Connect CodeRabbit to ChatGPT: Manage seats and analyze reviews

If you need to connect CodeRabbit to ChatGPT to automate user seat provisioning, audit access logs, or analyze pull request review metrics, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between ChatGPT's function calling capabilities and CodeRabbit's administrative APIs. You can either build and maintain this infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL in seconds.

If your team uses Claude, check out our guide on connecting CodeRabbit to Claude or explore our broader architectural overview on connecting CodeRabbit to AI Agents.

Giving a Large Language Model (LLM) read and write access to an enterprise AI code review platform is a serious engineering challenge. You have to handle complex identity mappings between Git providers and CodeRabbit, manage nested security finding schemas, and safely expose destructive bulk operations. Every time you want to expose a new CodeRabbit capability to your AI, custom server code must be updated, redeployed, and tested.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for CodeRabbit, connect it natively to ChatGPT, and execute complex seat management and review analytics workflows using natural language.

The Engineering Reality of the CodeRabbit API

Building a custom MCP server is essentially building a self-hosted integration proxy. While the open MCP standard provides a predictable JSON-RPC interface for LLMs to discover tools, implementing it against CodeRabbit's highly specific API surface is complex.

If you decide to build a custom MCP server for CodeRabbit, you own the entire API lifecycle. Here are the specific integration challenges that break standard CRUD assumptions when working with the CodeRabbit API:

Cross-Platform Identity Resolution

CodeRabbit sits on top of your Git providers (GitHub, GitLab, Bitbucket, Azure DevOps). When you manage users via the CodeRabbit API, you are constantly translating between different identity primitives. A user might have a cr_user_id (CodeRabbit's internal ID), an email address, or a provider_user_id (the ID from GitHub/GitLab). If an LLM needs to bulk assign seats, your MCP server must handle the strict validation rules of the code_rabbit_seats_bulk_assign endpoint, which behaves differently depending on whether you authenticate with an Organization API key (requiring provider IDs) or a Workspace API key (accepting emails or cr_user_id). Forcing an LLM to navigate this identity maze usually results in hallucinations or 400 Bad Request errors.

Handling Deep Scan Reachability Evidence

CodeRabbit's Deep Scan feature generates highly nested, complex payloads. When fetching security code findings, the API returns not just the vulnerability, but the entire saved reachability evidence, including massive call stacks and step-by-step explanations. If you pass this raw payload directly to ChatGPT, you will rapidly exhaust your context window. A custom MCP server must implement strict JSON Schema filtering and truncation logic to ensure the LLM only receives the actionable metadata (like the cwe, severity, and file path) without choking on the evidence trace.

Bulk Array Limits and Partial Success States

The CodeRabbit API is heavily optimized for enterprise scale, meaning operations like role changes and seat assignments are executed in bulk (up to 500 users per request). These endpoints do not return simple HTTP 200/500 binary states. Instead, they return states like partial_success along with per-user result arrays. Your MCP server must translate these complex, multi-state responses into a format the LLM can understand, so it knows exactly which 498 users were provisioned and which 2 users failed, allowing the agent to attempt a correction.

CodeRabbit to ChatGPT Quickstart Guide

If you want the fastest path from a fresh Truto account to ChatGPT calling the CodeRabbit API, follow these steps. Deeper architecture, security, and lifecycle details are covered in the sections below.

What you need:

• A Truto account with API access.
• A CodeRabbit Enterprise account with an active API key (Organization or Workspace scoped).
• A ChatGPT Pro, Plus, Business, Enterprise, or Education seat with Developer mode available, OR a custom OpenAI agent environment.

Step 1: Connect CodeRabbit as an Integrated Account

First, you need to establish the connection between Truto and CodeRabbit. In the Truto dashboard, navigate to Integrated Accounts -> New Integrated Account, select CodeRabbit, and input your API key. Truto securely vaults this credential. Make a note of the integrated_account_id generated.

Step 2: Generate the CodeRabbit MCP Server

Truto scopes a unique MCP endpoint to this specific CodeRabbit account. You can create this server in two ways:

Method A: Via the Truto UI

1. Navigate to the Integrated Account page for your CodeRabbit connection.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Select your desired configuration (e.g., allow read and write methods, filter by users tags).
5. Copy the generated MCP server URL (it will look like https://api.truto.one/mcp/<token>).

Method B: Via the API You can programmatically generate the server using a POST request. This is ideal for provisioning agent access on the fly.

curl -X POST https://api.truto.one/integrated-account/$INTEGRATED_ACCOUNT_ID/mcp \
  -H "Authorization: Bearer $TRUTO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "CodeRabbit Seat Manager",
    "config": {
      "methods": ["read", "write"],
      "tags": ["users", "roles", "metrics"]
    }
  }'

The response contains the url field. This single URL handles routing, tool discovery, and authentication. Treat it like a highly sensitive credential.

Step 3: Connect the MCP Server to ChatGPT

You can connect this server to ChatGPT using either the native UI or a local config file if you are running a custom OpenAI agent.

Method A: Via the ChatGPT UI (Custom Connectors)

1. In ChatGPT, go to Settings -> Apps -> Advanced settings.
2. Enable Developer mode.
3. Under MCP servers / Custom connectors, click to add a new server.
4. Enter a name (e.g., "CodeRabbit Admin").
5. Paste the Truto MCP URL into the Server URL field and save.

ChatGPT will immediately connect, perform the JSON-RPC handshake, and list the available CodeRabbit tools.

Method B: Via Manual Config File (Custom Agents) If you are building a custom agent wrapper around the OpenAI API and need to run a local client bridge, you can use the standard MCP SSE transport. Create a JSON configuration file (e.g., mcp-config.json):

{
  "mcpServers": {
    "coderabbit": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "--url",
        "https://api.truto.one/mcp/<your-token-here>"
      ]
    }
  }
}

Start your agent framework pointing to this config, and it will route local tool calls over SSE to the Truto edge.

Hero Tools for CodeRabbit AI Agents

When Truto exposes CodeRabbit to ChatGPT, it maps CodeRabbit's resources and API documentation directly into JSON Schema-backed tools. The LLM sees a flat list of highly descriptive functions.

Here are the highest-leverage tools available for automating CodeRabbit workflows.

list_all_code_rabbit_users

Retrieves the complete roster of users in your CodeRabbit organization, including their current seat assignments, role types, and linked Git accounts. This is the critical first step for any audit or provisioning workflow.

Usage Note: The LLM uses this to map human-readable names or emails to the specific cr_user_id or provider IDs required for bulk assignment actions.

"Pull a list of all users in our CodeRabbit organization and show me exactly who currently does not have a seat assigned."

code_rabbit_seats_bulk_assign

Allows the agent to bulk assign or unassign CodeRabbit seats for up to 500 users simultaneously.

Usage Note: Depending on how your API key is scoped, the agent must pass either an array of user_ids (provider IDs for Org keys) or members (emails/cr_user_ids for Workspace keys). The tool automatically enforces these schema requirements.

"Take the five developers I just listed who are missing seats and bulk assign them CodeRabbit licenses using their email addresses."

code_rabbit_seats_bulk_change_roles

Modifies the role assignments (e.g., Admin, Member, Reviewer) for a batch of users.

Usage Note: Returns a status of success, partial_success, or failure along with per-user results, allowing the LLM to verify the operation succeeded across the entire array.

"Upgrade the roles of john.doe@example.com and jane.smith@example.com to Admin status in CodeRabbit."

list_all_code_rabbit_review_metrics

Aggregates PR review metrics across your organization over a specific date range. It returns data on review iterations, estimated review minutes saved, and the count of CodeRabbit comments posted versus accepted.

Usage Note: This is a read-only reporting tool that requires start_date and end_date parameters. It is highly effective for calculating ROI or identifying teams that are ignoring AI review feedback.

"Fetch the PR review metrics for the last 30 days and calculate the total estimated review minutes saved by CodeRabbit across all merged PRs."

list_all_code_rabbit_security_code_findings

Retrieves CodeRabbit Deep Scan security findings for active repositories. It provides the state, severity, and exact file paths of identified vulnerabilities.

Usage Note: Includes saved reachability evidence (call stacks). You should instruct the LLM to summarize the findings rather than reading the entire call stack aloud to save context space.

"List all open security code findings from our latest Deep Scans, group them by severity, and highlight any Critical findings with their file paths."

update_a_code_rabbit_learning_by_id

Replaces the text of a CodeRabbit learning (custom instruction) and triggers a refresh of its search embedding.

Usage Note: Requires the Enterprise plan. This is used to enforce new engineering guidelines globally across all automated reviews.

"Update the CodeRabbit learning instruction with ID 'lrn_12345' to explicitly state that all new API endpoints must include rate limiting middleware."

To view the complete inventory of available tools, query parameters, and schema definitions, visit the CodeRabbit integration page.

Workflows in Action

Connecting CodeRabbit to ChatGPT unlocks agentic workflows that traditionally required navigating complex UIs or writing custom Python scripts. Here is how a custom GPT or agent executes multi-step logic.

Scenario 1: Bulk Seat Provisioning and Role Alignment

When a new cohort of engineers joins the company, an IT administrator can ask ChatGPT to provision their AI tooling access in a single prompt.

"Audit our CodeRabbit organization for any users who have logged in via GitHub but don't have a seat assigned. Assign seats to all of them, and ensure anyone in the 'Backend' team is given the standard Member role."

How the agent executes this:

1. Calls list_all_code_rabbit_users to retrieve the current user roster.
2. Filters the returned JSON array in memory to isolate users where seat_assigned is false.
3. Calls code_rabbit_seats_bulk_assign passing the array of unassigned user_ids with action: "assign".
4. Reads the partial_success or success response to confirm the seats were granted.
5. Calls code_rabbit_seats_bulk_change_roles for the targeted subset of users to enforce the Member role.

sequenceDiagram
    participant User as User
    participant ChatGPT as ChatGPT
    participant Truto as Truto MCP Server
    participant CodeRabbit as CodeRabbit API

    User->>ChatGPT: "Assign seats to unassigned users..."
    ChatGPT->>Truto: Call list_all_code_rabbit_users
    Truto->>CodeRabbit: GET /users
    CodeRabbit-->>Truto: JSON (User List)
    Truto-->>ChatGPT: Tool Result (User List)
    ChatGPT->>Truto: Call code_rabbit_seats_bulk_assign (IDs)
    Truto->>CodeRabbit: POST /seats/bulk-assign
    CodeRabbit-->>Truto: JSON (Success/Partial Status)
    Truto-->>ChatGPT: Tool Result (Success Status)
    ChatGPT-->>User: "Successfully assigned 14 seats."

Scenario 2: Security Audit and PR Metric Analysis

Engineering managers need to understand if developers are actually acting on the security vulnerabilities CodeRabbit identifies during code review.

"Fetch the security code findings from the last week. Cross-reference them with our PR review metrics. Are developers accepting the CodeRabbit comments related to these security findings, or are they being ignored?"

How the agent executes this:

1. Calls list_all_code_rabbit_security_code_findings to pull the active Deep Scan alerts.
2. Calls list_all_code_rabbit_review_metrics with start_date and end_date set to the past 7 days.
3. Correlates the data in its context window by looking at the coderabbit_comments object inside the review metrics, comparing the posted versus accepted counts for high-severity categories.
4. Generates a natural language report summarizing the security hygiene of the engineering team.

Security and Access Control

When you give an LLM access to your CodeRabbit administrative API, security and scoping are paramount. Truto's MCP servers provide several layers of defense to ensure your agents operate within strict boundaries.

• Method Filtering: When creating the MCP server, you can pass config.methods: ["read"]. This drops all write, update, and delete tools (like bulk assigning seats or updating roles) from the server entirely. The LLM physically cannot modify data.
• Tag Filtering: CodeRabbit resources are tagged logically (e.g., users, metrics, learnings). By passing config.tags: ["metrics"], the server will only expose reporting tools, hiding user management completely.
• Time-to-Live (TTL): You can set an expires_at timestamp when creating the server. Once the timestamp passes, Truto automatically destroys the token and the server endpoint, making it ideal for temporary agent sessions.
• Dual Authentication: By enabling require_api_token_auth: true, the URL alone is no longer sufficient to call tools. The client must also pass a valid Truto API token in the Authorization header, preventing lateral movement if the MCP URL leaks in application logs.

Handling CodeRabbit Rate Limits

Enterprise APIs employ strict rate limiting, and CodeRabbit is no exception. A common mistake when building custom MCP servers is failing to account for how LLMs invoke tools in rapid succession, especially during bulk data retrieval or pagination loops.

It is a critical architectural fact that Truto does not silently retry, throttle, or absorb rate limit errors. If ChatGPT executes a loop that hammers the CodeRabbit API and exhausts your quota, CodeRabbit will return an HTTP 429 Too Many Requests error.

Truto passes this 429 error directly back to the calling client (the LLM or your agent framework) in the tool result. However, Truto normalizes the upstream rate limit information into standardized IETF headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset).

This design forces the caller to be aware of the exact rate limit state. You must configure your agent framework (like LangChain or OpenAI's swarm) to read these headers, catch the 429 error gracefully, and implement its own exponential backoff or pause execution until the ratelimit-reset window clears. This prevents your MCP server from acting as a black box that silently hangs when limits are breached.

Moving from Manual Admin to Agentic Workflows

Connecting CodeRabbit to ChatGPT shifts your engineering operations from manual UI clicks to natural language orchestration. Instead of logging into a dashboard to audit seats, update custom learnings, or manually export CSVs to calculate PR review ROI, you can simply ask your AI agent to handle it.

By leveraging Truto's dynamically generated MCP servers, you eliminate the need to write custom integration code, parse nested Swagger schemas, or maintain authentication pipelines. You define the access boundaries, generate the secure URL, and let the model discover the tools it needs to execute the workflow.