Use Case · code-review-bot

How to build an AI code review bot.

Q: What does an AI code review bot do?

It fetches a pull request diff, reads the changed files in context, and leaves line-anchored review comments. A good bot also surfaces uncovered tests, files follow-up issues in Linear or Jira for non-blocking findings, and posts a summary to Slack — without competing with the human reviewer.

Q: Does it replace human review?

No. The pattern that works in production is bot-first, human-final. The bot catches the obvious — null checks, missing tests, naming inconsistencies, security smells — so the human reviewer can focus on architecture and intent. wmcp.sh keeps the bot's write surface scoped to comments only, never merges.

Q: How does it leave line-anchored comments?

GitHub's review API supports per-line comments via the pulls.createReviewComment method. wmcp.sh exposes the GitHub OpenAPI surface through /integration/github so the agent can call this method directly with line numbers it picked while reading the diff.

Q: What about secrets and IP exposure?

Run the agent in your VPC or on a self-hosted runner. wmcp.sh proxies tool listings, not source code — code flows directly between your runner and the model provider. The /managed plan can deploy the entire loop in your AWS or GCP account if data residency matters.

Q: How is this different from Copilot PR review or CodeRabbit?

Both are good products. A custom MCP-backed reviewer lets you pick the model (Claude, GPT, open weights), read across GitHub + your internal docs + your ADR registry in one loop, and wire whatever follow-up system you use. wmcp.sh is not affiliated with GitHub, OpenAI, or any code-review SaaS.

Every PR rots in the queue for the same reason: humans don’t have the bandwidth to read every diff carefully. A code review bot solves the boring half — null checks, missing tests, ADR drift, secrets, unobvious naming — so the human reviewer can spend their attention on architecture and intent. The blocker isn’t the model. It’s wiring GitHub, your tracker, and your chat into a clean tool loop.

The gap

GitHub’s API surface is broad. Your bot only needs ten methods.

A useful reviewer needs: list PRs, read PR diff, read file content at a commit, create a review, create line comments, optionally label the PR, optionally request changes. Mapping these to a typed tool surface the model can call without inventing parameter names is the actual integration work.

Teams that ship hand-roll a thin wrapper, watch it drift when GitHub renames a field, and end up maintaining a tiny SDK forever. None of that work is differentiated. None of it is what your reviewer policy should be optimizing for.

wmcp.sh exposes the GitHub API as schema-valid MCP tools via /integration/github, so your agent calls pulls.get and pulls.createReviewComment by name with typed args — and you spend your week on the review prompt instead. wmcp.sh is not affiliated with GitHub.

Architecture

PR-open → review → comment → track.

1. PR webhook. Your GitHub App fires on pull_request.opened and pull_request.synchronize. The handler enqueues the repo + PR number with a unique correlation ID so reviews are idempotent.

2. Tool gateway (wmcp.sh). The runner pulls MCP tools for /integration/github (PR + file + review methods), Linear (for non-blocking follow-ups), and Slack (for the summary post).

3. Reasoning loop. The agent fetches the diff, fetches related file context at the head SHA, drafts a structured review (summary + line comments + tags), and submits it as COMMENT review state (never APPROVED).

4. Track + notify. Non-blocking findings become Linear issues with a backlink to the line. A Slack message lands in the team channel with the summary and PR link.

Tools the agent needs

What wmcp.sh provides.

Capability	System	How wmcp.sh wires it
Read PR + diff	GitHub	✅ /integration/github — `pulls.get`, `pulls.listFiles`
Read file at commit SHA	GitHub	✅ `repos.getContent` with `ref` parameter
Submit review + line comments	GitHub	✅ `pulls.createReview` (scoped to `COMMENT` state)
File follow-up tickets	Linear	✅ OpenAPI adapter — `issues.create` only
Post summary	Slack	✅ /integration/slack
Look up ADR / standards	Notion or repo /docs	✅ /integration/notion or generic fetch

Code

From PR webhook to line comments.

Python sketch. Receives a repo + PR number; emits a review with line-anchored comments. Never approves, never merges.

import os, httpx
from anthropic import Anthropic

client = Anthropic()
WMCP = "https://wmcp.sh"

def tools_for(url):
    return httpx.get(f"{WMCP}/api/v1/tools", params={"url": url}).json()["tools"]

tools = (
    tools_for("https://api.github.com")
    + tools_for("https://api.linear.app")
    + tools_for("https://slack.com/api")
)

repo = os.environ["REPO"]     # e.g. "acme/api"
pr   = os.environ["PR_NUM"]

msg = client.messages.create(
    model="claude-sonnet-4-5",
    max_tokens=4096,
    tools=tools,
    messages=[{"role": "user",
        "content": f"Review PR {repo}#{pr}. Read the diff and related files. "
                   "Submit a review (COMMENT state, never APPROVE). For non-blocking findings, "
                   "file a Linear issue. Post a one-line summary to #eng-reviews."}],
)

print(msg.content)

Where we win

Custom GitHub wrapper vs MCP gateway.

Hand-rolled GitHub client:

Tiny SDK that drifts when GitHub renames fields
Auth + rate limit handling per repo
No standard tool shape — model must be re-prompted
Adding Linear means another adapter

wmcp.sh tool gateway:

Schema-valid MCP tools for GitHub out of the box
Scope to pulls.* and repos.getContent only
Edge-cached tool listings, sub-50ms
Add Linear or Jira by adding a URL

FAQ

Common questions.

What does an AI code review bot do?

Fetches the diff, reads the changed files in context, leaves line-anchored comments, files follow-ups, posts a Slack summary. Never approves or merges.

Does it replace human review?

No. Bot-first, human-final. The bot covers boring checks; the human focuses on architecture and intent.

How does it leave line-anchored comments?

Via pulls.createReviewComment, which wmcp.sh exposes through /integration/github.

What about secrets and IP exposure?

Run the agent on your own runner. wmcp.sh proxies tool schemas, not code. /managed can deploy in your cloud account.

How is this different from Copilot PR review or CodeRabbit?

Your model, your tools, your follow-up system. Portable across model providers.