GitHub Copilot Code Review Gets Agent Skills and MCP, Now GA

GitHub announced on July 29, 2026, that Copilot code review support for agent skills and MCP (Model Context Protocol) servers is now generally available for all Copilot Pro, Pro+, Business, and Enterprise subscribers. The two features, previously in public preview, let teams feed their own tooling, coding standards, and external platform data directly into automated code reviews. MCP tool calls are limited to read-only access, and any existing MCP configurations already set up for the Copilot cloud agent carry over automatically.

What happened

Detail	Fact
GA date	July 29, 2026
Available plans	Copilot Pro, Pro+, Business, Enterprise
Previous status	Public preview
MCP access level	Read-only
Default MCP servers	GitHub and Playwright
Agent skills config file	SKILL.md under .github/skills/[skill-dir]/

GitHub has moved two Copilot code review features from public preview to general availability. Agent skills and MCP server connections are now live for all paid Copilot tiers. No action is needed if you were already using either feature during the preview period.

How each feature works

Agent skills

Agent skills give Copilot access to your team’s internal tools and coding standards at review time. You set them up by creating a skill-specific subdirectory inside .github/skills and placing a SKILL.md file in it. That file holds whatever instructions or context you want Copilot to apply when it reviews a pull request in that repository or organization.

MCP server connections

MCP (Model Context Protocol) is a standard that lets AI systems query external data sources. Copilot code review can now connect to platforms your team already uses, such as issue trackers, documentation systems, and service catalogs, pulling relevant context into the review automatically. All calls are read-only, so Copilot cannot write to or modify any connected service. The GitHub MCP and Playwright MCP servers are enabled by default.

If you had MCP configured for the Copilot cloud agent before this release, those settings apply to code review automatically. No duplication needed.

Attribution on skill and MCP comments

New to the GA release: Copilot now labels each review comment that was generated using agent skills or MCP context, so reviewers can see which tool or server influenced a particular suggestion. This makes it easier to audit and iterate on your skill and MCP configurations over time.

How do I set this up for the first time?

For teams starting fresh, here is the setup order GitHub recommends:

1. Go to repository settings, then Copilot, then MCP servers, and add your MCP configuration.
2. Store any authentication tokens under repository settings, then Secrets and variables, then Agents.
3. For agent skills, create a skill-specific directory under .github/skills, then add a SKILL.md file with your instructions inside it.
4. Open a pull request and check that Copilot review comments carry the new attribution labels confirming your skills or MCP servers are active.

Why it matters

Code review is one of the higher-friction parts of any development workflow. Copilot’s automated review already flags common issues, but without context about your team’s specific standards or the state of linked tickets, it misses a lot. Agent skills and MCP close that gap by letting Copilot ask “what does our style guide say?” or “what does the linked issue describe?” before it comments.

The read-only restriction on MCP is a sensible guardrail for a GA release. It means Copilot cannot accidentally close an issue or update a doc; it can only read. That limits the blast radius while teams figure out how to configure things properly.

For teams already exploring AI integration into their development pipelines, this is a concrete step toward reviews that enforce team conventions automatically rather than relying on a human reviewer to remember them every time. The attribution feature matters here too: without it, developers would have no way to know whether a comment came from a general model response or a specific skill file they wrote, which makes debugging configurations much harder.

Our take

The SKILL.md approach is genuinely practical. It is low-overhead (a markdown file in a known directory), versioned alongside your code, and reviewable by anyone on the team. Compare that to prompt engineering hidden inside a third-party tool and this is a much more auditable setup.

The MCP read-only restriction is the right call for now, but watch this space. Write access during review, such as automatically updating a ticket or tagging a dependency, is a logical next step and also a meaningful security decision. Teams should plan their MCP architecture now rather than retrofitting it later.

If you have already done the work of documenting your team’s standards somewhere, turning that into a SKILL.md is low effort and worth testing on a few pull requests this week. The attribution labels mean you can immediately see whether the investment pays off. More coverage of similar developer tooling moves is on the Lumien news page.

Source: GitHub Changelog