ReviewGuard MCP: Keeping AI-Augmented Code Review Under Control

TL;DR

An agent helping with code review works directly on a public GitHub PR, so what it may post there needs a real boundary. ReviewGuard MCP holds the GitHub token itself and fixes the allowed operations at server start, so the agent cannot talk its way past them.

👉 @eclipsesource/review-guard-mcp is on npm, listed on the AI registry at ai.openvsx.org, and the source is at github.com/eclipsesource/review-guard.

Two Different Use Cases

AI-supported reviews take two different forms:

• AI-Augmented Reviews: An AI agent helps a human reviewer gather and formulate review comments
• Autonomous AI Reviews: An AI agent performs a whole review on its own

The ReviewGuard MCP server was built to support both use cases as well as possible.

AI-Augmented Reviews

We are convinced that the best reviews are produced by a maintainer and AI working together. The AI handles the mechanical parts of a review, adds its own findings, and points the maintainer at critical code paths. The maintainer contributes their own findings from their expertise and polishes the AI’s, from rejecting some to fine-tuning others.

Once the maintainer and the AI have settled on their findings, the agent has the full context of what was discussed. Entering all findings manually in the GitHub UI is cumbersome for the maintainer, so it is natural to let the agent help with submitting the review comments to GitHub.

However, telling an agent “don’t submit reviews” or “don’t touch other people’s threads” in a prompt is not a safety boundary, especially given how determined stronger models are to get the job done. And a review agent reads attacker-controlled text all day, since the diff and the PR discussion are exactly what it is supposed to look at.

That is why we built ReviewGuard MCP. The server holds the GitHub token and the agent never sees it. Which operations exist is decided when the server starts, not later in a conversation. Under the hood it talks to GitHub’s APIs directly. For convenience, if the gh CLI happens to be installed and logged in, it borrows the token from there, so you do not have to configure one.

In the default mode the agent can read the PR and its discussion and build a pending draft review: add inline comments, edit them, drop them again. Nothing it writes is visible to anyone until a human opens the PR, looks at the draft, and submits it. That is not a rule the agent is asked to follow: the submit tool is not registered at all and the server refuses every submit action. This is the mode you want in an IDE, where the agent drafts and you stay the reviewer of record.

Autonomous AI Reviews

Although not of the same quality as an AI-augmented review, autonomous AI reviews still have their place. They can act as a quality threshold before a maintainer spends time on a PR, or as a quick check after a maintainer review for “another pair of eyes”.

ReviewGuard MCP supports this use case as well, via opt-in capabilities at server start:

• Submitting can be allowed, optionally restricted to specific actions (approve, comment, request changes).
• The agent may be permitted to resolve its own review threads. Threads started by anyone else are refused.
• The MCP server can be pinned to a single pull request, so the agent cannot place a review on any other pull request the token might have access to.
• The submit body can be prefixed with a disclaimer that the agent cannot override.

We use this ourselves: the EclipseSourceAI account reviews PRs in Eclipse Theia, and this review on theia#17890 is a good example.

Pairing It with a Sandbox

ReviewGuard MCP bounds what the agent can do on GitHub. It says nothing about what it can do on the machine it runs on, which for an autonomous bot matters just as much. We run those reviews inside Eclipse Enclave, a sandbox for coding agents: the agent lives in a container, so the checkout it can touch is a throwaway worktree and the hosts it can reach are the ones you named in the network allowlist.

The two fit together nicely. Enclave keeps the agent off everything except the code under review, and ReviewGuard MCP turns its one channel back out into a short list of review operations on one PR. ReviewGuard’s HTTP mode exists for exactly this combination: the server runs on the host with the token, and the sandboxed agent reaches it over the container gateway without ever holding a credential.

Try It

We are sharing it because others are likely hitting the same problem. It is a plain MCP server over stdio or HTTP, so it works the same from Claude Code, Codex, Theia AI, or anything else that speaks MCP.

📦 @eclipsesource/review-guard-mcp on npm

🗂️ Listed on the AI registry at ai.openvsx.org

🛠️ Source at github.com/eclipsesource/review-guard

Improving Dev Workflows with AI Tooling

Are you looking for ways to improve your dev workflows with AI tooling? Review is one step where the gap between a demo and something you can hand to a team is mostly about control and integration, and the same is true for the rest of the workflow.

At EclipseSource, we help teams set up AI coding workflows that hold up in real projects, and we build custom AI-native tools and IDEs where off-the-shelf tooling does not fit.

👉 AI Coding Training & Guided Adoption

👉 Services for Building AI-Enhanced Tools and IDEs

👉 Contact us to discuss your project

💼 Follow us: EclipseSource on LinkedIn

🎥 Subscribe to our YouTube channel: EclipseSource on YouTube