Back to cookbook

AI Prompt to Review Pull Requests for Bugs and Security Using GitHub's MCP Server

0 views Updated

Make this prompt yours

Share

This prompt gives developers and engineering leads a repeatable way to review pull requests for bugs, security issues, and style problems by connecting an AI model to GitHub's MCP server, so it reads the actual diff, file list, and CI status instead of relying on pasted code snippets. It's built for developers, tech leads, and reviewers who want a consistent first pass on incoming pull requests before a human review.

With the MCP connection live, the model can pull the real diff for a specific PR number, check it against the team's house rules (naming conventions, error handling, test coverage expectations), and flag security-sensitive patterns like unsanitized input or hardcoded secrets. Because the review runs against the actual repository state rather than a copy-pasted chunk, the output stays accurate even as the PR gets updated with new commits.

Before wiring this into a review workflow, it helps to tighten the instructions themselves — running the prompt through Prompt Optimizer's Coding mode first will tighten vague review criteria into the specific checks a model can reliably apply.

Prompt template

Make this prompt yours

prompt-template
250 tokens
Role: You are a senior code reviewer with access to a GitHub MCP connection. Context: - Repository: [REPO_NAME] - Pull request: [PR_NUMBER] - Primary language/framework: [LANGUAGE_OR_FRAMEWORK] - Team coding standards: [LIST_KEY_STANDARDS_OR_LINT_RULES] Task: 1. Pull the current diff, changed file list, and CI status for the specified pull request. 2. Review the changes for: functional bugs, security issues (e.g. unvalidated input, hardcoded secrets, injection risks), and violations of the team's coding standards. 3. Note any missing or inadequate test coverage for the changed code. Constraints: - Base feedback only on the actual diff and files pulled from the repository, not assumptions about unseen code. - Separate findings into "Blocking" and "Suggestion" categories. - Reference the specific file and line number for each finding. - Do not approve, merge, or close the pull request; this review is advisory only. Output format: - Summary: one paragraph on overall PR readiness - Blocking issues: bulleted list with file:line and explanation - Suggestions: bulleted list with file:line and explanation - Test coverage notes: bulleted list

Want it sharper? Optimize this prompt with Prompt Optimizer, check it with the Prompt Debugger or shorten it with the Token Optimizer.

Example input

example-input
70 tokens
Review PR #482 in the repo acme-inc/billing-service. It's a Python/FastAPI service. Our standards: all new endpoints need request validation with Pydantic, no bare except blocks, and at least one test per new endpoint. Pull the diff and CI status via the GitHub MCP connection and flag anything that would block merge.

When to use it

  • Reviewing an incoming pull request before assigning it to a human reviewer, to catch obvious issues early
  • Auditing a backlog of open PRs for security-sensitive patterns like hardcoded credentials or unvalidated input
  • Checking a PR against team-specific style and testing conventions before merge
  • Giving a junior developer automated feedback on their PR before it goes to a senior reviewer

Best practices

  • Scope the review to one PR or one file set at a time rather than asking the model to review an entire repository at once
  • Give the model your team's actual lint rules and PR checklist instead of asking for generic "best practices"
  • Ask for inline, file-and-line-referenced feedback rather than a general summary, so comments map back to the diff
  • Re-run the review after new commits are pushed to the same PR, since the diff changes

Common mistakes

  • Pasting a static copy of the diff into the prompt instead of letting the MCP connection pull the live version, so feedback goes stale after new commits
  • Asking the model to approve or merge the PR directly instead of treating its output as a first-pass review for a human to confirm
  • Not specifying the project's language version or framework, leading to suggestions that don't match the actual codebase
  • Treating every flagged issue as equally severe instead of asking the model to separate blocking issues from minor style notes

FAQs

How do I connect ChatGPT or Claude to a GitHub MCP server for code review?

You connect through an MCP-compatible client (such as Claude Desktop, Claude Code, or an MCP-enabled ChatGPT integration) that has a GitHub MCP server configured with a personal access token or GitHub App credentials. Once connected, the model can call tools to read repository contents, pull requests, and CI status directly instead of relying on text you paste in.

Can AI actually read a live pull request diff instead of a pasted code snippet?

Yes, when it's connected through an MCP server with GitHub access, the model can request the current diff, file list, and check status for a specific PR number in real time. This means the review reflects the latest commits on that PR rather than a snapshot you copied earlier.

Is an AI code review from an MCP-connected prompt a replacement for human review?

No. It's best used as a first pass that catches obvious bugs, security issues, and style violations before a human reviewer looks at the PR, not as a substitute for a maintainer's sign-off, especially for security-sensitive or architecturally significant changes.

Which Cuelara tool can help me tighten this prompt before using it on a real PR?

Prompt Optimizer — its Coding mode is built to turn vague review instructions into specific, checkable criteria, which is useful for sharpening the constraints in this exact prompt before you run it against a real pull request.

Found this prompt useful? Share it.

Share

More in Code Generation & Software Engineering

Code Generation & Software Engineering

AI Prompt to Generate API Documentation From Source Code

This AI prompt for API documentation turns a block of source code (a function, a class, a set of REST route handlers) into clear, structured…

ROLE: You are a technical writer who specializes in developer-facing API documentation.

CONTEXT:
Language/framework: [PROGRAMMING LANGUAGE AND FRAMEWORK, e.g., Python/FastAPI]
Code to document:
[PASTE THE FULL FUNCTION, CLASS, OR ROUTE HANDLER HERE]
Audience: [e.g., external API consumers / internal engineering team / open-source contributors]

TASK:
Document the code above. Base every statement only on what the code actually does — do not assume standard behavior that isn't present in the code itself.

For each function or endpoint, produce:
1. SUMMARY: one sentence describing its purpose
2. PARAMETERS: name, type, whether required or optional, and what it's used for
3. RETURNS: the type and shape of the return value or response
4. ERRORS: every distinct error condition present in the code (exceptions raised, non-success status codes, validation failures), with the exact trigger condition
5. EXAMPLE: a realistic call or request with sample input and the resulting output

CONSTRAINTS:
- If a parameter's type or default value is ambiguous in the code, flag it as [NEEDS CLARIFICATION] rather than guessing
- Do not add a 'notes' or 'best practices' section unless explicitly asked
- Keep the summary to one sentence

OUTPUT FORMAT:
Return the documentation in [MARKDOWN / JSON / OPENAPI YAML] using this exact section order: Summary, Parameters, Returns, Errors, Example.

Make this prompt yours

Code Generation & Software Engineering

Prompt to Generate Unit Tests From a Function

This prompt turns an existing function into a set of unit tests covering its normal behavior, edge cases, and error handling, built for deve…

You are a senior software engineer writing unit tests.

Function to test:
[PASTE THE FUNCTION CODE]

Language and test framework: [E.G. TYPESCRIPT WITH VITEST, PYTHON WITH PYTEST]

Instructions:
1. Write tests covering normal, expected inputs.
2. Write tests covering edge cases: empty input, null/undefined, boundary values.
3. Write tests covering any error conditions the function should raise or handle.
4. Use clear, descriptive test names that state what is being verified.
5. Return only the test code, in a single code block, ready to run.

Output format: one fenced code block containing the complete test file.

Make this prompt yours

Code Generation & Software Engineering

Claude Prompt to Refactor Legacy Code for Readability and Maintainability

This Claude prompt for refactoring legacy code is built for developers who've inherited a function or module that works but is hard to read,…

Role: You are a senior software engineer specializing in code readability and maintainability.

Context:
Language/framework: [LANGUAGE_AND_VERSION]
Style guide or conventions to follow: [STYLE_GUIDE_OR_LINTING_RULES]
What this code does: [BRIEF_DESCRIPTION_OF_FUNCTIONALITY]
Constraints (things that must not change): [PUBLIC_API_SIGNATURES_OR_OTHER_CONSTRAINTS]

Code to refactor:
[PASTE_FULL_FUNCTION_OR_FILE_HERE]

Instructions:
1. Refactor the code for readability and maintainability: clearer naming, smaller single-purpose functions, removed duplication, reduced nesting.
2. Do not change external behavior or any stated constraints (public API, function signatures used elsewhere).
3. List each change you made, one by one, with a short reason for it.
4. Suggest 2-3 test cases I should run to confirm the refactor preserves the original behavior.
5. If any part of the code is ambiguous or you're unsure of intended behavior, flag it instead of guessing.

Output format:
1. Refactored code in a fenced code block
2. A numbered list of changes with a one-line reason for each
3. Suggested test cases

Make this prompt yours