Firetrail MCP

Firetrail knows things about a pull request that the tool in your terminal doesn't: which classifiers fired and why, what the review team found, where the description and the diff disagree, how much of the new code is tested, and how risky the files it touches have been in the past. The Firetrail MCP puts all of that within reach of your coding agent.

MCP (the Model Context Protocol) is the standard way for an AI tool to call an outside service. Firetrail runs an MCP server. You connect your agent to it once with a personal token, and from then on you can ask the agent for Firetrail's help in plain English while you work in a checkout of the repository. It works with Claude Code, Cursor, Codex CLI, VS Code (Copilot's agent mode) and any other client that supports remote MCP servers.

The split is always the same: the agent does the local work in your checkout, on your own account. Firetrail brings the analysis it already ran, and when there is a page to show, Firetrail renders and hosts it at its own link.

What you can ask for

Rework turns Firetrail's findings into a plan for the better version of a PR: a chain of smaller, single-intent PRs with the findings fixed. Your agent carries it out. It shows you the plan, asks, then opens one draft PR per step on new branches and reports them back. It never touches the original branch and never merges.

Review Brief is one page that explains a whole PR before you approve it: the endpoints and their contracts, the schema diff, the change mix, intent drift with evidence, the review team's findings, coverage, the key changes per file, and a wireframe of every screen it changes. Your agent reads the diff for the parts Firetrail can't see; Firetrail renders and hosts the page.

Security Audit is a verified, evidence-only pass over your whole application (or the files one PR touches) for the five security failures that hurt teams most: data not fenced per customer, permissions only checked in the browser, records reachable by changing an ID, secrets written into the code, and user input rendered as HTML. Your agent reads the code and proves every finding; Firetrail renders one page that ranks what to fix first, explains each failure in plain words beside the evidence, and hands the team ready-to-file issues.

Business Case is one page for the people who decide whether a change is worth shipping, in their language: the measurable facts (revenue, cost, retention, acquisition, risk, speed — each with its source and how sure it is) kept apart from what the customer will feel (trust, ease, delight, control, reputation, team confidence — the part no dashboard shows but that decides whether they buy again), plus the recommendation, the costs, the risks, the cost of doing nothing, and the case in each reader's words. Your agent reads the change and the repository; Firetrail brings the numbers from its analysis and your history, renders the page and hosts it.

The sentence is the primary way in and works in every client. In Claude Code the same four things are also slash commands, /mcp__firetrail__rework 123, /mcp__firetrail__review_brief 123, /mcp__firetrail__security_audit and /mcp__firetrail__business_case 123. That naming is Claude Code's for anything an MCP server provides; each does exactly what the sentence does.

Coming next

These are planned capabilities of the same connection. They aren't available yet. The Firetrail MCP page in the app shows them as coming next so you know where this is going, and each will be one more thing to ask your agent for, with nothing new to install.

• Specialist Deep Dive — a full report on the PR from one member of the review team in their lane (Priya on privacy, Sarah on operations, Mike on tests, Alex on performance, or any core reviewer), instead of the short verdict they give during review.

Connecting your agent

Once per person, about two minutes. Open MCP from the top bar in the app.

1. Create a personal token. Give it a name that says where you'll use it. Firetrail shows the token once; if you lose it, revoke it and create another. A token is yours, not your organization's: through it, your agent reaches exactly the projects you can see in Firetrail.
2. Add the Firetrail server to your agent. Pick your client on the page and copy what it shows: a one-line claude mcp add … command for Claude Code, a small config block for Cursor, VS Code or Codex, or the three facts for anything else. Every client needs the same thing, a remote Streamable HTTP server at Firetrail's MCP URL with the header Authorization: Bearer <your token>.
3. Ask. In a checkout of a connected repository, say what you want. If the PR hasn't been analyzed yet, or has new commits since the last analysis, Firetrail analyzes it first and the agent waits. A brief or a business case on an already-analyzed PR costs nothing extra.

For a whole team on Claude Code, a checked-in .mcp.json at the repository root (the page shows it) gives everyone the server when they open the repo. Each person exports their own token as FIRETRAIL_TOKEN, so no token ever lands in git.

What the connection can and can't do

• Firetrail never writes to your repository. Every branch, commit and pull request a rework produces is made by your agent with your credentials, and every PR it opens is a draft.
• The MCP answers with per-PR output only: plans, findings, evidence, the brief, the case. The reviewer prompts and the scoring behind the analysis stay on the server.
• A token reaches only the projects you belong to. Asking about a repository you can't see in Firetrail gets a plain "no access" answer.
• Revoking a token on the Firetrail MCP page stops it immediately.

Cost

Everything the agent does locally (reading the diff, writing code, drawing wireframes) runs on your own account with your own tool, and Firetrail doesn't meter it. On Firetrail's side, a Rework plan is one AI call over the existing analysis, built automatically for every analyzed PR on Business, and a Review Brief or a Business Case on an analyzed PR reuses the analysis at no extra cost. The only time the MCP spends is when it has to analyze a PR first, which counts like any other analysis on your plan. (On Business, Firetrail also writes a Review Brief for every analyzed PR on its own and links it from the GitHub comment — one model call per PR, included in the plan; see the Review Brief page.)