docs/mcp-app-review.md is a manual review checklist with no automated CI enforcement

Which version line?

v2 — current (@modelcontextprotocol/inspector@latest)

Which client?

All / shared core

Inspector version

2.7.0 (git tag) — static code-review finding, not run locally

Node version

N/A — static code review, no live run performed

Operating system (and browser, for the web client)

N/A — static code review

Transport

Not applicable / never connected

MCP server under inspection

N/A — this is a static code-review finding about docs/mcp-app-review.md, a review checklist, not a live reproduction against a running MCP server.

Steps to reproduce

Found via static review of the 2.7.0 tag source, not a live run.

1. docs/mcp-app-review.md is a manual review checklist "for automated reviewers (CI, agents)" to run on-demand against an MCP app/server.
2. A repo-wide search of scripts/ and .github/ finds no script or workflow that references "mcp-app-review" — unlike other conformance surfaces in the repo (e.g. verify-skills.mjs, dependabot-alerts.mjs, gate-lease checks), which ARE wired into CI/local:gate.
3. So the checklist's guidance can silently drift out of sync with the code it describes, since nothing forces a contributor or CI run to apply it.
   No live run was performed; this is based on reading the doc and searching the repo's scripts/CI config against the 2.7.0 tag.

Expected behavior

docs/mcp-app-review.md's checklist is either run automatically (a script/CI job that applies at least the mechanically-checkable items) the way other conformance docs in this repo are, or the doc explicitly says it is manual-only and by whom/how often it should be run.

Actual behavior

The doc is a well-written, on-demand checklist for reviewers (CI or agents) but nothing in scripts/ or .github/ actually invokes it — it's the only conformance surface in the repo without some automated enforcement, so it can go stale silently.

Suggested fix: turn at least the objectively-checkable items into a script (similar to verify-skills.mjs) runnable in CI/local:gate, or add a short note in the doc itself clarifying it's intentionally manual-only and stating who is expected to run it.

Logs, errors, or screenshots

No response

Already prototyped a fix?

No response

Before you submit

• I searched existing issues and this is not a duplicate.
• This is not a security vulnerability report (those go through the private advisory process).

Read docs/mcp-app-review.md, then inspect scripts/ and .github/ for existing conformance checks such as verify-skills.mjs and local:gate wiring. Determine whether the mechanically checkable items can be enforced there, or whether the checklist should document its manual-only owner and schedule. Done means the checklist is either invoked by CI/local:gate or explicitly defines that manual process.