Handing Your AI Reviewer the "Company Rulebook": Copilot Code Review Officially Adopts Skills and MCP

AI Reviews That Could Only Offer Generic Advice

An AI leaving comments on your pull requests—this feature itself has become standard across vendors. But until now, AI reviews were good at flagging what's "generally good or bad," while failing to account for rules that apply only within a given organization or the context written in issue trackers and design documents. On July 29, 2026, GitHub made an update generally available (GA) that fills exactly this gap. Copilot's code review can now pull in "your company's circumstances" through Agent Skills and MCP servers.

It covers all plans: Copilot Pro, Pro+, Business, and Enterprise. This is the graduation from public preview, and any settings configured during the preview carry over unchanged.

Two Kinds of "Context" You Can Bring Into a Review

What's been added are two extension points of differing character.

Agent Skills: Handing Over Your Own Standards

By creating a directory for a skill under the repository's .github/skills and writing your instructions and standards into SKILL.md, Copilot will reference them during review. This lets you explicitly pass "team tribal knowledge"—naming conventions, architectural do-nots, and the like—as material for the review's judgment. Because Copilot reads the skills on the changed (head) branch, you can test the standards themselves before merging.

MCP Servers: Pulling In External Primary Sources

Via MCP (Model Context Protocol), you can pull information from the external tools your team uses day to day—issue tracking, documentation, service catalogs, incident management, and more—directly into the review. The GitHub and Playwright MCPs are enabled by default. For example, if an issue key is written in the PR description, the intended workflow is for Copilot to return feedback that takes that issue's background into account.

A "Read-Only" Safeguard

The concern with external integrations is safety, but GitHub states explicitly that "all MCP tool calls made by Copilot code review are limited to read-only." The line drawn is that the reviewing AI will not write to or operate external systems. In addition, comments generated using skill or MCP context are labeled as such, so you can check afterward which extension contributed to a given piece of feedback.

Getting Set Up

The steps to actually start using it are as follows.

• Skills: Add .github/skills/<skill-name>/SKILL.md and write the standards and instructions you want to apply to reviews.
• MCP servers: Register the connection under Repository settings → Copilot → MCP servers.
• Credentials: Store tokens and the like under Repository settings → Secrets and variables → Agents.

The skill directory names, your custom instructions, and identifiers in the PR description (issue keys and incident IDs) serve as cues for which context to use. There's also a setting to disable only the code-review-facing MCPs individually.

Review "Quality" Will Diverge by Organization

What this change signals is that the competitive axis for AI reviews is shifting from "how smart the model is" alone toward "how much of your own context you can hand it." With the very same Copilot, the more a team invests in its SKILL.md and MCP setup, the more concrete its feedback becomes, while teams that don't stay stuck with generic remarks. Raising the floor on reviews is entering a phase governed by how well you configure things. It's also worth noting that MCP—a mechanism that first spread as an external connector for conversational AI—has now come down to code review, an unglamorous but genuinely useful front line.

That said, caution is warranted. The more plausibly an AI returns feedback grounded in your company's rules, the more likely human reviewers are to swallow it wholesale—a real concern. Read-only or not, once you're feeding the contents of external documents and issues into the review context, the operators need to understand what information is being handed to the AI. A design that keeps AI review firmly in the role of assisting human review, and nothing more, is the realistic one.

References: Copilot code review: Agent skills and MCP now generally available (GitHub Changelog) / About GitHub Copilot code review (GitHub Docs) / Copilot code review: AGENTS.md support and UI improvements (GitHub Changelog)