Code review MCP · mcp · 16 picks

MCP servers for code review workflows

MCP servers and adjacent agent tools for repository review, pull request triage, quality checks, and source-backed engineering review.

Curated by @heyclaude-editors Updated 2026-07-18

MCP servers and adjacent agent tools for repository review, pull request triage, quality checks, and source-backed engineering review.

Compared at a glance

The top 5 picks side by side on trust, install, platform support, and disclosed notes — full rationale for each below.

3 trust signals differ across this comparison (Package trust, Source provenance, Submitter).

Field	Cloudflare MCP Server - MCP Servers Build applications, analyze traffic, and manage security settings through Cloudflare Open dossier	Jam MCP Server for Claude Debug faster with AI agents that access video recordings, console logs, and network requests Open dossier	Socket MCP Server for Claude Security analysis and vulnerability scanning for dependencies Open dossier	Stytch MCP Server for Claude Configure and manage Stytch authentication services and workspace settings Open dossier	Codacy MCP Server The official Codacy MCP server (@codacy/codacy-mcp) that gives AI assistants access to the Codacy API for code quality, security, and coverage — listing repository and pull-request issues, retrieving file coverage and duplication, searching security (SRM) findings, inspecting analysis tools and patterns, and running local analysis with the Codacy CLI. Open dossier
Next steps	Open dossier API JSON Open LLM MCP feed Open source Newsletter Claim listing	Open dossier API JSON Open LLM MCP feed Open source Newsletter Claim listing	Open dossier API JSON Open LLM MCP feed Open source Newsletter Claim listing	Open dossier API JSON Open LLM MCP feed Open source Newsletter Claim listing	Open dossier API JSON Open LLM MCP feed Open source Newsletter Claim listing
Trust
Review status	ReviewedMaintainer reviewed	ReviewedMaintainer reviewed	ReviewedMaintainer reviewed	ReviewedMaintainer reviewed	ReviewedMaintainer reviewed
Package trustDiffers	Package verified	Package verified	Package verified	Package verified	Package not verified
Source provenanceDiffers	No submission link	No submission link	No submission link	No submission link	Source-backed
SubmitterDiffers	—	—	—	—	davion-knight
Install risk	Low risk	Low risk	Low risk	Low risk	Review first
Notes	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓	Safety ✓ Privacy ✓
Brand	Cloudflare	Jam	Socket	Stytch	Codacy MCP Server
Category	mcp	mcp	mcp	mcp	mcp
Source	First-party	First-party	First-party	First-party	Source-backed
Author	Cloudflare	Jam	Socket	Stytch	codacy
Added	2025-09-18	2025-09-18	2025-09-18	2025-09-18	2026-07-08
Platforms	Claude Code Claude Desktop	Claude Code Claude Desktop	Claude Code Claude Desktop	Claude Code Claude Desktop	Claude Code Claude Desktop
Harness	Claude Code Claude Desktop	Claude Code Claude Desktop	Claude Code Claude Desktop	Claude Code Claude Desktop	Claude Code Claude Desktop
Source repo	—	—	—	—	—
Safety notes	✓Use a least-privilege Cloudflare token because DNS, security, Worker, and deployment actions can affect production services.	✓Share only Jam recordings and debugging captures that are intended for AI review, especially when they include production sessions.	✓Treat dependency risk findings as triage input and verify impact before blocking releases or changing package policy.	✓Restrict Stytch workspace and admin permissions because auth configuration changes can affect sign-in and account security.	✓The `codacy_cli_analyze` tool runs Codacy CLI analysis locally on files or directories, and if the CLI is not installed the server will attempt to download and install it, so it can execute and install software on your machine. The Codacy Account API Token grants API access to the organizations and repositories your account can see, including private ones, so treat it as a secret and scope it to least privilege. Most tools are read-only analysis (issues, coverage, duplication, security findings), but `codacy_setup_repository` adds or follows a repository in Codacy, which is an account-write action. Security (SRM) tools surface real vulnerabilities and findings for your code, so handle that output carefully and avoid leaking it. Prefer a token scoped to the intended organization and a non-sensitive repository when an agent acts autonomously.
Privacy notes	✓Zone settings, analytics, logs, account identifiers, deployment metadata, and security configuration may be sent through model context.	✓Screen recordings, console logs, network requests, URLs, cookies, and user-visible data may be exposed through model context.	✓Package names, manifests, dependency graphs, repository context, and security findings may be sent through tool calls.	✓User identities, authentication logs, session details, workspace settings, and security configuration may be sent through tool calls.	✓The server calls the Codacy API with your token; repository metadata, code-quality issues, coverage, duplication, security findings, and pull-request data it returns are passed to the LLM/MCP client. Some tools return source-derived content — for example `codacy_get_pull_request_git_diff` returns a PR's Git diff and file-analysis tools return issue context — which can include real source code. Security findings can reveal sensitive vulnerability details about your codebase; review before sharing that output. The account token is provided via the `CODACY_ACCOUNT_TOKEN` environment variable in your MCP client config — keep that config out of version control and restrict access to it.
Prerequisites	Cloudflare account with active zones Cloudflare API Token from https://dash.cloudflare.com/profile/api-tokens Cloudflare Account ID (found in Cloudflare dashboard) Node.js and npm/npx available for running the @cloudflare/mcp-server-cloudflare package	Jam account (sign up at https://jam.dev if needed) Jam API token (Bearer token format: jam_sk_live_xxx) - get from Jam account settings or Developer Hub Jam browser extension (optional but recommended for capturing bugs with full technical context) HTTP transport support (remote MCP server at https://mcp.jam.dev/mcp)	Socket account (free or paid plan) OAuth authentication setup (for mcp.socket.dev MCP connection) Socket API key (for Socket API access, available in Socket Dashboard) Network access to mcp.socket.dev (HTTPS required)	Stytch account (free or paid plan) Stytch API key authentication (for mcp.stytch.dev MCP connection) Stytch project_id and secret from Dashboard (test or live environment) Network access to mcp.stytch.dev (HTTP transport, not HTTPS)	Node.js and npm, with the `npx` command working (the server runs via `npx -y @codacy/codacy-mcp`) A Codacy account and an Account API Token from Codacy Account access management For local analysis, the Codacy CLI v2 (macOS/Linux/Windows via WSL); the server installs it if it is missing An MCP-compatible client (Claude Desktop, Cursor, VS Code, Windsurf, etc.)
Install	`claude mcp add cloudflare --env CLOUDFLARE_API_TOKEN=YOUR_TOKEN --env CLOUDFLARE_ACCOUNT_ID=YOUR_ACCOUNT_ID && claude mcp list`	`claude mcp list && claude mcp status jam`	`claude mcp add --transport http socket https://mcp.socket.dev/ && claude mcp list`	`claude mcp add --transport http stytch http://mcp.stytch.dev/mcp && claude mcp list`	`npx -y @codacy/codacy-mcp`
Config	`{ "mcpServers": { "cloudflare": { "env": { "CLOUDFLARE_API_TOKEN": "${CLOUDFLARE_API_TOKEN}", "CLOUDFLARE_ACCOUNT_ID": "${CLOUDFLARE_ACCOUNT_ID}" }, "args": [ "-y", "@cloudflare/mcp-server-cloudflare" ], "command": "npx", "type": "stdio" } } }`	`{ "mcpServers": { "jam": { "url": "https://mcp.jam.dev/mcp", "type": "http" } } }`	`{ "mcpServers": { "socket": { "url": "https://mcp.socket.dev/", "type": "http" } } }`	`{ "mcpServers": { "stytch": { "url": "http://mcp.stytch.dev/mcp", "type": "http" } } }`	`{ "mcpServers": { "codacy": { "command": "npx", "args": ["-y", "@codacy/codacy-mcp"], "env": { "CODACY_ACCOUNT_TOKEN": "<YOUR_TOKEN>" } } } }`
Citations	Source repositorygithub.com 2026-07-18T19:14:44+00:00 Documentationdevelopers.cloudflare.com Package (SHA-256 pinned)/downloads/mcp/cloudflare-mcp-server.mcpb Source methodology →	Source repositorygithub.com 2026-07-18T19:14:44+00:00 Documentationjam.dev Package (SHA-256 pinned)/downloads/mcp/jam-mcp-server.mcpb Source methodology →	Source repositorygithub.com 2026-07-18T19:14:44+00:00 Documentationgithub.com Package (SHA-256 pinned)/downloads/mcp/socket-mcp-server.mcpb Source methodology →	Source repositorygithub.com 2026-07-18T19:14:44+00:00 Documentationstytch.com Package (SHA-256 pinned)/downloads/mcp/stytch-mcp-server.mcpb Source methodology →	Source repositorygithub.com 2026-07-18T19:14:44+00:00 Documentationgithub.com Submitted by davion-knight2026-07-08 Source methodology →
Claim	Unclaimed	Unclaimed	Unclaimed	Unclaimed	Unclaimed