docs: assess whether this project should expose an MCP server

[webdevsamran]

Phase 16 of the plan asks for this evaluation and assumes the answer: "all four are strong candidates". Working through them one at a time, that is not what the code says.

Project	Verdict	Why
api-verity-lab	yes, read-only subset	Bounded questions about files on disk; already emits result-v1 artifacts
devrepro-doctor	yes — strongest of the four	Read-only by design, and output already passes a privacy gate before serialization
tooltrace-bench	mostly no	Exposing the scorer is a contamination problem, not an engineering one
aihwbench	split — read yes, run no	Not danger; a benchmark invoked concurrently produces two wrong numbers

Where the plan's assumption breaks

tooltrace-bench. An agent that can call run can run itself, retry until the score improves, and report the best result — with the same provenance as an honest one. Nothing in the protocol distinguishes that from a legitimate call. It's also already an MCP client (tooltrace/agents/mcp.py speaks JSON-RPC over stdio with conformance fixtures), which is the useful direction: MCP servers are something this benchmark measures, not something it needs to become.

aihwbench. benchmark takes minutes and assumes it owns the machine. Two concurrent calls produce two invalid numbers, published with a full hardware manifest that makes them look trustworthy. The read side — especially compare, which can answer "you may not compare these, and here is why" — is a genuinely good fit.

devrepro-doctor is the strongest case precisely because its output already passes through devrepro/privacy/ before serialization. Most machine-inspection tools are unsafe behind an agent because their output is full of paths, usernames and environment variables; this one treats that as a correctness property. Its one hard exclusion is fix, whose --yes gate exists so a human confirms remediation — an MCP call would move that confirmation to a model.

What these documents are

Assessments, not features. Nothing is built. Each states what would be exposed, what deliberately would not be, and what has to be true first — recorded while the reasoning is fresh, and explicit that this is not a capability the project currently has.

The constraint common to all four: path confinement. Every candidate tool takes a file path, and a server handing an agent unrestricted filesystem reach through a path argument is a hazard whatever the tool does with it.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.