@rigour-labs/mcp 4.3.6 → 5.0.1

package/dist/tools/deep-handlers.d.ts

@@ -20,6 +20,7 @@ export declare function handleCheckDeep(runner: GateRunner, cwd: string, config:
 }): Promise<ToolResult>;
 /**
  * Get deep analysis statistics from SQLite storage.
+ * v5: includes temporal drift report with per-provenance EWMA streams.
  */
 export declare function handleDeepStats(cwd: string, limit?: number): Promise<ToolResult>;
 export {};

package/dist/tools/deep-handlers.js

@@ -107,6 +107,7 @@ export async function handleCheckDeep(runner, cwd, config, args) {
 }
 /**
  * Get deep analysis statistics from SQLite storage.
+ * v5: includes temporal drift report with per-provenance EWMA streams.
  */
 export async function handleDeepStats(cwd, limit = 10) {
     try {
@@ -144,6 +145,18 @@ export async function handleDeepStats(cwd, limit = 10) {
                 text += `  ${issue.category}: ${issue.count} occurrences\n`;
             }
         }
+        // v5: Temporal Drift Report
+        try {
+            const { generateTemporalDriftReport, formatDriftSummary } = await import('@rigour-labs/core');
+            const driftReport = generateTemporalDriftReport(cwd);
+            if (driftReport && driftReport.totalScans >= 3) {
+                text += `\n${'═'.repeat(60)}\n`;
+                text += formatDriftSummary(driftReport);
+            }
+        }
+        catch {
+            // Temporal drift is advisory — never blocks stats output
+        }
         return { content: [{ type: "text", text }] };
     }
     catch (error) {

package/dist/tools/hooks-handler.js

@@ -27,7 +27,7 @@ export async function handleHooksCheck(cwd, files, timeout, text, agent) {
             block_on_detection: true,
             audit_log: true,
         });
-        // Log to audit trail
+        // Log to audit trail (with rotation to prevent unbounded growth)
         if (result.status !== 'clean') {
             try {
                 const rigourDir = path.join(cwd, '.rigour');
@@ -37,6 +37,15 @@ export async function handleHooksCheck(cwd, files, timeout, text, agent) {
                     agent: agent ?? 'mcp',
                 });
                 await fs.appendFile(eventsPath, JSON.stringify(auditEntry) + '\n');
+                // Rotate: only check when file exceeds ~500KB
+                const stat = await fs.stat(eventsPath);
+                if (stat.size >= 512 * 1024) {
+                    const content = await fs.readFile(eventsPath, 'utf-8');
+                    const lines = content.trim().split('\n');
+                    if (lines.length > 2000) {
+                        await fs.writeFile(eventsPath, lines.slice(-2000).join('\n') + '\n');
+                    }
+                }
             }
             catch {
                 // Silent

package/dist/utils/config.d.ts

@@ -51,6 +51,10 @@ export declare function loadConfig(cwd: string): Promise<{
         };
         dependencies: {
             forbid: string[];
+            detect_unused: boolean;
+            detect_heavy_alternatives: boolean;
+            detect_duplicate_purpose: boolean;
+            unused_allowlist: string[];
             trusted_registry?: string | undefined;
         };
         architecture: {
@@ -218,6 +222,19 @@ export declare function loadConfig(cwd: string): Promise<{
             check_circular_triggers: boolean;
             check_auto_restart: boolean;
         };
+        style_drift: {
+            enabled: boolean;
+            deviation_threshold: number;
+            sample_size: number;
+            baseline_path: string;
+        };
+        logic_drift: {
+            enabled: boolean;
+            baseline_path: string;
+            track_operators: boolean;
+            track_branches: boolean;
+            track_returns: boolean;
+        };
     };
     hooks: {
         enabled: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/mcp",
-  "version": "4.3.6",
+  "version": "5.0.1",
   "description": "MCP server for AI code governance — OWASP LLM Top 10 (10/10), real-time hooks, 25+ security patterns, hallucinated import detection, multi-agent governance. Works with Claude, Cursor, Cline, Windsurf, Gemini. Industry presets for HIPAA, SOC2, FedRAMP.",
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -48,7 +48,7 @@
     "execa": "^8.0.1",
     "fs-extra": "^11.2.0",
     "yaml": "^2.8.2",
-    "@rigour-labs/core": "4.3.6"
+    "@rigour-labs/core": "5.0.1"
   },
   "devDependencies": {
     "@types/node": "^25.0.3",