GitHub's public preview for stacked pull requests helps teams split dependent code changes into ordered, reviewable layers. GitHub has opened stacked pull requests in public preview, giving teams a native way to split a large change into smaller dependent PRs without managing the stack entirely by hand. What it is Stacked pull requests are ordered PRs where each pull request represents one focused layer of a larger change. GitHub says reviewers can inspect each layer independently, then merge the stack together when the series is ready. Who it helps This is useful for engineering teams that regularly ship refactors, migrations, feature branches with several dependencies, or AI-assisted changes that are too large for one review. It also matters for teams using Copilot workflows, because the changelog notes Copilot using a gh-stack skill in the stacked-PR flow. How to evaluate it Try it first on a non-critical branch with a small three-PR stack: setup, implementation, and tests. Check how status checks, review comments, rebases, branch protection, and merge order behave in your repository before making it part of your default review workflow. Limits and risks This is a public preview, so workflows may still change. Teams should verify compatibility with required checks, release automation, merge queues, and any bot that assumes every PR can merge independently. Sources GitHub changelog

LinkLoot access: Free
Provider costs: Unknown

Review open

@ZachasADMIN

Open loot

Let Copilot code review use repo skills and MCP context

No votes yet

#github #copilot+5

GitHub’s Copilot code review can now use repository agent skills and read-only MCP servers, giving teams a practical way to inject standards and project context into automated reviews. GitHub has moved agent skills and MCP support for Copilot code review to general availability across Copilot Pro, Pro+, Business, and Enterprise. What it is Copilot code review can now use repository-level agent skills and MCP server context when reviewing pull requests. Skills live under .github/skills with a SKILL.md file, while MCP servers can bring in read-only context from tools such as issue trackers, docs systems, service catalogs, or incident systems. Who it helps This is useful for engineering teams that already rely on internal review checklists, service ownership rules, security conventions, or issue metadata. Instead of hoping a generic reviewer catches local standards, teams can encode focused instructions and let Copilot reference external context during review. How to evaluate it Start with one narrow skill, such as API compatibility, migration checks, or test expectations for a specific package. Keep the first MCP connection read-only and low-risk, then inspect whether Copilot’s comments clearly attribute skill or MCP usage. For Business and Enterprise environments, check policy controls and billing behavior before enabling automatic reviews broadly. Limits and risks Copilot code review is still advisory. GitHub’s docs warn that it can miss issues or make mistakes, and human review remains required. MCP tool calls for code review are read-only, but teams should still audit what context each server exposes. Medium review effort and agentic capabilities can also consume more AI credits and GitHub Actions minutes. Sources GitHub changelog announcement GitHub Docs: Copilot code review

LinkLoot access: Free
Provider costs: Unknown

Review open

@ZachasADMIN

Open loot

Use code-review-graph to give coding agents targeted review context

No votes yet

#code review #mcp+3

code-review-graph is an MIT-licensed MCP and CLI tool that builds a local structural map of a repository so coding agents can review changes with narrower, more relevant context. code-review-graph is a practical add-on for teams that ask Codex, Claude Code, Cursor, Gemini CLI, or similar assistants to review real repositories. Instead of making the model reread broad chunks of the codebase, it builds a local Tree-sitter-backed graph of functions, classes, imports, calls, tests, and affected flows, then exposes targeted context through MCP and CLI commands. The useful part is that it is local-first and installable today from PyPI. The project documents one-command setup, platform-specific install targets, incremental updates, broad language coverage, and a GitHub Action that can post risk-scored pull request comments. That makes it worth testing in larger repos where review prompts waste tokens or miss the actual blast radius of a change. Caveats: treat the benchmark claims as project-reported until you reproduce them on your own codebase, and review the generated MCP/editor configuration before enabling it across a team. The current PyPI and GitHub release checked for this Loot is v2.3.7, published July 18, 2026, with Python 3.10+ required.

LinkLoot access: Free
Provider costs: Unknown

Review open

@ZachasADMIN

Open loot

Run Copilot security reviews before code leaves your branch

No votes yet

#github #copilot+3

GitHub's Copilot app now exposes a /security-review command in public preview for scanning in-flight code changes. GitHub has added a /security-review slash command to the GitHub Copilot app, extending the security-focused review flow beyond the earlier Copilot CLI preview. Use it as a pre-PR or pre-merge check when a branch includes authentication, file upload, payment, dependency, or permission changes. What to try: Open a project in the Copilot app. Make or load the code changes you want reviewed. Run /security-review and inspect the findings before you create or merge a pull request. Keep normal SAST, dependency scanning, secret scanning, and human review in place. Limits to remember: GitHub labels the app command as public preview. Copilot code review availability depends on plan and organization policy. AI review can miss issues, especially in framework-specific flows or code paths that need runtime context. Treat findings as triage input, not as a release gate by itself.

LinkLoot access: Free
Provider costs: Unknown

Review open

@ZachasADMIN

Open loot

Use Cloudflare Mythos to Find Real Codebase Bugs with AI Agents

No votes yet

#AI agents #code review+4

A practical defensive guide for checking your own codebase with AI agents: narrow scopes, parallel hunts, adversarial validation, reachability tracing, dedupe, gapfill, and governance gates. Built from the core operational lessons in Cloudflare's Project Glasswing write-up.

LinkLoot access: 29 Gems
Provider costs: Unknown

Review open

@ZachasADMIN

Open loot

Blog

#code-review

More from this topic

Review large GitHub changes as stacked pull requests

Let Copilot code review use repo skills and MCP context

Use code-review-graph to give coding agents targeted review context

Run Copilot security reviews before code leaves your branch

Use Cloudflare Mythos to Find Real Codebase Bugs with AI Agents

Related reads

GitHub Copilot approvals turn code review into a merge-control decision

GitHub puts Copilot code review behind a default firewall

Check GitHub Code Quality costs before July 20 billing starts

Use GitHub's new pulls dashboard to stop losing review work

Lock Down GitHub Review Dismissals Before a Bad Merge Clears Approval

A practical rule for AI code review: reject working diffs you cannot explain

Ponytail turns YAGNI into an agent skill with real GitHub momentum

GitHub Copilot code review now reads AGENTS.md

GitHub Copilot code review adds org runners, content exclusions, and longer instructions