mergewarden — Claude Code MCP server: what it does, how to install
Inspects incoming pull requests for missing context and sensitive boundary changes before code review. Works without calling AI models or running external code.
claude mcp add mergewarden -- npx -y mergewarden-mcpWhat mergewarden does
MergeWarden audits pull requests using deterministic checks rather than language models. It flags contributions that omit linked issues, carry fewer than 80 characters of description, drop repository template sections, or exceed 50 modified files and 1500 lines. The inspection relies on base commit structures and metadata without executing untrusted pull request code.
A deeper security scan focuses on sensitive touchpoints across the repository. It surfaces workflow permission escalations, lifecycle install scripts inside package manifests, unvalidated text flowing into action prompts, and modifications to agent guidelines like CLAUDE.md or .mcp.json.
The server never assigns arbitrary quality scores or automatically closes contributions. Because it operates purely on explicit rules, it marks incomplete inspection results rather than assuming missing details represent safe code.
What it helps with
- spot pull requests missing issue references or containing minimal text
- detect unauthorized edits to agent prompt files like
CLAUDE.mdand.mcp.json - catch risky workflow triggers and elevated permissions in GitHub Actions
- flag newly added lifecycle install scripts in package configurations
Example prompts for the agent
- Scan pull request
https://github.com/owner/repository/pull/123for security boundary risks - Triage open pull requests in
owner/repositoryusing mergewarden
How to install mergewarden
Platform CLI
claude mcp add mergewarden -- npx -y mergewarden-mcpPlatform CLI
codex mcp add mergewarden -- npx -y mergewarden-mcpConfig file
{
"mcpServers": {
"mergewarden": {
"command": "npx",
"args": [
"-y",
"mergewarden-mcp"
]
}
}
}Config file
{
"servers": {
"mergewarden": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"mergewarden-mcp"
]
}
}
}Platform CLI
gemini mcp add mergewarden npx -y mergewarden-mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about mergewarden
How do I install mergewarden in Claude Code?
Run claude mcp add mergewarden -- npx -y mergewarden-mcp in your terminal.
What security boundaries does mergewarden verify?
The scan tracks workflow permission changes, lifecycle scripts in dependencies, pull request text reaching workflow prompts, and modifications to steering files such as AGENTS.md or .mcp.json.
Does mergewarden use LLMs to score code?
No. It relies entirely on deterministic heuristics without executing code or calling language models, and it never labels pull requests as spam or poor quality.
