Code-review agent on a GitHub PR

1Install enclawed-oss

curl -fsSL --proto '=https' --tlsv1.2 https://enclawed.com/install.sh | bash

enclawed --version

2Configure the egress allowlist

The framework’s egress guard reads allowedHosts from the Policy object the runtime is bootstrapped with. The bundled mcp-github bridge talks to GitHub’s MCP server on 127.0.0.1; that server is the one process talking outbound to api.github.com. From the enclawed runtime’s perspective the only outbound destination is loopback.

// bootstrap-shim.ts — loaded before any MCP traffic.
import { bootstrapEnclawed } from "enclawed/bootstrap";
import { createPolicy } from "enclawed/policy";
import { makeLabel, LEVEL } from "enclawed/classification";

await bootstrapEnclawed({
  policy: createPolicy({
    enforceAllowlists: true,
    allowedHosts:      ["127.0.0.1", "::1", "localhost"],
    allowedChannels:   ["mcp.github"],
    maxOutputClearance: makeLabel({ level: LEVEL.UNCLASSIFIED }),
    defaultDataLabel:   makeLabel({ level: LEVEL.UNCLASSIFIED }),
  }),
});

If you instead point mcp-github at a remote MCP server, add that one hostname to the allowlist and nothing else.

3Run GitHub’s MCP server + load the bundled bridge

The GitHub PAT (or fine-grained token) is a CSP — it lives in an env var, not the config:

# Shell env (~/.zshrc, ~/.bashrc, or a systemd unit's EnvironmentFile=...).
export ENCLAWED_GITHUB_TOKEN="ghp_..."
export ENCLAWED_GITHUB_REPO="acme/widgets"
# Optional: pin the local MCP server endpoint (default is
# http://127.0.0.1:8744/mcp/v1).
# export ENCLAWED_GITHUB_MCP_ENDPOINT="http://127.0.0.1:8744/mcp/v1"
# Legacy OPENCLAW_GITHUB_TOKEN / OPENCLAW_GITHUB_REPO still work for
# backward compatibility; if both are set, ENCLAWED_* wins.

Start GitHub’s first-party MCP server locally. It reads the same PAT from ENCLAWED_GITHUB_TOKEN:

# Option A: Docker (simplest if you have Docker).
docker run --rm -it \
  -p 127.0.0.1:8744:8744 \
  -e GITHUB_PERSONAL_ACCESS_TOKEN="$ENCLAWED_GITHUB_TOKEN" \
  ghcr.io/github/github-mcp-server:latest --http :8744

# Option B: npm (if you'd rather run it on the host).
npx --yes @github/github-mcp-server --http :8744

Load the bundled bridge from your bootstrap shim. It registers mcp.github with mcp-attested, wires the PAT as bearer auth, and enforces the closed tool allowlist:

// bootstrap-shim.ts (continued from step 2).
import { loadGithubBridge } from "@enclawed/mcp-github";

loadGithubBridge({
  requiredClearance: "internal",
  // Trim the allowlist if you only need read-only review:
  allowedTools: [
    "github.pulls.get",
    "github.pulls.list_files",
    "github.pulls.create_review_comment",
  ],
});

The allowedTools array is the admission-gate contract: anything missing from this list — github.repos.delete, you name it — mcp-attested denies before any network call (and appends an mcp.tool.deny line to the audit log). The default allowlist (when you don’t pass allowedTools) covers pulls / issues / repos / search; pick the smallest subset your agent actually needs.

Inspect the running trust root and bridge state:

enclawed trust list           # signers in the trust root
enclawed mcp list             # registered bridge endpoints + admitted tools

4Author the review-agent system prompt

Configure the agent (via enclawed configure or enclawed agents add --agent pr-reviewer) with the system prompt below. For repeatable runs, drop the same prompt + user instruction into a markdown task file and dispatch it with enclawed run ./review.md --var pr=1234; the runner substitutes {{pr}} and pumps the turn through the same agent path as enclawed agent --message.

You are a code-review agent. For the PR number and repo named
in the user message:

  1. Call github.pulls.get to read title, description, base ref.
  2. Call github.pulls.list_files to get the list of changed files
     with patches.
  3. For each changed file, use the diffs extension to render the
     unified hunks. Note any:
       - unused imports
       - dead branches
       - missing error handling on async calls
       - obvious off-by-one or fence-post bugs
       - secrets-in-source patterns

  4. Compose ONE review comment summarising your findings.
     Prefer 3-5 concrete bullets to a wall of prose. Be polite.

  5. Post the comment via github.pulls.create_review_comment.
     If you have no findings, post a one-line "no blocking issues
     from automated review" comment.

Rules:
  - Never request changes you cannot justify from the diff itself.
  - Never invent file paths or line numbers; cite real ones.
  - Never call any tool not listed above.

5Run it on a real PR

enclawed agent \
  --agent pr-reviewer \
  --local \
  --message "Review PR #42 in $ENCLAWED_GITHUB_REPO."

Expect a sequence of audit lines: a few mcp.connect.allow records for the GitHub MCP bridge, model-call records (subject to prompt-shield and DLP), and any tool-call audit lines for github.pulls.get, github.pulls.list_files, and github.pulls.create_review_comment as your MCP server emits them through the framework’s audit pipeline.

6Confirm the comment was posted

# Open the PR in your browser and confirm the review appears
# under the bot's account.
#
# Or programmatically, but staying inside the allowlist:
#   gh pr view 42 --repo "$ENCLAWED_GITHUB_REPO" --json comments

7Verify the audit chain

tail -n 20 ~/.enclawed/audit.jsonl | jq .

# Real record shape (timestamps are ms epoch, types reflect what
# the framework actually emits today):
#
# { "ts": 1716221469000,
#   "type": "mcp.connect.allow",
#   "actor": "mcp-attested",
#   "level": "internal",
#   "payload": { "serverUrl": "stdio:///opt/github-mcp/server.js",
#                "signerKeyId": "your-org-mcp-2026" },
#   "prevHash":  "...",
#   "recordHash":"..." }
#
enclawed audit verify

Every record on the chain commits to the hash of its predecessor. Any post-hoc edit to a line — even a single character — breaks verification at exactly that index and audit verify exits non-zero with the broken-entry index. A signed off-host audit-shipping side-table (so you can prove text bodies months later) is a roadmap shape.