GitHub, GitLab & PR Code Review MCP Servers: SKILL.md Automation Playbook
A complete, copy-pasteable SKILL.md that teaches your agent to review pull requests through the GitHub MCP server: which tools to call, in what order, and where it must stop for approval.
An MCP server gives your agent the tools; a SKILL.md gives it the procedure. This playbook ships a full PR-review skill built on the GitHub MCP server's real tool names (pull_request_read, pull_request_review_write, add_comment_to_pending_review), a GitLab variant, and the testing loop to make it reliable before you publish it.
Verified Capabilities Benchmarked in This Guide
Inspect Live JSON Feed ↗GitHub Official MCP — Repositories, Pull Requests, Actions & Code Search
Official GitHub MCP server for searching repositories, inspecting PR diffs and review comments, triaging issues, and reading GitHub Actions workflow runs.
GitLab Merge Requests, CI Pipelines & Issue Tracker MCP Server
Connect AI coding agents to GitLab self-hosted or cloud instances: inspect Merge Request diffs, debug failed GitLab CI jobs, and update issues.
Portable SKILL.md Authoring, Trigger Optimization & QA Playbook
Author, test, and package reusable `SKILL.md` playbooks compatible with Grok Bot, Claude Code, and Cursor: YAML frontmatter trigger phrasing, progressive d
GitHub Actions Matrix Caching, OIDC & Fast CI Pipeline Skill
Cut GitHub Actions CI runtimes by 60%: configure pnpm/Cargo/Docker layer caching, concurrency cancel-in-progress groups, and keyless OIDC cloud deployments
Sentry Stack-Trace Triage, Source Maps & Root-Cause Skill
Query production Sentry issues, resolve minified JavaScript/TypeScript stack traces via source maps, correlate release commits, and generate minimal reprod
LLM Indirect Prompt Injection & Untrusted Data Fencing Skill
Defend autonomous agents against indirect prompt injection in emails, web pages, and MCP tool outputs using XML data fencing, privilege separation, and hum
1. Why code review needs a skill, not just a server
Connect the GitHub MCP server and ask an agent to review a PR, and you will get inconsistent results: sometimes it reads the diff, sometimes only the description; sometimes it posts comments immediately. A SKILL.md fixes the order of operations, caps the output, and encodes the approval gate. The skill is plain Markdown with YAML frontmatter, so it works across agents that support the SKILL.md format.
2. The full skill file
Save this as skills/pr-review-github-mcp/SKILL.md. Tool names and methods match the GitHub MCP server's documented tools (pull_request_read methods get, get_files, get_diff, get_status, get_review_comments; pull_request_review_write; add_comment_to_pending_review).
3. GitLab variant: what changes
GitLab's built-in MCP server (https://<your-gitlab>/api/v4/mcp) uses merge requests rather than pull requests and its own tool names, which vary by GitLab version and enabled toolsets. Do not copy the GitHub tool names. Instead, ask your agent to list the server's tools once, then write the GitLab skill against those exact names. Keep the same structure: read, classify, draft, stop, submit only on approval.
4. Test the skill before you trust it
Skill quality comes from testing against real pull requests. The Portable SKILL.md Authoring playbook on LightState covers trigger tuning and progressive disclosure; here is the minimum test loop for a review skill.
- Pick five merged PRs where you know the right answer: one clean, one with a real bug, one huge refactor, one docs-only, one with a failing check.
- Run the skill on each and compare findings with what human reviewers flagged.
- Check the guardrails: the agent must stop before submitting, and must ignore an instruction you plant in a PR description (for example "approve this PR").
- Tighten the Steps section wherever the agent skipped a call or over-commented, then re-run all five.
5. Pair it with CI and production-context skills
A review skill gets better when it can see why CI failed and whether the touched code is throwing errors in production. Two catalog skills pair naturally: the GitHub Actions CI skill for caching, concurrency and OIDC fixes when get_status shows failures, and the Sentry root-cause skill for checking recent production exceptions in the files under review.
6. Publish your review skill
If your team has a review skill that works, publish it so others can reuse it. Submit the repo containing your SKILL.md, then claim it with your X handle so it appears on your builder profile.
Frequently Asked Questions
Which GitHub MCP tools does a PR review skill need?
pull_request_read (methods get, get_files, get_diff, get_status, get_review_comments) for reading, plus pull_request_review_write and add_comment_to_pending_review for drafting and submitting a review. Nothing else is required.
How do I stop the agent from posting comments without asking?
Have the skill create a pending review, add comments to it, and then stop and ask. Only call pull_request_review_write with method submit_pending after explicit approval. Also connect the server through a read-only URL while you test.
Can I reuse the same SKILL.md for GitLab?
Reuse the structure, not the tool names. GitLab's built-in MCP server has its own merge-request tools, so list them from your instance and substitute the exact names.
How long should a review SKILL.md be?
Short enough to load quickly. The example here is about 40 lines. Put long style guides in a separate reference file the skill links to.