@optimalai/optibot-mcp

Optibot MCP Server — AI Code Reviews for Any Editor

An MCP server that brings Optibot AI-powered code reviews to Claude Desktop, Cursor, Windsurf, Claude Code, and any MCP-compatible client.

Review local changes, compare branches, and get actionable feedback — all from your AI assistant.

What is MCP? The Model Context Protocol is an open standard that lets AI assistants use external tools and data sources. Once you add this server, your assistant can run Optibot reviews on your behalf — just ask in natural language.

What It Does

• Review your code — say "review my changes" and get an AI code review instantly
• Compare branches — "review my branch against main" triggers a full branch diff review
• Review patch files — point it at any .patch or .diff file
• Run AI security scans — trigger token-metered scans on any repo in your org and get the full markdown report back
• Manage organizations — switch the active org for multi-org accounts
• Manage API keys — create, list, and delete keys for CI/CD automation
• Detect merge conflicts — warns you about conflicts before you review

Install

npm install -g @optimalai/optibot-mcp

Setup

Claude Desktop

Add to your Claude Desktop configuration:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "optibot": {
      "command": "npx",
      "args": ["-y", "@optimalai/optibot-mcp"],
      "env": {
        "OPTIBOT_API_KEY": "optk_your_key_here"
      }
    }
  }
}

Cursor

Add to your Cursor MCP configuration:

• Global (all projects): ~/.cursor/mcp.json
• Project-level: .cursor/mcp.json in your project root

{
  "mcpServers": {
    "optibot": {
      "command": "npx",
      "args": ["-y", "@optimalai/optibot-mcp"],
      "env": {
        "OPTIBOT_API_KEY": "optk_your_key_here"
      }
    }
  }
}

Windsurf

Add to your Windsurf MCP configuration (~/.codeium/windsurf/mcp_config.json):

{
  "mcpServers": {
    "optibot": {
      "command": "npx",
      "args": ["-y", "@optimalai/optibot-mcp"],
      "env": {
        "OPTIBOT_API_KEY": "optk_your_key_here"
      }
    }
  }
}

Claude Code

claude mcp add optibot -e OPTIBOT_API_KEY=optk_your_key_here -- npx -y @optimalai/optibot-mcp

The -e flag stores the API key in the MCP server config so it is always available when Claude Code spawns the server, regardless of your shell environment.

Authentication

Option 1: API Key (Recommended for MCP)

Set the OPTIBOT_API_KEY environment variable in your MCP client configuration. You can generate a key from the Optibot dashboard or using the CLI:

npx @optimalai/optibot apikey create my-mcp-key

Option 2: Browser Login

Use the login tool to authenticate via browser. This saves credentials to ~/.optibot/config.json (90-day token).

Usage

Once configured, just ask your AI assistant naturally:

What you say	What happens
"review my changes"	Reviews uncommitted local changes
"review my branch against main"	Compares current branch against main
"review this diff file"	Reviews an arbitrary patch file
"what's my Optibot status?"	Shows auth method, profile, active org, and daily quota
"which Optibot organizations do I have?"	Lists all orgs (active marked with *)
"switch Optibot to the Acme org"	Rescopes your token to that org
"run a security scan on org/repo-a"	Triggers an AI security scan and returns the full report
"show me recent security scans"	Lists recent scans with cost and severity
"how much have we spent on scans this month?"	Shows current-month token usage and cost
"create an API key for CI"	Creates and displays a new API key
"list my API keys"	Lists all API keys with metadata

Available Tools

Review

Tool	Description
review_local_changes	Review uncommitted local changes (git diff HEAD)
review_branch	Review changes against a target branch (auto-detects or specify)
review_diff_file	Review an arbitrary diff/patch file

Auth & status

Tool	Description
login	Authenticate via browser OAuth (handles onboarding redirects; refuses inside CI environments)
logout	Remove saved credentials
check_auth	Check current authentication status
get_status	Full status: auth method, active org, daily quota

Organizations

Tool	Description
list_organizations	List all organizations you belong to
get_current_organization	Show the active organization (read from the JWT claim)
switch_organization	Rescope your token to a different org (by id or name)

CI/CD setup

Tool	Description
setup_ci	Recommended onboarding for CI/CD — mints a long-lived API key bound to the active organization and returns the export line ready to paste into the user's CI secret store. Refuses inside CI environments.

API keys

Tool	Description
create_api_key	Create a new API key (lower-level primitive; prefer setup_ci for CI onboarding)
list_api_keys	List all API keys
delete_api_key	Delete an API key by ID

⚠️ Heads up: create_api_key and setup_ci return the full secret in the tool output — by design, since you have to copy it. That output then lives in your AI host's conversation transcript (Claude Desktop, Cursor, etc.), which may be persisted, synced, or backed up. Copy the key into your CI secret store, then delete the conversation or rotate the key with delete_api_key if you don't want it lingering in transcript history.

Security scans

Tool	Description
trigger_security_scan	Start an AI security scan on a repo; blocks until complete (configurable timeout)
list_security_scans	Paginated list of recent scans (optionally filtered by repo)
get_security_scan	Full markdown report + metadata for a specific scan id
get_security_usage	Current-month token usage and cost
get_security_pricing	Per-tier pricing and markup multiplier
list_scannable_repos	Repositories available to scan in the active org
get_security_config	Scheduled-scan configuration
update_security_config	Update the scheduled-scan configuration (partial merge)

Real-Time Progress

During reviews and security scans, the MCP server connects to the Optibot backend via WebSocket and emits real-time progress notifications using MCP logging messages. Your MCP client will receive updates as the operation progresses.

Reviews:

• started — Review request accepted
• analyzing_patch — Parsing and analyzing the diff
• tool_call — Running analysis tools (with tool name and query details)
• generating_review — Generating the final review
• completed — Review finished

Security scans:

• started — Scan request accepted
• cloning_repository — Fetching the repository
• scanning_code — Running security analysis
• tool_call — Individual analyzer tool invocations
• budget_update — Running token + cost ticker
• generating_report — Producing the final markdown report
• completed / failed — Final status

CI/CD Integration

For automated reviews in CI/CD pipelines (GitHub Actions, GitLab CI, etc.), use the Optibot CLI instead. The CLI is purpose-built for non-interactive environments and runs as a standard command-line tool.

The MCP server is designed to run inside AI assistants (Claude Desktop, Cursor, etc.) — it speaks the MCP stdio protocol and is not intended to be invoked directly in a pipeline.

To use in CI:

• Generate an API key from the Optibot dashboard or with create_api_key tool
• Add OPTIBOT_API_KEY as a repository secret
• Use the CLI in your pipeline:

# GitHub Actions
- name: Install Optibot CLI
  run: npm install -g @optimalai/optibot
- name: Run code review
  env:
    OPTIBOT_API_KEY: ${{ secrets.OPTIBOT_API_KEY }}
  run: optibot review --branch origin/${{ github.base_ref }}

See the Optibot CLI README for full CI/CD setup instructions including GitLab CI.

Environment Variables

Variable	Description
OPTIBOT_API_KEY	Your API token (required for automated use)
OPTIBOT_API_URL	Custom backend URL (must use https://, defaults to https://agents.getoptimal.ai)

Requirements

• Node.js >= 22
• Git (for review tools)

Changelog

See CHANGELOG.md for the full release history. Security disclosures: SECURITY.md.

Contributing

Contributions are welcome! See CONTRIBUTING.md for guidelines.

Links

• Optibot Website
• Sign Up (Free)
• Report an Issue
• Optibot CLI on npm
• Optibot Claude Code Plugin
• Twitter / X
• LinkedIn
• YouTube
• Contact Us

License

MIT — see LICENSE for details. Copyright (c) 2026 Optimal AI, Inc.