Wire optional MCP (Model Context Protocol) context into this repo's self-hosted Claude PR-review pipeline so reviews can draw on real-time, version-aware signal (library docs, secret/dependency scanning) instead of relying solely on the model's training data. From Ideas discussion #650.
Grounding correction (important): #650 proposes adding an mcp_servers input to a claude-code-reusable.yml workflow. Neither that workflow nor that input exists in this repo. The actual Claude review engine is scripts/engine.sh (invoked by .github/workflows/pr-review.yml via review-batch.sh/review-one-pr.sh); the claude --print agentic calls live in run_agentic and run_duck with --allowed-tools "Bash,Read,Grep,Glob". This plan retargets the work to that real surface.
Scope: (1) server-agnostic, opt-in MCP plumbing in engine.sh's agentic/duck tiers; (2) graceful degradation — a warning annotation, never a silent failure or fabricated "all clear"; (3) a per-stack recommended-server doc; (4) one downstream-repo pilot with quality/latency measurement. Default (knob unset) behavior must stay byte-for-byte unchanged.
Sequencing gate (from #650): pilot only after in-flight security-hardening (action allowlisting, input sanitization) lands. That prerequisite is NOT tracked as a repo issue in the planning context (referenced_issues is empty) — it is an external gate, surfaced in open_questions, not a blocked_by edge.
Activation is a human decision. This epic is created inert; do not auto-activate.
Planned from idea discussion #650 by the BMAD Scrum Master initiative-planner. Inert until a maintainer adds initiative:auto.
Wire optional MCP (Model Context Protocol) context into this repo's self-hosted Claude PR-review pipeline so reviews can draw on real-time, version-aware signal (library docs, secret/dependency scanning) instead of relying solely on the model's training data. From Ideas discussion #650.
Grounding correction (important): #650 proposes adding an
mcp_serversinput to aclaude-code-reusable.ymlworkflow. Neither that workflow nor that input exists in this repo. The actual Claude review engine isscripts/engine.sh(invoked by.github/workflows/pr-review.ymlviareview-batch.sh/review-one-pr.sh); theclaude --printagentic calls live inrun_agenticandrun_duckwith--allowed-tools "Bash,Read,Grep,Glob". This plan retargets the work to that real surface.Scope: (1) server-agnostic, opt-in MCP plumbing in engine.sh's agentic/duck tiers; (2) graceful degradation — a warning annotation, never a silent failure or fabricated "all clear"; (3) a per-stack recommended-server doc; (4) one downstream-repo pilot with quality/latency measurement. Default (knob unset) behavior must stay byte-for-byte unchanged.
Sequencing gate (from #650): pilot only after in-flight security-hardening (action allowlisting, input sanitization) lands. That prerequisite is NOT tracked as a repo issue in the planning context (referenced_issues is empty) — it is an external gate, surfaced in open_questions, not a blocked_by edge.
Activation is a human decision. This epic is created inert; do not auto-activate.
Planned from idea discussion #650 by the BMAD Scrum Master initiative-planner. Inert until a maintainer adds
initiative:auto.