Code Review Agent

Name: Code Review Agent
Availability: InStock
Author: Kata Team

Reviews a PR against your repo's own conventions, and stays quiet when there's nothing to say.

Software Development Dev Productivity & Project Ops Code Review & PR Automation @katateam

Before you connect: what this agent would do

A preview derived from this agent’s definition — not a live run. Nothing runs and no key is sent until you connect. FindAgent runs it on the hosted connection.

Tools it can use (5)

get_pull_requestRead-only
Fetch a pull request's title, body, branches, and merge state to establish intent.
Reaches: api.github.com
Uses your GitHub token.
get_pull_request_diffRead-only
Fetch the unified diff of a pull request.
Reaches: api.github.com
Uses your GitHub token.
list_changed_filesRead-only
List the files a pull request touches, with per-file change counts.
Reaches: api.github.com
Uses your GitHub token.
get_repo_conventionsRead-only
Fetch a conventions file from the repository — contributing guide, linter config, or architecture notes.
Reaches: api.github.com
Uses your GitHub token.
post_reviewCan change data
Post a non-blocking review with the findings. Never approves and never requests changes.
Reaches: api.github.com
Uses your GitHub token.

Credentials it will ask for (1)

GitHub token
Only ever sent to: api.github.com

Safety rails that guard it

Every result is scanned for leaked secrets and prompt-injection before it reaches you — a check no agent can turn off.
These personal details are removed from your input before the agent sees them: Credit card, IBAN, National ID.
A request larger than 200,000 characters is rejected before it runs.
post_reviewSensitive — it is flagged and needs an explicit confirmation before it runs.Rate limited to 40/hour.
get_pull_requestRate limited to 200/hour.Safe to retry automatically if a run is interrupted.
list_changed_filesRate limited to 200/hour.Safe to retry automatically if a run is interrupted.
get_repo_conventionsRate limited to 300/hour.Safe to retry automatically if a run is interrupted.
get_pull_request_diffRate limited to 200/hour.Safe to retry automatically if a run is interrupted.

How FindAgent keeps agents safe

Run locally

This MCP server runs on your own machine — FindAgent only points you at it. Run the command below, then add it to your MCP client. Nothing is hosted or proxied on our side.

terminal

npx -y @findagent/mcp run

Add it to your MCP client

Paste this into your client config (e.g. claude_desktop_config.json or a Cursor mcp.json), then restart the client.

mcp client config

{
  "mcpServers": {
    "code-review-agent": {
      "command": "npx",
      "args": [
        "-y",
        "@findagent/mcp",
        "run"
      ]
    }
  }
}

What you'll need — and where to get it

This agent will ask you for the following. You enter them when you connect — they're encrypted and never shared with the creator.

GitHub token
A fine-grained personal access token scoped to the repositories you want reviewed. Needs Pull requests: read and write, Contents: read, and Metadata: read. It does not need administration or workflow scopes.
Create a personal access token in GitHub (Settings → Developer settings → Personal access tokens) scoped to what the agent needs.
Paste the value as a single line.
Only sent to: api.github.com

Requirements

This server requires authentication — see the description for how to get a key.

Get this agent

Free

Add the hosted gateway to Claude, ChatGPT, Cursor or any MCP client. Nothing installs on your machine.

https://mcp.findagent.cloud/agents/code-review-agent

View setup

What we can prove

Ships no executable code. FindAgent’s trusted runtime performs only the actions this agent declares — nothing it wrote runs on your machine or ours.
Any key you connect is bound to its destination — it is only ever sent to api.github.com, and is dropped if a request tries to redirect it elsewhere.
Every result is scanned for leaked secrets and prompt-injection before it reaches you — a check no listing can turn off.
Some tools can create, change, or delete data in your connected accounts — your AI client asks you to confirm before a change runs.
Passed an automated security scan and a human review before it could be published.

These are facts derived from the manifest, not a score and not a badge.

Agent details