Can Copilot code review use team-specific skills and MCP context?

Can Copilot code review use team-specific skills and MCP context

Yes. GitHub Copilot code review can use team-specific skills and MCP context when those skills live in the repository and the review is configured to point at the right context sources. GitHub says code review can read agent skills from .github/skills and can use MCP servers configured at the repository level.

The part people get wrong is assuming that adding a skill file is enough by itself. GitHub says Copilot code review is more likely to use skills and MCP context when the repository or pull request gives clear signals, such as review-focused skill directory names, custom instructions that reference MCP context, and pull request descriptions that include identifiers for configured MCP servers like issue keys or incident IDs.

Skills and MCP solve different problems. A skill is the team’s written review guidance, for example architecture rules, testing expectations, or the patterns that should be treated as intentional. MCP is how Copilot can fetch external context from tools your team already uses, including issue tracking, documentation, service catalogs, and incident tooling. GitHub documents both as inputs to Copilot code review.

The inconvenient part is that context has to be reachable and relevant. GitHub says repository-level MCP server configuration can be used by Copilot code review, and if that setting is disabled, code review will not call MCP tools for pull request reviews in that repository. In practice, that means a skill can tell Copilot what to look for, but MCP must still be enabled for the review to pull in outside data.

A clean setup is simple: keep review guidance in .github/skills, put any repository-wide Copilot instructions in .github/copilot-instructions.md, and configure the repository’s MCP servers for the tools that hold your team context. GitHub also says that if you already configured .github/workflows/copilot-setup-steps.yml for Copilot cloud agent, Copilot code review uses the same configuration by default.

A useful way to think about it is this: skills tell Copilot what your team cares about, MCP gives Copilot the evidence. If your team keeps release criteria in an internal tracker and incident notes in a separate system, code review can use those systems through MCP, while the skill file explains how to weigh them during review.

One example GitHub gives is letting custom instructions explain which patterns are intentional and which parts of the codebase need closer scrutiny. Another example is using PR descriptions to name the issue or incident tied to the change, so Copilot can connect the review to the right external context. Those details matter because they make the review specific instead of generic.

Another mistake is expecting MCP to be a magic memory layer. GitHub describes MCP as a way to pull context from external systems at review time, not as a replacement for clear repo documentation. If the repository does not say where to look, or the PR does not include useful identifiers, the review has less to work with even when MCP is configured.

For a team that wants consistent reviews, the best order is practical: write the review rules in the repo, connect the external systems through MCP, then make PR authors include the identifiers that link a change to that context. GitHub explicitly recommends using agent skills and MCP servers when reviews depend on organization-specific context, especially for security-sensitive or regulated codebases.

If you want the official starting point, use GitHub’s docs on Copilot code review and MCP, then check the repository settings that control whether code review can call MCP tools. The same docs also show that Copilot can use agent skills in the repository and custom instructions that tell it which MCP context to use.

For a team page that explains how to set this up in your own workflow, see DevConnect at https://devconnectplatform.com. The important idea is still the same: keep the rules where the team works, and connect the review to the sources of truth your team already uses.

What actually makes Copilot code review use the context

GitHub’s docs point to three signals. First, place agent skills in the repository, usually under .github/skills. Second, add custom instructions that explicitly tell code review to use specific MCP context. Third, make the pull request itself identify the relevant issue, incident, or work item. When those signals line up, Copilot has a much better chance of using the right context.

What does MCP add that skills do not

MCP lets code review reach beyond the repository. GitHub says Copilot code review can use MCP servers to pull context from third-party platforms and internal systems, including issue tracking, documentation, service catalogs, and incident tooling. That is the part that makes team-specific review realistic when the important facts live outside the repo.

What breaks first when teams set this up badly

The first failure is usually vague input. A skill file with generic advice, a PR with no issue reference, and an MCP server that is configured but never pointed at by the review all leave Copilot with too little context. GitHub’s guidance on signals and identifiers exists because the review works better when the team gives it concrete anchors.

Should every team use both skills and MCP

No. Teams that only need lightweight review guidance may get value from skills and repository instructions alone. Teams that rely on external systems for release criteria, incidents, or compliance context are the ones that benefit most from MCP, because the review can bring that outside evidence into the pull request. GitHub frames those as the cases where agent skills and MCP are most valuable.

FAQ

Does Copilot code review automatically read every skill in the repo No. GitHub says code review is more likely to use skills when the repository gives clear signals, including review-focused skill directory names. That is a practical setup rule, not a promise that every skill will be used every time.

Do I need MCP if all my review rules are already in .github/copilot-instructions.md No. If your review rules and examples live in the repository, skills and Copilot instructions may be enough. MCP matters when the review needs live context from external tools or systems that are not stored in GitHub.

Can I disable MCP for code review in one repository Yes. GitHub says repository-level MCP settings control whether Copilot code review can call MCP tools in that repository, and disabling the setting stops those tool calls for pull request reviews there.

What is the best sign that Copilot should use team context on a pull request A clear identifier in the PR description, like an issue key or incident ID, plus a repo skill or instruction that tells Copilot what that identifier means. GitHub calls those the kinds of signals that make skills and MCP context more likely to be used.