← Docs

Fix findings from your editor

Last updated 13 October 2026.

What is the MergeSafe MCP server?

It connects your own coding agent, such as Claude Code or Cursor, to MergeSafe, so the agent can read a pull request’s findings, fix them in your checkout, reply on each thread and ask for a new review, without leaving your editor.

MCP (Model Context Protocol) is the standard way coding agents use outside tools. The MergeSafe server runs on your machine, next to your agent.

Why use it

Fix findings where you work. Your agent reads each finding and its fix prompt, changes the code in your checkout and runs your tests.
Close the loop. It replies on the finding’s thread, as you, and asks MergeSafe to review the new commit.
Your code stays on your machine by default. MergeSafe’s API returns the findings, not your code, and never writes or applies a patch. Only request_review_with_context, for an organization that has turned it on, sends test excerpts (see below).

Install

You need uv. Run the server on demand with uvx mergesafe-mcp, or install it once:

uv tool install mergesafe-mcp

Get an API key

In the MergeSafe app, open your organization’s API keys and create a key. Only Admins can create keys; a key’s secret is shown once. See API keys and API reviews.

Configure Claude Code

claude mcp add mergesafe --env MERGESAFE_API_KEY=ms_live_... -- uvx mergesafe-mcp

Configure Cursor

Add this to your user-level ~/.cursor/mcp.json, not a project’s .cursor/mcp.json: the file holds your API key, so keep it out of any repository.

{
  "mcpServers": {
    "mergesafe": {
      "command": "uvx",
      "args": ["mergesafe-mcp"],
      "env": { "MERGESAFE_API_KEY": "ms_live_..." }
    }
  }
}

The server reads your GitHub token from gh auth token. If you don’t use the GitHub CLI, export GITHUB_TOKEN in your shell rather than writing it into a config file.

The tools

Tool	What it does
`get_findings`	The latest review’s findings on a pull request, each with its fix prompt.
`request_review`	Asks MergeSafe to review the pull request’s current head. It is charged like any other review.
`request_review_with_context`	Asks for a review and sends relevant test files from your checkout as extra context. Off unless enabled for your organization.
`reply`	Replies on a finding’s thread, as you.
`report_reproduction`	Posts the result of reproducing a finding (the command, its exit code and the last lines of output) on its thread, as you.

The loop

Ask your agent: “Fix MergeSafe’s blocking findings on PR 42 in acme/widgets.”
It gets the findings, fixes each one in your checkout and runs your tests.
You review the change and push it.
It replies on each thread with what it changed, or why a finding is wrong. See Replying to a finding.
It asks for a re-review, and the open findings are checked again on the new commit.

What leaves your machine

To MergeSafe, by default: only your API key, the repository name and the pull request number. The API returns the review’s findings (severity, title, file and line), not your code.
With request_review_with_context: only if your organization has local context enabled, excerpts of test files from your checkout are also sent. They are encrypted in transit and at rest, used only for that review, and deleted as soon as that review starts, or when the app is uninstalled.
To GitHub: your own GitHub token, to read comments you can already see on github.com and to post your replies.
Nothing else. Your agent writes the fixes locally with your own tools.

Troubleshooting

401 or “invalid API key”: the key was revoked or mistyped. Create a new one in the app.
No findings: the pull request has no finished review yet, or the key belongs to a different organization than the repository.
Replies fail: run gh auth status, or set GITHUB_TOKEN to a token that can comment on the repository.
The agent doesn’t see the tools: restart it after adding the server, and check that uvx mergesafe-mcp starts in a terminal.

Next: When reviews run →