GitHub announced on 29 July 2026 that support for agent skills and MCP servers in Copilot code review is now generally available. The headline is straightforward: automated reviews can apply your team's own standards and read context from the tools you already use. The detail worth reading twice is that every MCP call is restricted to read-only, which is what makes the feature adoptable rather than merely interesting.
What actually shipped
Two capabilities left preview at the same time, and they solve different halves of the same problem.
Agent skills let a review invoke your team's internal tools and coding standards. You add a SKILL.md file inside a skill subdirectory under .github/skills, and its contents extend the analysis with context and instructions specific to your repository or organisation. The practical consequence is that conventions which live in a wiki nobody reads, or in the head of one senior engineer, become something the reviewer applies consistently.
MCP server connections pull context from third-party platforms your team already runs: issue trackers, documentation systems, service catalogues. Instead of reviewing a diff in isolation, the reviewer can see what the linked ticket actually asked for.
GitHub lists the feature for Copilot Pro, Pro+, Business and Enterprise. That is worth noting because several recent Copilot releases started higher up the plan ladder. If you configured either capability during the public preview, GitHub states that no changes are needed and your existing setup continues to work.
The read-only constraint is the real news
Connecting an automated agent to your internal systems is the kind of proposal that stalls in a security review, and usually for good reason. The question is never whether the context would help, it is what happens when the agent is wrong or manipulated.
GitHub's answer here is a design decision rather than a policy promise: all MCP tool calls performed by Copilot code review are limited to read-only. The reviewer can read your issue tracker; it cannot close tickets, edit documentation or change a service definition. That converts an open-ended risk into a bounded one, and it is the difference between a feature a security team can approve and one it cannot.
It is worth being precise about what this does not cover. Read-only access still means the content of those systems reaches the reviewer, so the usual questions about what data leaves your perimeter remain relevant. We looked at that broader surface in our analysis of MCP security, and the reasoning there applies unchanged: restricting writes reduces blast radius, it does not remove the data-exposure question.
Attribution: the quiet feature that makes skills usable
GitHub also states that Copilot code review now indicates when a comment was generated using agent skills or MCP context.
This reads like a small transparency touch and is actually the thing that makes the rest workable. Without attribution, a review comment is undifferentiated: you cannot tell whether it reflects a standard you encoded or the model's general training. That matters the moment a skill starts producing noise, because you have no way to know which comments to trace back to which SKILL.md. With attribution, a badly written skill is debuggable. Without it, teams quietly stop trusting the whole reviewer.
What it changes in practice
If your team already runs Copilot code review, the useful move is narrow rather than ambitious. Encode the conventions that generate the most repeated review comments, the ones a human writes for the tenth time this month, and start there. Those are the cases where a SKILL.md pays for itself immediately, and where a wrong answer is cheap to spot.
If you were holding off on connecting internal systems, the read-only limit removes the objection that usually killed the discussion. It does not remove the need to decide which servers are worth connecting, and the answer is probably fewer than you would like: context that changes a review's conclusion is valuable, context that merely adds volume makes reviews slower and noisier.
If you are still choosing a reviewer, this narrows the gap between Copilot and tools that differentiated on customisation. Our comparison of AI code review tools sets out the categories and the trade-offs, though it predates this announcement and treats customisation as a differentiator that Copilot lacked.
The bottom line
The feature is generally available as of 29 July 2026 for Pro, Pro+, Business and Enterprise, configured through SKILL.md files under .github/skills and through MCP server connections, with every MCP call read-only and comments attributed to their source.
Taken together, that is a more conservative shape than the announcement's framing suggests, and conservative is the right call here. An automated reviewer that can read your systems and tell you where its opinions came from is useful. One that could write to them, without saying which comment came from where, would be a liability. This shipped as the former. For the model side of the same stack, we covered Claude Opus 5 arriving in Copilot last week, including a safeguard that cuts the other way for security work.
Based on GitHub's published changelog entry of 29 July 2026. Plan names, the SKILL.md path, the read-only restriction and the attribution behaviour are GitHub's own wording, not our characterisation. We have not benchmarked review quality with or without skills and make no claim about it.
