MCP server for GitHub PR reviews and code analysis using FastMCP. Provides AI-powered code review comments, security analysis, and automated feedback for pull requests.
The server defines 14 tools with consistent naming patterns (verb_noun structure), explicit Zod schemas, and descriptions for all tools. However, descriptions are often terse (10-50 chars), many parameters lack granular descriptions, output schemas are undocumented, and error handling is minimal. Tool compositions show good intent (e.g., get_pr_diff_hunks, validate_pr_comment_target, ensure_pending_review), but the implementation lacks recovery guidance and actionable error messages. The server scores well on naming and parameter enumeration but poorly on description depth and output documentation.
Add a comment to a PR (general or line-specific)
Analyze code changes in a PR for issues and suggestions
Ensure a pending review exists for the PR. Creates a new pending review if none exists, or returns the existing one. Returns reviewId and commitId for adding inline comments.
Get the current pending review for the PR (if any). Returns null if no pending review exists.
Get all comments on a GitHub pull request
Get detailed information about a pull request
Tool descriptions are uniformly terse (10-50 chars). LLMs cannot determine when or why to select tools without understanding context. E.g., 'Get all reviews for a GitHub pull request' does not explain when to use this vs. get_pr_details, what the response contains, or prerequisites.
Output schemas are completely undocumented. Tools return JSON responses, but the LLM has no schema to know what fields to expect (e.g., what fields are in a review object, what pagination structure is used, what fields enable chaining to downstream tools). This forces LLMs to guess field names and risks errors.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | D | 58 | 2026-07-28+ | v2 |
| 2026-03-09 | C | 63 | - | v1 |
Get diff hunks with line mapping for all changed files in a PR. Returns per-file hunks with oldStart/oldLines, newStart/newLines, and patch content for accurate inline comment placement.
Get list of files changed in a pull request
Get all reviews for a GitHub pull request
List all draft comments in the pending review for the PR. Returns empty array if no pending review exists. Each comment includes path, line, side, body, and metadata.
Get PR context and review prompt for AI-powered code review. Returns formatted PR data and review guidelines that can be used with an LLM to generate a comprehensive review. The LLM can then use submit_pr_review to submit the review.
Submit a review to a pull request
Update PR title, description, or state
Validate if a comment target (path, line, side) is valid for the PR diff. Returns validation status, reason for invalidity, and nearest valid line suggestion if applicable.
Error handling is absent from tool implementations. The code returns generic success messages ('✅ Review submitted successfully') but does not document what errors could occur, how to categorize them (retryable vs. user-fixable), or what the LLM should do next on failure. E.g., what if the GitHub API rate limit is hit? What if the user lacks permissions?
Parameter descriptions are often missing or incomplete. E.g., 'add_pr_comment' accepts 'commit_id' and 'in_reply_to' but these are undescribed. LLMs cannot infer when to use commit_id vs. path+line, or how to obtain a comment ID to reply to.
No pagination or result limiting documented. Tools like 'get_pr_reviews', 'get_pr_comments', and 'get_pr_files' return all results without documented limits. A PR with 1000 comments could blow the context window. No total count or next_cursor returned.
Metadata responses not stripped. The code calls GitHub API and returns JSON.stringify() of raw responses, which likely includes internal metadata (timestamps, user IDs, URLs, audit fields) the LLM does not need. High token count dilutes signal.
Tool composition is weak. E.g., 'add_pr_comment' accepts 'commit_id' and 'path'+'line' but does not guide the LLM on which to use. Calling 'validate_pr_comment_target' first is not enforced. The server offers the tools but does not scaffold the workflow.
No idempotency guarantees documented. Destructive tools like 'submit_pr_review', 'add_pr_comment', and 'update_pr' do not state whether they are idempotent. If an agent retries due to a network error, will it create duplicate reviews or comments?