# ReviewGuard

Keeps the write-enabled GitHub token on the server side and hands the agent review operations only. Draft comments stay invisible until a human submits.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 4
- Author: eclipsesource
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/eclipsesource/review-guard
- Updated: 2026-09-24
- HTML: https://affpapa.org/en/nevibecode/mcp/reviewguard

## What it does

Leaving review comments in a pull request takes a GitHub token with write access. Handing that token straight to an agent opens the door to prompt-injected approvals, change requests, or edits in unrelated repositories. ReviewGuard sits in between: the token never reaches the agent, and the permitted operations are locked in when the server starts. The agent cannot renegotiate them.

Pending mode is what you get by default. The agent reads the PR discussion and builds a draft review; none of it becomes visible until someone opens the pull request and submits the review themselves. The `submit` tool is not registered at all in this mode, and the client refuses every submit call. That fits IDE workflows where the agent drafts inline notes and a person stays the reviewer of record.

Autonomous posting is opt-in through `--allow-submit` with a list of allowed actions (`approve`, `comment`, `reject`). The `submit` tool appears, yet every posted review opens with a fixed disclaimer the agent can neither edit nor drop. Add `--allow-resolve` and the agent may close its own threads only; `--repo` and `--pr` pin the server to a single pull request. Node.js >= 22 is required, and the server will not start without `GITHUB_TOKEN`.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `GITHUB_TOKEN` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add review-guard -e GITHUB_TOKEN=<GITHUB_TOKEN> -- npx -y @eclipsesource/review-guard-mcp
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add reviewguard --env GITHUB_TOKEN=<GITHUB_TOKEN> -- npx -y @eclipsesource/review-guard-mcp
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "reviewguard": {
            "command": "npx",
            "args": [
                "-y",
                "@eclipsesource/review-guard-mcp"
            ],
            "env": {
                "GITHUB_TOKEN": "<GITHUB_TOKEN>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "reviewguard": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@eclipsesource/review-guard-mcp"
            ],
            "env": {
                "GITHUB_TOKEN": "<GITHUB_TOKEN>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e GITHUB_TOKEN=<GITHUB_TOKEN> reviewguard npx -y @eclipsesource/review-guard-mcp
```
Replace <…> with your own values

## When to use it
- let an agent comment on PRs without handing it a write token
- build a draft review a human submits later
- run a bot that posts comments and never approves
- resolve your own stale threads after a new push
- keep the agent scoped to one pull request

## Example prompts
- Pull the review context for this PR and add a comment about error handling in `src/api.ts`
- Draft a review of the latest commit, don't submit anything
- Submit the review with comments only, no approval

## Similar
- [github-code-review](https://affpapa.org/en/nevibecode/skills/github-code-review.md) — skill · 1300 installs
- [mergewarden](https://affpapa.org/en/nevibecode/mcp/mergewarden.md) — MCP server · ★ 14
- [code-review](https://affpapa.org/en/nevibecode/skills/anthropics-code-review.md) — skill · 9900 installs
- [git-pr-reviewer](https://affpapa.org/en/nevibecode/skills/git-pr-reviewer.md) — skill · 320 installs
- [gh-stack](https://affpapa.org/en/nevibecode/skills/gh-stack.md) — skill · 18800 installs
- [autofix](https://affpapa.org/en/nevibecode/skills/autofix.md) — skill · 10400 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md