Preface¶

Since its gradual rollout in 2024, GitHub Copilot’s Code Review feature has been the primary entry point for “AI-assisted gatekeeping” in the PR workflow. However, anyone who has used it knows a major pain point: the review comments are often too generic. It can point out obvious null pointers or non-standard naming, but it struggles to flag issues based on your team’s internal specifications, and it cannot automatically cross-reference requirement descriptions in Jira or architectural constraints in internal documentation.

On July 29, 2026, GitHub announced in its Changelog: Copilot Code Review now has General Availability (GA) support for Agent Skills and MCP servers, available to all Copilot Pro, Pro+, Business, and Enterprise users. These two capabilities had previously been tested in the Public Preview phase, and their official launch means teams can embed coding standards and review checklists directly into their repositories, while also letting the review process pull read-only context from external systems like Jira and documentation platforms. This marks an important milestone in the deep integration of platform-level AI coding tools and enterprise workflows.

This article summarizes the core changes from this GA release based on GitHub’s official Changelog and documentation, and provides actionable configuration examples.

What’s New with This GA Release¶

According to GitHub Changelog (2026-07-29), this GA launch includes two major capability blocks:

1. Agent Skills

Copilot Code Review can now call team-customized skills during the review process. Skills are stored in the repository at .github/skills/<skill-name>/SKILL.md, where you define the rules, checklists, and examples to follow during reviews. Copilot will automatically load these instructions in relevant scenarios, turning “generic reviews” into “reviews tailored to your team’s standards”.

2. MCP Server Connections

The Model Context Protocol (MCP) allows Copilot to pull context from third-party platforms, such as issue trackers, documentation systems, service catalogs, etc. There is one hard constraint for code review scenarios: all MCP tool calls are limited to read-only operations to prevent accidental changes to external system data during reviews.

Additional important notes:
- If you have already configured MCP in Copilot Cloud Agent, the same setup will automatically apply to code reviews, with no need to reconfigure.
- GitHub MCP and Playwright MCP are enabled by default.
- New attribution labeling: Review comments will now indicate whether the opinion was generated using Agent Skills or MCP context, making it easier for teams to verify that skills are working as intended.

If you configured these features during the Preview phase, no changes are needed after GA—your existing settings will remain valid.

Agent Skills: Embed Enterprise Standards in SKILL.md¶

Agent Skills follow the open Agent Skills Specification, and the same skill files can be reused across Copilot Cloud Agent, Code Review, Copilot CLI, Copilot App, and Agent mode in VS Code/JetBrains IDEs.

Directory Structure¶

Project-level skills are stored in the repository, supporting the following paths (choose one):
- .github/skills/
- .claude/skills/
- .agents/skills/

Personal-level skills can be stored at ~/.copilot/skills or ~/.agents/skills for cross-project sharing.

Each skill is a separate subdirectory, which must contain a file named SKILL.md. You can optionally include subdirectories like scripts/, references/, and assets/ for references in the skill content.

Naming Recommendations for Code Review¶

GitHub’s documentation specifically notes that if you want Copilot Code Review to definitely load a skill, it is recommended to name the directory something related to reviews, such as code-review. Other existing skills under .github/skills will also be automatically selected if they are relevant to the review scenario.

Minimal SKILL.md Example¶

The following example shows how to inject your team’s API specifications into the review workflow. The name field in the YAML frontmatter must match the parent directory name:

---
name: code-review
description: Check that REST API naming, error codes, and logging standards comply with team standards when reviewing PRs
---

# Code Review Standards

## Mandatory Checks
1. External HTTP interface paths must use kebab-case, with version numbers placed at the URL prefix `/v1/`.
2. Error responses must include `code` and `message` fields; stack traces must never be returned directly.
3. New public methods must have corresponding unit tests; if test coverage drops by more than 2%, the reason must be explained in the PR description.

## Common Prohibited Practices
- Direct database access in handler layers is forbidden; access must go through service/repository layers.
- Sensitive fields such as tokens and passwords must not be printed in logs.

Frontmatter field requirements (from official documentation):

Writing tips: Keep the main file under 500 lines; place lengthy reference materials in the references/ directory and link to them in the main text.

Setup Steps¶

1. Create the .github/skills/code-review/ directory (or another skill name directory) at the root of your repository.
2. Create a SKILL.md file in this directory and fill in the frontmatter and review instructions.
3. Commit and merge the changes to the default branch; Copilot will load relevant skills automatically when subsequent PRs trigger a code review.
4. Check the attribution tags on review comments to confirm the skill was invoked.

You can also use GitHub CLI’s gh skill command to discover and install skills from community repositories. The official collection includes github/awesome-copilot and others.

MCP: Read-Only Pull Context from Jira, Documentation, and GitHub¶

MCP lets code reviews go beyond just the diff itself. During reviews, Copilot can query issues, documentation, service metadata, and more via configured MCP servers, then incorporate its findings into review comments.

Security Boundary: Code Review Enforces Read-Only Mode¶

GitHub has明确 stated that all MCP tool calls executed during Copilot Code Review are restricted to read-only operations. This differs from Cloud Agent, where some MCP tools may have write permissions— the platform has added extra restrictions for review scenarios to reduce the risk of accidental data changes in external systems.

Using GitHub’s official Remote MCP Server as an example, you can enable read-only mode via a URL suffix or header:

{
  "servers": {
    "github": {
      "type": "http",
      "url": "https://api.githubcopilot.com/mcp/",
      "headers": {
        "X-MCP-Readonly": "true",
        "X-MCP-Toolsets": "repos,issues,pull_requests,code_security"
      }
    }
  }
}

You can also use the /readonly path variant in the URL, for example: https://api.githubcopilot.com/mcp/x/issues/readonly.

Official documentation recommends: Only allowlist read-only tools—the Agent will call MCP autonomously without asking for manual confirmation step-by-step.

Configuration Entry Points¶

1. Go to the repository’s Settings → Copilot → MCP servers to add your MCP configuration JSON.
2. Authentication tokens are stored in Settings → Secrets and variables → Agents.
3. If you only want MCP to be used for Cloud Agent and not for code reviews, you can toggle off the Allow Copilot to use MCP tools when reviewing pull requests switch (enabled by default).

Repository-level MCP configurations are shared between Cloud Agent and code reviews; Jira, Confluence, and other connectors configured during the Preview phase will take effect immediately after GA.

Typical Use Cases¶

• Cross-reference requirements during reviews: Use the Issue/Jira MCP to pull acceptance criteria from linked tickets and check if the PR has missed edge cases.
• Enforce architectural consistency: Pull module dependency rules from internal documentation via MCP and flag changes that violate layered architecture constraints.
• Link PRs/Issues: Use the default-enabled GitHub MCP to read-only query historical PRs and open issues in the same repository to provide more complete contextual suggestions.

After the review is complete, you can use the GA’s new attribution labeling to distinguish which comments came from external information pulled via MCP and which came from standards injected via Agent Skills.

Similarities and Differences with Cursor Skills (Developer Perspective)¶

If you already use Agent Skills in Cursor or VS Code, the concepts are very similar: both use SKILL.md + directory structure to teach AI to follow predefined workflows for specific tasks. The main differences lie in runtime environment and trigger points:

For enterprises, the value of Copilot Code Review + Skills/MCP lies in: Standards travel with the repository, and reviews are enforced uniformly at the PR gate, without relying on every developer having the same plugins installed locally.

Implementation Recommendations¶

1. Start with one standard first: Write 5-10 of your most common violation items into .github/skills/code-review/SKILL.md, observe the false positive rate over one or two sprints before expanding the ruleset.
2. MCP least privilege: Only enable read-only toolkits for review scenarios; prioritize issue-specific connectors over a broad * wildcard.
3. Use attribution for iteration: After GA, comments will include source tags. Regularly review cases where “skills were triggered but rules are outdated” or “skills should have been triggered but were not” to update your SKILL.md.
4. Zero migration for Preview users: Repositories with pre-configured skills and MCP do not need special changes for the GA release.

Summary¶

The July 29, 2026 GA announcement advances Copilot Code Review from “a generic helper that looks at diffs” to “a team review node that can access specifications and external system context”. Agent Skills solve the “how to review” problem by turning .github/skills SKILL.md files into versionable review playbooks; MCP solves the “what context to review against” problem by providing read-only access to Jira, documentation, and GitHub’s own context.

This will not replace human code reviews, but it does address the long-standing pain point of “standard documents sitting in Confluence that no one references during reviews”. For teams building research and development efficiency and code quality systems, the next worthwhile step is to migrate existing Code Review Checklists into SKILL.md and add read-only configurations and token rotation processes for key MCP connectors.

Reference Sources
- Copilot code review: Agent skills and MCP now generally available (GitHub Changelog, 2026-07-29)
- About agent skills (GitHub Docs)
- Adding agent skills for GitHub Copilot (GitHub Docs)
- Configuring MCP servers for GitHub Copilot (GitHub Docs)