@rigour-labs/mcp 5.5.0 → 5.5.1

package/README.md

@@ -2,7 +2,7 @@
 
 **AI Agent Governance via Model Context Protocol — quality gates, DLP, drift detection, and deep analysis.**
 
-Rigour is a local-first MCP server that governs AI agents (Claude, Cursor, Cline, Windsurf) with deterministic quality gates, credential interception, and memory governance.
+Rigour is a local-first MCP server that governs AI agents (Claude, Cursor, Cline, Windsurf) with deterministic quality gates, credential warnings, and memory governance.
 
 [![Registry](https://img.shields.io/badge/MCP-Registry-brightgreen)](https://github.com/mcp)
 [![npm version](https://img.shields.io/npm/v/@rigour-labs/mcp?color=cyan)](https://www.npmjs.com/package/@rigour-labs/mcp)

package/dist/tools/cli-command.d.ts

@@ -0,0 +1 @@
+export declare function getPinnedCheckerCommand(): string;

package/dist/tools/cli-command.js

@@ -0,0 +1,30 @@
+import { readJsonSync } from 'fs-extra';
+import path from 'path';
+import { fileURLToPath } from 'url';
+function readVersion(packagePath) {
+    try {
+        const pkg = readJsonSync(packagePath);
+        const version = pkg.version?.trim();
+        return version && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)
+            ? version
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function getPinnedCheckerCommand() {
+    const thisDir = path.dirname(fileURLToPath(import.meta.url));
+    const packageCandidates = [
+        path.resolve(thisDir, '../../../cli/package.json'),
+        path.resolve(thisDir, '../../../rigour-cli/package.json'),
+        path.resolve(thisDir, '../../package.json'),
+    ];
+    const version = packageCandidates
+        .map(readVersion)
+        .find((candidate) => candidate !== null);
+    if (!version) {
+        throw new Error('Unable to resolve a compatible Rigour CLI version');
+    }
+    return `npx --yes @rigour-labs/cli@${version} hooks check`;
+}

package/dist/tools/definitions.js

@@ -441,7 +441,7 @@ export const TOOL_DEFINITIONS = [
     },
     {
         name: "rigour_hooks_init",
-        description: "Generate hook configs for AI coding tools (Claude, Cursor, Cline, Windsurf). Installs real-time quality checks AND DLP (credential interception) hooks by default. DLP hooks intercept credentials in user input BEFORE they reach the AI agent. Pass dlp=false to disable DLP hooks only.",
+        description: "Generate hook configs for AI coding tools (Claude, Cursor, Cline, Windsurf). Installs real-time quality checks and non-blocking DLP credential warnings by default. Pass dlp=false to disable DLP hooks only.",
         inputSchema: {
             type: "object",
             properties: {
@@ -449,7 +449,7 @@ export const TOOL_DEFINITIONS = [
                 tool: { type: "string", description: "Target tool: 'claude', 'cursor', 'cline', or 'windsurf'." },
                 force: { type: "boolean", description: "Overwrite existing hook files (default: false)." },
                 dryRun: { type: "boolean", description: "Preview changes without writing files (default: false)." },
-                dlp: { type: "boolean", description: "Generate DLP (Data Loss Prevention) hooks for pre-input credential interception (default: true). Set false to skip DLP hooks." },
+                dlp: { type: "boolean", description: "Generate DLP hooks for pre-input credential warnings (default: true). Set false to skip DLP hooks." },
             },
             required: ["cwd", "tool"],
         },

package/dist/tools/dlp-handler.d.ts

@@ -4,7 +4,7 @@
  * Handlers for: rigour_input_scan, rigour_dlp_init
  *
  * AI Agent Data Loss Prevention — scans user input for credentials
- * before they reach AI agents.
+ * before agent actions.
  *
  * @since v4.2.0 — AI Agent DLP layer
  */
@@ -19,18 +19,18 @@ type ToolResult = {
  * rigour_input_scan — Scan text for credentials before agent processing.
  *
  * This is the core DLP tool. Agents can call this to validate user input
- * contains no secrets before processing it.
+ * may contain secrets before processing it.
  */
 export declare function handleInputScan(cwd: string, text: string, agent?: string, block?: boolean): Promise<ToolResult>;
 /**
  * rigour_dlp_init — Generate DLP hook configs for AI coding tools.
  *
- * Creates pre-input hooks that intercept credentials before they
- * reach the AI agent.
+ * Creates pre-input hooks that warn about possible credentials before
+ * agent actions.
  */
 export declare function handleDLPInit(cwd: string, tool: string, force?: boolean, dryRun?: boolean): Promise<ToolResult>;
 /**
- * rigour_dlp_audit — Query the DLP audit log for recent credential interceptions.
+ * rigour_dlp_audit — Query the DLP audit log for recent credential detections.
  */
 export declare function handleDLPAudit(cwd: string, limit?: number): Promise<ToolResult>;
 export {};

package/dist/tools/dlp-handler.js

@@ -4,18 +4,20 @@
  * Handlers for: rigour_input_scan, rigour_dlp_init
  *
  * AI Agent Data Loss Prevention — scans user input for credentials
- * before they reach AI agents.
+ * before agent actions.
  *
  * @since v4.2.0 — AI Agent DLP layer
  */
 import { scanInputForCredentials, formatDLPAlert, createDLPAuditEntry, generateDLPHookFiles } from '@rigour-labs/core';
 import fs from 'fs-extra';
 import path from 'path';
+import { getPinnedCheckerCommand } from './cli-command.js';
+import { formatHookWriteResult, writeHookFiles } from './hook-file-writer.js';
 /**
  * rigour_input_scan — Scan text for credentials before agent processing.
  *
  * This is the core DLP tool. Agents can call this to validate user input
- * contains no secrets before processing it.
+ * may contain secrets before processing it.
  */
 export async function handleInputScan(cwd, text, agent, block) {
     if (!text || text.trim().length === 0) {
@@ -28,7 +30,7 @@ export async function handleInputScan(cwd, text, agent, block) {
     }
     const result = scanInputForCredentials(text, {
         enabled: true,
-        block_on_detection: block ?? true,
+        block_on_detection: block ?? false,
         audit_log: true,
     });
     // Log to audit trail
@@ -66,13 +68,13 @@ export async function handleInputScan(cwd, text, agent, block) {
 /**
  * rigour_dlp_init — Generate DLP hook configs for AI coding tools.
  *
- * Creates pre-input hooks that intercept credentials before they
- * reach the AI agent.
+ * Creates pre-input hooks that warn about possible credentials before
+ * agent actions.
  */
 export async function handleDLPInit(cwd, tool, force = false, dryRun = false) {
     try {
         const hookTool = tool;
-        const checkerCommand = 'rigour hooks check';
+        const checkerCommand = getPinnedCheckerCommand();
         const files = generateDLPHookFiles(hookTool, checkerCommand);
         if (dryRun) {
             const preview = files.map(f => `${f.path}:\n${f.content.slice(0, 200)}...`).join('\n\n');
@@ -83,30 +85,12 @@ export async function handleDLPInit(cwd, tool, force = false, dryRun = false) {
                     }],
             };
         }
-        const written = [];
-        const skipped = [];
-        for (const file of files) {
-            const fullPath = path.join(cwd, file.path);
-            if (!force && await fs.pathExists(fullPath)) {
-                skipped.push(file.path);
-                continue;
-            }
-            await fs.ensureDir(path.dirname(fullPath));
-            await fs.writeFile(fullPath, file.content);
-            if (file.executable) {
-                await fs.chmod(fullPath, 0o755);
-            }
-            written.push(file.path);
-        }
-        const parts = [];
-        if (written.length > 0)
-            parts.push(`✓ Created: ${written.join(', ')}`);
-        if (skipped.length > 0)
-            parts.push(`⊘ Skipped (exists): ${skipped.join(', ')}. Use force=true to overwrite.`);
+        const writeResult = await writeHookFiles(cwd, files, force);
+        const parts = formatHookWriteResult(writeResult);
         parts.push(`Tool: ${tool}`);
-        parts.push('DLP Protection: AWS keys, API tokens, database URLs, private keys, JWTs, passwords');
+        parts.push('DLP warnings: AWS keys, API tokens, database URLs, private keys, JWTs, passwords');
         parts.push('');
-        parts.push('🛑 Credentials will now be intercepted BEFORE reaching the AI agent.');
+        parts.push('⚠ Possible credentials will be reported before agent actions.');
         return {
             content: [{ type: 'text', text: parts.join('\n') }],
         };
@@ -122,7 +106,7 @@ export async function handleDLPInit(cwd, tool, force = false, dryRun = false) {
     }
 }
 /**
- * rigour_dlp_audit — Query the DLP audit log for recent credential interceptions.
+ * rigour_dlp_audit — Query the DLP audit log for recent credential detections.
  */
 export async function handleDLPAudit(cwd, limit = 20) {
     try {

package/dist/tools/hook-file-writer.d.ts

@@ -0,0 +1,14 @@
+interface HookFile {
+    path: string;
+    content: string;
+    executable?: boolean;
+}
+export declare function mergeHookFiles(files: HookFile[]): HookFile[];
+export interface HookWriteResult {
+    written: string[];
+    skipped: string[];
+    incompatible: string[];
+}
+export declare function writeHookFiles(cwd: string, files: HookFile[], force: boolean): Promise<HookWriteResult>;
+export declare function formatHookWriteResult(result: HookWriteResult): string[];
+export {};

package/dist/tools/hook-file-writer.js

@@ -0,0 +1,71 @@
+import fs from 'fs-extra';
+import path from 'path';
+function parseHookConfig(content, filePath) {
+    try {
+        return JSON.parse(content);
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`Cannot merge generated hook config ${filePath}: ${reason}`);
+    }
+}
+export function mergeHookFiles(files) {
+    const merged = new Map();
+    for (const file of files) {
+        const existing = merged.get(file.path);
+        if (!existing) {
+            merged.set(file.path, file);
+            continue;
+        }
+        const existingConfig = parseHookConfig(existing.content, file.path);
+        const nextConfig = parseHookConfig(file.content, file.path);
+        merged.set(file.path, {
+            ...existing,
+            content: JSON.stringify({
+                ...existingConfig,
+                ...nextConfig,
+                hooks: { ...existingConfig.hooks, ...nextConfig.hooks },
+            }, null, 2),
+            executable: existing.executable || file.executable,
+        });
+    }
+    return [...merged.values()];
+}
+export async function writeHookFiles(cwd, files, force) {
+    const result = { written: [], skipped: [], incompatible: [] };
+    for (const file of files) {
+        const fullPath = path.join(cwd, file.path);
+        if (!force && await fs.pathExists(fullPath)) {
+            result.skipped.push(file.path);
+            continue;
+        }
+        try {
+            await fs.ensureDir(path.dirname(fullPath));
+            await fs.writeFile(fullPath, file.content);
+            if (file.executable)
+                await fs.chmod(fullPath, 0o755);
+            result.written.push(file.path);
+        }
+        catch (error) {
+            const code = error instanceof Error && 'code' in error
+                ? String(error.code)
+                : '';
+            if (code !== 'ENOTDIR' && code !== 'EEXIST')
+                throw error;
+            result.incompatible.push(file.path);
+        }
+    }
+    return result;
+}
+export function formatHookWriteResult(result) {
+    const parts = [];
+    if (result.written.length > 0)
+        parts.push(`✓ Created: ${result.written.join(', ')}`);
+    if (result.skipped.length > 0) {
+        parts.push(`⊘ Skipped (exists): ${result.skipped.join(', ')}. Use force=true to overwrite.`);
+    }
+    if (result.incompatible.length > 0) {
+        parts.push(`⚠ Not configured (parent path is a file): ${result.incompatible.join(', ')}`);
+    }
+    return parts;
+}

package/dist/tools/hooks-handler.d.ts

@@ -18,7 +18,7 @@ export declare function handleHooksCheck(cwd: string, files: string[], timeout?:
  * rigour_hooks_init — Generate hook configs for AI coding tools.
  *
  * NEW in v4.2.0: When `dlp` param is true, also generates pre-input
- * DLP hooks that intercept credentials before agent processing.
+ * DLP hooks that warn about possible credentials before agent processing.
  */
 export declare function handleHooksInit(cwd: string, tool: string, force?: boolean, dryRun?: boolean, dlp?: boolean): Promise<ToolResult>;
 export {};

package/dist/tools/hooks-handler.js

@@ -5,12 +5,14 @@
  * Now includes DLP (Data Loss Prevention) capabilities.
  *
  * @since v3.0.0 — real-time hooks for AI coding tools
- * @since v4.2.0 — AI Agent DLP layer (credential interception)
+ * @since v4.2.0 — AI Agent DLP warning layer
  */
 import { runHookChecker, generateHookFiles } from "@rigour-labs/core";
 import { scanInputForCredentials, formatDLPAlert, createDLPAuditEntry, generateDLPHookFiles } from "@rigour-labs/core";
 import fs from "fs-extra";
 import path from "path";
+import { getPinnedCheckerCommand } from "./cli-command.js";
+import { formatHookWriteResult, mergeHookFiles, writeHookFiles } from "./hook-file-writer.js";
 /**
  * rigour_hooks_check — Run the fast hook checker on specific files.
  * This is the same check that runs inside IDE hooks (Claude, Cursor, Cline, Windsurf).
@@ -24,7 +26,7 @@ export async function handleHooksCheck(cwd, files, timeout, text, agent) {
     if (text) {
         const result = scanInputForCredentials(text, {
             enabled: true,
-            block_on_detection: true,
+            block_on_detection: false,
             audit_log: true,
         });
         // Log to audit trail (with rotation to prevent unbounded growth)
@@ -92,17 +94,17 @@ export async function handleHooksCheck(cwd, files, timeout, text, agent) {
  * rigour_hooks_init — Generate hook configs for AI coding tools.
  *
  * NEW in v4.2.0: When `dlp` param is true, also generates pre-input
- * DLP hooks that intercept credentials before agent processing.
+ * DLP hooks that warn about possible credentials before agent processing.
  */
 export async function handleHooksInit(cwd, tool, force = false, dryRun = false, dlp = true) {
     try {
         const hookTool = tool;
-        const checkerCommand = 'rigour hooks check';
+        const checkerCommand = getPinnedCheckerCommand();
         // Generate post-output hooks (existing)
         const files = generateHookFiles(hookTool, checkerCommand);
         // Generate DLP pre-input hooks (new)
         const dlpFiles = dlp ? generateDLPHookFiles(hookTool, checkerCommand) : [];
-        const allFiles = [...files, ...dlpFiles];
+        const allFiles = mergeHookFiles([...files, ...dlpFiles]);
         if (dryRun) {
             const preview = allFiles.map(f => `${f.path}:\n${f.content.slice(0, 300)}...`).join('\n\n');
             return {
@@ -112,32 +114,14 @@ export async function handleHooksInit(cwd, tool, force = false, dryRun = false,
                     }],
             };
         }
-        const written = [];
-        const skipped = [];
-        for (const file of allFiles) {
-            const fullPath = path.join(cwd, file.path);
-            if (!force && await fs.pathExists(fullPath)) {
-                skipped.push(file.path);
-                continue;
-            }
-            await fs.ensureDir(path.dirname(fullPath));
-            await fs.writeFile(fullPath, file.content);
-            if (file.executable) {
-                await fs.chmod(fullPath, 0o755);
-            }
-            written.push(file.path);
-        }
-        const parts = [];
-        if (written.length > 0)
-            parts.push(`✓ Created: ${written.join(', ')}`);
-        if (skipped.length > 0)
-            parts.push(`⊘ Skipped (exists): ${skipped.join(', ')}. Use force=true to overwrite.`);
+        const writeResult = await writeHookFiles(cwd, allFiles, force);
+        const parts = formatHookWriteResult(writeResult);
         parts.push(`Tool: ${tool}`);
         parts.push('Checks: file-size, security-patterns, hallucinated-imports, command-injection');
         if (dlp) {
             parts.push('');
-            parts.push('🛑 DLP Protection: AWS keys, API tokens, database URLs, private keys, JWTs, passwords');
-            parts.push('Credentials will be intercepted BEFORE reaching the AI agent.');
+            parts.push('⚠ DLP warnings: AWS keys, API tokens, database URLs, private keys, JWTs, passwords');
+            parts.push('Possible credentials will be reported before agent actions.');
         }
         return {
             content: [{ type: "text", text: parts.join('\n') }],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/mcp",
-  "version": "5.5.0",
+  "version": "5.5.1",
   "description": "MCP server + live dashboard for AI code governance — OWASP LLM Top 10 (10/10), real-time MCP App UI, 25+ security patterns, Bayesian learning Brain, hallucinated import detection, multi-agent governance. Works with Claude, Cursor, VS Code, ChatGPT, Goose, Windsurf. Industry presets for HIPAA, SOC2, FedRAMP.",
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -62,7 +62,7 @@
     "execa": "^8.0.1",
     "fs-extra": "^11.2.0",
     "yaml": "^2.8.2",
-    "@rigour-labs/core": "5.5.0"
+    "@rigour-labs/core": "5.5.1"
   },
   "devDependencies": {
     "@types/node": "^25.0.3",