Log inSubmit server
Mergewarden logo

Mergewarden

Reviews public GitHub pull requests for missing context and deterministic security risks without login or AI.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Mergewarden

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "mergewarden": {
      "command": "npx",
      "args": [
        "--yes",
        "mergewarden@0.10.4"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

The install command installed and started the server, which then stopped for configuration (such as an API key) that our sandbox does not have — expected for servers that connect to your account.

npx --yes mergewarden@0.10.4

Process exited before answering initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 3d ago.

Overview

The mergewarden MCP server is referenced as an advanced interface for MergeWarden's GitHub pull-request review tools. The documented product examines public repository metadata, templates, and selected pull-request files to identify missing issue links, thin descriptions, unused templates, oversized changes, and several security risks.

Use cases

  • Review public pull requests for missing issue links
  • Find pull requests with thin descriptions or unused templates
  • Scan workflow and agent-instruction changes before review
  • Automate deterministic pull-request risk checks in GitHub Actions

Key features

  • Public GitHub pull-request queue
  • Deterministic context checks
  • Workflow permission analysis
  • Agent-instruction file detection
  • Install-script change detection
  • GitHub Action and CLI interfaces

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

7/7 checks healthy over the last 45d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 15d ago via OSV.dev · mergewarden@0.10.4 (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars14Stargazers on the source repository.
npm downloads61Package downloads in the last 30 days.
Last commit7d agoMost recent push to the default branch.
Install checkRunsOur sandbox started it; it then asked for an API key or config.

How Mergewarden works

What mergewarden MCP server does

The supported product behavior centers on reviewing public GitHub pull requests before code review. It identifies missing issue references, descriptions with little prose, unused pull-request templates, and changes exceeding 50 files or 1,500 changed lines.

A separate detailed scan checks four deterministic security areas: workflow permission changes and risky triggers, modifications to files that guide coding agents, pull-request text passed into workflow prompts, and package-manifest changes to install-time lifecycle scripts.

How it works

MergeWarden reads public GitHub data directly. Its browser queue examines the latest 30 open pull-request summaries, excludes trusted repository roles, base-repository branches, and known maintenance automation, then loads details for no more than 10 external pull requests. Rows are ordered by observable facts rather than an AI-generated judgment.

The queue reads repository metadata and the base branch's pull-request template. The detailed scan reads only files needed by its deterministic rules and evaluates policy from the exact base commit, not the untrusted pull-request head. The analysis does not call a language model, execute code, or clone the target repository.

Setup and configuration

A browser user can paste owner/repository or a full public GitHub repository URL into the review queue. The CLI can run a larger authenticated queue with GH_TOKEN, or scan a pull request directly with npx --yes mergewarden@0.10.4 scan <url>.

A GitHub Action can run the detailed risk check on pull_request events. Its example requests contents: read and pull-requests: write, and supports comment: auto. For immutable Action usage, the documentation recommends pinning a release commit.

Tools and capabilities

The documented MergeWarden interfaces support:

  • Reviewing public pull-request queues for missing context.
  • Scanning a pull request for deterministic security findings.
  • Running queue triage from a terminal.
  • Automating detailed scans through GitHub Actions.
  • Updating one actionable pull-request comment when the Action is configured to do so.

Limitations and notes

MergeWarden never closes, labels, scores, or comments on a pull request through the review queue. It does not classify contributions as spam, low quality, or AI-generated. Browser limits are explicit: sampling 30 summaries or exceeding the 10-detail limit produces an incomplete queue rather than a complete result.

The web app has no backend or telemetry and communicates directly with the public GitHub API. The Action and web app do not execute pull-request code. Incomplete evidence is reported as incomplete, not as a pass. The mergewarden MCP server should therefore be evaluated against its unspecified MCP interface before integration.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Mergewarden

mergewarden is an MCP server that is documented alongside tools for reviewing public GitHub pull requests, including a queue for missing issue links, thin descriptions, unused templates, and oversized changes, plus a deterministic scan for workflow permissions, agent-instruction changes, untrusted prompt inputs, and install scripts. Its MCP tool names and transport are not specified.

It documents browser usage, a CLI distributed through npx, and a GitHub Action, but gives no MCP transport or client configuration.

Yes, the documented detailed scan runs without cloning the target repository. Use the CLI with a full pull-request URL or repository-and-number reference; the scan reads only files required by its deterministic rules.

No, MergeWarden does not call a language model. Its queue and detailed scan use public metadata, templates, selected files, and deterministic rules instead of AI-generated judgments.

Related MCP servers

All in Version Control All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewMergewarden AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/mergewarden?style=directory)](https://allmcps.com/mcp/mergewarden)
HTML Embed
<a href="https://allmcps.com/mcp/mergewarden"><img src="https://allmcps.com/api/badge/mergewarden?style=directory" alt="Mergewarden on AllMCPs" /></a>