
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
mcp-pr-command
Advanced tools
MCP stdio server to help with PR workflows: detecting branches, preparing PR content, collecting commit diffs, rewriting commit messages and submitting pull requests.
This package provides an MCP server (mcp-pr-command) designed to be connected through GitHub Copilot in VS Code. It offers several tools to simplify pull request creation and maintenance.
You can check out demonstration PR here
This MCP server exposes focused tools to simplify common pull-request workflows by inspecting and operating on git history and remote PRs. Each tool is available as an MCP tool that can be invoked through GitHub Copilot.
Core tools and what they do:
Inspect the current git branch and suggest a target/base branch for a PR. It computes branch proximity using git merge-base and rev-list heuristics and can infer tracker/card links from branch names. Use this as the first step in an "open PR" workflow.
Prepare PR artifacts and human-facing instructions. It gathers diffs and commit lists, detects existing PRs (via gh), reads PR templates (if present), and returns files to read plus step-by-step next actions and candidate card links. Intended to be run after detect-branches and before submitting.
Create or update a pull request on the remote (uses the GitHub CLI under the hood). Ensures the branch is pushed and then either edits an existing PR or creates a new one, returning the PR URL and follow-ups.
Given an existing PR URL, fetch PR metadata (head/base branches, title/body) and run the same prepare flow so you can update the PR using local context.
Return full commit messages (title + body) in the range between a base and head ref. Handles common local/origin ref combinations and will fetch missing refs if necessary.
Generate a single file containing commit messages, a diff summary and the full unified diff between two refs. Useful to attach to reviews or to pass to other tools that need a human-readable changeset.
Rewrite the commit messages between two refs using a provided list of messages (ordering matters). The tool validates counts, protects special branches, creates a backup tag, and rewrites history safely using a temporary branch and git filter-branch flow.
Combine the commits between a base and head into a single commit with a supplied message. The tool creates a backup tag, supports the single-commit amend case, and pushes changes with --force when appropriate.
Create a new feature/fix/hotfix/release branch following configurable branch schemas (from McpPRCommandOptions) or sane defaults. Normalizes suffixes and checks out from the chosen base.
Notes and recommended usage:
detect-branches -> prepare-pr (inspect suggested files and the suggested body) -> submit-pr.get-commit-messages first to review the changes before calling replace-commit-messages or squash-commits.gh) where needed. Ensure those are available in your PATH when using prepare-pr, submit-pr, or update-pr-by-link.Of course, you need to have git installed and running on your system.
Several tools (for example prepare-pr, submit-pr and update-pr-by-link) rely on the GitHub CLI (gh) to query and create PRs. Before using those tools, please install the official GitHub CLI and make sure you're logged in to your GitHub account:
gh auth login and follow the prompts to authenticate.Install the package globally:
npm i -g mcp-pr-command
After installation, you need to configure it in VS Code (see next section).
The simplest way to register an MCP server is using the MCP extension command inside VS Code:
Ctrl + Shift + P on Windows/Linux or Cmd + Shift + P on macOS).mcp-pr-command
wsl zsh -i -c "mcp-pr-command"
wsl bash -i -c "mcp-pr-command"
mcp-pr-command).global).This will register the MCP server and allow Copilot to use these tools to generate PR descriptions and rewrite commits! Remember you can add --mcp-options or --mcp-options-file to the call so you can customize card link inferring from branch.
When the MCP server runs inside WSL but the user workspace is a Windows path (or vice-versa), path strings can be in different formats (for example C:\Users\... vs /mnt/c/Users/...). To avoid mismatches and broken git commands, this package now normalizes incoming cwd values passed to tools so they match the environment where the MCP server is running.
What changed:
src/internal/path-utils.ts which detects whether the server is running in WSL and converts Windows paths to WSL paths (and back) when needed.cwd parameter now run it through normalizePath(cwd) before using it.Quick notes for users:
wsl zsh -i -c "mcp-pr-command"). The server will normalize repo paths passed from the client.mcp.json or server registration:{
"command": "mcp-pr-command",
"env": {
"WORKSPACE_ROOT": "${workspaceFolder}"
}
}
This package will use the normalized cwd passed by the client when available, but the automatic normalization ensures the server behaves correctly across Windows and WSL environments.
The MCP server supports runtime inference of card and PR links by passing a JSON options object. Example:
mcp-pr-command --mcp-options '{"branchCardIdExtractPattern":"[\w\-]+/(\d+)/(\d+)", "cardLinkWebSite":"https://link.com","cartPathLinkReplacePattern":"$1/card/$2/details"}'
In the example above the server will use the provided regular pattern to extract card identifiers from text and map them into the prLinkInferPattern template.
You can also inform a config option file like this:
mcp-pr-command --mcp-options-file mcp-pr-command-options.json
You can also use this library directly from Node.js, which is ideal for organizations that want to set up their own CLI wrapper or enforce specific options programmatically. This allows you to start the MCP PR Command server with custom options, without relying on CLI arguments or config files.
// my-mcp-server.js
#!/usr/bin/env node
const { startServer } = require('mcp-pr-command');
startServer({
cardLinkWebSite: 'https://link.com',
cartPathLinkReplacePattern: '$1/card/$2/details',
branchCardIdExtractPattern: '[\\w\\-]+/(\\d+)/(\\d+)',
complementaryMcpDescription: 'Custom org PR workflow',
// ...any other options from McpPRCommandOptions
});
You can then run your server with:
node my-mcp-server.js
This approach is recommended for organizations with well-established parameters or custom workflows. You can fully control the server's configuration in code, integrate with other systems, or wrap it in your own CLI.
FAQs
MCP PR Command
The npm package mcp-pr-command receives a total of 16 weekly downloads. As such, mcp-pr-command popularity was classified as not popular.
We found that mcp-pr-command demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.