@rigour-labs/mcp 5.4.0 → 5.5.1

package/README.md

@@ -2,7 +2,7 @@
 
 **AI Agent Governance via Model Context Protocol — quality gates, DLP, drift detection, and deep analysis.**
 
-Rigour is a local-first MCP server that governs AI agents (Claude, Cursor, Cline, Windsurf) with deterministic quality gates, credential interception, and memory governance.
+Rigour is a local-first MCP server that governs AI agents (Claude, Cursor, Cline, Windsurf) with deterministic quality gates, credential warnings, and memory governance.
 
 [![Registry](https://img.shields.io/badge/MCP-Registry-brightgreen)](https://github.com/mcp)
 [![npm version](https://img.shields.io/npm/v/@rigour-labs/mcp?color=cyan)](https://www.npmjs.com/package/@rigour-labs/mcp)

package/dist/index.js

@@ -34,7 +34,7 @@ import { handleContextStats, handleTaskCost, handleCacheStats, handleContextExpl
 import { handleIndex } from './tools/index-handlers.js';
 import { recordContextEvent, estimateTokenCount } from '@rigour-labs/core';
 // ─── Server Setup ─────────────────────────────────────────────────
-const server = new Server({ name: "rigour-mcp", version: getMcpVersion('5.3.2') }, { capabilities: { tools: {}, prompts: {}, logging: {}, resources: {} } });
+const server = new Server({ name: "rigour-mcp", version: getMcpVersion('5.5.0') }, { capabilities: { tools: {}, prompts: {}, logging: {}, resources: {} } });
 // Bind server for logging notifications from handlers
 bindServer(server);
 // ─── Tool Listing ─────────────────────────────────────────────────

package/dist/tools/cli-command.d.ts

@@ -0,0 +1 @@
+export declare function getPinnedCheckerCommand(): string;

package/dist/tools/cli-command.js

@@ -0,0 +1,30 @@
+import { readJsonSync } from 'fs-extra';
+import path from 'path';
+import { fileURLToPath } from 'url';
+function readVersion(packagePath) {
+    try {
+        const pkg = readJsonSync(packagePath);
+        const version = pkg.version?.trim();
+        return version && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)
+            ? version
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function getPinnedCheckerCommand() {
+    const thisDir = path.dirname(fileURLToPath(import.meta.url));
+    const packageCandidates = [
+        path.resolve(thisDir, '../../../cli/package.json'),
+        path.resolve(thisDir, '../../../rigour-cli/package.json'),
+        path.resolve(thisDir, '../../package.json'),
+    ];
+    const version = packageCandidates
+        .map(readVersion)
+        .find((candidate) => candidate !== null);
+    if (!version) {
+        throw new Error('Unable to resolve a compatible Rigour CLI version');
+    }
+    return `npx --yes @rigour-labs/cli@${version} hooks check`;
+}

package/dist/tools/context-handlers.js

@@ -11,7 +11,7 @@
 import fs from 'fs-extra';
 import path from 'path';
 import { createHash } from 'crypto';
-import { getTaskContextStats, getTaskCostStats, getCacheStats, explainContext, getSemanticQueryCache, setSemanticQueryCache, estimateTokenCount, } from '@rigour-labs/core';
+import { getTaskContextStats, getTaskCostStats, getCacheStats, explainContext, getSemanticQueryCache, setSemanticQueryCache, findRelatedSemanticQueryCache, filterExistingEditScope, estimateTokenCount, } from '@rigour-labs/core';
 import { loadPatternIndex, getDefaultIndexPath, generateEmbedding, semanticSearch, } from '@rigour-labs/core/pattern-index';
 import { buildTelemetryMeta, getWorkspaceCommitSha } from '../utils/context-telemetry.js';
 import { appendContextFooter } from '../utils/context-footer.js';
@@ -122,26 +122,88 @@ function textMatchPatterns(query, patterns, limit) {
         .slice(0, limit)
         .map(s => s.pattern);
 }
+async function serveCachedScope(cached, opts) {
+    const originalScope = cached.editScope || [];
+    const { valid, missing } = await filterExistingEditScope(originalScope, opts.cwd);
+    // Quality guard: require majority of scoped files still present, else recompute.
+    if (originalScope.length > 0) {
+        const retention = valid.length / originalScope.length;
+        if (valid.length === 0 || retention < 0.5) {
+            return null;
+        }
+    }
+    const validSet = new Set(valid);
+    const validationScope = (cached.validationScope || []).filter((item) => {
+        // Keep entries that don't look like file paths, or whose path still exists.
+        const maybePath = item.replace(/^review\s+/i, '').trim();
+        if (!maybePath.includes('/') && !maybePath.endsWith('.ts') && !maybePath.endsWith('.tsx')) {
+            return true;
+        }
+        return validSet.has(maybePath) || valid.some((f) => item.includes(f));
+    });
+    const evidence = (cached.evidence || []).filter((line) => {
+        if (missing.length === 0)
+            return true;
+        return !missing.some((m) => line.includes(m));
+    });
+    const payload = {
+        ...cached,
+        editScope: valid,
+        validationScope,
+        evidence,
+        staleFilesDropped: missing,
+        cacheNote: opts.note,
+    };
+    const cachedText = JSON.stringify(payload, null, 2);
+    const telemetry = scopeTelemetryMeta({
+        candidateText: opts.fullIndexCandidate,
+        returnedText: cachedText,
+        cacheStatus: opts.cacheStatus,
+        query: opts.query,
+        taskId: opts.taskId,
+        agentId: opts.agentId,
+    });
+    const label = opts.cacheStatus === 'partial-hit'
+        ? 'CONTEXT SCOPE (partial cache)'
+        : 'CONTEXT SCOPE (cached)';
+    const text = `${label}\n\n${cachedText}`;
+    return {
+        content: [{ type: 'text', text: appendContextFooter(text, telemetry, 'rigour_check_pattern before creating code') }],
+        _telemetry: telemetry,
+    };
+}
 export async function handleContextScope(cwd, query, limit = 10, taskId, agentId) {
     const commitSha = await getWorkspaceCommitSha(cwd);
     const indexPath = getDefaultIndexPath(cwd);
     const fullIndexCandidate = `Full repository scan for: ${query}`;
     const cached = await getSemanticQueryCache(query, commitSha, cwd);
     if (cached) {
-        const cachedText = JSON.stringify(cached, null, 2);
-        const telemetry = scopeTelemetryMeta({
-            candidateText: fullIndexCandidate,
-            returnedText: cachedText,
-            cacheStatus: 'semantic-hit',
+        const served = await serveCachedScope(cached, {
+            cwd,
             query,
+            fullIndexCandidate,
+            // Exact query+commit key hit — content-addressed semantic layer.
+            cacheStatus: 'exact-hit',
             taskId,
             agentId,
         });
-        const text = `CONTEXT SCOPE (cached)\n\n${cachedText}`;
-        return {
-            content: [{ type: 'text', text: appendContextFooter(text, telemetry, 'rigour_check_pattern before creating code') }],
-            _telemetry: telemetry,
-        };
+        if (served)
+            return served;
+    }
+    // Quality-safe power-up: reuse highly overlapping queries at the same commit only.
+    const related = await findRelatedSemanticQueryCache(query, commitSha, cwd);
+    if (related) {
+        const served = await serveCachedScope(related.entry, {
+            cwd,
+            query,
+            fullIndexCandidate,
+            cacheStatus: 'partial-hit',
+            taskId,
+            agentId,
+            note: `Reused related query at same commit (overlap ${(related.overlap * 100).toFixed(0)}%): "${related.sourceQuery}"`,
+        });
+        if (served)
+            return served;
     }
     const index = await loadPatternIndex(indexPath);
     if (!index) {
@@ -165,12 +227,16 @@ export async function handleContextScope(cwd, query, limit = 10, taskId, agentId
         try {
             const queryVector = await generateEmbedding(query);
             const similarities = semanticSearch(queryVector, index.patterns);
+            // Slightly stricter threshold — quality over vanity hit-rate; partial cache covers near-queries.
             matched = index.patterns
                 .map((p, i) => ({ pattern: p, similarity: similarities[i] ?? 0 }))
-                .filter(r => r.similarity > 0.3)
+                .filter(r => r.similarity > 0.4)
                 .sort((a, b) => b.similarity - a.similarity)
                 .slice(0, limit)
                 .map(r => r.pattern);
+            if (matched.length === 0) {
+                matched = textMatchPatterns(query, index.patterns, limit);
+            }
         }
         catch {
             matched = textMatchPatterns(query, index.patterns, limit);

package/dist/tools/definitions.js

@@ -441,7 +441,7 @@ export const TOOL_DEFINITIONS = [
     },
     {
         name: "rigour_hooks_init",
-        description: "Generate hook configs for AI coding tools (Claude, Cursor, Cline, Windsurf). Installs real-time quality checks AND DLP (credential interception) hooks by default. DLP hooks intercept credentials in user input BEFORE they reach the AI agent. Pass dlp=false to disable DLP hooks only.",
+        description: "Generate hook configs for AI coding tools (Claude, Cursor, Cline, Windsurf). Installs real-time quality checks and non-blocking DLP credential warnings by default. Pass dlp=false to disable DLP hooks only.",
         inputSchema: {
             type: "object",
             properties: {
@@ -449,7 +449,7 @@ export const TOOL_DEFINITIONS = [
                 tool: { type: "string", description: "Target tool: 'claude', 'cursor', 'cline', or 'windsurf'." },
                 force: { type: "boolean", description: "Overwrite existing hook files (default: false)." },
                 dryRun: { type: "boolean", description: "Preview changes without writing files (default: false)." },
-                dlp: { type: "boolean", description: "Generate DLP (Data Loss Prevention) hooks for pre-input credential interception (default: true). Set false to skip DLP hooks." },
+                dlp: { type: "boolean", description: "Generate DLP hooks for pre-input credential warnings (default: true). Set false to skip DLP hooks." },
             },
             required: ["cwd", "tool"],
         },

package/dist/tools/dlp-handler.d.ts

@@ -4,7 +4,7 @@
  * Handlers for: rigour_input_scan, rigour_dlp_init
  *
  * AI Agent Data Loss Prevention — scans user input for credentials
- * before they reach AI agents.
+ * before agent actions.
  *
  * @since v4.2.0 — AI Agent DLP layer
  */
@@ -19,18 +19,18 @@ type ToolResult = {
  * rigour_input_scan — Scan text for credentials before agent processing.
  *
  * This is the core DLP tool. Agents can call this to validate user input
- * contains no secrets before processing it.
+ * may contain secrets before processing it.
  */
 export declare function handleInputScan(cwd: string, text: string, agent?: string, block?: boolean): Promise<ToolResult>;
 /**
  * rigour_dlp_init — Generate DLP hook configs for AI coding tools.
  *
- * Creates pre-input hooks that intercept credentials before they
- * reach the AI agent.
+ * Creates pre-input hooks that warn about possible credentials before
+ * agent actions.
  */
 export declare function handleDLPInit(cwd: string, tool: string, force?: boolean, dryRun?: boolean): Promise<ToolResult>;
 /**
- * rigour_dlp_audit — Query the DLP audit log for recent credential interceptions.
+ * rigour_dlp_audit — Query the DLP audit log for recent credential detections.
  */
 export declare function handleDLPAudit(cwd: string, limit?: number): Promise<ToolResult>;
 export {};

package/dist/tools/dlp-handler.js

@@ -4,18 +4,20 @@
  * Handlers for: rigour_input_scan, rigour_dlp_init
  *
  * AI Agent Data Loss Prevention — scans user input for credentials
- * before they reach AI agents.
+ * before agent actions.
  *
  * @since v4.2.0 — AI Agent DLP layer
  */
 import { scanInputForCredentials, formatDLPAlert, createDLPAuditEntry, generateDLPHookFiles } from '@rigour-labs/core';
 import fs from 'fs-extra';
 import path from 'path';
+import { getPinnedCheckerCommand } from './cli-command.js';
+import { formatHookWriteResult, writeHookFiles } from './hook-file-writer.js';
 /**
  * rigour_input_scan — Scan text for credentials before agent processing.
  *
  * This is the core DLP tool. Agents can call this to validate user input
- * contains no secrets before processing it.
+ * may contain secrets before processing it.
  */
 export async function handleInputScan(cwd, text, agent, block) {
     if (!text || text.trim().length === 0) {
@@ -28,7 +30,7 @@ export async function handleInputScan(cwd, text, agent, block) {
     }
     const result = scanInputForCredentials(text, {
         enabled: true,
-        block_on_detection: block ?? true,
+        block_on_detection: block ?? false,
         audit_log: true,
     });
     // Log to audit trail
@@ -66,13 +68,13 @@ export async function handleInputScan(cwd, text, agent, block) {
 /**
  * rigour_dlp_init — Generate DLP hook configs for AI coding tools.
  *
- * Creates pre-input hooks that intercept credentials before they
- * reach the AI agent.
+ * Creates pre-input hooks that warn about possible credentials before
+ * agent actions.
  */
 export async function handleDLPInit(cwd, tool, force = false, dryRun = false) {
     try {
         const hookTool = tool;
-        const checkerCommand = 'rigour hooks check';
+        const checkerCommand = getPinnedCheckerCommand();
         const files = generateDLPHookFiles(hookTool, checkerCommand);
         if (dryRun) {
             const preview = files.map(f => `${f.path}:\n${f.content.slice(0, 200)}...`).join('\n\n');
@@ -83,30 +85,12 @@ export async function handleDLPInit(cwd, tool, force = false, dryRun = false) {
                     }],
             };
         }
-        const written = [];
-        const skipped = [];
-        for (const file of files) {
-            const fullPath = path.join(cwd, file.path);
-            if (!force && await fs.pathExists(fullPath)) {
-                skipped.push(file.path);
-                continue;
-            }
-            await fs.ensureDir(path.dirname(fullPath));
-            await fs.writeFile(fullPath, file.content);
-            if (file.executable) {
-                await fs.chmod(fullPath, 0o755);
-            }
-            written.push(file.path);
-        }
-        const parts = [];
-        if (written.length > 0)
-            parts.push(`✓ Created: ${written.join(', ')}`);
-        if (skipped.length > 0)
-            parts.push(`⊘ Skipped (exists): ${skipped.join(', ')}. Use force=true to overwrite.`);
+        const writeResult = await writeHookFiles(cwd, files, force);
+        const parts = formatHookWriteResult(writeResult);
         parts.push(`Tool: ${tool}`);
-        parts.push('DLP Protection: AWS keys, API tokens, database URLs, private keys, JWTs, passwords');
+        parts.push('DLP warnings: AWS keys, API tokens, database URLs, private keys, JWTs, passwords');
         parts.push('');
-        parts.push('🛑 Credentials will now be intercepted BEFORE reaching the AI agent.');
+        parts.push('⚠ Possible credentials will be reported before agent actions.');
         return {
             content: [{ type: 'text', text: parts.join('\n') }],
         };
@@ -122,7 +106,7 @@ export async function handleDLPInit(cwd, tool, force = false, dryRun = false) {
     }
 }
 /**
- * rigour_dlp_audit — Query the DLP audit log for recent credential interceptions.
+ * rigour_dlp_audit — Query the DLP audit log for recent credential detections.
  */
 export async function handleDLPAudit(cwd, limit = 20) {
     try {

package/dist/tools/hook-file-writer.d.ts

@@ -0,0 +1,14 @@
+interface HookFile {
+    path: string;
+    content: string;
+    executable?: boolean;
+}
+export declare function mergeHookFiles(files: HookFile[]): HookFile[];
+export interface HookWriteResult {
+    written: string[];
+    skipped: string[];
+    incompatible: string[];
+}
+export declare function writeHookFiles(cwd: string, files: HookFile[], force: boolean): Promise<HookWriteResult>;
+export declare function formatHookWriteResult(result: HookWriteResult): string[];
+export {};

package/dist/tools/hook-file-writer.js

@@ -0,0 +1,71 @@
+import fs from 'fs-extra';
+import path from 'path';
+function parseHookConfig(content, filePath) {
+    try {
+        return JSON.parse(content);
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`Cannot merge generated hook config ${filePath}: ${reason}`);
+    }
+}
+export function mergeHookFiles(files) {
+    const merged = new Map();
+    for (const file of files) {
+        const existing = merged.get(file.path);
+        if (!existing) {
+            merged.set(file.path, file);
+            continue;
+        }
+        const existingConfig = parseHookConfig(existing.content, file.path);
+        const nextConfig = parseHookConfig(file.content, file.path);
+        merged.set(file.path, {
+            ...existing,
+            content: JSON.stringify({
+                ...existingConfig,
+                ...nextConfig,
+                hooks: { ...existingConfig.hooks, ...nextConfig.hooks },
+            }, null, 2),
+            executable: existing.executable || file.executable,
+        });
+    }
+    return [...merged.values()];
+}
+export async function writeHookFiles(cwd, files, force) {
+    const result = { written: [], skipped: [], incompatible: [] };
+    for (const file of files) {
+        const fullPath = path.join(cwd, file.path);
+        if (!force && await fs.pathExists(fullPath)) {
+            result.skipped.push(file.path);
+            continue;
+        }
+        try {
+            await fs.ensureDir(path.dirname(fullPath));
+            await fs.writeFile(fullPath, file.content);
+            if (file.executable)
+                await fs.chmod(fullPath, 0o755);
+            result.written.push(file.path);
+        }
+        catch (error) {
+            const code = error instanceof Error && 'code' in error
+                ? String(error.code)
+                : '';
+            if (code !== 'ENOTDIR' && code !== 'EEXIST')
+                throw error;
+            result.incompatible.push(file.path);
+        }
+    }
+    return result;
+}
+export function formatHookWriteResult(result) {
+    const parts = [];
+    if (result.written.length > 0)
+        parts.push(`✓ Created: ${result.written.join(', ')}`);
+    if (result.skipped.length > 0) {
+        parts.push(`⊘ Skipped (exists): ${result.skipped.join(', ')}. Use force=true to overwrite.`);
+    }
+    if (result.incompatible.length > 0) {
+        parts.push(`⚠ Not configured (parent path is a file): ${result.incompatible.join(', ')}`);
+    }
+    return parts;
+}

package/dist/tools/hooks-handler.d.ts

@@ -18,7 +18,7 @@ export declare function handleHooksCheck(cwd: string, files: string[], timeout?:
  * rigour_hooks_init — Generate hook configs for AI coding tools.
  *
  * NEW in v4.2.0: When `dlp` param is true, also generates pre-input
- * DLP hooks that intercept credentials before agent processing.
+ * DLP hooks that warn about possible credentials before agent processing.
  */
 export declare function handleHooksInit(cwd: string, tool: string, force?: boolean, dryRun?: boolean, dlp?: boolean): Promise<ToolResult>;
 export {};

package/dist/tools/hooks-handler.js

@@ -5,12 +5,14 @@
  * Now includes DLP (Data Loss Prevention) capabilities.
  *
  * @since v3.0.0 — real-time hooks for AI coding tools
- * @since v4.2.0 — AI Agent DLP layer (credential interception)
+ * @since v4.2.0 — AI Agent DLP warning layer
  */
 import { runHookChecker, generateHookFiles } from "@rigour-labs/core";
 import { scanInputForCredentials, formatDLPAlert, createDLPAuditEntry, generateDLPHookFiles } from "@rigour-labs/core";
 import fs from "fs-extra";
 import path from "path";
+import { getPinnedCheckerCommand } from "./cli-command.js";
+import { formatHookWriteResult, mergeHookFiles, writeHookFiles } from "./hook-file-writer.js";
 /**
  * rigour_hooks_check — Run the fast hook checker on specific files.
  * This is the same check that runs inside IDE hooks (Claude, Cursor, Cline, Windsurf).
@@ -24,7 +26,7 @@ export async function handleHooksCheck(cwd, files, timeout, text, agent) {
     if (text) {
         const result = scanInputForCredentials(text, {
             enabled: true,
-            block_on_detection: true,
+            block_on_detection: false,
             audit_log: true,
         });
         // Log to audit trail (with rotation to prevent unbounded growth)
@@ -92,17 +94,17 @@ export async function handleHooksCheck(cwd, files, timeout, text, agent) {
  * rigour_hooks_init — Generate hook configs for AI coding tools.
  *
  * NEW in v4.2.0: When `dlp` param is true, also generates pre-input
- * DLP hooks that intercept credentials before agent processing.
+ * DLP hooks that warn about possible credentials before agent processing.
  */
 export async function handleHooksInit(cwd, tool, force = false, dryRun = false, dlp = true) {
     try {
         const hookTool = tool;
-        const checkerCommand = 'rigour hooks check';
+        const checkerCommand = getPinnedCheckerCommand();
         // Generate post-output hooks (existing)
         const files = generateHookFiles(hookTool, checkerCommand);
         // Generate DLP pre-input hooks (new)
         const dlpFiles = dlp ? generateDLPHookFiles(hookTool, checkerCommand) : [];
-        const allFiles = [...files, ...dlpFiles];
+        const allFiles = mergeHookFiles([...files, ...dlpFiles]);
         if (dryRun) {
             const preview = allFiles.map(f => `${f.path}:\n${f.content.slice(0, 300)}...`).join('\n\n');
             return {
@@ -112,32 +114,14 @@ export async function handleHooksInit(cwd, tool, force = false, dryRun = false,
                     }],
             };
         }
-        const written = [];
-        const skipped = [];
-        for (const file of allFiles) {
-            const fullPath = path.join(cwd, file.path);
-            if (!force && await fs.pathExists(fullPath)) {
-                skipped.push(file.path);
-                continue;
-            }
-            await fs.ensureDir(path.dirname(fullPath));
-            await fs.writeFile(fullPath, file.content);
-            if (file.executable) {
-                await fs.chmod(fullPath, 0o755);
-            }
-            written.push(file.path);
-        }
-        const parts = [];
-        if (written.length > 0)
-            parts.push(`✓ Created: ${written.join(', ')}`);
-        if (skipped.length > 0)
-            parts.push(`⊘ Skipped (exists): ${skipped.join(', ')}. Use force=true to overwrite.`);
+        const writeResult = await writeHookFiles(cwd, allFiles, force);
+        const parts = formatHookWriteResult(writeResult);
         parts.push(`Tool: ${tool}`);
         parts.push('Checks: file-size, security-patterns, hallucinated-imports, command-injection');
         if (dlp) {
             parts.push('');
-            parts.push('🛑 DLP Protection: AWS keys, API tokens, database URLs, private keys, JWTs, passwords');
-            parts.push('Credentials will be intercepted BEFORE reaching the AI agent.');
+            parts.push('⚠ DLP warnings: AWS keys, API tokens, database URLs, private keys, JWTs, passwords');
+            parts.push('Possible credentials will be reported before agent actions.');
         }
         return {
             content: [{ type: "text", text: parts.join('\n') }],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/mcp",
-  "version": "5.4.0",
+  "version": "5.5.1",
   "description": "MCP server + live dashboard for AI code governance — OWASP LLM Top 10 (10/10), real-time MCP App UI, 25+ security patterns, Bayesian learning Brain, hallucinated import detection, multi-agent governance. Works with Claude, Cursor, VS Code, ChatGPT, Goose, Windsurf. Industry presets for HIPAA, SOC2, FedRAMP.",
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -62,7 +62,7 @@
     "execa": "^8.0.1",
     "fs-extra": "^11.2.0",
     "yaml": "^2.8.2",
-    "@rigour-labs/core": "5.4.0"
+    "@rigour-labs/core": "5.5.1"
   },
   "devDependencies": {
     "@types/node": "^25.0.3",