Custom MCP servers

Connect your own remote Model Context Protocol servers, such as an internal docs search, a service catalog or a runbook index, and MergeHarbor can look things up there while it reviews a pull request.

Available on the Advanced plan (up to 5 servers) and Enterprise (no limit).

Add a server

1. Go to Integrations and choose Add MCP server. You need the settings.manage permission.
2. Enter a name and the server’s MCP endpoint URL. It must be https:// and reachable from the internet. Internal and private addresses are refused.
3. Choose the transport: Streamable HTTP (current servers) or SSE (older servers). Local (stdio) servers are not supported.
4. Choose authentication: none, a bearer token, or a custom header such as X-Api-Key. Use a read-only credential. It is stored encrypted and never shown again.
5. Choose Connect. MergeHarbor connects, lists the server’s tools and saves a snapshot.

No tool is called until you allow it.

Choose the tools reviews may call

Open Tools and scope on the server:

• Tick only tools that read data. Tools the server marks destructive cannot be allowed.
• A tool the server does not mark read-only needs you to confirm that it only reads data.
• Under Repositories, limit the server to some repositories. Reviews of other repositories never call it.

Choose Test to reconnect and refresh the tool list. Allowed tools that the server no longer offers are removed.

What happens during a review

• One small call on the cheapest model tier reads the pull request’s title, description and changed paths, and picks at most 5 tool calls from the tools you allowed. Most pull requests need none.
• Each call runs once, with an 8-second timeout and a response size cap. A tool’s output is never used to make another call.
• Secrets and personal data are removed from the output, which is cut to a few thousand tokens and given to the reviewer as untrusted data. Text in it cannot instruct the review.
• The review’s Context used list shows each tool called and why.

Cost

A review that used tool context costs 1 credit per pull request update, on top of the review. The planning call counts toward your monthly budget. When the budget or credit limit is reached, reviews skip tool context.

Audit and data

Adding, changing, testing and disconnecting servers are recorded in the audit log. MergeHarbor keeps a log of tool calls (tool, status, size, duration) without their output; disconnecting a server deletes its credential and call log.