pal-e-docs

Review: Spike: Penny MCP services + OAuth wiring

review-227-2026-03-27-v3 Review

review ready
Project

Verdict: READY

Template Completeness

  • [x] Type — Spike
  • [x] Lineage — Board item #227, labels, dependency #132
  • [x] Repo — forgejo_admin/claude-custom
  • [x] Question — Clear: what MCP services does Penny need, deployment state, OAuth wiring gaps
  • [x] What to Explore — Current state (8 MCP servers verified) + 4 gaps to investigate
  • [x] Success Criteria — 4 items, all verifiable
  • [x] Time-box — 1 session with escalation path
  • [x] Related — 5 references including project, dependency, agent def, config files

Traceability

  • [x] story:superuser-manage — superuser platform management story
  • [x] arch:mcp-tools — MCP tooling architecture component
  • [x] Forgejo issue — forgejo_admin/claude-custom#133, open

File Targets

Spikes have no file targets per template-issue-spike. Contextual references verified:
  • [x] ~/.mcp.json — verified: 8 MCP servers (playwright, notion, pal-e-docs, forgejo, gmail, groupme, chrome-devtools, woodpecker)
  • [x] ~/claude-custom/agents/penny.md — verified: mcpServers lists only pal-e-docs and notion; "Future MCP Servers" says gmail "NOT DEPLOYED" (stale, confirmed in issue body)
  • [x] ~/secrets/google-oauth/gcal-mcp-remote.json — exists
  • [x] ~/secrets/linkedin/credentials.env — exists
  • [x] plugins/marketplaces/.../external_plugins/ — exists, 17 plugin dirs confirmed (Slack, Discord, Telegram, iMessage + 13 others)
  • [x] Forgejo repos: gcal-mcp, gcal-mcp-remote, linkedin-mcp-scheduler — all exist, non-empty

Repo Placement

OK. Issue filed on claude-custom, which owns agents/penny.md and MCP wiring config. Investigation touches ~/.mcp.json (outside any repo) and Forgejo repos for gcal/linkedin — appropriate for a spike that inventories across boundaries.

Dependencies

  • depends:132 (claude-custom#132) — closed. Penny agent type added to spawn schema. Dependency satisfied.
  • Board items #63 (gcal-mcp-remote CI) and #65 (linkedin-scheduler-remote CI) in todo column — downstream work that spike may validate or update.

Acceptance Criteria

4 success criteria, all agent-verifiable:
  • Complete MCP inventory with auth type + deployment status — enumerate .mcp.json, check repos, check ~/secrets
  • OAuth tokens inventoried — check ~/secrets for freshness
  • Follow-up tickets created for each wiring gap — Forgejo issue creation
  • Escape hatch: "not ready" conclusion documented — standard spike outcome
Note: existing board items #63 and #65 already partially cover GCal/LinkedIn CI wiring. Spike should validate whether those tickets are sufficient or need updating.

Blast Radius

Minimal. This is an inventory spike — no code changes. Follow-up tickets carry the blast radius. No downstream consumer concerns for the investigation itself.

Decomposition

No decomposition needed. Spike = investigation, not implementation. 0 file targets, 4 acceptance criteria, 1 session time-box. Single agent pass is appropriate.

Recommendation

No action needed. Issue body restoration is complete and accurate. All template sections present, traceability intact, contextual claims verified against filesystem and Forgejo. Ready for next_up.

Context: Re-review History

This is the third review (v3) of board item #227:
  • review-227-2026-03-27 (v1) — NEEDS_REFINEMENT: stale Gmail/GroupMe facts in issue body
  • review-227-2026-03-27-v2 (v2) — BLOCK: issue body clobbered to literal $NEW_BODY
  • review-227-2026-03-27-v3 (v3, this review) — READY: body restored from review notes + spike template, all facts verified