code-review — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited code-review (Rules) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
English | 中文
MCP (Model Context Protocol) server for code review. Enables AI assistants to review GitHub/GitLab Pull Requests and Merge Requests.
Keywords: MCP server, AI code review, GitHub pull request review, GitLab merge request, Cursor IDE, Claude Desktop, Model Context Protocol, automated PR comments.
uvx or pip# Run directly, no installation needed
uvx code-review-mcppip install code-review-mcp
# Run the server
code-review-mcp
# (Optional) Install Cursor rules to your project
code-review-mcp init-rulesgit clone https://github.com/OldJii/code-review-mcp.git
cd code-review-mcp
pip install -e .
code-review-mcp| Variable | Description | Required |
|---|---|---|
GITHUB_TOKEN | GitHub personal access token | When using GitHub |
GITLAB_TOKEN | GitLab personal access token | When using GitLab |
GITLAB_HOST | GitLab host URL | For self-hosted (default: gitlab.com) |
GitHub
# Option 1: Using gh CLI (Recommended)
brew install gh
gh auth login
# Option 2: Manual Token Creation
# Visit https://github.com/settings/tokens
# Create Personal Access Token with 'repo' scope
export GITHUB_TOKEN="your-token-here"GitLab
# Option 1: Using glab CLI (Recommended)
brew install glab
glab auth login
# For self-hosted GitLab
glab auth login --hostname gitlab.yourcompany.com
# Option 2: Manual Token Creation
# Visit GitLab -> Settings -> Access Tokens
# Create token with 'api' scope
export GITLAB_TOKEN="your-token-here"
export GITLAB_HOST="gitlab.yourcompany.com" # For self-hostedEdit ~/.cursor/mcp.json:
{
"mcpServers": {
"code-review": {
"command": "uvx",
"args": ["code-review-mcp"],
"env": {
"GITHUB_TOKEN": "your-github-token",
"GITLAB_TOKEN": "your-gitlab-token"
}
}
}
}Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"code-review": {
"command": "uvx",
"args": ["code-review-mcp"],
"env": {
"GITHUB_TOKEN": "your-github-token",
"GITLAB_TOKEN": "your-gitlab-token"
}
}
}
}# Start SSE server
code-review-mcp --transport sse --port 8000Client configuration:
{
"mcpServers": {
"code-review": {
"url": "http://your-server:8000/sse"
}
}
}# Start WebSocket server
code-review-mcp --transport websocket --port 8000Client configuration:
{
"mcpServers": {
"code-review": {
"url": "ws://your-server:8000/ws"
}
}
}docker build -t code-review-mcp .stdio mode
docker run -i --rm \
-e GITHUB_TOKEN="your-token" \
code-review-mcpSSE mode
docker run -d --rm \
-e GITHUB_TOKEN="your-token" \
-p 8000:8000 \
code-review-mcp --transport sse| Tool | Description |
|---|---|
get_review_rules | Get review rules (builtin + custom project rules) |
| Tool | Description |
|---|---|
get_pr_info | Get PR/MR details (title, description, branches) |
get_pr_changes | Get code changes (diff), supports file type filtering |
extract_related_prs | Extract related PR/MR links from description |
| Tool | Description |
|---|---|
add_inline_comment | Add inline comment to specific code line |
add_pr_comment | Add general comment |
batch_add_comments | Batch add comments (inline + general) |
Chat with Cursor or Claude:
Review GitHub PR
Review https://github.com/facebook/react/pull/12345Review GitLab MR
Review https://gitlab.com/group/project/-/merge_requests/678Review Self-hosted GitLab MR
Review https://gitlab.yourcompany.com/team/project/-/merge_requests/90Review Only Specific File Types
Review this PR, only check .py and .js files:
https://github.com/owner/repo/pull/123# Run with MCP Inspector
npx @modelcontextprotocol/inspector uvx code-review-mcpThis launches a web interface where you can:
# Clone repository
git clone https://github.com/OldJii/code-review-mcp.git
cd code-review-mcp
# Install dev dependencies
pip install -e ".[dev]"
# Run tests
pytest
# Debug with Inspector
npx @modelcontextprotocol/inspector python -m code_review_mcp.servercode-review-mcp/
├── src/
│ └── code_review_mcp/
│ ├── __init__.py # Package entry
│ ├── cli.py # CLI commands (init-rules, etc.)
│ ├── server.py # MCP server main logic
│ ├── providers.py # GitHub/GitLab providers
│ └── rules/ # Bundled Cursor rules
│ ├── code-review.mdc
│ └── code-review-en.mdc
├── pyproject.toml # Project config & PyPI publishing
├── Dockerfile # Docker build file
├── smithery.yaml # Smithery deployment config
├── CHANGELOG.md # Changelog
├── CONTRIBUTING.md # Contributing guide
└── README.md # DocumentationThis package includes built-in code review rules for Cursor IDE. Install them to your project with one command:
# Install rules to current project
code-review-mcp init-rules
# Install to a specific directory
code-review-mcp init-rules --target /path/to/project
# Overwrite existing rules
code-review-mcp init-rules --force
# List available rules
code-review-mcp list-rulesAfter installation, the rules will be available in your project's .cursor/rules/ directory:
code-review.mdc - Chinese versioncode-review-en.mdc - English versionYou can define project-specific review rules that the MCP server loads at runtime. This allows each project to enforce its own coding standards during reviews.
Quick Setup:
# Generate a custom rules template
code-review-mcp init-rules --customThis creates .code-review-rules/project-rules.md in your project. Edit it with your project-specific conventions, then configure the MCP server to load it:
{
"mcpServers": {
"code-review": {
"command": "uvx",
"args": ["code-review-mcp"],
"env": {
"GITHUB_TOKEN": "your-token",
"CODE_REVIEW_RULES_DIR": "/absolute/path/to/project/.code-review-rules"
}
}
}
}How It Works:
CODE_REVIEW_RULES_DIR to a directory containing .md or .mdc files.code-review-rules/ directory in your project root (auto-discovered)get_review_rules tool returns both builtin and custom rulesEnvironment Variable:
| Variable | Description | Required |
|---|---|---|
CODE_REVIEW_RULES_DIR | Path to custom rules directory | No (optional) |
Contributions welcome! See CONTRIBUTING.md for details.
What is code-review-mcp? An MCP server that lets AI assistants (Cursor, Claude, etc.) fetch PR/MR diffs and post inline or general review comments on GitHub and GitLab.
How do I install it? Fastest: uvx code-review-mcp. Or pip install code-review-mcp. See Quick Start.
Does it work with self-hosted GitLab? Yes. Set GITLAB_TOKEN and GITLAB_HOST=gitlab.yourcompany.com.
Which AI clients are supported? Any MCP client — Cursor, Claude Desktop, and custom integrations via stdio, SSE, or WebSocket.
Can I add project-specific review rules? Yes. Run code-review-mcp init-rules --custom or set CODE_REVIEW_RULES_DIR.
Is my code stored on a server? No persistent storage. Tokens are read from environment variables; diffs are fetched on demand from GitHub/GitLab APIs.
Where can AI assistants read a structured summary? See llms.txt in this repository.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.