pr-review-mcp (thebtf/pr-review-mcp) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 21 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
C
Caution
74/100

pr-review-mcp

Unified MCP control plane for AI pull request reviews on GitHub.

→ thebtf/pr-review-mcp· listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

thebtf

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical, 1 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
⚠️
Tests do not pass
Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.
🔐
You'll be asked for 1 credential: GITHUB_PERSONAL_ACCESS_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes21 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

pr_summary

Get PR review statistics: total, resolved, unresolved counts by severity and file

pr_list_prs

List all pull requests in a repository with stats (review threads, comments, changes)

pr_list

List PR review comments with optional filtering by resolved/file/severity

pr_get

Get detailed comment information including full body and AI prompt

pr_changes

Get comments since cursor for incremental updates

pr_poll_updates

Poll for new review updates since a timestamp (comments, commits, status, agents). Use include=["agents"] for agent completion status.

pr_await_reviews

Non-blocking: checks agent review completion status once and returns immediately. Use after pr_invoke — pass the `since` field. Returns retryAfterMs hint if agents are still pending (call again after that delay). Per-agent timeouts via maxWaitMs mark agents that likely won't respond.

pr_resolve

Mark a review thread as resolved

pr_invoke

Invoke AI code review agents on a PR. When agent="all", agents are resolved from: (1) .github/pr-review.json in repo, (2) PR_REVIEW_AGENTS env var, (3) default (coderabbit only). Use pr:setup prompt to configure per-repo agents. Smart detection skips agents that already reviewed (use force to overri…

pr_labels

Get, add, remove, or set labels on a PR

pr_reviewers

Request or remove reviewers on a PR

pr_create

Create a new pull request from an existing branch

pr_merge

Merge a pull request. Uses interactive elicitation for confirmation when supported, falls back to confirm=true parameter.

pr_claim_work

Claim file partition for parallel PR review processing

pr_report_progress

Report completion status for a claimed file partition

pr_get_work_status

Get current coordination run status and progress

pr_reset_coordination

Reset/clear the current coordination run. Uses interactive elicitation for confirmation when supported, falls back to confirm=true parameter.

pr_progress_update

Report orchestrator phase transition (called by background subagent)

pr_progress_check

Check orchestrator progress and run status in a single call

pr_sessions

List active and recent review invocations across sessions. Shows which agents were invoked, their completion status, and elapsed time. Useful for recovery after crash/compaction.

pr_cancel

Cancel an active review invocation, preventing further polling. Provide either invocationId (from pr_invoke or pr_sessions) or (owner, repo, pr) to cancel the most recent active invocation for that PR.

// known CVEs in dependencies1 critical1 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@4.0.0GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

high@modelcontextprotocol/sdk@1.0.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

lowzod@3.22.0GHSA-m95q-7qp3-xv42

Zod denial of service vulnerability

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretGITHUB_PERSONAL_ACCESS_TOKEN"": "ghp_your_token_here"
configMCP_STARTUP_DELAY
configMCP_TEST_OWNER
configMCP_TEST_REPO
configPR_REVIEW_AGENTSNo coderabbit Comma-separated agent IDs used when pr_invoke resolves agent: "all" without repository config.
configPR_REVIEW_MODENo sequential Review invocation mode: sequential or parallel.
// quality suggestions

Tool inputs are validated

Only 0/21 tool handlers declare input schemas (0%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool test coverage

Only 2/21 tools referenced in tests (10%)

Write tests that reference each tool by name so every tool has at least one test.

Tests pass

npm test failed — tests do not pass

Make sure npm test runs cleanly. Common cause: missing build step or missing env vars.

Shell command execution

16 child_process calls — runs shell commands

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Production dependencies are patched

0 critical, 1 high severity in production deps — @modelcontextprotocol/sdk@1.0.0 (high), zod@3.22.0 (low)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/thebtf/pr-review-mcp?variant=verified)](https://m8ven.ai/mcp/thebtf/pr-review-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 6b43398eb7dadccc3c05c78fa18d6a094e03da76
code hash: 188cae0bc1cb661c5f5d54914c164b412eb0a0ca97c8d7931465f2dcd76105a6
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client