Source: GitHub Changelog — 2026-07-29
Summary
GitHub Copilot code review's support for agent skills and MCP servers is now generally available across all paid Copilot tiers. Agent skills let teams drop a SKILL.md file into .github/skills to teach the reviewer their own internal conventions and tools, while MCP server connections pull live context from third-party systems — issue trackers, docs, service catalogs — directly into a review. GitHub's own MCP server and a Playwright MCP server are enabled by default, all MCP tool calls during review are restricted to read-only, and generated comments are now labeled with which skill or MCP source produced them.
Key Takeaways
- The core shift is from "review the diff" to "review the diff against your team's actual standards and the live state of your other systems" — the diff alone was never enough context for a real reviewer.
- Read-only is a deliberate boundary: Copilot can look things up mid-review (check a linked ticket, query a doc) but can't take any action through those same connections.
- Comment attribution (which skill or MCP produced a given suggestion) is the auditability piece that lets a team actually trust and debug what the reviewer is doing, rather than treating it as a black box.
- No separate paywall or preview flag — this lands for Pro, Pro+, Business, and Enterprise Copilot users simultaneously.
Reel Script
Hook (~18s): Every AI code reviewer right now reads your diff and nothing else — no idea what your team's actual conventions are, no idea if the code even satisfies the ticket it's supposed to close. GitHub just shipped the fix for that, and it's live today for every paying Copilot user.
Core Concept (~70s): Two pieces shipped together here. The first is "agent skills" — basically a markdown file, SKILL.md, that you drop into a folder in your repo. Think of it as the house rules: your team's actual coding conventions, the internal tools you expect people to use, written down once so the reviewer reads them before it ever comments on your code. The second piece is MCP — the Model Context Protocol — which is the plumbing that lets the reviewer reach out and call other systems as tools instead of just reading text. That's the part that lets it open your actual Jira ticket, or query your internal docs, mid-review. Put those together and the reviewer stops being diff-only and starts being context-aware.
Hands-On (~100s): Here's the concrete setup. You put your skill file at something like .github/skills/api-conventions/SKILL.md, and separately, under your repo's settings, there's a Copilot → MCP servers panel where you wire up connections — GitHub's own MCP server and a Playwright server for browser checks ship turned on by default. Now picture the actual review flow: a PR comes in that touches a payments endpoint. Old flow — Copilot reads the diff, comments on style and obvious bugs. New flow — Copilot also reads your SKILL.md on how payment endpoints are supposed to handle idempotency keys, and because the GitHub MCP server is wired in, it can pull up the linked issue and check whether the PR actually satisfies the acceptance criteria written there — then it labels the resulting comment so you know exactly which skill or MCP source produced it. Every one of those MCP calls is read-only; the reviewer can look, not touch.
Takeaway (~25s): This is what "agentic code review" actually means in practice — not a smarter diff parser, it's context plumbing. If your team ships a SKILL.md for your actual conventions and wires in the trackers you already use, your reviewer stops guessing. Worth setting up this week if you're already on Copilot.