CodeRabbit MCP server: community and dormant

A third-party server that still runs, reads its data from GitHub rather than CodeRabbit, and has had no commit in over a year.

Checked 3 October 2026 · from CodeRabbit's changelog and CLI documentation, the community repositories, npm and the server's own tools/list response

One of 91 guides to monitoring and developer tools. Each covers what an AI coding agent can get out of the tool through MCP, the protocol that lets the agent query the tool directly.

What is the CodeRabbit MCP server?

CodeRabbit reviews pull requests automatically and leaves its findings as comments. An agent that reads those findings does not have to re-derive them. CodeRabbit's own agent route is its CLI, so the MCP route to those comments is community-built: coderabbitai-mcp, which registered all six of its tools in a capture on 25 August 2026.

The community server does not talk to CodeRabbit. It authenticates with a GitHub personal access token and reads CodeRabbit's review comments through GitHub's own API, which is why it works without a CodeRabbit credential at all.

That design has a consequence worth knowing. Anything CodeRabbit keeps outside a pull request comment is invisible to it, and anything GitHub exposes about those comments is available whether or not this server is involved.

CodeRabbit works in code review. Its MCP routes to those findings are community projects, the most used one last pushed in July 2025.

CodeRabbit's findings are reachable, but through GitHub rather than through CodeRabbit. A GitHub connector already reads pull request comments, so the community server's value is the structure it adds on top, not access it uniquely has.

What can an AI agent do with CodeRabbit?

What the tool definitions cost in context

A client that loads every tool definition at the start of a session spends this much context before the first question. Claude Code defers definitions by default through tool search, and loads a tool's definition when the agent needs it. The method below gives the version and date measured.

A context window is the amount of text a model can hold at once. A client that loads every tool definition upfront uses some of it before the agent asks anything. Unless the client defers tool loading, every tool the server registers sends its name, description and input schema to the model when the session starts.

6 tools cost between 616 and 1,506 tokens, or 0.3% to 0.8% of a 200,000-token window. That is a small share for a review connector.

It is cheap because it is terse. Descriptions average 62 characters and schemas average 386.

Encodings: GPT-5.6, GPT-5.5 o200k_base; GPT-4, GPT-3.5 cl100k_base; Claude Haiku 4.5 to Opus 5 count_tokens. Counted 25 August 2026 from tools/list on the released npm package 1.1.1. It was run locally with a placeholder GitHub token.

Registration is static, so no repository was read. Figures cover name, description and input schema.

The two models in column one share the o200k_base encoding, so they get one count. The spread is formatting, about 77%.

The Claude figures are measured rather than encoded. Anthropic publishes no local tokenizer. So the definitions were sent to the API's count_tokens endpoint, and a no-tools baseline was subtracted. The range covers two tokenizer generations rather than two serializations. Haiku 4.5 and Opus 4.6 sit at the low end. Opus 5 and Sonnet 5 sit at the high end. The gap between them is about a tenth.

CodeRabbit MCP server limits: where answers come back incomplete

The limits below are about where the data comes from and how old the code is.

Do you need the MCP server at all?

No, not the community one, for most teams. CodeRabbit's findings are pull request comments, and GitHub's own server reads pull requests, reviews and comments with 85 tools and active maintenance.

CodeRabbit's own answer for agents is its CLI. The Claude Code and Codex plugins let an agent request a review of local changes, which none of the community servers can do.

The community server adds structure rather than access. It separates a CodeRabbit review from an ordinary comment. get_comment_details also returns the AI prompt behind a comment, which a generic comment reader does not surface.

For review findings an agent can query from the vendor directly, Codacy and SonarQube both publish maintained servers.

Read the comments with GitHub. Add the community server only if you want CodeRabbit's reviews separated out, and pin it.

CodeRabbit MCP server setup

CodeRabbit has not published an MCP server, so there is no first-party MCP install. Its own agent route is the CodeRabbit CLI, there is a community server that still runs, and GitHub needs nothing extra at all.

One detail shapes the MCP options. The community server reads CodeRabbit's findings through GitHub, not through CodeRabbit, so a GitHub connector reaches the same comments without a dormant dependency.

Pick the community server only if you want CodeRabbit's reviews separated from every other comment on a pull request.

claude mcp add --transport http github \
  https://api.githubcopilot.com/mcp/

claude mcp add-json "coderabbit" '{"command":"npx",
  "args":["-y","coderabbitai-mcp@1.1.1"],
  "env":{"GITHUB_PAT":"<your-token>"}}'

Every other client

Each block below is the configuration for one client, with the file path and the key that client expects.

Ask: "use the CodeRabbit review-comments tool on PR 412"
Not: "what did the reviewer say?"

curl -fsSL https://cli.coderabbit.ai/install.sh | sh
coderabbit auth login
claude plugin install coderabbit

Read-only access, permissions and security

• The credential is GitHub's, not CodeRabbit's

  Connecting this server grants repository access, so scope the personal access token to the repositories you mean.

• A dormant dependency is a supply-chain decision

  The repository has not been pushed since 1 July 2025, so pin the version and review the diff before any bump.

• It reads through GitHub, so GitHub's permissions apply

  There is no CodeRabbit-side scoping to configure, and nothing about this server narrows what the token can see.

• Review comments quote your code

  Findings include the surrounding source, which reaches the model along with the comment.

• The plain GitHub route is the narrower one

  It reaches the same comments through a maintained, first-party server with an explicit read-only mode available.

Troubleshooting

You cannot find an official CodeRabbit MCP server

CodeRabbit has not published one as of 3 October 2026. Its MCP documentation describes CodeRabbit consuming other servers, and its agent integration is the CodeRabbit CLI with plugins for Claude Code and Codex.

The server asks for a GitHub token rather than a CodeRabbit key

That is correct, and it tells you what the server actually reads. It reaches CodeRabbit's review comments through GitHub rather than through CodeRabbit's own API.

So its answers are limited to what CodeRabbit has already posted on a pull request. Anything held only inside CodeRabbit is out of reach.

The repository looks abandoned

It was last pushed on 1 July 2025 and has never tagged a GitHub release. The npm package sits at 1.1.1, published on 29 June 2025.

It does still start and register its six tools, so it is usable but unmaintained.

The agent picks the wrong tool

The descriptions are unusually short. They average 62 characters per tool, and a description is how an agent chooses.

Name the tool you want in the prompt rather than relying on the model to infer it.

You want CodeRabbit's own review data, not GitHub's copy of it

No MCP connector exposes that. CodeRabbit has not published a server, and the community ones read through GitHub. Use CodeRabbit's app, or its CLI for reviews of local changes.

CodeRabbit MCP server: Reference

What engineers report

The useful signals here are the dates: one for the last commit, one for what CodeRabbit's own changelog says about MCP.

“Would it be possible to support other Code providers (which coderabbit supports) such as GitLab?”

CodeRabbit's changelog and documentation index were checked on 3 October 2026: every MCP page describes CodeRabbit consuming servers, and its agent integrations run through the CLI. The community repositories and npm package were checked the same day. The tool count comes from the released package's own tools/list response on 25 August 2026.

Should you connect an agent to CodeRabbit?

Only if a community server is acceptable to you. Best for reading the comments through a GitHub connector, unless the CodeRabbit-specific structure is worth a dormant dependency.

Strongest fit

Yes, if you want CodeRabbit's reviews separated from other pull request comments and will maintain a pinned dependency. For reviews before a push, use CodeRabbit's CLI plugin instead.

Main advantage

It distinguishes a CodeRabbit review from an ordinary comment, and exposes the prompt behind one.

Main weakness

No commit since 1 July 2025, and it reads GitHub rather than CodeRabbit, so it holds no privileged access.

Operational risk

Two tools resolve review conversations, acting with whatever the GitHub token allows.

Frequently asked questions