feat: implement issue #842 — [Phase 2] Wire candidate LSP-MCP server(s) into the pr-review runtime — config, install, tier gating

[don-petry]

Closes #842

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 52 minutes and 15 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 4f9119a7-eb4c-4dbe-9438-f5bdebb46d1e

📥 Commits

Reviewing files that changed from the base of the PR and between f9b25d5 and 30977bf.

📒 Files selected for processing (5)

• .github/mcp/lsp.json
• .github/workflows/pr-review.yml
• docs/lsp-pilot.md
• scripts/setup-lsp-pilot.sh
• tests/dev-lead/unit/test_lsp_pilot.bats

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-842-20260621-0147

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[gemini-code-assist]

Code Review

This pull request implements the LSP-MCP review pilot, introducing the .github/mcp/lsp.json configuration, the scripts/setup-lsp-pilot.sh setup script, comprehensive unit tests, and updated documentation. The feedback suggests two improvements to the setup script: robustly handling binary-mode checksum formats during verification, and using a local prefix for the npm installation of bash-language-server to prevent permission failures in restricted CI environments.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-21T03:04:39Z.

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-21T03:09:26Z.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-21T04:27:08Z.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: e78199c9f47ece94083ba133a63bca0736cc26ac
Review mode: triage-approved (single reviewer)

Summary

Phase-2 LSP-MCP review pilot wiring for issue #842: adds an opt-in, candidate-switchable MCP config (.github/mcp/lsp.json), an install script (scripts/setup-lsp-pilot.sh) that fetches the pinned agent-lsp binary (sha256-verified against checksums.txt) plus pinned bash-language-server, a gated pr-review.yml step, docs, and 202 lines of bats coverage. The whole feature is gated behind repo var LSP_PILOT_ENABLED (default off), so it is inert by default.

Linked issue analysis

Closes #842. All four acceptance criteria are met and verified against the actual engine code: (AC#1) the committed config + REVIEW_MCP_CONFIG/REVIEW_MCP_ALLOWED_TOOLS knobs are threaded by engine.sh _mcp_review_flags() into the deep (engine.sh:950) and rubber-duck (engine.sh:1302) tiers only — triage is never touched; (AC#2) setup-lsp-pilot.sh installs the pinned candidate + bash-language-server and degrades gracefully (::warning:: + skip, never non-zero) when a tool is absent; (AC#3) exactly 10 read-only navigation tools are exposed, asserted to be within the 8-12 bound and free of any mutating tool; (AC#4) the conventional auto-default path remains .github/review-mcp.json (engine.sh:66), so merely committing lsp.json activates nothing — proven by the 'inert' bats tests. The story's split-out cold-start/cache instrumentation is correctly deferred to a separate story, so engine.sh is untouched (lower risk).

Findings

No blocking findings.

• Security: the workflow step injects no untrusted input — env comes from trusted repo vars.* with safe literal defaults, so there is no Actions-injection smell. The binary download is pinned by version and sha256-verified against checksums.txt, and refuses to install on a missing/failed checksum. No secrets, auth, or crypto handling.
• Prior gemini-code-assist suggestions are both addressed in the reviewed code: binary-mode checksum lines are handled via the grep '[ *]' separator class, and bash-language-server installs under a local prefix (--prefix $(dirname INSTALL_BIN) = $HOME/.local) to avoid global-permission failures in CI.
• Downstream: .github/workflows/pr-review.yml is pinned by 5 consumer repos, but the new step is gated 'if: vars.LSP_PILOT_ENABLED == true' (default off), so all consumers are byte-for-byte unchanged unless they explicitly opt in.
• shellcheck/bats/CodeQL all green; the script is set -euo pipefail with failure paths captured via '|| ok=0', preserving the never-fail-the-workflow contract.
• Secret scanning: run_secret_scanning MCP tool not available in this environment — skipped (no fabricated result); the gitleaks CI check passed.

CI status

All required checks pass. SUCCESS: CI (Lint, ShellCheck, bats, validate-agent-profiles, gh-aw-compile, Compile agentic workflows, Agent Security Scan, Secret scan/gitleaks), CodeQL (actions + python), SonarCloud (Quality Gate passed, 0 new issues), unit-tests, validate-fixtures, Test Dev-Lead Agent suite, AgentShield, Holdout Guard, Test-Deletion Guard, CodeRabbit status. SKIPPED (expected): dependency-audit language jobs, dependabot-automerge, dev-lead ci-relay. No failures. mergeStateStatus is BLOCKED only on REVIEW_REQUIRED.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: none
Skipped: 0 (no issues reported)
```
The PR is ready for merge from a code quality perspective. Remaining CI checks (Lint, ShellCheck, bats, etc.) are queued and will complete automatically.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-21T08:28:04Z.