AI Code Review

A Kiro workspace for AI-assisted code review automation — skills, a custom agent, and a power backed by two MCP servers.

What's Included

Skills (auto-registered)

| Skill | Description | |-------|-------------| | code-change-review | Platform-agnostic diff analysis. Traces callers, types, imports, tests. Produces structured findings JSON. | | gitlab-mr-review | End-to-end GitLab MR review. Clones, analyzes, posts draft notes, publishes with verdict. Supports batch reviews. | | gitlab-todo-triage | GitLab todo list cleanup. Marks merged/closed/draft MRs as done, delegates open MRs for review. |

Agent (auto-registered)

Code Change Reviewer — subagent used by gitlab-mr-review for code analysis. Reads diffs in full codebase context and produces structured findings.

Power (manual import)

code-review — two MCP servers from the @renfeng/ai-code-review npm package:

• git — platform-agnostic git operations (clone, diff, show, log, grep)
• gitlab — GitLab API tools (MR metadata, draft notes, publish, todos)

Usage

1. Add as a workspace folder

Add this repo to your .code-workspace file:

{
  "folders": [
    { "name": "ai-code-review", "path": "../path/to/ai-code-review" }
  ]
}

This auto-registers the skills and the Code Change Reviewer agent.

2. Install the power

The power provides the MCP servers that the skills depend on.

In Kiro: Powers panel → Add power from Local Path → select .kiro/powers/code-review/ within this repo.

To update the power after pulling new changes: reinstall from the same path.

Prerequisites

• Node.js 18+ (for npx to run the MCP servers)
• GitLab authentication via one of: GITLAB_TOKEN + GITLAB_URL env vars in the power's mcp.json, or glab CLI (glab auth login)
• SSH keys configured for git clone operations

Troubleshooting

401 "Token is expired" when using glab OAuth

The gitlab MCP server reads the token from the glab config file but does not perform OAuth refresh. If the token has expired, API calls fail with 401 Unauthorized.

Fix: run glab auth status — this silently refreshes the OAuth token and writes it to disk. The MCP server picks up the new token on the next call, no restart needed.

Contributing

See CONTRIBUTING.md.

License

MIT