How to use MCP for automated code review

1// Claude Desktop: ~/Library/Application Support/Claude/claude_desktop_config.json
2{
3  "mcpServers": {
4    "github": {
5      "command": "npx",
6      "args": ["-y", "@modelcontextprotocol/server-github"],
7      "env": {
8        "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_your_token_here"
9      }
10    }
11  }
12}

1// Add to your mcpServers configuration:
2{
3  "mcpServers": {
4    "github": { /* ... from previous step */ },
5    "filesystem": {
6      "command": "npx",
7      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/path/to/your/repo"],
8      "env": {}
9    }
10  }
11}

1// Example review prompt for Claude Desktop / Cursor:
2// "Review PR #42 in the repository owner/repo-name.
3// 
4// Steps:
5// 1. Use the GitHub tools to fetch the PR diff and changed files list
6// 2. For each changed file, use the filesystem tools to read the full file
7// 3. Check for:
8//    - Logic bugs and edge cases
9//    - Security vulnerabilities (injection, XSS, auth bypass)
10//    - TypeScript type safety issues
11//    - Missing error handling
12//    - Performance concerns
13//    - Code style violations per our .cursorrules
14// 4. Format each finding as:
15//    FILE: path/to/file.ts
16//    LINE: 42
17//    SEVERITY: critical | warning | suggestion
18//    ISSUE: Description of the problem
19//    FIX: Suggested code change
20// 
21// Be specific with line numbers and provide concrete fix suggestions."

1// src/tools/review-tools.ts
2import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
3import { z } from "zod";
4
5export function registerReviewTools(server: McpServer) {
6  server.tool(
7    "get_pr_diff",
8    "Get the diff for a pull request",
9    {
10      owner: z.string(),
11      repo: z.string(),
12      prNumber: z.number(),
13    },
14    async ({ owner, repo, prNumber }) => {
15      const response = await fetch(
16        `https://api.github.com/repos/${owner}/${repo}/pulls/${prNumber}`,
17        {
18          headers: {
19            Authorization: `Bearer ${process.env.GITHUB_TOKEN}`,
20            Accept: "application/vnd.github.v3.diff",
21          },
22        }
23      );
24      const diff = await response.text();
25      return { content: [{ type: "text", text: diff }] };
26    }
27  );
28
29  server.tool(
30    "post_review_comment",
31    "Post a review comment on a specific line of a PR",
32    {
33      owner: z.string(),
34      repo: z.string(),
35      prNumber: z.number(),
36      body: z.string().describe("Comment text"),
37      path: z.string().describe("File path relative to repo root"),
38      line: z.number().describe("Line number in the diff"),
39    },
40    async ({ owner, repo, prNumber, body, path, line }) => {
41      const response = await fetch(
42        `https://api.github.com/repos/${owner}/${repo}/pulls/${prNumber}/comments`,
43        {
44          method: "POST",
45          headers: {
46            Authorization: `Bearer ${process.env.GITHUB_TOKEN}`,
47            "Content-Type": "application/json",
48          },
49          body: JSON.stringify({ body, path, line, side: "RIGHT" }),
50        }
51      );
52      if (!response.ok) {
53        const error = await response.text();
54        return { content: [{ type: "text", text: `Error: ${error}` }], isError: true };
55      }
56      return { content: [{ type: "text", text: `Comment posted on ${path}:${line}` }] };
57    }
58  );
59}

1# .github/workflows/ai-review.yml
2name: AI Code Review
3on:
4  pull_request:
5    types: [opened, synchronize]
6
7jobs:
8  review:
9    runs-on: ubuntu-latest
10    permissions:
11      pull-requests: write
12      contents: read
13    steps:
14      - uses: actions/checkout@v4
15        with:
16          fetch-depth: 0
17      - uses: actions/setup-node@v4
18        with:
19          node-version: 20
20      - name: Install MCP review server
21        run: cd review-server && npm ci && npx tsc
22      - name: Run AI code review
23        env:
24          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
25          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
26          PR_NUMBER: ${{ github.event.pull_request.number }}
27          REPO_OWNER: ${{ github.repository_owner }}
28          REPO_NAME: ${{ github.event.repository.name }}
29        run: node review-server/dist/run-review.js