Four providers with per-provider tuning means you can run security reviews on a hosted model and keep everything else on a local Ollama instance where no code leaves the machine. The `analyze_uncommitted_work` tool is the one with the clearest daily use: it reads the working tree, tells you whether the change is ready, and proposes how to split it.
An MCP server that reviews code using a different model from the one you are talking to. Point it at a diff, a commit SHA or the working tree and it sends the content to a provider you configured — OpenAI, Google, Mistral, or Ollama running locally — and returns the analysis. The premise is disagreement: a second opinion from another model is worth more than the same model checking itself.
- A git diff read and explained, optionally summarised, with the provider and model overridable per call — `analyze_git_diff`
- A code review focused on `security`, `performance`, `style` or `all`, with temperature tuned per focus — 0.1 for security reviews, 0.2 for general review — `review_code`
- A commit assessed for message quality and adherence to practice, defaulting to HEAD — `analyze_commit`
- Uncommitted work analysed before you commit: what changed, whether it is coherent, suggested commit messages, and whether it should be split — with `staged_only` to look at just the index — `analyze_uncommitted_work`
- Repository facts with no model call at all — `get_repo_info`
- Token budget scaled to the input rather than fixed: 4096 for diffs under 5KB up to 32768 for diffs over 500KB, with automatic chunking past 10MB or 1000 files
Go 1.20 or higher and git; build with `go build -o bin/second-opinion` and point your client at the binary. Configuration is a `~/.second-opinion.json` in your home directory, which takes precedence, or environment variables — `DEFAULT_PROVIDER` plus the key for whichever you chose (`OPENAI_API_KEY`, `GOOGLE_API_KEY`, `MISTRAL_API_KEY`), or `OLLAMA_ENDPOINT` for a local model that needs no key. Repository paths are validated and restricted to the current working directory and below, commit SHAs are validated before use, and every provider call has a 30-second timeout.