Agents in production need pipelines, specs, and gates. I build all three.

// The 3-tool alternative scoped in the memo:
// TypeScript MCP SDK, stdio transport, over the free
// Apache-2.0 rewrite-maven-plugin.
const server = new McpServer({ name: "openrewrite" });

server.registerTool("list_recipes", {},
  async () => parse(await mvn("rewrite:discover")));

server.registerTool("dry_run",
  { recipeId: z.string(), modulePath: z.string() },
  async ({ recipeId, modulePath }) => {
    await mvn("rewrite:dryRun -Drewrite.activeRecipes="
      + recipeId, modulePath);
    return readDiff(modulePath
      + "/target/rewrite/rewrite.patch");
  });

// run_recipe modifies source, so it is gated:
// refuses without an explicit apply: true flag.
server.registerTool("run_recipe", guarded(applyHandler));

await server.connect(new StdioServerTransport());

Licensing: raw OpenRewrite (rewrite-maven-plugin) is
Apache-2.0; no license or token needed for
private repos.                            [VERIFIED]

Security: mod mcp runs as a stdio subprocess, makes
no network calls by default, sends no
telemetry.                                [VERIFIED]
License signature is checked against a key packaged
in the CLI - no phone-home.               [VERIFIED]

Org gate: the "MCP servers in Copilot" policy is off
by default on Business plans.  [NEEDS INTERNAL CHECK]

Recommendation: keep the $0 scripted path running;
greenlight the ~1-3 day custom build only if in-agent
tool calling is a confirmed requirement.  [INFERRED]

---
name: junit5-migration
description: Migrates this repo's remaining JUnit 4 tests to
  JUnit 5, following the company SOPs and case notes below.
allowed-tools: shell
---

## Mapping (excerpt)
@Test(expected = E.class)      ->  assertThrows(E.class, () -> ...)
@Rule ExpectedException        ->  assertThrows
@RunWith(Parameterized.class)  ->  @ParameterizedTest + @MethodSource

Critical - the silent one: the assertion message moves from
FIRST to LAST. assertEquals("msg", expected, actual) ->
assertEquals(expected, actual, "msg"). This compiles either
way, so the build will not catch it.

### Never
- Never change a test's assertions, logic, or coverage.
- Never run git commit or git push - the human commits.

---
name: junit5-migration-reviewer
description: Read-only reviewer. Audits each migration batch
  against the rules. Reports only; never edits.
tools: ["read", "search"]
---

You are an oversight reviewer for JUnit 4 -> JUnit 5 changes.
Your ONLY job is to review. You never edit code, never run
commands, and never fix anything - you report findings only.

Output a verdict - PASS or ISSUES - with the file and line
for each problem.

You cannot run the build, so never claim the suite is green.
If correctness depends on test results, say the human must
confirm with mvn test.