MCP PR Review Pipeline

Name: MCP PR Review Pipeline
Author: skrptiq

Developer Official v1.0.16

Multi-agent pull request review via GitHub MCP — security, quality, and style agents with a human gate before posting

by skrptiq

code-review mcp pull-requests security

workflow Updated 15 July 2026 13 nodes

What's included 13 nodes

1 workflow 6 skills 6 prompts

workflow (1)

MCP PR Review Pipeline

Multi-agent PR review: fetch via MCP, three parallel review agents, human gate, post via MCP

skills (6)

PR Data Fetch

Retrieves pull request metadata, diff, and changed files from GitHub via MCP

Quality Review

Evaluates code quality — logic, architecture, testing, error handling, and maintainability

Review Gate

Human gate — pauses for you to review findings before posting to GitHub

Review Posting

Posts the approved review to GitHub via MCP — summary comment, inline comments, and verdict

Security Review

Scans changed files for security vulnerabilities, credential exposure, and unsafe patterns

Style Review

Checks code style, naming conventions, formatting, and project-specific patterns

prompts (6)

Fetch PR Data

Retrieves and structures pull request data from GitHub via MCP

Post Review

Formats and posts the approved review to GitHub via MCP

Quality Analysis

Evaluates code quality — logic, architecture, testing, and maintainability

Review Gate Summary

Synthesises findings from all review agents into a human-readable gate summary

Security Analysis

Analyses PR diff for security vulnerabilities and credential exposure

Style Analysis

Checks code style, naming, formatting, and project-specific conventions

Requirements 2 services, 1 permission, 1 data type

Services

LLM Service
GitHub (MCP)

Permissions

network:github.com

Data Handling

source code

Security Passed

All checks passed v1.0.16 · scanner v3.3.0

Detected

Services: github-mcp, llm-service
Permissions:
Data Handling:

Full report →

Version history 14 releases

v1.0.16 latest 15 July 2026

GH#844 — migrate the gate step from node-meta (`metadata.gate: true` in the skill) to the canonical execution-entry `gate: true` on the workflow step. Single source of truth; the engine + app read the execution entry. No behaviour change — `IsGate` is identical.

v1.0.15 14 July 2026

GH#833 — drop the embedded `github-mcp` service node; dep-reference the canonical `_shared/github-mcp@1.0.0`. This bundle was the source of the canonical content (current API). contents.services 1→0.

v1.0.14 3 July 2026

GH#745 — declare per-step `output: {name, type}` on every execution step (pr_data/text, security_review/text, quality_review/text, style_review/text, gate_decision/decision, posted_review/text). Lights up the #744 rich flow-map. Content-only; no bindings or logic changes.

v1.0.13 7 June 2026

Fix-forward after Row 3b v1.0.12 publish failure. The v1.0.12 per-skrpt CI's "Register version with Hub API" step failed because the consumer's source `manifest.id` (9de9f1f1…) did not match the D1 catalogue row's id (946666b0…) — a legacy drift from before Action 6 (`0bcc5ae0`) made publish-skrpt.mjs Step 2 INSERT use `manifest.id` for the D1 id column. v1.0.13 reconciles the source `manifest.id` to the catalogue authoritative value (Row-5-equivalent for consumers) and republishes. Per Adj-1: no re-tag of v1.0.12; the orphaned GitHub release artefact stays inert (no D1 versions row, no consumer pinned it).

v1.0.11 22 May 2026

Wave 2: re-signed with canonical engine signing pipeline.

v1.0.8 19 May 2026

Signature fix — RELEASE_NOTES.md now included in integrity checksum.

v1.0.7 19 May 2026

Initial catalogue release with full structural and content-quality validation. All scanner checks pass.

v1.0.6 18 May 2026