Proofline

npx add-mcp 'https://proofline.sh/mcp'

Coding agents

Connect your coding agent to read Proofline review status through the Model Context Protocol (MCP).

Eligible new organizations get one calendar month of hosted code reviews for private and public GitHub pull requests. If your user asks you to set up Proofline, start the CLI setup below and give them the browser approval step. The month starts when they install the GitHub App on their chosen repositories. Opening a pull request in one of those repositories starts the first automatic review.

Install and start setup

Run one command on macOS or Linux:

curl -fsSL https://proofline.sh/cli | sh -s -- --setup

The command installs the CLI and registers MCP in Claude Code, Cursor and Codex. Existing Proofline entries stay in place, and credentials stay out of agent configuration.

When the browser opens, sign in with GitHub, install the App and approve CLI permissions. Choose your team's organization as an administrator. Then restart your agent or reload MCP and ask it to set up Proofline. Cloud access and configuration approvals open in the Proofline console.

Your agent can also connect an AWS account. You choose the account and any reads to leave out, such as ECS task definitions, and approve the connection in the browser. The agent then installs Proofline's read-only IAM role with your own AWS CLI, and Proofline checks that it can assume it. Your AWS credentials stay on your machine.

If a step fails, fix the reported cause and rerun the command; completed local steps remain installed. CLI sign-in uses your operating system keychain.

Add ~/.local/bin to PATH when the installer requests it. New MCP entries use the installed binary's absolute path, so agents can launch it before you change PATH.

Install the CLI separately

Run this command in your terminal to install the latest release on macOS or Linux:

curl -fsSL https://proofline.sh/cli | sh

If the installer asks you to add ~/.local/bin to your PATH, follow its instructions before continuing.

Sign in

Sign in and choose your organization on the approval page:

proofline login --scope reviews:read

Your account must belong to an active organization. The CLI stores your credential in the operating system keychain. You can revoke it from Personal tokens.

Connect an agent

Run the command for your agent. The CLI previews the configuration and asks for approval before saving it. It preserves existing Proofline entries and keeps credentials out of the configuration file.

Codex

proofline agent install codex

Configuration: ~/.codex/config.toml.

Cursor

proofline agent install cursor

Configuration: ~/.cursor/mcp.json. This is Cursor’s global user file. See Cursor’s MCP documentation to manage its servers.

Gemini CLI

proofline agent install gemini

Configuration: ~/.gemini/settings.json.

Kiro

proofline agent install kiro

Configuration: ~/.kiro/settings/mcp.json.

Add --print to preview a configuration without saving it. If you use a custom CODEX_HOME, or the CLI refuses your configuration file, copy the preview into your user configuration manually. Keep agent configuration outside your repository.

Claude Code

proofline agent install claude-code

Configuration: ~/.claude.json. A custom CLAUDE_CONFIG_DIR requires manual configuration with --print.

For local-review and setup skills, add the Proofline skills repository as a plugin marketplace and install the plugin:

/plugin marketplace add prooflinedev/skills
/plugin install proofline@proofline

The plugin starts proofline mcp and uses the CLI's sign-in; it stores no token. Set PROOFLINE_BASE_URL for a console other than proofline.sh. Its skills review local changes before a push (/proofline:review), read a repository's review guidance, fix a pull request's findings, run setup and change an organization's settings.

Skills for other agents

With Node.js available and your agent connected, install the review skill from the published Proofline skills:

npx skills add prooflinedev/skills --skill proofline-review

Choose your agent and installation scope when prompted. Sign in with permission to read findings and request reviews:

proofline login --scope reviews:read --scope findings:read --scope reviews:request

Approve access for the repositories you want to review. Reload your agent's skills, then ask it to review your changes or read Proofline's findings. The skill requires the Proofline CLI and its authenticated MCP connection; this command installs the instructions only. The free-month offer applies to hosted pull-request reviews.

To run organization setup from your connected agent, install the onboarding skill:

npx skills add prooflinedev/skills --skill proofline-onboarding

Approve the setup permission described below before asking the agent to set up Proofline.

To fix a pull request's findings or change the settings of an organization that is already set up, install the matching skill:

npx skills add prooflinedev/skills --skill proofline-fix-findings
npx skills add prooflinedev/skills --skill proofline-configure

The Claude Code plugin above already includes all of these skills.

Set up Proofline from your agent

An organization administrator can answer Proofline's setup questions from a connected agent. Sign in with the setup permission, and approve it in a browser where you signed in to Proofline within the last 24 hours:

proofline login --scope reviews:read --scope findings:read --scope reviews:request --scope setup:write

Then ask your agent to set up Proofline. The agent reads setup status and open blockers with get_setup_status and Proofline's next setup question with get_setup_conversation. It asks you the question and sends your answer with answer_setup_question, or your own request with send_setup_message. Proofline checks each answer against your organization's repositories before it continues.

Answers need that browser session's sign-in to be from the last 24 hours. After that, sign in to Proofline again and run proofline login to renew the permission. Signing out of that session ends it. The organization's API token policy must allow setup:write. When it refuses the permission, each setup tool returns NOT_AUTHORIZED with a message that names the policy, and an organization owner can allow it under Settings › API tokens › Policy. Confirming the setup, connecting cloud accounts and approving access changes stay in the Proofline console. Run proofline setup to open it. The proofline-onboarding skill in the Proofline skills repository runs this loop with the console setup assistant's instructions.

Fix findings from your agent

Sign in with permission to read findings and request reviews, as for the review skill, then ask your agent to fix what Proofline found on a pull request. The proofline-fix-findings skill reads the pull request's open environment findings with list_open_findings and each finding's source excerpts with get_fix_context. Code findings are not part of this loop: when a pull request has only a code review, the skill says so and lists its code findings instead. It checks the fixes locally with proofline review --verify before anything is pushed.

After the push, the skill asks Proofline to re-verify the fixed findings at the pushed commit with request_reverification, then reads each outcome with get_reverification. Re-verification requires GitHub write access to the repository. The skill reports a finding as fixed only when Proofline verified the fix at that commit; a local check or a note never closes a finding. Proofline limits re-verification requests per finding and per pull request; a refusal names the limit and when it resets, and the skill stops there.

Change settings from your agent

An organization administrator can review and change Proofline's settings for an organization that is already set up. Sign in with the setup and configuration permissions, and approve them in a browser where you signed in to Proofline within the last 24 hours:

proofline login --scope reviews:read --scope setup:write --scope org:configure

Only an organization administrator can approve org:configure: a GitHub organization owner or a member with Proofline's administrator role. The approval page offers it only for organizations you administer. Each change acts for the administrator who approved the sign-in. Signing out of that browser session ends the permission, and a change is refused once that person no longer administers the organization. The organization's API token policy must allow both permissions.

Then ask your agent to review or change your Proofline settings. The proofline-configure skill reads the configuration of the organization, an environment or a repository with get_configuration, and explains each open problem and who can fix it. It finds the setting to change with list_operations and reads its current value with describe_operation. Before it records anything, it shows you the current and new values and the repository file, pinned to a commit, behind each value it inferred, and asks you to agree.

The agent records each change with propose_change and applies an ordinary change with apply_change once you agree. Before it writes, Proofline checks that the setting has not changed since the agent read it, and refuses the change when it has; the agent then reads the setting again. A console save that lands between that check and the write is overwritten. The organization's audit log records each applied change with the administrator who approved the agent.

Approve sensitive changes

Sensitive settings include cloud access, Slack and provider bindings, a repository's review environments, connector scopes, the fix rule, billing, membership and credentials. An agent never applies a sensitive change. Proposing one returns an approval link, and nothing changes until an organization administrator approves the exact change at that link in a browser signed in within the last 24 hours. org:configure never approves a sensitive change. The help center describes what the administrator sees and decides at that link.

Proofline refuses an agent's change to a setting whose console page requires a fresh administrator sign-in, such as the merge gate. Change that setting in the Proofline console.

Configuration commands

The CLI calls the same tools and prints each result as JSON:

Command	What it does	Permission
proofline config get	Prints the organization's configuration; add --environment ID or --repo owner/name for one environment or repository	setup:write
proofline config operations	Lists the settings an agent can change; filter with --area AREA or --subject SUBJECT	setup:write or org:configure
proofline config describe OPERATION	Prints one setting's input schema, current value and revision; pass route parameters with --param NAME=VALUE	org:configure
proofline config propose FILE	Records the change in a JSON file and prints its diff, change ID and any approval link	org:configure for an ordinary change; setup:write also proposes a sensitive one
proofline config apply CHANGE_ID	Applies an ordinary proposal	org:configure

The proposal file holds a JSON object with operation, parameters and input, and optionally expected_revision and cited_files. Omit input for a setting that takes no request body. Each run adds a new request ID and leaves the file unchanged. A proposal applies nothing, even when the command succeeds.

proofline config apply exits nonzero when nothing applied, and prints the reason. For a sensitive proposal it prints the approval link. The commands never retry a call: after an uncertain result, check the setting and its pending changes in the console before you propose again.

Read reviews

Restart your agent or reload its MCP servers. Ask it to read a review’s status with get_review_status and the review ID. Verify that the agent can call the tool after setup.

To read findings for your repository’s current commit, run:

proofline findings

Review local changes

Sign in with permission to request reviews, then run the review from your repository:

proofline login --scope reviews:read --scope reviews:request
proofline review

An incomplete review retains its evidence gaps. Read the findings and missing evidence before deciding to deploy.

Automatic pull-request reviews require an assigned seat and follow your organization’s review settings. Ask an administrator to assign a seat if you need automatic reviews. Recorded review reads do not require a seat.