Bubo MCP server
Commit Nov 14, 2026Performs agentic AI code reviews on GitLab MRs and GitHub PRs by posting actionable findings as inline threads using your preferred LLM.
Also known as mountainowl/bubo
- Stars
- 8
- Tools
- —
- Downloads, 30 days
- —
- Latest version
- —
- Last commit
- Nov 14, 2026
- License
- MIT
What is Bubo MCP?
Bubo performs agentic AI code reviews on GitLab MRs and GitHub PRs by posting actionable findings as inline threads using your preferred LLM.
Summary generated from the project's README
About Bubo MCP server
Bubo provides agentic AI code reviews for developers working with GitLab Merge Requests and GitHub Pull Requests. It functions by using a preferred large language model to identify actionable code issues and posting them directly as inline threads. This approach focuses on providing evidence-backed findings while avoiding unnecessary chatbot chatter, praise, or general summaries.
Users can deploy this server locally or via Docker, connecting it to various LLM infrastructures such as OpenAI, Anthropic, or custom CLI-backed models. The system supports continuous reviews through a polling service or manual triggers via MCP. It includes features like confidence gates, deduplication, and optional verification to ensure high signal quality.
Administrators can monitor performance through local dashboards and reports that track findings, usage, and policy decisions. The tool also emits OpenTelemetry metrics for detailed observability. For security and compliance, releases are signed with cosign and include SBOMs for auditing purposes.
What you can do with it
- 1Automated Pull Request ReviewsAn AI client can trigger a code review on a GitHub Pull Request to find actionable bugs.
- 2Continuous Code MonitoringA developer can set up a service to automatically poll and review incoming GitLab Merge Requests.
- 3Custom LLM IntegrationTeams can use their own private infrastructure by connecting the server to a custom CLI-backed model.
- 4Review Quality AuditingA lead developer can use local dashboards to review findings and track the return on investment for AI reviews.
Written from the project's README. Every use case is checked against a quote from it.
Automated checks
Ran Nov 15, 2026Full report →Not verified yet. A server needs a score of 80, no serious finding, and enough data for us to check. How checks work · What to fix for more points
- Source repository linked and reachablemountainowl/bubo is public and reachablegithub.com/mountainowl/bubo ↗Pass
- Package names this repository as its sourceNot checked
- Build provenance (Sigstore attestation)Not checked
- Open source license (OSI)MITspdx.org/licenses/MIT.html ↗Pass
- Commit or release in the last yearLast commit or release 2026-11-14github.com/mountainowl/bubo ↗Pass
- OpenSSF ScorecardOpenSSF Scorecard 7.3 / 10; weakest: Code-Review 0, CII-Best-Practices 0, Fuzzing 0scorecard.dev/viewer/?uri=github.com/mountainowl/bubo ↗Pass
- Package name not close to a popular packageNot checked
- No critical advisory in the package or its dependenciesNot checked
- No hidden instructions to the model0 tool descriptions and the README read; no override phrases, credential paths or hidden charactersPass
- Destructive tools are labelledNot checked
- Remote endpoint answers the MCP handshakeNot checked
README
View on GitHubBubo 🦉
This wise owl is Bubo, an agentic AI code reviewer that reviews your GitLab MRs and GitHub PRs with the LLM model of your choice, and posts only the findings worth acting on as inline threads — no chatbot noise, no praise, no summaries.
- Signal over noise — evidence-backed inline findings, confidence gates, optional verification, and deduplication.
- Your model, your infrastructure — OpenAI, Anthropic, or another CLI-backed reviewer with your own deployment.
- Feedback-driven reviews — recorded outcomes help tune thresholds and suppress recurring unwanted findings.
- Review evidence, in one place — local dashboards and reports for findings, usage, policy decisions, and outcomes.
- Compliance - cosign-signed releases with SBOMs, auditable on-prem report
- Metrics and RoI — Read about real world metrics and ROI
Run continuous reviews through polling, or trigger reviews through MCP. The experimental GitHub Action.
Install
uv tool install bubo # or: pipx install bubo
bubo init # idempotent; seeds config + workspace + DB
bubo doctor # verify before the first poll
bubo-poller service start # start the review service (polling + outcome sync)
Container → docker pull ghcr.io/mountainowl/bubo - Bring your own LLM CLI, you can use multiple architectures.
Documentation
Everything lives on the docs site — this README is just the front door.
| Recipes | Copy-paste GitLab / GitHub / in-house-model setups. |
| Features | The full capability list. |
| Configuration | Every setting, per section, plus a quick-start config. |
| Operate | Deploy, schedule, grade outcomes, governance report. |
| Troubleshooting | Host / infra fixes (sandbox, AppArmor). |
| Metrics & telemetry | Emitted llm_review.* metrics and dashboards. |
| Updates & recovery | Automatic/manual updates, safe deferrals and issue-ready failure reports; platform acceptance status. |
Community
Contributing · Security policy · Release verification · Support · Code of conduct · License: MIT
Bubo MCP questions
Which LLMs can Bubo use?
You can use OpenAI, Anthropic, or any other CLI-backed reviewer with your own deployment.
How does Bubo post its findings?
It posts only actionable findings as inline review threads, avoiding chatbot noise or summaries.