Overview
Human PR reviews are expensive and inconsistent. This workflow turns Claude into a first-pass reviewer that runs against every PR: it reads the diff, understands the surrounding code via the GitHub MCP server, checks it against a versioned rubric (style guide, security rules, test coverage), and leaves inline comments — never approving on its own, always deferring the final call to a human.
How it works
- Claude Desktop (or a headless Claude client) connects to the GitHub MCP server with a scoped personal access token.
- A webhook on pull_request events triggers the agent via a small Cloudflare Worker.
- The agent uses MCP to read the diff, the surrounding files, and the PR description.
- A system prompt encodes your review rubric: naming, error handling, test presence, common security anti-patterns, and doc updates.
- Claude posts inline comments and a summary, tagging a human owner for the final approve/deny.
Benefits
- Every PR gets a review inside 60 seconds, not next-day.
- Reviewers spend their time on architecture, not nits.
- Style-guide drift disappears because the rubric is versioned in one file.
Use cases
- Small teams where the senior engineer is the bottleneck on reviews.
- Open-source projects with unpredictable contributor volume.
- Consultancies that want a consistent baseline across many client repos.
Step-by-step guide
Step 1: Install the GitHub MCP server
Use the official @modelcontextprotocol/server-github package. Give it a fine-scoped PAT with pull_requests:write and contents:read on the target repos only.
Step 2: Author the review rubric
Write a single markdown file with your review rules grouped by category. This becomes the system prompt; commit it to the repo so history is auditable.
Step 3: Wire the webhook
A Cloudflare Worker verifies the GitHub HMAC signature, then invokes Claude with the PR number. Keep the worker small — no business logic, just secure hand-off.
Step 4: Prompt for humility
Instruct Claude to say 'I'm not sure' and defer, not guess. Ask it to cite the file and line for every claim so reviewers can verify quickly.
Step 5: Roll out on one repo
Enable on a low-traffic repo first. Read the first 20 reviews line-by-line and tighten the rubric before expanding.
Step 6: Add feedback loops
When a human overrides a comment, log the diff between what the agent said and what shipped. Weekly, feed the top disagreements back into the rubric.
Example
PR comment: 'src/auth/session.ts:42 — new setCookie call is missing HttpOnly and Secure flags. Our rubric §3.2 requires both on any auth cookie. Suggested fix: pass { httpOnly: true, secure: true, sameSite: "lax" }.'