Overview

The CloudAEye code-review MCP server exposes a small set of pre-commit review tools over the Model Context Protocol. Your coding agent — Claude Code, or any MCP client — calls these tools after it finishes a coding task and before you commit, so problems are caught in the editor loop rather than in CI or review.

Unlike a hosted PR reviewer that comments after you push, this server works against your local working tree. The unit of review is the complete change you are about to commit — including new files you haven't added to the repository yet, not just edits to tracked files — compared against your project's main branch: the branch you selected when you integrated the repository with CloudAEye. This assumes your repository is already integrated.

What you get

• Inspect — a light-weight pass that flags important bugs and security-essential issues.
• Describe — a plain-markdown summary of what the change does, for commit messages and PR bodies.
• Check Task — a verification pass that judges the diff against a task, a Jira ticket, a GitHub issue, or a freeform spec, and returns a per-requirement checklist.
• Security Review — a security-focused pass across the full security surface: application, LLM, agentic-AI, and MCP-server security.
• Review — the comprehensive pass across every report type and category.

The review model

Every tool call runs against a session. A session is minted once per (repo, branch, head) triple and holds the uploaded diff plus any cached code context. Three things happen before a tool runs, and the skills do them for you:

sequenceDiagram
    participant Agent as Coding agent
    participant Server as CloudAEye MCP server
    Agent->>Server: POST /session  {repo, branch, head, language, tenant_key}
    Server-->>Agent: { session_id, resumed }
    Agent->>Server: POST /upload/{session_id}  (multipart: git diff)
    Server-->>Agent: { session_id, diff_unchanged }
    Agent->>Server: MCP tool call  inspect_diff(session_id, intent, …)
    Server-->>Agent: { verdict, findings[], counts, … }
    Agent->>Agent: Surface findings to the user

1. Create or resume the session — POST /session. If a session already exists for the exact (repo, branch, head), the server returns the same id so iteration continues in place. If HEAD moved (you committed), it mints a fresh session.
2. Upload the diff — POST /upload/{session_id}. The diff is stored server-side keyed by session id. A byte-identical re-upload is a no-op; a changed diff invalidates the cached code-context graph.
3. Call the tool — inspect_diff, describe_change, or check_task. The diff is referenced by session_id, never passed inline.

See the Tool Reference for the exact request and response shapes.

Why the diff is uploaded, not pasted

Passing a large diff inline through a tool call burns context tokens and couples the review to the agent's context window. Uploading it once and referencing it by session id keeps the agent's tool calls small, and lets a single upload be reused across inspect → describe → check_task in the same turn.

Command surface

Command	MCP tool	Description
/inspect	inspect_diff	Performs important code and security review: BUG_REPORT + SECURITY_REPORT essentials (10 categories)
/review	review	Performs a deeper code review involving all report types and categories
/check_task	check_task	Verifies the code changes for a task, ticket or spec
/security_review	security_review	Performs a security review: SECURITY_REPORT, LLM_SECURITY_REPORT, AIAGENT_SECURITY_REPORT, MCP_REPORT
/describe	describe_change	Summarizes a PR, not a review

Clients

Any MCP client that can reach the server URL can call the tools. The distributed skills target Claude Code specifically — they wrap the POST /session → POST /upload → tool-call sequence into a single slash command. See Setup to connect the server and install the skills.