chore: add project MCP configuration - #1589
Conversation
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 45 minutes Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (7)
📝 WalkthroughWalkthroughThe project adds secret-free, project-scoped MCP registrations for Figma, Supabase, Railway, and Sentry. It tracks ChangesMCP configuration
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.gitignore (1)
22-23: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winAdd automated protection for the trackable Codex config.
This exception permits future credentials or secret headers to enter Git. Add a CI secret scan and document that credentials must remain in the host credential store.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.gitignore around lines 22 - 23, Add CI secret scanning that covers the trackable .codex/config.toml exception, and document that credentials and secret headers must remain in the host credential store rather than this file. Ensure the scan fails when secrets are detected while preserving the intended config tracking behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.codex/config.toml:
- Around line 4-14: Update the mcp_servers.figma_cloud, supabase_cloud,
railway_cloud, and sentry_cloud configuration entries to explicitly set enabled
status instead of relying on defaults. For any enabled server, define the
allowed tool restrictions and default_tools_approval_mode; keep Supabase
production access read-only, and document its required OAuth scope and
confirmation boundary within the configuration.
---
Nitpick comments:
In @.gitignore:
- Around line 22-23: Add CI secret scanning that covers the trackable
.codex/config.toml exception, and document that credentials and secret headers
must remain in the host credential store rather than this file. Ensure the scan
fails when secrets are detected while preserving the intended config tracking
behavior.
🪄 Autofix (Beta)
❌ Autofix failed (check again to retry)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 7ccaeb2c-ba5e-428b-9545-bde9e18b14ef
📒 Files selected for processing (2)
.codex/config.toml.gitignore
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b9b2690de1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
CI triageCI failed on this PR. Automated classification of the 2 failed job(s):
Compared with main CI run #7866 (cancelled). Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger. |
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. The agent ran but didn't make any changes. The issues may already be fixed or require manual intervention. |
|
@cursoragent resolve failing CI testing please |
|
Fixed the CI failure and pushed to Cause: Fix: Added a Verified: Commit   |
Static PR checks failed because docs:check-index treats tracked .codex/ as an unindexed top-level root. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
|
@cursoragent resolve all comments please after fixing them if appropriate. |
|
All 6 review threads on PR #1589 are resolved. Already fixed earlier: Codex P1 + CodeRabbit (disabled-by-default MCP + governance gate) This pass:
Couldn’t update the PR description — ManagePullRequest reports it isn’t agent-managed. The incomplete Summary/Verification template is still a CodeRabbit warning if you want to fill that in manually. |
|
@cursoragent here are potential fixes... compare them against yours Review — logical fixes for config.toml MCP registrations
Set enabled = false for servers not needed every session, or gate them behind a connected profile. an allowed-server-name list (or an explicit, documented allowance for Figma/Sentry),
|
|
Comparison of that review against this branch:
Open question (project-scoped load): Confirmed and documented — trusted Codex hosts do load project Verified after the alignment pass: |
Address the P1 that trusted checkouts auto-enabled Figma, Supabase, Railway, and Sentry. Registrations stay URL-only with enabled=false and auto tool approval for connected Cloud hosts; gate validates the file. Paid API canaries remain confirmation-gated. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Document that the gitignore exception is for the secret-free MCP template only; host credentials stay out of the tracked file. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Match .codex/config.toml Railway endpoint to .mcp.json (no trailing slash) and clarify that trusted Codex hosts load project config.toml alongside CODEX_HOME, including Figma/Sentry approval boundaries. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
2 participants
Summary
Verification
npm run verify:pr-localDuring development, use
npm run verify:cheapas the faster iteration gate before the final PR-local preflight.npm run verify:uiwhen UI, routing, styling, browser behavior, reduced-motion, or forced-colors behavior changednpm run verify:releasebefore release or handoff confidence claimsFor retrieval, ranking, selection, chunking, source/citation rendering, or answer-contract changes,
verify:pr-localrunseval:rag:offlineautomatically. Run the offline command directly during iteration before spending a live eval.npm run eval:retrieval:quality(must stay 36/36) when retrieval, ranking, selection, chunking, or scoring behavior changed — CI cannot run it (needs live keys), so run it locally and paste the summary. A metadata/governance-weighting change once buried correct docs (recall 1.0→0.76) and only this eval caught it.npm run eval:rag -- --limit 15+npm run eval:quality -- --rag-onlywhen answer generation, the synthesis prompt, or answer post-processing changed (grounded-supported must not drop; citation-failure 0)npm run check:production-readinesswhen clinical workflow, privacy, environment, Supabase, source governance, or deployment behavior changednpm run check:deployment-readinesswhen deployment startup, hosting, or rollout behavior changedRisk and rollout
Complete this section for clinical, data, API, auth/privacy, workflow, dependency, build, or deployment changes.
Clinical Governance Preflight
Complete this section when the change touches ingestion, answer generation, search/ranking, source rendering, document access, privacy, production env, or clinical output.
Clinical KB Database(sjrfecxgysukkwxsowpy)Notes
Summary by CodeRabbit