Review: Spike: Penny MCP services + OAuth wiring

review-227-2026-03-27 Review

review needs-refinement

Project

[x] Type — Spike
[x] Lineage — plan-pal-e-agency Phase 16 (note: plans are obsolete per feedback_kanban_over_plans.md, minor)
[x] Repo — forgejo_admin/claude-custom
[x] Question — clear and well-framed
[x] What to Explore — 8 bullet points (but contains stale info, see Recommendation)
[x] Success Criteria — 4 checkboxes, all verifiable
[x] Time-box — 1 session
[x] Related — 5 references, all valid

Spike template: no file targets expected. However, the "What to Explore" section references paths. Verification:

[x] ~/secrets/ — verified: contains google-oauth/ (with desktop/credentials.json + token.json), linkedin/credentials.env, notion/credentials.env
[x] agents/penny.md — verified at ~/claude-custom/agents/penny.md. "Future MCP Servers" section present. mcpServers frontmatter lists only pal-e-docs and notion.
[ ] claude-custom/plugins/marketplaces/ — INACCURATE PATH. Actual: plugins/marketplaces/claude-plugins-official/external_plugins/. Contains: Slack, Discord, Telegram, iMessage, and 13 others.
[x] Gmail OAuth for westsidebasketball@gmail.com — verified: ~/secrets/google-oauth/desktop/token.json exists

OK. Issue is on forgejo_admin/claude-custom, which is correct — agent config, frontmatter, and MCP wiring all live there.

depends:132 — claude-custom#132 ("Bug: Penny agent type missing from spawn schema") is closed with status:approved. Board item #226 is in done column. Dependency satisfied.

4 success criteria, all verifiable by an agent:

Complete list of MCP services with auth type — verifiable by listing ~/.mcp.json + Forgejo repos
OAuth tokens inventoried — verifiable by checking ~/secrets/ dirs
Follow-up tickets created — verifiable by checking Forgejo
"Not ready" conclusion with blockers — verifiable by reading the spike output

Criteria are reasonable and testable. No missing criteria.

Spike is research-only. No code changes. No downstream impact. Low risk.

The "What to Explore" section contains outdated information that will waste agent time:

Gmail MCP is already deployed. The issue and agents/penny.md both say "NOT DEPLOYED," but gmail MCP IS wired in ~/.mcp.json and is active (41 mcp__gmail__* tools available). The agent will spend time "discovering" what's already running.
Notion MCP is already deployed. Wired in ~/.mcp.json, active in sessions. agents/penny.md mcpServers frontmatter lists it correctly.
GroupMe MCP is deployed but not mentioned. Wired in ~/.mcp.json with access token. Not referenced in agent-penny definition or this spike. Should the spike consider GroupMe as a Penny service?
GCal MCP and LinkedIn MCP are truly NOT wired in ~/.mcp.json — these are the actual gaps. Repos exist on Forgejo (gcal-mcp, gcal-mcp-remote, linkedin-mcp-scheduler) but aren't configured locally.
agents/penny.md mcpServers frontmatter lists only pal-e-docs and notion — gmail is missing even though the MCP server exists. This is a concrete wiring gap the spike should flag.

Two fixes before moving to next_up:

Update the "What to Explore" section to reflect current state: Gmail MCP and Notion MCP are deployed. GCal and LinkedIn are the actual unknowns. Add GroupMe to the investigation scope or explicitly exclude it.
Add arch: label to the board item — recommend arch:mcp-tools.

After these fixes, the spike is READY. The structural scope is solid — just needs factual corrections to avoid wasted investigation time.

Verdict: NEEDS_REFINEMENT