fix: configure Cloud provider MCP access by BigSimmo · Pull Request #1561 · BigSimmo/Database

BigSimmo · 2026-08-01T15:52:04Z

Summary

replace the Railway CLI-backed project MCP entry with Railway's hosted OAuth endpoint
add a production-scoped, read-only Supabase MCP entry with restricted feature groups
harden Cloud setup validation for hosted MCP transport metadata, proxy cleanup, and task-only Cloud clones
document the OAuth, project-scope, and protected live-test boundaries

Why

Fresh Cloud containers cannot inherit a developer machine's Railway CLI login. The prior stdio MCP therefore discovered Railway but could not authenticate project operations. Supabase access also lacked a checked-in project-scoped, read-only MCP contract.

Files

.mcp.json
docs/codex-cloud.md
scripts/check-codex-cloud-setup.mjs
scripts/setup-codex-cloud.sh
tests/codex-cloud-setup.test.ts

Verification

node scripts/check-codex-cloud-setup.mjs — PASS
targeted Prettier check for all supported changed files — PASS
direct MCP contract assertion — PASS
git diff --check — PASS
fresh hosted Cloud runtime acceptance — Node 24.18.1/npm 11.17.0 and static/environment/runtime Cloud contracts PASS
Supabase metadata query — expected active project and database role confirmed
Railway status --project 5deaad0b-675a-4c13-978e-5ca2b5b877f9 --environment production --json — expected project, workspace, services, and running deployments confirmed read-only
authenticated live tests run 30705178751 — 1 test file passed, 1 test passed

Checks not completed

focused local Vitest was blocked first by an interrupted local install and then by another worktree's exclusive coordinator lease
lightweight production-readiness reached its local checks but could not load zod from the interrupted install; no production-readiness assertion failed
no deployment, schema change, Railway mutation, Supabase data mutation outside the documented live test, or merge was performed

Risk and follow-up

Railway hosted MCP and the scoped Supabase MCP require browser OAuth consent after the client reloads the new configuration
Supabase production MCP remains read-only by design; write testing should use a development project or branch
unrestricted Cloud internet remains an elevated-risk environment setting and should be narrowed per task when practical

RAG impact: no retrieval behaviour change — this PR changes Cloud/MCP setup and validation only.

Summary by CodeRabbit

New Features
- Added hosted Railway MCP access with browser-based OAuth.
- Added a read-only Supabase MCP connection for production data and diagnostics.
- Expanded setup output with MCP connection details and validation scope.
Bug Fixes
- Improved setup validation for MCP endpoints, environments, and access restrictions.
- Prevented npm proxy settings from interfering with setup and runtime configuration.
Documentation
- Updated cloud setup guidance for hosted Railway access and read-only Supabase usage.

coderabbitai · 2026-08-01T15:52:09Z

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in:38 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: afc31671-170b-47e4-958a-e132860bc61c

📥 Commits

Reviewing files that changed from the base of the PR and between da6c839 and 5a3e73f.

📒 Files selected for processing (1)

scripts/check-codex-cloud-setup.mjs

📝 Walkthrough

Walkthrough

The PR replaces Railway CLI MCP access with hosted Railway OAuth and read-only Supabase MCP endpoints. It adds MCP metadata validation, Cloud setup scope handling, task-only Git baseline support, npm proxy cleanup, and related tests.

Changes

Hosted MCP and Codex Cloud setup

Layer / File(s)	Summary
MCP contracts and hosted configuration `.mcp.json`, `docs/codex-cloud.md`, `scripts/check-codex-cloud-setup.mjs`	Railway now uses a hosted HTTP MCP endpoint. Supabase uses a production-scoped, read-only MCP configuration. Codex Cloud guidance documents the OAuth scope and mutation restrictions.
MCP validation and capability reporting `scripts/check-codex-cloud-setup.mjs`, `tests/codex-cloud-setup.test.ts`	Setup validation checks hosted Railway and Supabase MCP settings. Capability output reports transport metadata, endpoints, query names, and environment names. Tests cover parsing and validation.
Cloud runtime and baseline handling `scripts/check-codex-cloud-setup.mjs`, `scripts/setup-codex-cloud.sh`, `tests/codex-cloud-setup.test.ts`	Cloud validation reports runtime scope, accepts task-only `HEAD` baselines, and removes lowercase npm proxy aliases before npm use and in the generated runtime profile. Tests cover these paths.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

BigSimmo/Database#909: This PR supersedes the earlier CLI-based Railway MCP configuration.
BigSimmo/Database#1497: Both PRs update Codex Cloud MCP configuration, validation, documentation, and tests.
BigSimmo/Database#918: Both PRs modify shared Railway/Supabase staging configuration and validation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: configuring Cloud provider MCP access.
Description check	✅ Passed	The description covers the change, rationale, files, verification results, incomplete checks, risks, and follow-up actions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

_{Comment @coderabbitai help to get the list of available commands.}

ecc-tools · 2026-08-01T15:52:10Z

🔒 Upgrade Required

Private repository analysis requires Pro or Enterprise.

Upgrade: https://ecc.tools/pricing?plan=pro

_{ECC Tools keeps the core app open, and puts private repos, team features, and enterprise controls behind paid tiers.}

supabase · 2026-08-01T15:52:10Z

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

BigSimmo · 2026-08-01T15:52:21Z

Cloud provider connector write acceptance complete: the GitHub connector created this draft PR comment and successfully edited it. No merge, deployment, workflow rerun, label, or review action was requested by this comment.

qodo-code-review · 2026-08-01T15:56:43Z

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

ecc-tools · 2026-08-01T15:59:09Z

🔒 Upgrade Required

Private repository analysis requires Pro or Enterprise.

Upgrade: https://ecc.tools/pricing?plan=pro

_{ECC Tools keeps the core app open, and puts private repos, team features, and enterprise controls behind paid tiers.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:da6c839cce

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

ecc-tools · 2026-08-01T16:01:07Z

🔒 Upgrade Required

Private repository analysis requires Pro or Enterprise.

Upgrade: https://ecc.tools/pricing?plan=pro

_{ECC Tools keeps the core app open, and puts private repos, team features, and enterprise controls behind paid tiers.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/codex-cloud-setup.test.ts`:
- Around line 213-214: Update the ProcessEnv fixtures passed to localGitBaseline
in the affected test: add NODE_ENV: "test" to both environment objects, while
retaining CODEX_CLOUD: "1" in the cloud fixture.

🪄 Autofix (Beta)

❌ Autofix failed (check again to retry)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 5f11a6bb-d5f6-41e2-9b14-bced8ca5be53

📥 Commits

Reviewing files that changed from the base of the PR and between d4a4463 and da6c839.

📒 Files selected for processing (5)

.mcp.json
docs/codex-cloud.md
scripts/check-codex-cloud-setup.mjs
scripts/setup-codex-cloud.sh
tests/codex-cloud-setup.test.ts

coderabbitai · 2026-08-01T16:17:53Z

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

❌ Failed to clone repository into sandbox. Please try again.

ecc-tools · 2026-08-01T16:18:00Z

🔒 Upgrade Required

Private repository analysis requires Pro or Enterprise.

Upgrade: https://ecc.tools/pricing?plan=pro

_{ECC Tools keeps the core app open, and puts private repos, team features, and enterprise controls behind paid tiers.}

coderabbitai · 2026-08-01T16:20:23Z

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

The agent ran but didn't make any changes. The issues may already be fixed or require manual intervention.

fix: configure Cloud provider MCP access
da6c839

BigSimmo marked this pull request as ready for review August 1, 2026 15:56

fix: type Cloud baseline environment input
6e8531e

Merge branch 'main' into codex/cloud-provider-access
331be96

chatgpt-codex-connectorBot reviewed Aug 1, 2026
View reviewed changes

Comment threadscripts/check-codex-cloud-setup.mjs

BigSimmo enabled auto-merge (squash) August 1, 2026 16:01

coderabbitaiBot reviewed Aug 1, 2026
View reviewed changes

Comment threadtests/codex-cloud-setup.test.ts

Merge branch 'main' into codex/cloud-provider-access
5a3e73f

BigSimmo merged commit 93ab1e0 into mainAug 1, 2026
48 checks passed

BigSimmo deleted the codex/cloud-provider-access branch August 1, 2026 16:57

Conversation

BigSimmo commented Aug 1, 2026• edited by coderabbitai BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Files

Verification

Checks not completed

Risk and follow-up

Summary by CodeRabbit

Uh oh!

coderabbitaiBot commented Aug 1, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Uh oh!

ecc-toolsBot commented Aug 1, 2026

🔒 Upgrade Required

Uh oh!

supabaseBot commented Aug 1, 2026

Uh oh!

BigSimmo commented Aug 1, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-code-reviewBot commented Aug 1, 2026

Qodo reviews are paused for this user.

Uh oh!

ecc-toolsBot commented Aug 1, 2026

🔒 Upgrade Required

Uh oh!

chatgpt-codex-connectorBot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

ecc-toolsBot commented Aug 1, 2026

🔒 Upgrade Required

Uh oh!

coderabbitaiBot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitaiBot commented Aug 1, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ecc-toolsBot commented Aug 1, 2026

🔒 Upgrade Required

Uh oh!

coderabbitaiBot commented Aug 1, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

BigSimmo commented Aug 1, 2026•
edited by coderabbitai Bot
Loading

coderabbitaiBot commented Aug 1, 2026•
edited
Loading

BigSimmo commented Aug 1, 2026•
edited
Loading

coderabbitaiBot left a comment •
edited
Loading

coderabbitaiBot commented Aug 1, 2026•
edited
Loading

coderabbitaiBot commented Aug 1, 2026•
edited
Loading