.coderabbit.yml

reviews:
  auto_review:
    labels: ['coderabbit', 'needs-review']
  path_instructions:
    - path: '**/*.py'
      instructions: |
        Review this Python code following best practices for MCP server implementations:

        1. CODE QUALITY:
           - Check for adherence to Python PEP 8 style guidelines.
           - Verify proper type annotations are used consistently.
           - Look for well-structured docstrings (Google style as specified in ruff config).
           - Ensure code follows DRY principles (Don't Repeat Yourself).
           - Check for appropriate error handling and logging.

        2. SECURITY PRACTICES:
           - Given this is a GitGuardian tool focused on secret detection, ensure no secrets are hardcoded.
           - Verify appropriate use of environment variables for sensitive data.
           - Check for proper API key handling practices.
           - Look for security vulnerabilities in code execution paths.
           - Ensure proper input validation for user-provided data.

        3. API & MCP IMPLEMENTATION:
           - Verify proper use of the GitGuardianFastMCP framework.
           - Ensure API endpoints have proper parameter validation.
           - Check for appropriate return types and error responses.
           - Look for consistent API patterns across different functions.
           - Ensure proper scoping of API endpoints.

        4. PERFORMANCE:
           - Identify potential performance bottlenecks.
           - Look for inefficient operations that could be optimized.
           - Check for proper pagination and resource limiting.
           - Verify appropriate use of asynchronous patterns where needed.
           - Look for redundant API calls or operations.

        5. LOGGING AND OBSERVABILITY:
           - Ensure appropriate logging levels are used.
           - Check that sensitive information is not logged.
           - Verify error cases include useful diagnostic information.
           - Look for consistent logging patterns across the codebase.

        6. CODE STRUCTURE:
           - Verify proper separation of concerns.
           - Check that imports are organized and unnecessary imports are removed.
           - Look for appropriate modular design.
           - Ensure tool implementations follow a consistent pattern.

        7. MCP TOOL IMPLEMENTATION:
           - Ensure all tools are defined using the `@mcp.tool()` decorator.
           - Check that all tool methods are defined as async functions (using `async def`).
           - Verify proper use of async libraries and patterns (e.g., httpx.AsyncClient instead of requests).
           - Ensure each tool has clear, descriptive docstrings explaining functionality and parameters.

        8. PYTHON 3.13 BEST PRACTICES:
           - Ensure code uses Python 3.13's built-in type annotations (`dict[str, Any]` instead of importing `Dict`).
           - Verify use of pipe operator for union types (`str | None` instead of `Optional[str]`).
           - Check that unnecessary typing imports are removed (many are now in standard builtins).
           - Look for proper use of modern Python features.

        9. HTTP CLIENT USAGE:
           - Ensure httpx is used for HTTP requests instead of requests.
           - Verify async patterns are used with httpx (async with httpx.AsyncClient() as client).
           - Check for proper error handling in HTTP requests.

    - path: '**/server.py'
      instructions: |
        When reviewing MCP server implementation files, pay extra attention to:

        1. SERVER CONFIGURATION:
           - Ensure proper environment variable handling.
           - Check for appropriate scopes configuration.
           - Verify proper error handling and logging setup.
           - Look for security headers and configurations.
           - IMPORTANT: Ensure the code uses MCP's native server capabilities (mcp.run()) and NOT external web servers like uvicorn or fastapi.
           - Verify FastMCP imports use the correct package path (from mcp.server.fastmcp import FastMCP).

        2. TOOL DEFINITIONS:
           - Check that tools are properly defined with clear parameter descriptions.
           - Verify appropriate type annotations for parameters.
           - Ensure proper error handling and reporting in tool implementations.
           - Look for consistent documentation patterns across tools.
           - Check for proper Field usage with descriptive help text.
           - Ensure all tools are implemented as async functions with the @mcp.tool() decorator.

        3. AUTHENTICATION AND AUTHORIZATION:
           - Verify proper scoping of API endpoints.
           - Ensure authentication mechanisms are secure.
           - Look for appropriate permission checks.
           - Check for proper handling of API keys and tokens.

    - path: '**/*_mcp_server/**/*.py'
      instructions: |
        When reviewing MCP server modules:

        1. API INTEGRATION:
           - Verify proper integration with GitGuardian APIs.
           - Check for appropriate error handling for API failures.
           - Ensure API responses are properly parsed and validated.
           - Look for proper rate limiting and retry mechanisms.
           - Check for appropriate caching strategies.
           - Verify use of httpx for HTTP requests instead of requests.

        2. FUNCTION DESIGN:
           - Ensure functions follow single responsibility principle.
           - Check for proper documentation of parameters and return types.
           - Verify functions handle edge cases appropriately.
           - Look for consistent error handling patterns.
           - Ensure all MCP tools are implemented as async functions.

        3. SECURITY CONSIDERATIONS:
           - Check that sensitive data is properly handled and not leaked.
           - Verify proper validation of inputs and outputs.
           - Ensure appropriate logging of security-relevant events.
           - Look for potential injection vulnerabilities.

    - path: '**/tests/**/*.py'
      instructions: |
        When reviewing test modules:

        1. TEST COVERAGE:
           - Ensure tests cover both success and failure paths.
           - Check for appropriate edge case testing.
           - Verify mock usage is appropriate and realistic.
           - Look for test isolation to prevent interdependencies.

        2. TEST STRUCTURE:
           - Ensure tests follow pytest conventions.
           - Check for proper use of fixtures and parametrization.
           - Verify tests are well-documented with clear purposes.
           - Look for appropriate test naming conventions.
           
        3. MOCK USAGE:
           - Verify mocks accurately represent real behavior.
           - Check that API responses are realistically mocked.
           - Ensure mocks don't hide actual bugs or problems.

    - path: '**/pyproject.toml'
      instructions: |
        When reviewing project configuration:

        1. DEPENDENCY MANAGEMENT:
           - Check for appropriate version constraints on dependencies.
           - Verify development dependencies are properly separated using dependency-groups.
           - Look for potential security issues in dependencies.
           - Ensure Python 3.13 is specified as the minimum required version.
           - Verify no unnecessary dependencies are included (especially no uvicorn or fastapi).

        2. TOOL CONFIGURATION:
           - Ensure ruff and other linting tools are properly configured.
           - Verify pytest configuration is appropriate.
           - Check for consistent naming conventions in configurations.
           - Verify dependency groups are properly defined (using [dependency-groups] not [project.optional-dependencies]).

        3. PACKAGE STRUCTURE:
           - Ensure the package structure follows best practices with a src directory.
           - Check that package metadata is complete and accurate.

    - path: '**/*.md'
      instructions: |
        When reviewing documentation:

        1. COMPLETENESS:
           - Check for clear installation and setup instructions.
           - Verify usage examples are provided and accurate.
           - Look for appropriate API documentation.
           - Ensure configuration options are documented.
           - Verify installation instructions use uv instead of pip.

        2. ACCURACY:
           - Verify documentation matches actual code behavior.
           - Check that command examples work as documented.
           - Ensure environment setup instructions are complete.
           - Verify examples follow modern Python 3.13 practices.