# mergewarden

Inspects incoming pull requests for missing context and sensitive boundary changes before code review. Works without calling AI models or running external code.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 14
- Author: sjh9714
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/sjh9714/mergewarden
- Updated: 2026-10-21
- HTML: https://affpapa.org/en/nevibecode/mcp/mergewarden

## What it does

MergeWarden audits pull requests using deterministic checks rather than language models. It flags contributions that omit linked issues, carry fewer than 80 characters of description, drop repository template sections, or exceed 50 modified files and 1500 lines. The inspection relies on base commit structures and metadata without executing untrusted pull request code.

A deeper security scan focuses on sensitive touchpoints across the repository. It surfaces workflow permission escalations, lifecycle install scripts inside package manifests, unvalidated text flowing into action prompts, and modifications to agent guidelines like `CLAUDE.md` or `.mcp.json`.

The server never assigns arbitrary quality scores or automatically closes contributions. Because it operates purely on explicit rules, it marks incomplete inspection results rather than assuming missing details represent safe code.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add mergewarden -- npx -y mergewarden-mcp
```

### Codex

**Platform CLI**
```bash
codex mcp add mergewarden -- npx -y mergewarden-mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "mergewarden": {
            "command": "npx",
            "args": [
                "-y",
                "mergewarden-mcp"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "mergewarden": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "mergewarden-mcp"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add mergewarden npx -y mergewarden-mcp
```

## When to use it
- spot pull requests missing issue references or containing minimal text
- detect unauthorized edits to agent prompt files like `CLAUDE.md` and `.mcp.json`
- catch risky workflow triggers and elevated permissions in GitHub Actions
- flag newly added lifecycle install scripts in package configurations

## Example prompts
- Scan pull request `https://github.com/owner/repository/pull/123` for security boundary risks
- Triage open pull requests in `owner/repository` using mergewarden

## Similar
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74569
- [Codebase Memory](https://affpapa.org/en/nevibecode/mcp/codebase-memory.md) — MCP server · ★ 47577
- [Serena MCP: the IDE for your agent](https://affpapa.org/en/nevibecode/mcp/serena-mcp-the-ide-for-your-agent.md) — MCP server · ★ 30739
- [Repomix](https://affpapa.org/en/nevibecode/mcp/repomix.md) — MCP server · ★ 29037
- [Repowise](https://affpapa.org/en/nevibecode/mcp/repowise.md) — MCP server · ★ 7925
- [sem](https://affpapa.org/en/nevibecode/mcp/sem.md) — MCP server · ★ 3427

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md