GitHub PR Comment
Post one bounded review comment to one known GitHub pull request. The skill is
deliberately narrower than a general GitHub operator: it binds the exact
repository, pull request, and comment body to a scoped provider operation, and
closes only when provider evidence identifies and reads back the created note.
Use it after a review workflow has produced final wording and the operator wants
that exact note posted. Use issue-triage for analysis and drafting, and a
broader GitHub skill for other resource types. This skill never merges a pull
request; comment authority cannot be promoted into merge authority.
Composes
github-mcp-merge-pr#defaultgithub-mcp-pr-review-note#default
How it works
- Supply
owner/name, the exact pull-request number, exact comment body, and a
stable idempotency key for that body.
- The default
post runner computes the body digest and admits the write only
under a compatible pr.comment grant.
- Native
provider.mutate posts under pr.comment; native provider.read
then reads the returned comment ref under pr.read. Repository, PR number,
comment ref, and body digest must match before completion.
- The explicit
comment runner preserves the separately human-gated bundled
examples/github-mcp-hero/review-note path as the canonical MCP composition
and deterministic harness surface. It is not live Connect evidence.
The separate merge-refused runner routes the same comment grant to the
bundled examples/github-mcp-hero/merge-pr denial fixture. It is an executable
authority test: a pr.merge request must seal as policy denied, never as a
backdoor merge path.
Stop conditions
- Stop when repository, pull-request number, body, or idempotency key is
missing or changes after admission.
- The explicit
comment runner stops when its human approval is absent or
denied; the default post runner does not add that second gate.
- Refuse a provider grant that does not resolve uniquely to
pr.comment.
- Refuse a missing, ambiguous, wrong-provider, or under-scoped GitHub binding;
compatible local
gh, hosted connectors, and MCP transports all remain
behind the same provider effect rather than a raw token or package HTTP client.
- Do not treat mutation acceptance without an independent comment read, stable
comment ref, and matching body digest as final readback.
- Never merge, close, label, or otherwise mutate the pull request beyond the
exact comment.
Example
An operator invokes post with “Please add the missing recovery fixture” for
PR 42 under a pr.comment grant. The skill posts exactly that body under the
stable retry key and seals the returned comment id. Changing the body changes
the operation identity. Attempting to reuse the comment grant for merge is
denied before GitHub mutation.
1---2name: github-pr-comment3description: Post one exact GitHub pull-request comment through local gh, any compatible hosted connector, or the explicit human-gated MCP composition, with retry safety and independent readback.4---56# GitHub PR Comment78Post one bounded review comment to one known GitHub pull request. The skill is9deliberately narrower than a general GitHub operator: it binds the exact10repository, pull request, and comment body to a scoped provider operation, and11closes only when provider evidence identifies and reads back the created note.1213Use it after a review workflow has produced final wording and the operator wants14that exact note posted. Use `issue-triage` for analysis and drafting, and a15broader GitHub skill for other resource types. This skill never merges a pull16request; comment authority cannot be promoted into merge authority.1718## Composes1920<!-- Generated from the native execution closure; run pnpm core-skills:composes:generate. -->2122- `github-mcp-merge-pr#default`23- `github-mcp-pr-review-note#default`2425## How it works26271. Supply `owner/name`, the exact pull-request number, exact comment body, and a28 stable idempotency key for that body.292. The default `post` runner computes the body digest and admits the write only30 under a compatible `pr.comment` grant.313. Native `provider.mutate` posts under `pr.comment`; native `provider.read`32 then reads the returned comment ref under `pr.read`. Repository, PR number,33 comment ref, and body digest must match before completion.344. The explicit `comment` runner preserves the separately human-gated bundled35 `examples/github-mcp-hero/review-note` path as the canonical MCP composition36 and deterministic harness surface. It is not live Connect evidence.3738The separate `merge-refused` runner routes the same comment grant to the39bundled `examples/github-mcp-hero/merge-pr` denial fixture. It is an executable40authority test: a `pr.merge` request must seal as policy denied, never as a41backdoor merge path.4243## Stop conditions4445- Stop when repository, pull-request number, body, or idempotency key is46 missing or changes after admission.47- The explicit `comment` runner stops when its human approval is absent or48 denied; the default `post` runner does not add that second gate.49- Refuse a provider grant that does not resolve uniquely to `pr.comment`.50- Refuse a missing, ambiguous, wrong-provider, or under-scoped GitHub binding;51 compatible local `gh`, hosted connectors, and MCP transports all remain52 behind the same provider effect rather than a raw token or package HTTP client.53- Do not treat mutation acceptance without an independent comment read, stable54 comment ref, and matching body digest as final readback.55- Never merge, close, label, or otherwise mutate the pull request beyond the56 exact comment.5758## Example5960An operator invokes `post` with “Please add the missing recovery fixture” for61PR 42 under a `pr.comment` grant. The skill posts exactly that body under the62stable retry key and seals the returned comment id. Changing the body changes63the operation identity. Attempting to reuse the comment grant for merge is64denied before GitHub mutation.
runxhq