# get_review_comments Get review threads on a pull request. Each thread contains logically grouped review comments made on the same code location during pull request reviews. Returns threads with metadata (isResolved, isOutdated, isCollapsed) and their associated comments. Use cursor-based pagination (perPage, after) to control results. Agent View of the PolicyLayer registry record for `get_review_comments`. HTML page: https://policylayer.com/tools/io-github-aifity-omnigit-mcp/get-review-comments ## Facts - Tool: `get_review_comments` - Server: GitHub (`oci:ghcr.io/aifity/omnigit-mcp:0.5.0`) — https://policylayer.com/tools/io-github-aifity-omnigit-mcp.md - Homepage: https://github.com/aifity/omnigit-mcp - Risk category: Read (Low risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 0 - Recommended policy verdict: Allowed ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "get_review_comments", "arguments": {} } } ``` ## Why get_review_comments is rated Low This tool only queries and retrieves existing pull request review data. No creation, modification, deletion, or execution of code/operations occurs. The metadata flags (isResolved, isOutdated, isCollapsed) are read attributes, not write actions. Blast radius is minimal — worst case an attacker gains visibility into code review discussions, which is a Read-level confidentiality risk, not integrity or availability. From the tool's own definition: "Tool retrieves review threads and comments on pull requests with no modification capability. Description states 'Get review threads' and 'Returns threads with metadata and their associated comments' — purely data retrieval operations." ## Use case AI agents call get_review_comments to retrieve information from GitHub without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere. ## Recommended policy (PolicyLayer) Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches GitHub: ```json { "version": "1", "default": "deny", "tools": { "get_review_comments": {} } } ``` ## Other tools on GitHub (244) - `delete_file` — Destructive — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/delete-file.md - `force` — Destructive — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/force.md - `git_reset` — Destructive — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/git-reset.md - `git_worktree_prune` — Destructive — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/git-worktree-prune.md - `git_worktree_remove` — Destructive — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/git-worktree-remove.md - `actions_run_trigger` — Execute — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/actions-run-trigger.md - `detach` — Execute — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/detach.md - `git_checkout` — Execute — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/git-checkout.md - `git_pull` — Execute — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/git-pull.md - `git_push` — Execute — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/git-push.md - `git_worktree_add` — Execute — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/git-worktree-add.md - `git_worktree_lock` — Execute — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/git-worktree-lock.md - `autoInit` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/autoinit.md - `base` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/base.md - `base_branch` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/base-branch.md - `base_ref` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/base-ref.md - `before_id` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/before-id.md - `branch` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/branch.md - `branch_name` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/branch-name.md - `color` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/color.md - `comment_id` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/comment-id.md - `commentId` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/commentid.md - `commit_title` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/commit-title.md - `commitID` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/commitid.md - `direction` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/direction.md - `gist_id` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/gist-id.md - `issue_number` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/issue-number.md - `item_type` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/item-type.md - `job_id` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/job-id.md - `message` — Other — https://policylayer.com/tools/io-github-aifity-omnigit-mcp/message.md - …and 214 more: https://policylayer.com/tools/io-github-aifity-omnigit-mcp.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-aifity-omnigit-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-aifity-omnigit-mcp