GitHub Copilot Code Review with MCP: Cite Your Real Docs in Every PR

On July 29, GitHub made Copilot code review MCP generally available for all Pro and Business users. It is a different feature from Copilot agent mode in VS Code. This one lives in the pull request — Copilot reviews your changes as a PR bot, and it can now use MCP servers to pull in live context when it does.

The practical consequence: if you connect AgentReady as your MCP server, Copilot's review comments cite your actual documentation instead of guessing from training data. For teams that maintain SDK docs, API references, or internal style guides, this is a meaningful shift.

How Copilot code review MCP works

Copilot's code review feature runs as a bot on pull requests. When a review is requested, the bot analyzes the diff and leaves inline comments. Until now, its only knowledge came from the model's training data and the repository itself.

MCP changes this by letting the bot call external tools during the review. GitHub implemented this via SKILL.md files — Markdown files placed in .github/skills/ that describe which MCP server to connect to and what it can do.

When the bot encounters code that touches a domain your skill covers — say, an auth flow, a webhook handler, or a rate-limiting implementation — it calls the MCP tool, gets a grounded answer with source citations, and includes that in the review comment.

What this looks like in practice

Without MCP, a Copilot review comment on a Stripe webhook handler might say:

⚠️ Consider verifying the webhook signature before processing.
Stripe recommends validating the Stripe-Signature header using
your endpoint's signing secret.

That's reasonable generic advice drawn from training data. With AgentReady connected as the MCP server, the same comment can become:

⚠️ Webhook signature not verified before processing payload.

Per docs.stripe.com/webhooks/signatures:
"Stripe signs the webhook events it sends to your endpoints by
including a signature in each event's Stripe-Signature header.
This allows you to verify that the events were sent by Stripe,
not by a third party."

Recommended: use stripe.webhooks.constructEvent() with your
STRIPE_WEBHOOK_SECRET before accessing event.data.

Source: docs.stripe.com/webhooks/signatures

The difference is that the second comment is grounded. The citation is a real URL. The quote is verbatim from the indexed documentation. If your docs change, the next review reflects the updated content.

Setting it up: the SKILL.md approach

There are two parts: indexing your docs in AgentReady, and telling Copilot where to find them.

Step 1 — Index your documentation. If your docs aren't already in AgentReady, submit the URL at agentready.it.com. Indexing takes under a minute for most sites. You can also index third-party docs you rely on (Stripe, Auth0, AWS) — they're all already in the directory.

Step 2 — Create a SKILL.md file in your repo at .github/skills/agentready.md:

---
name: agentready-docs
description: Query indexed documentation for cited answers during code review
mcp:
  url: https://www.agentready.it.com/api/mcp
  transport: streamable-http
tools:
  - ask_site
  - list_sites
---

Use the ask_site tool to look up documentation when reviewing:
- API usage patterns or SDK method signatures
- Security best practices from third-party docs
- Internal company documentation or style guides
- Error handling patterns from service documentation

Always include the source URL from ask_site in review comments
so engineers can read the full context.

Step 3 — Enable Copilot code review in your repository settings under Code and automation → Code review → Copilot code review. Once enabled, request a Copilot review on any PR via the Reviewers panel.

Which docs to index first

The highest-value docs to connect are the ones your team refers back to most during code review:

— Your own API docs or SDK reference — if you maintain a library or API, this is the primary use case. Copilot will cite your actual spec when reviewing usage.

— Third-party service docs — Stripe, Twilio, Auth0, AWS SDK, SendGrid. These are already indexed in the AgentReady directory and available immediately via ask_site.

— Internal style guides or architectural decision records — if you have internal docs on how the team approaches error handling, logging, or API design, index those too. Copilot will reference them when it spots deviations.

The difference from Copilot agent mode

Copilot agent mode in VS Code (covered in a previous post) is interactive — you're chatting with Copilot inside the editor, asking it to write or explain code. It uses MCP to pull in context while you work.

Copilot code review is asynchronous and automated. It runs when a PR is opened or updated, without any human prompting it. The MCP tools are called by the bot based on what it detects in the diff. The result is persistent PR comments, not a chat response.

Both use the same AgentReady MCP endpoint. The SKILL.md approach specifically targets the code review bot.

Keeping citations fresh

One advantage of AgentReady's indexed RAG approach over direct web fetch: cached, indexed answers are consistent across reviews. If you want the index to reflect a docs update, run:

npx @agentreadyweb/mcp refresh yourdocs.com

Add this to your CI pipeline after a docs deploy to keep the index synchronized with your latest content. After a refresh, the next code review that calls ask_site will return answers grounded in the updated docs.