Gerrit Code Review MCP server

go-gerrit-mcp

An MCP (Model Context Protocol) server that exposes Gerrit code review operations as capability-gated tools. An AI agent can search and read changes, publish review comments, vote, and drive change-state transitions. Every write capability is an explicit operator opt-in.

• Transport: stdio
• Target platform: Gerrit 3.13+, authenticated via HTTP credentials
• Output: llmxml, semantically tagged text meant to be read by a model (see Output format)

Safety posture

Two defaults encode it:

votes, state changes, anything other humans see) are refused on changes the authenticated account does not own, until the operator explicitly passes --own-changes-only=false.

• Zero configuration exposes the read group only. Write capability never appears unless enabled via --groups.
• The own-changes restriction is on by default. Even with write groups enabled, trail-leaving operations (comments,

An agent leaving unwanted trail on colleagues' changes is an externally visible failure; a missing capability is a locally discoverable inconvenience. The defaults are chosen accordingly. Widen deliberately:

# agent may comment and vote on anyone's changes, but only within two projects
go-gerrit-mcp --groups read,comment,transition --own-changes-only=false --projects core,infra

Install

Binary release: download the binary for your platform from GitHub Releases, make it executable, and put it on your PATH:

# macOS on Apple silicon; substitute <os>_<arch> from: linux, darwin, windows x amd64, arm64
curl -Lo /usr/local/bin/go-gerrit-mcp \
  https://github.com/GaijinEntertainment/go-gerrit-mcp/releases/latest/download/go-gerrit-mcp_darwin_arm64
chmod +x /usr/local/bin/go-gerrit-mcp

Docker:

docker pull ghcr.io/gaijinentertainment/go-gerrit-mcp:latest

go install:

go install dev.gaijin.team/go/go-gerrit-mcp/cmd/go-gerrit-mcp@latest

Quick start

The server reads connection identity from environment variables only; credentials never travel through flags:

Generate the credential in Gerrit under Settings → HTTP Credentials (an HTTP password, or an auth token on instances that issue them). All three variables are required; the server exits with an error naming the missing ones.

Claude Code

claude mcp add gerrit \
  --env GERRIT_URL=https://gerrit.example.com \
  --env GERRIT_USERNAME=your-username \
  --env GERRIT_TOKEN=your-http-credential \
  -- go-gerrit-mcp

Any MCP client (JSON configuration)

{
  "mcpServers": {
    "gerrit": {
      "command": "go-gerrit-mcp",
      "args": ["--groups", "read"],
      "env": {
        "GERRIT_URL": "https://gerrit.example.com",
        "GERRIT_USERNAME": "your-username",
        "GERRIT_TOKEN": "your-http-credential"
      }
    }
  }
}

Docker

{
  "mcpServers": {
    "gerrit": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "GERRIT_URL", "-e", "GERRIT_USERNAME", "-e", "GERRIT_TOKEN",
        "ghcr.io/gaijinentertainment/go-gerrit-mcp:latest",
        "--groups", "read"
      ],
      "env": {
        "GERRIT_URL": "https://gerrit.example.com",
        "GERRIT_USERNAME": "your-username",
        "GERRIT_TOKEN": "your-http-credential"
      }
    }
  }
}

Per-project configuration in Claude Code

Shortened. The full README is on GitHub.