Build Log: Building a Custom MCP Code Review Server With FastMCP and Python
TL;DR: Built a custom MCP (Model Context Protocol) server using FastMCP that provides automated code review tools — style linting, diff analysis, dependency scanning, and PR summarization. Integrated with Claude Desktop and Hermes Agent. Covers 3 repos with 47 PRs in the first week, catching 89 issues before manual review.
The Problem: Scattered PR Review Standards
Our team runs three active Python repositories — a FastAPI backend, a data processing pipeline, and a CLI tool. Code review was inconsistent: one reviewer focused on style, another on logic, and critical issues like hardcoded secrets or missing error handling slipped through. We needed a standardized, automated pre-review layer that works across all repos without per-repo CI config.
What We Built: MCP Code Review Server
Build Log Review 2026
We built a Python MCP server using FastMCP (by John Lowin) that exposes four review tools. Any MCP host — Claude Desktop, Cursor, Hermes Agent — can connect and use them.
Server Setup
from fastmcp import FastMCPmcp = FastMCP(“code-review-server”)
@mcp.tool() def lint_file(filepath: str) -> str: """Run Ruff linter on a file and return violations.""" import subprocess result = subprocess.run( [“ruff”, “check”, “—output-format”, “concise”, filepath], capture_output=True, text=True, timeout=30 ) if result.returncode == 0: return “No linting issues found.” return result.stdout
@mcp.tool() def analyze_diff(diff_text: str) -> str: """Analyze a unified diff for risky patterns.""" patterns = { “hardcoded_secrets”: r”(?i)(password|api_key|secret|token)\s*[=:]\s*[’”][^’”]+[’”]”, “print_statements”: r”^+\sprint(”, “except_pass”: r”^+\sexcept.:\s\n^+\s*pass”, “unresolved_markers”: r”(?i)(XXX|FIXTHIS|HACK)”, } findings = [] for name, pattern in patterns.items(): import re matches = re.findall(pattern, diff_text, re.MULTILINE) if matches: findings.append(f”{name}: {len(matches)} occurrence(s)”) return “\n”.join(findings) if findings else “No risky patterns detected.”
@mcp.tool() def scan_dependencies(repo_path: str) -> str: """Scan requirements for known-vulnerability packages.""" import json, subprocess result = subprocess.run( [“pip-audit”, “—requirement”, f”{repo_path}/requirements.txt”, “—format”, “json”], capture_output=True, text=True, timeout=60 ) data = json.loads(result.stdout) if not data.get(“vulnerabilities”): return “No known vulnerabilities found.” lines = [] for v in data[“vulnerabilities”]: lines.append(f”- {v[‘name’]}=={v[‘version’]}: {v[‘advisory’]}”) return “\n”.join(lines)
@mcp.tool() def summarize_pr(title: str, body: str, changed_files: list[str]) -> str: """Generate a structured PR summary for reviewers.""" lines = [f”== PR Summary: {title} ==”, ""] lines.append(f”Files changed: {len(changed_files)}”) lines.append(f”Description: {body[:500]}”) lines.append("") lines.append(“File Categories”) for f in changed_files: ext = f.split(”.”)[-1] if ”.” in f else “unknown” emoji = {“py”: “snake”, “md”: “memo”, “json”: “clipboard”}.get(ext, “file”) lines.append(f”- {emoji}{f}”) lines.append("") lines.append(“Auto-Checks Required”) lines.append(”- [ ] Lint check passed”) lines.append(”- [ ] No secrets detected”) lines.append(”- [ ] Dependencies clean”) lines.append(”- [ ] Tests pass”) return “\n”.join(lines)
Integration With Hermes Agent
We connected the server to Hermes Agent by adding it to the MCP config. Hermes can now triage incoming PRs automatically — it runs lint_file and analyze_diff on every changed file, then scan_dependencies for the repo, and posts a structured comment back to the PR with findings.
# .hermes/mcp.json snippet
{
"mcpServers": {
"code-review": {
"command": "python",
"args": ["/home/techgeek/mcp-code-review/server.py"],
"env": {}
}
}
}Results: 7-Day Pilot
We ran the server against three repos for one week:
- 47 PRs analyzed across all three repos
- 89 issues caught before manual review:
except: pass)9 vulnerable dependencies found by pip-audit6 unresolved marker comments that were meant to be resolved- 23 minutes average time saved per PR (reviewer estimate)
- 100% catch rate for hardcoded secrets (zero slipped through)
Key Technical Decisions
Why FastMCP Instead of Raw stdio MCP
The FastMCP PyPI package handles transport negotiation, request batching, and error propagation automatically. Writing raw MCP over stdio means manually implementing the JSON-RPC lifecycle — FastMCP reduced our server code from ~400 lines to ~80 lines.
Per-Tool Timeouts
We set explicit timeouts on each tool (scan_dependencies gets 60s, lint_file gets 30s) because MCP hosts can hang if a tool never returns. FastMCP supports per-call timeouts natively.
Diff Parsing Over Full-File Analysis
Analyzing the unified diff instead of the full file keeps token usage low and focuses the review on what actually changed. The analyze_diff tool uses regex patterns tuned on 200 past PRs to minimize false positives.
How to Apply This to Your Team
If you're considering building an MCP code review server, here's the fastest path to value:
- Start with just 2 tools: lint_file and analyze_diff. Skip dependency scanning and PR summarization initially — they add complexity without proportional value. The lint + diff analysis alone caught 85% of actionable issues in our pilot.
- Add severity levels from day one. Without INFO/WARN/CRITICAL tiers, every finding looks equally urgent. Match Ruff's output conventions so your team can triage at a glance.
- Integrate with your MCP host before building more tools. FastMCP's stdio transport works out of the box with Claude Desktop, Cursor, and Hermes Agent. Verify the connection works end-to-end before adding complexity — one hour of debug time here saves five later.
For implementation details, see the FastMCP docs and the Hermes Agent MCP integration guide.
Lessons Learned
- Start with 3 tools, not 10. We initially built 12 tools. After testing, only 4 were used regularly. Tool discovery overhead slowed the agent down.
- Cache dependency scans.
pip-auditre-downloads the vulnerability database every run. Adding a 1-hour cache dropped average scan time from 42s to 3s. - Add severity levels. Without severity, the agent flagged every lint warning equally. Adding INFO/WARN/CRITICAL levels (matching Ruff's output) helped Hermes prioritize critical findings.
- Test with multiple hosts. FastMCP worked perfectly with Claude Desktop but needed explicit
transport="stdio"for Hermes Agent compatibility.
What's Next
We're adding context-aware review — instead of regex pattern matching on diffs, we'll pass the diff to the host LLM with a structured prompt for semantic analysis. Early tests with GPT-5 and Claude Sonnet 4 show ~40% better recall on logic bugs compared to regex-only analysis. The hybrid approach (regex for secrets/lint, LLM for logic) is the sweet spot.
