feat: implement issue #680 — [Phase 2] Document recommended MCP servers per tech stack

[don-petry]

Closes #680

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 37 minutes and 36 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 86b58c23-9f84-4098-9433-4a8b48b68a68

📥 Commits

Reviewing files that changed from the base of the PR and between b7e77c4 and 5b698a2.

📒 Files selected for processing (1)

• docs/initiatives/mcp-powered-review.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-680-20260614-1513

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request introduces a new initiative document, docs/initiatives/mcp-powered-review.md, outlining the integration of Model Context Protocol (MCP) servers to enrich CI pull request reviews with real-time context. The review feedback focuses on minor documentation improvements, including fixing a grammatical omission in the server table, correcting terminology from 'before commit' to 'before merge' to better reflect CI workflows, and ensuring consistent naming for the GitHub MCP secret scanning tool in the Python starter recommendations.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

The SonarCloud report shows a **Quality Gate Passed** status with:
- **0 New issues** found
- **0 Security Hotspots** detected
- **0.0% Coverage** and **0.0% Duplication** on new code (informational metrics)
**Tier 1 Blockers Review:**
- ✅ All CI checks are either `success` or `skipped` (no failures)
- ✅ No reviews contain `CHANGES_REQUESTED`
- ✅ CodeRabbit approved the PR
- ✅ No open security or quality issues from the bot
**Result:** No actionable issues. The SonarCloud report is a clean status confirmation, not a problem report. No changes required.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: a77d964d900569009cb1458904a02ffa7b498583
Review mode: triage-approved (single reviewer)

Summary

Adds a single new reference doc (docs/initiatives/mcp-powered-review.md, +169/-0) for the MCP-powered CI review enrichment initiative (Phase 2, epic #676). Docs-only, no code/CI/security surface touched. Triage's low-risk assessment confirmed.

Linked issue analysis

Closes #680. All four acceptance criteria are substantively met: (1) recommended servers mapped per stack (Context7 / GitHub MCP secret+dependency scanning / SonarQube MCP) with correct maturity caveats; (2) documents the engine knob (REVIEW_MCP_CONFIG + REVIEW_MCP_ALLOWED_TOOLS) and fail-loud graceful degradation with a worked Context7 example; (3) states security-first sequencing (pilot #681 only after security hardening) and the #650 weekly-update revised starter (GitHub MCP secret scanning); (4) no new standard surface is introduced by the doc itself, so correctly no AGENTS.md/CLAUDE.md edit was made. Header shape matches the existing docs/initiatives/agentic-release-strategy.md convention.

Findings

Verified the doc's concrete claims against scripts/engine.sh at the PR head (a77d964): REVIEW_MCP_CONFIG / REVIEW_MCP_ALLOWED_TOOLS knobs, _emit_mcp_failure_warning, the --mcp-config/--strict-mcp-config flags, the exact ::warning:: strings, and inert-when-unset behavior all match. The referenced tests/dev-lead/unit/test_engine_mcp.bats exists. Sibling stories #677/#678/#679 are merged (PRs #713/#717/#716), so the present-tense 'implemented'/'regression-tested' claims are accurate and not overstated. Maturity claims are appropriately hedged (secret scanning GA; dependency scanning public preview). Gemini's earlier wording suggestions (e.g. 'before merge') appear incorporated; CodeRabbit approved at the head SHA. No blocking issues found.

CI status

All checks pass: Lint, ShellCheck, unit-tests, CodeQL (actions+python), AgentShield, Agent Security Scan, Secret scan (gitleaks), Compile agentic workflows, SonarCloud (Quality Gate passed), CodeRabbit — all SUCCESS; dependency-audit ecosystem jobs and dependabot SKIPPED (expected, no matching manifests). No failing or cancelled checks. mergeStateStatus is BLOCKED only on the pending org-leads team review (REVIEW_REQUIRED), which is the human gate.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 5b698a215e65cf89424e6919cb1b75a5ebf4f401
Review mode: triage-approved (single reviewer)

Summary

Adds one new reference doc (docs/initiatives/mcp-powered-review.md, +169/-0) for the MCP-powered CI review enrichment initiative (Phase 2 of epic #676). Docs-only; no code, CI, or security surface is touched. Triage's low-risk assessment confirmed.

Linked issue analysis

Closes #680. Acceptance criteria are substantively met: (1) recommended MCP servers mapped per stack (Context7 all-stacks; GitHub MCP secret/dependency scanning; SonarQube MCP) with correctly hedged maturity (secret scanning GA, dependency scanning public preview); (2) documents the engine knob (REVIEW_MCP_CONFIG + REVIEW_MCP_ALLOWED_TOOLS), the threaded --mcp-config/--strict-mcp-config flags, the MCP-eligible tiers, and a worked Context7 example; (3) documents fail-loud graceful degradation; (4) states security-first sequencing (pilot #681 only after security hardening lands) and the #650 weekly-update revised starter. Header shape matches the existing docs/initiatives/agentic-release-strategy.md convention.

Findings

Verified the doc's concrete claims against scripts/engine.sh at the PR head (5b698a2): the REVIEW_MCP_CONFIG / REVIEW_MCP_ALLOWED_TOOLS knobs, _emit_mcp_failure_warning (inert when REVIEW_MCP_CONFIG unset; never alters exit code/verdict), the --mcp-config --strict-mcp-config flags via _mcp_review_flags, the base allowed-tools list 'Bash,Read,Grep,Glob' threaded into the agentic and rubber-duck tiers only (triage excluded), and the two exact ::warning::[mcp] strings (named-server and generic-fallback) all match the doc verbatim. tests/dev-lead/unit/test_engine_mcp.bats exists at the head SHA. No blocking issues. Minor (non-blocking) note: engine.sh also auto-enables MCP from a default path (.github/review-mcp.json) when REVIEW_MCP_CONFIG is unset; the doc's 'strictly opt-in / inert when unconfigured' framing remains accurate since committing that file is itself the opt-in, but the doc does not mention the convenience default path.

CI status

All substantive checks pass: Lint, ShellCheck, unit-tests, CodeQL (actions+python), AgentShield, Agent Security Scan, Secret scan (gitleaks), Compile agentic workflows, SonarCloud (Quality Gate passed), CodeRabbit — all SUCCESS; dependency-audit ecosystem jobs and dependabot SKIPPED (expected, no matching manifests). The three CANCELLED entries (dev-lead dispatch, dev-lead ci-relay, an earlier review/review) are concurrency-superseded agent-orchestration re-runs, each with a SUCCESS/SKIPPED counterpart — not real failures (cf. #608/#609). reviewDecision is APPROVED (CodeRabbit + prior pr-review-agent); merge is gated only on the pending org-leads human review.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.