@rigour-labs/mcp 6.3.0 → 6.4.0

package/dist/advertised-tools.d.ts

@@ -1,9 +1,18 @@
-/** Context, quality, and cost telemetry tools every agent should see first. */
-export declare const ESSENTIAL_CONTEXT_TOOLS: readonly ["rigour_recall", "rigour_index", "rigour_context_scope", "rigour_check_pattern", "rigour_check", "rigour_remember", "rigour_explain", "rigour_get_fix_packet", "rigour_review", "rigour_security_audit", "rigour_forget", "rigour_context_stats", "rigour_task_cost", "rigour_cache_stats", "rigour_context_explain"];
-/** Multi-agent governance, hooks, and execution tools with dispatch handlers. */
+export declare const TOOL_GROUPS: {
+    /** Load memory, scope context, avoid reinvention, gate and review the change, learn. */
+    readonly core: readonly ["rigour_recall", "rigour_index", "rigour_context_scope", "rigour_check_pattern", "rigour_check", "rigour_review", "rigour_get_fix_packet", "rigour_remember"];
+    /** Multi-agent registration, checkpoints, handoffs, hooks and supervised runs. */
+    readonly governance: readonly ["rigour_agent_register", "rigour_agent_deregister", "rigour_checkpoint", "rigour_handoff", "rigour_handoff_accept", "rigour_hooks_check", "rigour_hooks_init", "rigour_run", "rigour_run_supervised"];
+    /** Occasional context and security tools. */
+    readonly context: readonly ["rigour_explain", "rigour_forget", "rigour_context_explain", "rigour_security_audit"];
+    /** Cost and cache telemetry, mostly for dashboards. */
+    readonly telemetry: readonly ["rigour_context_stats", "rigour_task_cost", "rigour_cache_stats"];
+};
+export type ToolGroup = keyof typeof TOOL_GROUPS;
 export declare const GOVERNANCE_TOOLS: readonly ["rigour_agent_register", "rigour_agent_deregister", "rigour_checkpoint", "rigour_handoff", "rigour_handoff_accept", "rigour_hooks_check", "rigour_hooks_init", "rigour_run", "rigour_run_supervised"];
-export declare const ADVERTISED_TOOLS: Set<string>;
-export declare function getAdvertisedToolDefinitions(): ({
+/** Tool names for a RIGOUR_MCP_TOOLS value; core is always included, unknown groups are ignored. */
+export declare function advertisedToolNames(spec?: string | undefined): Set<string>;
+export declare function getAdvertisedToolDefinitions(spec?: string): ({
     name: string;
     description: string;
     inputSchema: {
@@ -599,11 +608,7 @@ export declare function getAdvertisedToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            repository: {
-                type: string;
-                description: string;
-            };
-            branch: {
+            base: {
                 type: string;
                 description: string;
             };

package/dist/advertised-tools.js

@@ -1,46 +1,59 @@
 /**
  * MCP tools advertised to clients via ListTools.
  *
- * Essential context/quality tools stay visible for day-to-day agent work.
- * Governance tools are included so Cursor and other MCP clients can discover
- * multi-agent registration, checkpoints, handoffs, hooks, and supervised runs
- * without hunting for undocumented callable tools.
+ * Every advertised tool costs every agent session its definition in context
+ * and one more choice to get wrong, so the default is the core loop a single
+ * agent needs. Other groups are opt-in through RIGOUR_MCP_TOOLS in the MCP
+ * client's config, e.g. "governance,telemetry" or "full". Tools outside the
+ * advertised set stay callable; they are just not listed.
  */
 import { TOOL_DEFINITIONS } from './tools/definitions.js';
-/** Context, quality, and cost telemetry tools every agent should see first. */
-export const ESSENTIAL_CONTEXT_TOOLS = [
-    'rigour_recall',
-    'rigour_index',
-    'rigour_context_scope',
-    'rigour_check_pattern',
-    'rigour_check',
-    'rigour_remember',
-    'rigour_explain',
-    'rigour_get_fix_packet',
-    'rigour_review',
-    'rigour_security_audit',
-    'rigour_forget',
-    'rigour_context_stats',
-    'rigour_task_cost',
-    'rigour_cache_stats',
-    'rigour_context_explain',
-];
-/** Multi-agent governance, hooks, and execution tools with dispatch handlers. */
-export const GOVERNANCE_TOOLS = [
-    'rigour_agent_register',
-    'rigour_agent_deregister',
-    'rigour_checkpoint',
-    'rigour_handoff',
-    'rigour_handoff_accept',
-    'rigour_hooks_check',
-    'rigour_hooks_init',
-    'rigour_run',
-    'rigour_run_supervised',
-];
-export const ADVERTISED_TOOLS = new Set([
-    ...ESSENTIAL_CONTEXT_TOOLS,
-    ...GOVERNANCE_TOOLS,
-]);
-export function getAdvertisedToolDefinitions() {
-    return TOOL_DEFINITIONS.filter(t => ADVERTISED_TOOLS.has(t.name));
+export const TOOL_GROUPS = {
+    /** Load memory, scope context, avoid reinvention, gate and review the change, learn. */
+    core: [
+        'rigour_recall',
+        'rigour_index',
+        'rigour_context_scope',
+        'rigour_check_pattern',
+        'rigour_check',
+        'rigour_review',
+        'rigour_get_fix_packet',
+        'rigour_remember',
+    ],
+    /** Multi-agent registration, checkpoints, handoffs, hooks and supervised runs. */
+    governance: [
+        'rigour_agent_register',
+        'rigour_agent_deregister',
+        'rigour_checkpoint',
+        'rigour_handoff',
+        'rigour_handoff_accept',
+        'rigour_hooks_check',
+        'rigour_hooks_init',
+        'rigour_run',
+        'rigour_run_supervised',
+    ],
+    /** Occasional context and security tools. */
+    context: [
+        'rigour_explain',
+        'rigour_forget',
+        'rigour_context_explain',
+        'rigour_security_audit',
+    ],
+    /** Cost and cache telemetry, mostly for dashboards. */
+    telemetry: [
+        'rigour_context_stats',
+        'rigour_task_cost',
+        'rigour_cache_stats',
+    ],
+};
+export const GOVERNANCE_TOOLS = TOOL_GROUPS.governance;
+/** Tool names for a RIGOUR_MCP_TOOLS value; core is always included, unknown groups are ignored. */
+export function advertisedToolNames(spec = process.env.RIGOUR_MCP_TOOLS) {
+    const requested = (spec ?? '').split(',').map(s => s.trim().toLowerCase()).filter(Boolean);
+    const groups = requested.includes('full') ? Object.keys(TOOL_GROUPS) : ['core', ...requested];
+    return new Set(groups.filter((g) => g in TOOL_GROUPS).flatMap(g => [...TOOL_GROUPS[g]]));
+}
+export function getAdvertisedToolDefinitions(spec) {
+    const names = advertisedToolNames(spec);
+    return TOOL_DEFINITIONS.filter(t => names.has(t.name));
 }

package/dist/index.js

@@ -214,7 +214,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 break;
             // Code review
             case "rigour_review":
-                result = await handleReview(runner, cwd, args.diff, args.files);
+                result = await handleReview(config, cwd, args);
                 break;
             // Context Telemetry & Cost Tools
             case "rigour_context_stats":

package/dist/tools/definitions.d.ts

@@ -611,11 +611,7 @@ export declare const TOOL_DEFINITIONS: ({
     inputSchema: {
         type: string;
         properties: {
-            repository: {
-                type: string;
-                description: string;
-            };
-            branch: {
+            base: {
                 type: string;
                 description: string;
             };

package/dist/tools/definitions.js

@@ -511,20 +511,19 @@ export const TOOL_DEFINITIONS = [
     // ─── Code Review ──────────────────────────────────────
     {
         name: "rigour_review",
-        description: "Perform a high-fidelity code review on a pull request diff. Analyzes changed files using all active quality gates.",
+        description: "Review the change you just made before calling it done: runs Rigour's gates and keeps only findings on changed lines, each with file, line and a suggested fix. With no diff it reads your uncommitted work from git (new files included); pass base to review the whole branch (e.g. 'main'). Same verdict as `rigour review` in CI.",
         inputSchema: {
             type: "object",
             properties: {
                 ...cwdParam(),
-                repository: { type: "string", description: "Full repository name (e.g., 'owner/repo')." },
-                branch: { type: "string", description: "The branch containing the changes." },
-                diff: { type: "string", description: "The git diff content to analyze." },
-                files: { type: "array", items: { type: "string" }, description: "List of filenames that were changed." },
+                base: { type: "string", description: "Review this branch against a base ref instead of uncommitted work, e.g. 'main'." },
+                diff: { type: "string", description: "A unified diff to review instead of reading git. Rarely needed." },
+                files: { type: "array", items: { type: "string" }, description: "Review exactly these files instead of the ones the change touches." },
             },
-            required: ["cwd", "diff"],
+            required: ["cwd"],
         },
         annotations: {
-            title: "Code Review",
+            title: "Review Change",
             readOnlyHint: true,
             destructiveHint: false,
             idempotentHint: true,

package/dist/tools/review-handler.d.ts

@@ -1,16 +1,22 @@
 /**
- * Code Review Tool Handler
+ * rigour_review: the same review as `rigour review` (core reviewChange), so an
+ * agent and CI get the same verdict for the same change.
  *
- * Handler for: rigour_review
- *
- * @since v2.17.0 — extracted from monolithic index.ts
+ * With no diff, the change is taken from git: uncommitted work (what the
+ * agent just wrote, new files included), or the branch against `base`.
  */
-import { GateRunner } from "@rigour-labs/core";
+import { type Config } from "@rigour-labs/core";
 type ToolResult = {
     content: {
         type: string;
         text: string;
     }[];
+    isError?: boolean;
 };
-export declare function handleReview(runner: GateRunner, cwd: string, diff: string, changedFiles?: string[]): Promise<ToolResult>;
+export interface ReviewArgs {
+    diff?: string;
+    base?: string;
+    files?: string[];
+}
+export declare function handleReview(config: Config, cwd: string, args: ReviewArgs): Promise<ToolResult>;
 export {};

package/dist/tools/review-handler.js

@@ -1,51 +1,41 @@
 /**
- * Code Review Tool Handler
+ * rigour_review: the same review as `rigour review` (core reviewChange), so an
+ * agent and CI get the same verdict for the same change.
  *
- * Handler for: rigour_review
- *
- * @since v2.17.0 — extracted from monolithic index.ts
+ * With no diff, the change is taken from git: uncommitted work (what the
+ * agent just wrote, new files included), or the branch against `base`.
  */
-import { parseDiff, normalizeScopePatterns } from "@rigour-labs/core";
+import { recordReviewOutcome, reviewChange, toReviewFinding } from "@rigour-labs/core";
 import { notifyProgress } from '../utils/notifications.js';
-export async function handleReview(runner, cwd, diff, changedFiles) {
-    // 1. Map diff to line numbers for filtering
-    const diffMapping = parseDiff(diff);
-    const targetFiles = changedFiles || Object.keys(diffMapping);
-    // 2. Run high-fidelity analysis on changed files
-    notifyProgress("info", `Reviewing ${targetFiles.length} changed files...`);
-    const report = await runner.run(cwd, await normalizeScopePatterns(cwd, targetFiles));
-    // 3. Filter failures to only those on changed lines (or global gate failures)
-    const filteredFailures = report.failures.filter(failure => {
-        if (!failure.files || failure.files.length === 0)
-            return true;
-        return failure.files.some(file => {
-            const fileModifiedLines = diffMapping[file];
-            if (!fileModifiedLines)
-                return false;
-            if (failure.line !== undefined)
-                return fileModifiedLines.has(failure.line);
-            return true;
+export async function handleReview(config, cwd, args) {
+    notifyProgress("info", args.diff ? "Reviewing the provided diff..." : `Reviewing ${args.base ? `this branch against ${args.base}` : "uncommitted changes"}...`);
+    try {
+        const result = await reviewChange({
+            cwd, config, diff: args.diff,
+            source: args.base ? { mode: 'base', base: args.base } : { mode: 'working' },
+            files: args.files,
+        });
+        recordReviewOutcome(cwd, result.findings, Object.keys(result.changedLines));
+        const stats = result.report?.stats;
+        return text({
+            status: result.status,
+            score: stats?.score ?? 100,
+            ai_health_score: stats?.ai_health_score,
+            structural_score: stats?.structural_score,
+            changed_files: Object.keys(result.changedLines).length,
+            failures: result.findings.map(toReviewFinding),
+            file_findings: result.fileFindings.map(toReviewFinding),
+            excluded_outside_changed_lines: result.excludedOutsideChangedLines,
+            unlocated_failures: result.unlocated,
+            next_step: result.findings.length
+                ? "Fix each failure at its file:line (see suggestion), then call rigour_review again."
+                : "No findings on changed lines.",
         });
-    });
-    return {
-        content: [{
-                type: "text",
-                text: JSON.stringify({
-                    status: filteredFailures.length > 0 ? "FAIL" : "PASS",
-                    score: report.stats.score,
-                    ai_health_score: report.stats.ai_health_score,
-                    structural_score: report.stats.structural_score,
-                    failures: filteredFailures.map(f => ({
-                        id: f.id,
-                        gate: f.title,
-                        severity: f.severity || 'medium',
-                        provenance: f.provenance || 'traditional',
-                        message: f.details,
-                        file: f.files?.[0] || "",
-                        line: f.line || 1,
-                        suggestion: f.hint,
-                    })),
-                }),
-            }],
-    };
+    }
+    catch (error) {
+        return { ...text({ error: error instanceof Error ? error.message : String(error) }), isError: true };
+    }
+}
+function text(value) {
+    return { content: [{ type: "text", text: JSON.stringify(value) }] };
 }

package/dist/utils/config.d.ts

@@ -1,3 +1,8 @@
+/**
+ * The repository's rigour.yml, or Rigour's defaults when it has none. A tool
+ * call never writes into the user's repository to create one (run `rigour init`
+ * for that), so the first call in a new repository behaves like `rigour review`.
+ */
 export declare function loadConfig(cwd: string): Promise<{
     ignore: string[];
     version: number;

package/dist/utils/config.js

@@ -12,22 +12,27 @@ import yaml from "yaml";
 import { randomUUID } from "crypto";
 import { ConfigSchema } from "@rigour-labs/core";
 // ─── Config Loading ───────────────────────────────────────────────
+/**
+ * The repository's rigour.yml, or Rigour's defaults when it has none. A tool
+ * call never writes into the user's repository to create one (run `rigour init`
+ * for that), so the first call in a new repository behaves like `rigour review`.
+ */
 export async function loadConfig(cwd) {
     const configPath = path.join(cwd, "rigour.yml");
     if (!(await fs.pathExists(configPath))) {
-        console.error(`[RIGOUR] rigour.yml not found in ${cwd}, auto-initializing...`);
-        const { execa } = await import("execa");
-        try {
-            await execa("npx", ["rigour", "init"], { cwd, shell: true });
-            console.error(`[RIGOUR] Auto-initialization complete.`);
-        }
-        catch (initError) {
-            throw new Error(`Rigour auto-initialization failed: ${initError.message}. Please run 'npx rigour init' manually.`);
-        }
+        noteMissingConfig(cwd);
+        return ConfigSchema.parse({ version: 1 });
     }
     const configContent = await fs.readFile(configPath, "utf-8");
     return ConfigSchema.parse(yaml.parse(configContent));
 }
+const notedMissingConfig = new Set();
+function noteMissingConfig(cwd) {
+    if (notedMissingConfig.has(cwd))
+        return;
+    notedMissingConfig.add(cwd);
+    console.error(`[RIGOUR] No rigour.yml in ${cwd}; using defaults. Run \`npx rigour init\` to configure gates and hooks.`);
+}
 export async function getMemoryPath(cwd) {
     const rigourDir = path.join(cwd, ".rigour");
     await fs.ensureDir(rigourDir);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/mcp",
-  "version": "6.3.0",
+  "version": "6.4.0",
   "description": "MCP server + live dashboard for AI code governance — OWASP LLM Top 10 (10/10), real-time MCP App UI, 25+ security patterns, Bayesian learning Brain, hallucinated import detection, multi-agent governance. Works with Claude, Cursor, VS Code, ChatGPT, Goose, Windsurf. Industry presets for HIPAA, SOC2, FedRAMP.",
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -62,7 +62,7 @@
     "execa": "^8.0.1",
     "fs-extra": "^11.4.0",
     "yaml": "^2.8.2",
-    "@rigour-labs/core": "6.3.0"
+    "@rigour-labs/core": "6.4.0"
   },
   "devDependencies": {
     "@types/node": "^25.0.3",