Which integrations are available for this server?

Provides a local LLM backend for code review using Ollama, keeping code private. Supports OpenAI and compatible APIs as the LLM backend for code reviews.

How do I use codereview-mcp?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@codereview-mcp review the latest commit diff" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

codereview-mcp

by lfylow

Overview Schema Related Servers Score Discussions

Python

Local

codereview-mcp

License Python

An MCP server that lets an AI coding agent review code with a language model. Point it at a git diff, a file, or a snippet and it returns a structured review with severity levels. It works with any MCP client (Claude Code, Cursor, VS Code, Continue, Windsurf) and supports Ollama (local, the default), OpenAI, Anthropic, OpenRouter, and any OpenAI-compatible server (llama.cpp, vLLM, LM Studio, and similar).

With the default Ollama backend, code never leaves your machine.

What it does

Reviews git diff output, parsing it per file and skipping binaries and deletions
Reviews whole files, with language auto-detected from the extension (50+ languages)
Reviews inline snippets in a language you specify
Returns findings tagged by severity: CRITICAL, WARNING, SUGGESTION, NOTE
Retries transient provider failures (rate limits, timeouts, 5xx) with backoff

It is a reviewer, not a gate. The output is advice from a model and should be read by a human, not wired straight into an automatic merge. See SECURITY.md for the threat model, including prompt injection.

Related MCP server: AI-PR-Review-MCP

Install

Requires Python 3.10+. Install from the repository:

pip install git+https://github.com/lfylow/codereview-mcp

Or from a clone:

git clone https://github.com/lfylow/codereview-mcp
cd codereview-mcp
pip install .

For the default local backend, install Ollama and pull a model. A coding-tuned model gives noticeably better reviews than a small general model:

ollama pull qwen2.5-coder:7b      # recommended
# or the smaller default, lighter on RAM:
ollama pull llama3.2:3b

Then run the server (it speaks MCP over stdio, so it's normally launched by a client rather than by hand):

codereview-mcp --model qwen2.5-coder:7b

To see which models are installed on your Ollama server:

codereview-mcp --list-models

Connect an agent

Claude Code

claude mcp add codereview-mcp -- codereview-mcp

To use a hosted provider, pass the environment through:

claude mcp add codereview-mcp --env LLM_PROVIDER=openai --env OPENAI_API_KEY=sk-... -- codereview-mcp

VS Code (Copilot) — `.vscode/mcp.json`

{
  "servers": {
    "codereview-mcp": { "type": "stdio", "command": "codereview-mcp" }
  }
}

Cursor — `.cursor/mcp.json`

{
  "mcpServers": {
    "codereview-mcp": { "command": "codereview-mcp" }
  }
}

Continue / Windsurf

Both use the same shape as Cursor: an mcpServers entry with "command": "codereview-mcp". Add provider keys under an "env" object on that entry if you aren't using Ollama.

Once connected, ask the agent things like "review my staged changes" or "review src/auth.py" and it will call the matching tool.

Tools

Tool	Use it for
`review_git_diff(diff)`	Output of `git diff`. Reviewed per file.
`review_code_file(filepath)`	A file on disk. Language detected from the extension.
`review_code_snippet(code, language="python")`	A piece of code not yet in a file.

Providers

Provider	Set `LLM_PROVIDER` to	Connection	Notes
Ollama	`ollama` (default)	local server, no key	Code stays on your machine
OpenAI	`openai`	`OPENAI_API_KEY`	Also any OpenAI-compatible API via `OPENAI_BASE_URL`
Anthropic	`anthropic`	`ANTHROPIC_API_KEY`
OpenRouter	`openrouter`	`OPENROUTER_API_KEY`	One key, many models — see openrouter.ai/models
OpenAI-compatible (llama.cpp, vLLM, LM Studio)	`openai` + `OPENAI_BASE_URL`	usually no key	Local servers generally ignore the key

Authentication is by API key. The hosted providers don't offer an official way to use an account subscription in place of an API key for programmatic API access, so that mode isn't supported.

# OpenRouter
LLM_PROVIDER=openrouter OPENROUTER_API_KEY=sk-or-... codereview-mcp

# local OpenAI-compatible server (e.g. LM Studio on :1234), no key needed
LLM_PROVIDER=openai OPENAI_BASE_URL=http://localhost:1234/v1 codereview-mcp --model my-local-model

Models

Review quality tracks the model. For local use, a coding-tuned model is worth the extra download:

Model	Pull with	Notes
Qwen2.5-Coder	`ollama pull qwen2.5-coder:7b`	Strong all-round code model; `:14b`/`:32b` if you have the VRAM
Qwen3-Coder	`ollama pull qwen3-coder`	Newer Qwen coding model
DeepSeek-Coder V2	`ollama pull deepseek-coder-v2`	Good multi-language coverage
Codestral	`ollama pull codestral`	Mistral's code model
CodeLlama	`ollama pull codellama`	Widely available baseline
Llama 3.2 3B	`ollama pull llama3.2:3b`	The default — small and fast, lighter reviews

Run codereview-mcp --list-models to see what's installed locally. Pick a model with --model, OLLAMA_MODEL, or the config file.

Configuration

Configuration is read from defaults, then a config file, then environment variables, then CLI flags — each layer overriding the previous one.

Environment variables

Variable	Default	Description
`LLM_PROVIDER`	`ollama`	`ollama`, `openai`, `anthropic`, or `openrouter`
`OLLAMA_BASE_URL`	`http://localhost:11434`	Ollama server URL
`OLLAMA_MODEL`	`llama3.2:3b`	Ollama model name
`OPENAI_API_KEY`	—	OpenAI API key (optional for local servers)
`OPENAI_MODEL`	`gpt-4o-mini`	OpenAI model name
`OPENAI_BASE_URL`	—	Custom OpenAI-compatible endpoint
`ANTHROPIC_API_KEY`	—	Anthropic API key
`ANTHROPIC_MODEL`	`claude-sonnet-4-6`	Anthropic model name
`OPENROUTER_API_KEY`	—	OpenRouter API key
`OPENROUTER_MODEL`	`qwen/qwen3-coder-30b-a3b-instruct`	OpenRouter model slug
`OPENROUTER_BASE_URL`	`https://openrouter.ai/api/v1`	OpenRouter endpoint
`MAX_TOKENS`	`4096`	Max tokens per response
`TEMPERATURE`	`0.3`	Sampling temperature (0–2)
`REQUEST_TIMEOUT`	`120`	Per-request timeout in seconds
`MAX_INPUT_CHARS`	`100000`	Reject inputs larger than this
`STREAM`	`true`	Stream responses; falls back to a single request if unsupported
`CUSTOM_PROMPT`	—	Override the review prompt (must contain `{code}` and `{language}`)

Config file

~/.config/codereview-mcp/config.yml on Linux/macOS (respects XDG_CONFIG_HOME), or %APPDATA%\codereview-mcp\config.yml on Windows:

llm_provider: ollama
ollama_model: llama3.2:3b
temperature: 0.2
max_tokens: 2048

CLI flags

codereview-mcp --help
codereview-mcp --version
codereview-mcp --provider openai --model gpt-4o
codereview-mcp --config /path/to/config.yml
codereview-mcp --list-models      # list installed Ollama models and exit
codereview-mcp --no-stream        # disable streaming
codereview-mcp --verbose

Example output

A review of a small Python file looks like this:

## Review: `src/database.py` (python)

🔴 CRITICAL — SQL injection
`f"SELECT * FROM users WHERE id = {user_id}"` interpolates user input into SQL.
Use a parameterized query: `cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))`

🟡 WARNING — connection never closed
The connection opened on line 2 is never closed. Use a context manager:
`with sqlite3.connect("users.db") as conn:`

🟢 SUGGESTION — use the built-in
`calculate_average` can be `sum(numbers) / len(numbers)`.

The exact wording depends on the model you run.

Troubleshooting

"connection refused" / transport errors — Ollama isn't running or isn't on the expected URL. Start it with ollama serve and check OLLAMA_BASE_URL.

Empty or low-quality reviews — small local models miss things. Try a larger model (OLLAMA_MODEL=qwen2.5-coder:7b) or a hosted provider.

"Input too large" — the file or diff exceeds MAX_INPUT_CHARS. Review a smaller chunk or raise the limit.

"API key is required" — set OPENAI_API_KEY or ANTHROPIC_API_KEY for the chosen provider.

Run with --verbose to see what the server is doing on stderr.

Limitations

Review quality depends entirely on the backing model. Small local models are fast and private but less thorough than large hosted ones.
The tool reviews the added/changed lines of a diff with surrounding context, not the full repository, so it can miss issues that span files.
Output is non-deterministic and advisory. It is not a substitute for tests or human review.

Development

git clone https://github.com/lfylow/codereview-mcp
cd codereview-mcp
pip install -e ".[dev]"

pytest
ruff check src/ tests/
ruff format --check src/ tests/
mypy

See CONTRIBUTING.md for more.

License

MIT — see LICENSE.

Available Tools

3 tools

review_code_fileB

Review an entire source file for bugs and improvements.

Provide the absolute path to a file. Language is auto-detected from the file extension. Supports 50+ languages.

Best for: reviewing new files, complete rewrites, or files where you want a comprehensive analysis of the entire codebase.

ParametersJSON Schema

Name	Required	Description	Default
`filepath`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

B3.3/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It does not disclose behavioral traits such as auth needs, rate limits, side effects, or that the tool is read-only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is compact (4 sentences), front-loaded with the main purpose. Slight redundancy in listing 'new files' twice, but overall efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With only one parameter and an output schema present, description covers basic needs. However, it misses differentiation from sibling tools, which reduces completeness for an agent choosing between tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% (no parameter descriptions in schema). Description adds meaning by stating filepath is absolute and language auto-detected, which is valuable context beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool reviews entire source files for bugs and improvements, mentions absolute path and language auto-detection. It gives use cases but does not explicitly contrast with siblings like review_code_snippet or review_git_diff.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description provides 'Best for' guidance (new files, rewrites, comprehensive analysis) but lacks explicit when-not-to-use or direct comparisons to sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

review_code_snippetA

Review a code snippet (not from a file) in the specified language.

Use this when you have a small piece of code to review that isn't in a file yet, or when you want to review an isolated snippet.

Args: code: The source code to review. language: Programming language (python, javascript, rust, go, etc.)

ParametersJSON Schema

Name	Required	Description	Default
`code`	Yes
`language`	No		python

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

A3.9/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility for behavioral disclosure. The description only says 'review' but does not explain what the review entails, what output is returned, or any side effects. Since an output schema exists but isn't described, the agent lacks critical behavioral insights beyond the basic operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with no wasted sentences. It opens with a clear purpose statement, follows with a usage paragraph, and then lists parameters. The structure is front-loaded and easy to parse. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (2 parameters, one required, no annotations), the description covers the main aspects: what it does, when to use it, and what parameters are needed. However, it omits the output format (despite an output schema existing) and lacks behavioral details. It is minimally adequate but not fully comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates by listing both parameters in an Args block with brief explanations: 'code: The source code to review' and 'language: Programming language (python, javascript, rust, go, etc.)'. This adds meaning beyond the schema, which only provides titles and types. However, it does not clarify defaults or constraints beyond examples.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'review' and the resource 'code snippet' and explicitly distinguishes it from file-based review by saying 'not from a file'. It also mentions the language parameter, making the purpose unambiguous and differentiating it from sibling tools like review_code_file and review_git_diff.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool: 'when you have a small piece of code to review that isn't in a file yet, or when you want to review an isolated snippet.' It does not explicitly state when not to use or name alternatives, but the sibling tools provide context for exclusion. This is clear but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

review_git_diffA

Review a git diff for bugs, security issues, and improvements.

Accepts the output of git diff as plain text. Returns a structured review with severity levels (🔴 CRITICAL, 🟡 WARNING, 🟢 SUGGESTION, ℹ️ NOTE).

Example: git diff | review_git_diff

ParametersJSON Schema

Name	Required	Description	Default
`diff`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, but description discloses output format (structured with severity levels). No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences plus example, front-loaded with purpose. No unnecessary text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given simplicity (one param, no annotations, has output schema), description covers input format, output format, and usage example completely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter (diff), schema has no description (0% coverage). Description clarifies it accepts 'git diff' output as plain text, adding value beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it reviews git diffs for bugs, security, and improvements, with a structured output. Distinct from siblings (code file/snippet review).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Describes input (git diff output) and gives example usage. Implicitly distinguishes from siblings, but no explicit when-not to use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

3 tool updatesv0.1.0Jun 23, 2026
- First observedreview_code_file
- First observedreview_code_snippet
- First observedreview_git_diff

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4/5.0

Disambiguation5/5

Each tool targets a distinct input type: file, snippet, or git diff. The descriptions clearly differentiate them, leaving no ambiguity about when to use each.

Naming Consistency5/5

All tools follow the consistent 'review_<source>' pattern (review_code_file, review_code_snippet, review_git_diff), making naming predictable and clear.

Tool Count5/5

Three tools is appropriate for the code review domain, covering the main scenarios without being too few or too many.

Completeness4/5

The surface covers the primary use cases: reviewing files, snippets, and diffs. Potential additions like reviewing a pull request or URL are missing but not essential.

Maintenance

ActivityStale

ResponsivenessSyncing

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

gread A
io.github.NitroRCr
An MCP server that gives your AI access to the source code and docs of all public github repos
Version Control Code Analysis Documentation Access
5361
Remote Desktop CommanderOAuth
app.desktopcommander
Hosted MCP server connecting claude.ai, ChatGPT and other AI apps to your own computer
Shell Access OS Automation
214
driflyte-mcp-server
com.driflyte
Driflyte MCP server which lets AI assistants query topic-specific knowledge from web and GitHub.
Search Web Scraping Knowledge & Memory
211
agentwork-mcp A
io.github.ferm-ai
Official MCP server for Agentwork — delegate tasks to AI agents with human-in-the-loop
Agent Orchestration Autonomous Agents App Automation
2

Related MCP Servers

mcp-agent-review
Code Analysis AI & Machine Learning
lzx1413
A
license
Not graded
quality
C
maintenance
An MCP server that provides agentic code review powered by OpenAI-compatible models, designed for use with Claude Code.
Updated 4 months ago (2026-04-29 01:52 UTC)
1
MIT
AI-PR-Review-MCP
Version Control Code Analysis AI & Machine Learning
AshishChandpa
F
license
Not graded
quality
D
maintenance
An MCP server that automates pull request reviews using multiple LLM providers (OpenAI, Claude, Gemini, Groq, Perplexity) and supports GitHub and Bitbucket with real-time webhook integration and interactive AI assistant commands.
Updated a year ago (2025-08-28 04:58 UTC)
1
-
llm-reviewer
Code Analysis AI & Machine Learning Version Control
asheshv
A
license
Not graded
quality
C
maintenance
MCP server for reviewing code changes using LLMs, supporting Copilot, Ollama, and OpenAI-compatible endpoints.
Updated 5 months ago (2026-04-13 08:22 UTC)
MIT
code-review-automation
Testing & QA Tools Code Analysis
KennyWayn3
A
license
Not graded
quality
B
maintenance
MCP server for automated code review using AI agents. It analyzes code diffs or file paths for bugs, security issues, and style violations.
Updated 2 months ago (2026-07-11 07:32 UTC)
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/lfylow/codereview-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

codereview-mcp

What it does

Install

Connect an agent

Claude Code

VS Code (Copilot) — .vscode/mcp.json

Cursor — .cursor/mcp.json

Continue / Windsurf

Tools

Providers

Models

Configuration

Environment variables

Config file

CLI flags

Example output

Troubleshooting

Limitations

Development

License

Available Tools

Output Schema

Output Schema

Output Schema

Tool Schema Changelog

Maintenance

Resources

Looking for Admin?

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

VS Code (Copilot) — `.vscode/mcp.json`

Cursor — `.cursor/mcp.json`