limitNo
ownerYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations supplied, the description carries the full behavioral burden, and 'without changing the repository' does disclose the key non-mutating trait. However, it omits other important behaviors for a list tool, such as result ordering, pagination/limit behavior, and whether auth or rate limits apply.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single short sentence with the action front-loaded and no filler. It is efficient, though its brevity is partly a symptom of under-specification rather than disciplined editing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return values need not be described, but with no annotations, no parameter documentation, and no usage routing, the definition leaves an agent guessing about pagination, permissions, and when to choose this over its several pull-request siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for all three parameters. The description says nothing about owner, repo, or limit (e.g., default of 20, maximum value, or filtering semantics), so it does not compensate for the gap at all.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List open pull requests') with a scoping qualifier ('open'), which lets an agent distinguish it from the singular get_pull_request sibling. It stops short of explicitly naming what it is not, so it stays at 4 rather than 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no indication of when to prefer get_pull_request or search_repository_code instead, and no prerequisites or context about pagination scope. The only hint is the implicit read-only framing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_repository_codeC

Search code in a repository using a bounded query.

ParametersJSON Schema
NameRequiredDescriptionDefault
repoYes
limitNo
ownerYes
queryYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden and fails to do so. It says nothing about authentication/permission requirements, result ordering, pagination, rate limits, or what "bounded" actually constrains, leaving the agent to guess how the underlying search behaves.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single short sentence is appropriately sized and front-loaded with the core action. But the trailing "using a bounded query" clause adds ambiguity rather than information, so it does not fully earn its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, but the tool still has 4 undocumented parameters, no annotations, no usage guidance, and no behavioral context. After removing the output-schema burden, the description remains too thin for a search tool with this many inputs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 4 parameters, so the description must compensate and largely does not. It never explains owner/repo/query semantics, and "bounded query" only loosely gestures at the limit parameter without defining its effect.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a clear verb and resource ("Search code in a repository"), which is enough to distinguish it from the PR-oriented siblings. However, the modifier "using a bounded query" is vague and unexplained — it is unclear whether "bounded" refers to result count (the limit param), query scope, or syntax constraints.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives, no prerequisites, and no exclusions. Nothing indicates what kind of query syntax is accepted or when a code search is appropriate versus the sibling PR-listing tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv0.1.0
    • First observedbuild_review_report
    • First observedfind_related_tests
    • First observedget_pull_request
    • First observedget_pull_request_diff
    • First observedget_pull_request_files
    • First observedlist_pull_requests
    • First observedsearch_repository_code

TDQS

B3/5.0

Scored across 7 tools

Disambiguation4/5

Each tool has a mostly distinct purpose: listing PRs, fetching metadata, fetching diffs/files, finding tests, searching code, and building a report. The main overlap is between get_pull_request_diff and get_pull_request_files, since both expose changed content, though the descriptions distinguish unified diff from file-level patches.

Naming Consistency5/5

All tools use a consistent snake_case verb_noun pattern, such as get_pull_request, list_pull_requests, find_related_tests, and build_review_report. The naming is predictable and easy to scan.

Tool Count5/5

Seven tools are well-scoped for a read-only PR review/evidence server. Each tool supports a clear part of the review workflow, and there is no obvious bloat.

Completeness4/5

The surface covers core read-only review needs: listing PRs, fetching metadata, diffs, changed files, related tests, code search, and report generation. Minor gaps remain around existing review comments, CI/check status, or commit context, but the core workflow is workable.

Maintenance

ActivityStale
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Provides AI agents with a secure PR review gateway through 9 MCP tools for managing pull requests, including context retrieval, diff, checks, and merge with two-layer access control.
    4 npm
    MIT