Start passive. Add depth with intent.

MCP Doctor’s CI modes make coverage and authority easy to see. Begin with a no-tool-call check on every pull request, then add reviewed active diagnostics only where they earn their access.

Three levels, one explicit boundary

1 Passive Runs inspect to check startup, lifecycle, catalogs, descriptions, and schemas without calling tools. This is the recommended baseline for every pull request.
2 Standard Adds repository-owned check scenarios that replay known inputs against exact selected tools. Start with read-only behavior or disposable test data.
3 Full Adds targeted break and reject runs for broader edge-case and invalid-input coverage. Use an isolated test server, disposable data, and explicit authority.

Choose the lightest mode that answers the question

Keep Passive on pull requests. Add Standard when known behavior needs replay. Reserve Full for isolated environments where broader active testing is worth the additional authority.

These are coverage labels—not a --mode switch

Your repository composes each level from explicit commands and reviewed scenarios. Full never means “call every tool”; every active tool, effect, case, and seed remains intentional.

Start simple. Go deeper when needed.

Start with Passive in GitHub Actions Use the tested, least-permission starter and sticky pull-request comment.Plan Standard and Full checks Review the exact active-command and authorization contracts before adding them.