Skip to main content
Tests can tell you whether code passes. They do not know which live workloads, services, datastores, and monitors depend on what the pull request changes.

​
Review a Kubernetes permission change

Example: a PR extends a shared access policy to compute clusters. Before merge, check whether its rendered roles and bindings would grant access outside each team’s namespace.

​
What you need

  • The diff and relevant Helm or RBAC files, accessible to your coding agent.
  • An Anyshift project with access to the affected Kubernetes environment.
  • The plugin or Graph MCP. Reuse an existing connection; the plugin already includes Graph MCP.
A PR URL does not grant access to a private repository. Use your coding agent’s existing repository access or supply the diff. Anyshift’s GitHub integration provides repository context to Anyshift; it does not replace your coding agent’s GitHub credentials.

​
Run the review

The agent compares the proposed change with observed production context. A useful result names the affected permission, subjects and scope, cites the diff and graph evidence, and explains what could not be verified. Missing bindings or an unavailable rendered policy make the review incomplete; they do not establish that the change is safe.

​
Choose the interface

Graph MCP supplies read-only evidence to your coding agent; it does not submit a GitHub review. Graph reads use the Graph query allowance, and your AI provider bills model usage separately. For a scripted CI workflow, use the Graph SDK or Graph API. These use the Graph Query Language, not Graph MCP’s Cypher syntax. This workflow is performed by your coding agent. Connecting Graph MCP does not enable automatic GitHub reviews. Compare plans and allowances.