@rigour-labs/mcp 5.0.1 → 5.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/README.md +47 -25
  2. package/dist/tools/deep-handlers.js +10 -10
  3. package/dist/tools/deep-handlers.test.js +1 -1
  4. package/dist/tools/definitions.js +3 -3
  5. package/dist/tools/quality-handlers.test.js +1 -1
  6. package/package.json +2 -2
package/README.md CHANGED
@@ -1,8 +1,8 @@
1
1
  # 🛡️ Rigour MCP Server
2
2
 
3
- **The Quality Gate for AI-Assisted Engineering.**
3
+ **AI Agent Governance via Model Context Protocol — quality gates, DLP, drift detection, and deep analysis.**
4
4
 
5
- Rigour is a local-first Model Context Protocol (MCP) server that forces AI agents (Claude, Cursor, Windsurf, etc.) to meet strict engineering standards before marking tasks as complete.
5
+ Rigour is a local-first MCP server that governs AI agents (Claude, Cursor, Cline, Windsurf) with deterministic quality gates, credential interception, and memory governance.
6
6
 
7
7
  [![Registry](https://img.shields.io/badge/MCP-Registry-brightgreen)](https://github.com/mcp)
8
8
  [![npm version](https://img.shields.io/npm/v/@rigour-labs/mcp?color=cyan)](https://www.npmjs.com/package/@rigour-labs/mcp)
@@ -11,54 +11,76 @@ Rigour is a local-first Model Context Protocol (MCP) server that forces AI agent
11
11
 
12
12
  ## 🚀 Overview
13
13
 
14
- Rigour moves code quality enforcement from the "Post-Commit" phase to the "In-Progress" phase. By running as an MCP server inside your editor, it provides the AI with a deterministic PASS/FAIL loop, preventing "Vibe Coding" and broken builds.
14
+ Rigour moves code quality enforcement from "Post-Commit" to "In-Progress." By running as an MCP server inside your editor, it provides the AI with a deterministic PASS/FAIL loop, preventing "Vibe Coding" and broken builds.
15
15
 
16
16
  ### Key Features:
17
- - **Quality Gates**: 23 deterministic checks for file size, complexity, hygiene, security, and AI-native drift detection.
18
- - **8-Language Support**: JS/TS, Python, Go, Ruby, C#/.NET, Rust, Java, and Kotlin — with stdlib whitelists, dependency manifest parsing, and project-relative import resolution.
17
+
18
+ - **27+ Quality Gates**: Deterministic checks for file size, complexity, hygiene, security, and AI-native drift detection.
19
+ - **8-Language Hallucination Detection**: JS/TS, Python, Go, Ruby, C#/.NET, Rust, Java, and Kotlin — with stdlib whitelists, dependency manifest parsing, and project-relative import resolution.
20
+ - **AI Agent DLP**: 29 credential patterns intercepted before agents see them (<50ms). Anti-evasion: unicode normalization, entropy detection, bidi stripping.
21
+ - **Memory & Skills Governance**: Blocks agent writes to native memory files (CLAUDE.md, .clinerules, .windsurf/memories/); forces DLP-scanned `rigour_remember` instead.
19
22
  - **Real-Time Hooks**: Sub-200ms file-write hooks for Claude Code, Cursor, Cline, and Windsurf — catches issues as the AI writes, not after CI.
20
- - **OWASP LLM Top 10**: Strong coverage on all 10 risks from the OWASP Top 10 for LLM-Generated Code, with 25+ security patterns.
21
- - **Two-Score System**: Separate AI Health Score and Structural Score with provenance tracking.
22
- - **Context Memory**: Persistent memory that tracks project rules and patterns across sessions.
23
- - **Pattern Reinvention Blocking**: Warns or blocks the AI when it tries to rewrite existing utilities.
24
- - **Security Audits**: Real-time CVE detection for dependencies the AI is suggesting.
25
- - **Multi-Agent Governance**: Agent registration, scope isolation, checkpoint supervision, and verified handoffs for multi-agent workflows.
23
+ - **Two-Score System**: Separate AI Health Score and Structural Score with provenance tracking (`ai-drift`, `traditional`, `security`, `governance`).
24
+ - **Deep Analysis**: Five-signal LLM pipeline (AST facts, embeddings, style fingerprints, logic baselines, dependency graphs) with deterministic verification.
25
+ - **Multi-Agent Governance**: Agent registration, scope isolation, checkpoint supervision, and verified handoffs.
26
26
  - **Industry Presets**: SOC2, HIPAA, FedRAMP-ready gate configurations.
27
- - **Local-First**: Deterministic gates run locally. If deep analysis is configured with a cloud provider, code context may be sent to that provider.
27
+ - **Local-First**: Deterministic gates run locally. Cloud deep analysis is opt-in BYOK.
28
28
 
29
29
  ---
30
30
 
31
- ## 🛠️ Available Tools
31
+ ## 🛠️ Available Tools (25)
32
32
 
33
- ### Core Tools
33
+ ### Core Quality Tools
34
34
 
35
35
  | Tool | Description |
36
36
  |:---|:---|
37
37
  | `rigour_check` | Runs all configured quality gates on the current workspace. |
38
- | `rigour_explain` | Explains why a specific gate failed and provides actionable fix instructions. |
38
+ | `rigour_explain` | Explains why a specific gate failed with actionable fix instructions. |
39
39
  | `rigour_status` | Quick PASS/FAIL check with JSON-friendly output for polling. |
40
40
  | `rigour_get_fix_packet` | Retrieves prioritized Fix Packet (v2) with severity and provenance. |
41
41
  | `rigour_list_gates` | Lists all configured quality gates and their thresholds. |
42
42
  | `rigour_get_config` | Returns the current rigour.yml configuration. |
43
43
  | `rigour_check_pattern` | Checks if a proposed code pattern already exists in the codebase. |
44
- | `rigour_remember` | Stores project-specific context or rules in Rigour's persistent memory. |
45
- | `rigour_recall` | Retrieves stored context to guide AI generation. |
46
- | `rigour_forget` | Removes a stored memory by key. |
47
44
  | `rigour_security_audit` | Runs a live CVE check on project dependencies. |
48
- | `rigour_run` | Executes a command under Rigour supervision with human arbitration. |
49
- | `rigour_run_supervised` | Full supervisor mode — iterative command + gate check loop. |
50
45
  | `rigour_review` | High-fidelity code review on a PR diff against all quality gates. |
51
46
 
52
- ### Real-Time Hooks (v3.0)
47
+ ### Memory & Context Tools
48
+
49
+ | Tool | Description |
50
+ |:---|:---|
51
+ | `rigour_remember` | DLP-gated persistent memory — scans values before storing. |
52
+ | `rigour_recall` | DLP-gated recall — blocks tainted memories on read. |
53
+ | `rigour_forget` | Removes a stored memory by key. |
54
+
55
+ ### Real-Time Hooks & DLP
56
+
57
+ | Tool | Description |
58
+ |:---|:---|
59
+ | `rigour_hooks_check` | Fast hook checker on specific files (<200ms). Also accepts `text` param for DLP mode — scans user input for credentials (AWS keys, API tokens, database URLs, private keys, JWTs) before agent processing. |
60
+ | `rigour_hooks_init` | Generate hook configs for Claude, Cursor, Cline, or Windsurf. Installs quality hooks + DLP pre-input hooks by default. Pass `dlp: false` to skip DLP. |
61
+
62
+ ### Deep Analysis
53
63
 
54
64
  | Tool | Description |
55
65
  |:---|:---|
56
- | `rigour_hooks_check` | Run fast hook checker on specific files (<100ms). Catches: hardcoded secrets, hallucinated imports, command injection, file size. |
57
- | `rigour_hooks_init` | Generate hook configs for Claude, Cursor, Cline, or Windsurf. Installs real-time checks on every file write. |
66
+ | `rigour_check_deep` | LLM-powered code review with five-signal extraction → verification pipeline. Local-first or cloud BYOK. |
67
+ | `rigour_deep_stats` | Score history, trend analysis, and top issues from SQLite storage. |
68
+
69
+ ### Supervisor & Execution
58
70
 
59
- ### Frontier Model Tools (v2.14+)
71
+ | Tool | Description |
72
+ |:---|:---|
73
+ | `rigour_run` | Executes a command under Rigour supervision with human arbitration. |
74
+ | `rigour_run_supervised` | Full supervisor mode — iterative command + gate check loop. |
75
+
76
+ ### Settings
77
+
78
+ | Tool | Description |
79
+ |:---|:---|
80
+ | `rigour_mcp_get_settings` | Get MCP runtime settings (.rigour/mcp-settings.json). |
81
+ | `rigour_mcp_set_settings` | Set MCP runtime settings (e.g., deep_default_mode). |
60
82
 
61
- For next-gen multi-agent workflows (Opus 4.6, GPT-5.3-Codex):
83
+ ### Multi-Agent Governance
62
84
 
63
85
  | Tool | Description |
64
86
  |:---|:---|
package/dist/tools/deep-handlers.js CHANGED
@@ -36,15 +36,15 @@ export async function handleCheckDeep(runner, cwd, config, args) {
36
36
  if (!isTestRuntime()) {
37
37
  try {
38
38
  const { openDatabase, insertScan, insertFindings } = await import('@rigour-labs/core');
39
- const db = openDatabase();
39
+ const db = await openDatabase();
40
40
  if (db) {
41
41
  const repoName = path.basename(cwd);
42
- const scanId = insertScan(db, repoName, report, {
42
+ const scanId = await insertScan(db, repoName, report, {
43
43
  deepTier: args.pro ? 'deep' : (execution.isLocal ? 'lite' : 'cloud'),
44
44
  deepModel: report.stats.deep?.model,
45
45
  });
46
- insertFindings(db, scanId, report.failures);
47
- db.close();
46
+ await insertFindings(db, scanId, report.failures);
47
+ await db.close();
48
48
  }
49
49
  }
50
50
  catch {
@@ -112,17 +112,17 @@ export async function handleCheckDeep(runner, cwd, config, args) {
112
112
  export async function handleDeepStats(cwd, limit = 10) {
113
113
  try {
114
114
  const { openDatabase, getRecentScans, getScoreTrendFromDB, getTopIssues } = await import('@rigour-labs/core');
115
- const db = openDatabase();
115
+ const db = await openDatabase();
116
116
  if (!db) {
117
117
  return {
118
118
  content: [{ type: "text", text: "SQLite storage not available. Run `rigour check --deep` first to generate scan data." }],
119
119
  };
120
120
  }
121
121
  const repoName = path.basename(cwd);
122
- const scans = getRecentScans(db, repoName, limit);
123
- const trend = getScoreTrendFromDB(db, repoName, limit);
124
- const topIssues = getTopIssues(db, repoName, 10);
125
- db.close();
122
+ const scans = await getRecentScans(db, repoName, limit);
123
+ const trend = await getScoreTrendFromDB(db, repoName, limit);
124
+ const topIssues = await getTopIssues(db, repoName, 10);
125
+ await db.close();
126
126
  if (scans.length === 0) {
127
127
  return {
128
128
  content: [{ type: "text", text: `No deep analysis scans found for "${repoName}". Run \`rigour check --deep\` first.` }],
@@ -148,7 +148,7 @@ export async function handleDeepStats(cwd, limit = 10) {
148
148
  // v5: Temporal Drift Report
149
149
  try {
150
150
  const { generateTemporalDriftReport, formatDriftSummary } = await import('@rigour-labs/core');
151
- const driftReport = generateTemporalDriftReport(cwd);
151
+ const driftReport = await generateTemporalDriftReport(cwd);
152
152
  if (driftReport && driftReport.totalScans >= 3) {
153
153
  text += `\n${'═'.repeat(60)}\n`;
154
154
  text += formatDriftSummary(driftReport);
package/dist/tools/deep-handlers.test.js CHANGED
@@ -10,7 +10,7 @@ describe('handleCheckDeep privacy routing', () => {
10
10
  score: 100,
11
11
  ai_health_score: 100,
12
12
  structural_score: 100,
13
- deep: { enabled: true, tier: 'lite', model: 'Qwen3.5-0.8B', total_ms: 1000 },
13
+ deep: { enabled: true, tier: 'lite', model: 'Qwen2.5-Coder-0.5B', total_ms: 1000 },
14
14
  },
15
15
  };
16
16
  it('reports local execution by default', async () => {
package/dist/tools/definitions.js CHANGED
@@ -34,7 +34,7 @@ export const TOOL_DEFINITIONS = [
34
34
  ...cwdParam(),
35
35
  files: { type: "array", items: { type: "string" }, description: "Optional file paths (relative to cwd) to limit scan scope for both deterministic and deep checks." },
36
36
  deep: { type: "string", enum: ["off", "quick", "full"], description: "Deep mode: 'off' (default), 'quick' (deep enabled with lite model), 'full' (deep enabled, combine with pro=true for full deep model)." },
37
- pro: { type: "boolean", description: "Use full deep model (Qwen2.5-Coder-1.5B) instead of lite (Qwen3.5-0.8B) when deep is enabled." },
37
+ pro: { type: "boolean", description: "Use full deep model (Qwen2.5-Coder-1.5B) instead of lite (Qwen2.5-Coder-0.5B) when deep is enabled." },
38
38
  apiKey: { type: "string", description: "Optional cloud API key for deep analysis." },
39
39
  provider: { type: "string", description: "Cloud provider for deep analysis (claude, openai, gemini, groq, mistral, together, deepseek, ollama, etc.)." },
40
40
  apiBaseUrl: { type: "string", description: "Custom API base URL for self-hosted/proxy deep endpoints." },
@@ -461,12 +461,12 @@ export const TOOL_DEFINITIONS = [
461
461
  // ─── Deep Analysis (v4.0+) ──────────────────────────────
462
462
  {
463
463
  name: "rigour_check_deep",
464
- description: "Run quality gates WITH deep LLM-powered analysis. Three-step pipeline: AST extracts facts → LLM interprets → AST verifies. Local-first by default (Qwen3.5-0.8B lite sidecar), or bring your own API key for any cloud provider.",
464
+ description: "Run quality gates WITH deep LLM-powered analysis. Three-step pipeline: AST extracts facts → LLM interprets → AST verifies. Local-first by default (Qwen2.5-Coder-0.5B lite sidecar), or bring your own API key for any cloud provider.",
465
465
  inputSchema: {
466
466
  type: "object",
467
467
  properties: {
468
468
  ...cwdParam(),
469
- pro: { type: "boolean", description: "Use full deep model (Qwen2.5-Coder-1.5B) instead of default lite model (Qwen3.5-0.8B)." },
469
+ pro: { type: "boolean", description: "Use full deep model (Qwen2.5-Coder-1.5B) instead of default lite model (Qwen2.5-Coder-0.5B)." },
470
470
  apiKey: { type: "string", description: "API key for cloud LLM provider. If provided, uses cloud instead of local sidecar." },
471
471
  provider: { type: "string", description: "Cloud provider name (e.g., 'claude', 'openai', 'gemini', 'groq', 'mistral', 'together', 'fireworks', 'deepseek', 'perplexity', 'ollama', 'lmstudio'). Default: 'claude' when apiKey is provided." },
472
472
  apiBaseUrl: { type: "string", description: "Custom API base URL for self-hosted or proxy endpoints." },
package/dist/tools/quality-handlers.test.js CHANGED
@@ -23,7 +23,7 @@ describe('handleCheck deep routing', () => {
23
23
  ...baseReport,
24
24
  stats: {
25
25
  ...baseReport.stats,
26
- deep: { enabled: true, tier: 'lite', model: 'Qwen3.5-0.8B' },
26
+ deep: { enabled: true, tier: 'lite', model: 'Qwen2.5-Coder-0.5B' },
27
27
  },
28
28
  });
29
29
  const runner = { run };
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@rigour-labs/mcp",
3
- "version": "5.0.1",
3
+ "version": "5.1.1",
4
4
  "description": "MCP server for AI code governance — OWASP LLM Top 10 (10/10), real-time hooks, 25+ security patterns, hallucinated import detection, multi-agent governance. Works with Claude, Cursor, Cline, Windsurf, Gemini. Industry presets for HIPAA, SOC2, FedRAMP.",
5
5
  "license": "MIT",
6
6
  "homepage": "https://rigour.run",
@@ -48,7 +48,7 @@
48
48
  "execa": "^8.0.1",
49
49
  "fs-extra": "^11.2.0",
50
50
  "yaml": "^2.8.2",
51
- "@rigour-labs/core": "5.0.1"
51
+ "@rigour-labs/core": "5.1.1"
52
52
  },
53
53
  "devDependencies": {
54
54
  "@types/node": "^25.0.3",