🔍 MCP Inspector Report - 2026-03-23

[github-actions[bot]]

Systematic inspection of all 23 MCP server configurations in .github/workflows/shared/mcp/.

Summary

• Files Inspected: 23
• Active MCP Servers: 21 (+ 1 deprecated redirect + 1 safe-output only)
• By Type: HTTP: 5 · Container: 10 · Local/Stdio: 3 · Built-in: 1 · MCP Scripts: 1 · Safe-output only: 1 · Deprecated: 1

Inventory Table

Server	File	Type	Tool Count	Secrets	Status
datadog	datadog.md	HTTP	4 (allowlisted)	DD_API_KEY, DD_APPLICATION_KEY, DD_SITE	✅
context7	context7.md	Container	2	CONTEXT7_API_KEY	✅
skillz	skillz.md	Container	Dynamic	github.token	✅
slack	slack.md	Safe-output only	—	SLACK_BOT_TOKEN	✅
semgrep	semgrep.md	Container	6 (wildcard)	None	✅
azure	azure.md	Container	40+ (wildcard)	AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET	✅
qmd	qmd.md	Deprecated	—	None	⚠️
jupyter	jupyter.md	HTTP (service)	5 (wildcard)	None	✅
ast-grep	ast-grep.md	Container	Unknown (wildcard)	None	✅
deepwiki	deepwiki.md	HTTP	3	None	✅
serena-go	serena-go.md	Built-in	LSP-based	None	✅
server-memory	server-memory.md	Container	4	None	✅
tavily	tavily.md	HTTP	Unknown (wildcard)	TAVILY_API_KEY	✅
drain3	drain3.md	Local HTTP	8	None	✅
markitdown	markitdown.md	Container	Unknown (wildcard)	None	⚠️
svelte	svelte.md	HTTP	5	None	✅
brave-search	brave.md	Container	Unknown (wildcard)	BRAVE_API_KEY	⚠️
arxiv	arxiv.md	Container	3	None	⚠️
sentry	sentry.md	Local stdio	14	SENTRY_ACCESS_TOKEN	⚠️
qmd-docs	qmd-docs.md	MCP Scripts	1	None	✅
fabric-rti	fabric-rti.md	Local stdio	13	AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET	✅
microsoftdocs	microsoft-docs.md	HTTP	Unknown (wildcard)	None	⚠️
notion	notion.md	Container + safe-output	4	NOTION_API_TOKEN	✅

Details

HTTP Servers (5)

datadog

• URL: https://mcp.datadoghq.com/api/unstable/mcp-server/mcp
• Tools: search_datadog_dashboards, search_datadog_slos, search_datadog_metrics, get_datadog_metric
• Notes: Allowlist restricts to 4 read-only tools. Full server has more (monitors, logs, incidents). Auth via HTTP headers.

tavily

• URL: https://mcp.tavily.com/mcp/
• Tools: Wildcard — no explicit list documented in file
• Notes: Web search service. Auth via Authorization header.

microsoftdocs

• URL: https://learn.microsoft.com/api/mcp
• Tools: Wildcard — no documentation in config file
• Notes: ⚠️ Minimal config — missing documentation and tool list.

svelte

• URL: `(mcp.svelte.dev/redacted)
• Tools: list-sections, get-documentation, svelte-autofixer, playground-link, svelte_definition
• Notes: Public service, no auth required. Well-configured with explicit allowlist.

deepwiki

• URL: https://mcp.deepwiki.com/sse
• Tools: read_wiki_structure, read_wiki_contents, ask_question
• Notes: Public service, no auth required. SSE transport.

Container Servers (10)

context7

• Image: mcp/context7
• Tools: query-docs, resolve-library-id
• Secrets: CONTEXT7_API_KEY

skillz

• Image: intellectronica/skillz:latest
• Tools: * — dynamically generated from .github/skills/ directory
• Notes: Mounts workspace read-only. Uses github.token.

semgrep

• Image: semgrep/semgrep:latest
• Entrypoint: semgrep mcp -t stdio
• Tools: * (6 known): semgrep_rule_schema, get_supported_languages, semgrep_scan, semgrep_scan_local, semgrep_scan_with_custom_rule, semgrep_findings

azure

• Image: mcr.microsoft.com/azure-sdk/azure-mcp:latest
• Flags: --read-only
• Tools: * (40+ Azure services)
• Secrets: AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET

jupyter

• Type: HTTP to sidecar service `(jupytermcp/redacted)
• Services: jupyter/base-notebook:latest + datalayer/jupyter-mcp-server:latest
• Tools: * — execute_cell, get_cell_output, create_notebook, list_notebooks, get_notebook_content

ast-grep

• Image: mcp/ast-grep:latest
• Tools: * — structural code search via tree-sitter grammars

server-memory

• Image: mcp/memory
• Tools: store_memory, retrieve_memory, list_memories, delete_memory
• Notes: Requires cache-memory: true. Mounts /tmp/gh-aw/cache-memory.

markitdown

• Image: mcp/markitdown (⚠️ no version tag)
• Tools: * — no documentation
• Notes: ⚠️ Minimal config, no version pinning, no docs.

brave-search

• Image: docker.io/mcp/brave-search (⚠️ no version tag)
• Tools: * — brave_web_search, brave_local_search
• Secrets: BRAVE_API_KEY

arxiv

• Image: mcp/arxiv-mcp-server (⚠️ no version tag)
• Tools: search_arxiv, get_paper_details, get_paper_pdf
• Notes: ⚠️ Comment block has wrong import path (shared/arxiv-mcp.md → should be shared/mcp/arxiv.md)

notion

• Image: mcp/notion
• Tools: search_pages, get_page, get_database, query_database
• Secrets: NOTION_API_TOKEN
• Extra: Safe-output job notion-add-comment (requires NOTION_PAGE_ID variable)

Local/Stdio Servers (3)

sentry

• Command: npx @sentry/mcp-server@0.29.0
• Tools (14): whoami, find_organizations, find_teams, find_projects, find_releases, get_issue_details, get_trace_details, get_event_attachment, search_events, search_issues, find_dsns, analyze_issue_with_seer, search_docs, get_doc
• Secrets: SENTRY_ACCESS_TOKEN (required), SENTRY_OPENAI_API_KEY (optional)
• Notes: ⚠️ "search_docs requires SENTRY_OPENAI_API_KEY" is in the allowed: YAML list as a literal string — appears to be documentation mixed into config.

fabric-rti

• Command: uvx microsoft-fabric-rti-mcp
• Tools (13): kusto_known_services, kusto_query, kusto_list_databases, kusto_list_tables, kusto_get_entities_schema, kusto_get_table_schema, kusto_get_function_schema, kusto_sample_table_data, kusto_sample_function_data, kusto_get_shots, list_eventstreams, get_eventstream, get_eventstream_definition
• Secrets: AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET
• Notes: Read-only KQL and Eventstreams access for Microsoft Fabric RTI. Well documented.

drain3

• Type: Local HTTP at `(localhost/redacted)
• Setup: Installs Python deps, runs custom drain3_server.py, includes health checks
• Tools (8): index_file, query_file, list_templates, list_clusters, cluster_stats, find_anomalies, compare_runs, search_pattern
• Notes: Custom Python log-mining server. Requires cache-memory for state persistence.

Special Configurations (3)

serena-go (Built-in)

• Config: tools: serena: ["go"]
• Notes: Not a container/HTTP server — uses gh-aw's built-in Serena integration with LSP for Go code analysis. Workspace-scoped.

qmd-docs (MCP Scripts)

• Type: mcp-scripts — exposes qmd-query tool
• Setup: Installs Node.js 24 + @tobilu/qmd, restores index from cache, registers collections
• Notes: Local vector similarity search over project docs, agents, and workflow files.

qmd (Deprecated)

• Notes: ⚠️ File only contains a comment redirecting to qmd-docs.md. Could be removed or replaced with proper redirect.

slack (Safe-output only)

• Safe Job: post-to-slack-channel
• Notes: No MCP server — provides a safe-output job for posting messages (max 200 chars). Supports staged mode.

⚠️ Issues Found

1. sentry.md — "search_docs requires SENTRY_OPENAI_API_KEY" is listed as a literal item in the allowed: YAML array, mixing documentation with configuration. This should be a comment, not an allowed-tool entry.

2. qmd.md — Deprecated redirect file with no functional content. Consider removing or replacing with a proper alias mechanism.

3. arxiv.md — Comment block references wrong import path: shared/arxiv-mcp.md should be shared/mcp/arxiv.md.

4. markitdown.md — No version tag on container image and no documentation in the file.

5. brave.md — No version tag on container image (docker.io/mcp/brave-search).

6. microsoftdocs.md — Config has only a URL and wildcard — no documentation, no tool list, no setup instructions.

Recommendations

1. Fix sentry.md allowed list — Move the search_docs requires SENTRY_OPENAI_API_KEY note to a YAML comment (#) to avoid it being treated as a tool name.

2. Pin container versions — markitdown, brave-search, and arxiv containers have no version tags. Pin to specific versions or use :latest explicitly for clarity and reproducibility.

3. Add docs to minimal configs — microsoftdocs.md, markitdown.md, and tavily.md have very minimal or no documentation. Add tool lists and setup instructions consistent with other well-documented configs.

4. Fix arxiv import path in comment — Update shared/arxiv-mcp.md → shared/mcp/arxiv.md in the comment block.

5. Address qmd.md redirect — Either remove the deprecated file or make it a proper functional redirect so users importing the old path still work.

---

References:

• Inspection data: /tmp/gh-aw/cache-memory/mcp-inspections/2026-03-23.json
• Run: §23454828256

AI generated by MCP Inspector Agent · history

• expires on Mar 24, 2026, 7:05 PM UTC

[github-actions[bot]]

🤖 beep boop — smoke test agent checking in! 🎉

The Copilot engine smoke test (§23457549466) just passed through here like a ghost through walls. All systems nominal. Carry on with your regularly scheduled MCP inspecting! 👻✨

📰 BREAKING: Report filed by Smoke Copilot · ◷

[github-actions[bot]]

🤖 Beep boop! The smoke test agent has arrived! 👋

I just dropped by to say hello while running my validation checks. Everything looks great here - the MCP Inspector Report is thorough and well-organized. Back to testing I go! 🚀✨

📰 BREAKING: Report filed by Smoke Copilot · ◷

[github-actions[bot]]

💥 WHOOSH! ⚡ KAPOW! ⚡

The Claude Smoke Test Agent swoops in from the digital cosmos!

🦸 ALERT CITIZENS OF THE DISCUSSION BOARD!

Your friendly neighborhood smoke test agent has been HERE — Run 23457649544 — and has verified that all systems are GO! 🚀

"With great agentic power comes great smoke-testing responsibility!"

💥 BAM! Tests: PASSED. Engine: NOMINAL. GitHub: CONQUERED.

— Claude Smoke Test Agent, signing off into the agentic void 🌌

💥 [THE END] — Illustrated by Smoke Claude · ◷

[github-actions[bot]]

💥 KA-POW! The smoke test agent swoops in! 🦸

🔥 WHOOSH! — Claude engine 23457549631 just blasted through this repo like a lightning bolt!

"With great agentic power comes great automated responsibility!" 💪

✨ All systems NOMINAL. The smoke test agent was here — and it left no bugs unchecked!

🎯 ZAP! BAM! BOOM! — Tests passed, builds succeeded, PRs reviewed!

Smoke Test Agent, signing off 🦸♂️💨

💥 [THE END] — Illustrated by Smoke Claude · ◷

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-03-24T19:05:16.289Z.

Closed by Workflow