@rigour-labs/mcp 6.4.4 → 6.5.1

package/dist/advertised-tools.d.ts

@@ -1,6 +1,6 @@
 export declare const TOOL_GROUPS: {
     /** Load memory, scope context, avoid reinvention, gate and review the change, learn. */
-    readonly core: readonly ["rigour_recall", "rigour_index", "rigour_context_scope", "rigour_check_pattern", "rigour_check", "rigour_review", "rigour_get_fix_packet", "rigour_remember"];
+    readonly core: readonly ["rigour_recall", "rigour_index", "rigour_context_scope", "rigour_check_pattern", "rigour_check", "rigour_review", "rigour_review_ack", "rigour_get_fix_packet", "rigour_remember"];
     /** Multi-agent registration, checkpoints, handoffs, hooks and supervised runs. */
     readonly governance: readonly ["rigour_agent_register", "rigour_agent_deregister", "rigour_checkpoint", "rigour_handoff", "rigour_handoff_accept", "rigour_hooks_check", "rigour_hooks_init", "rigour_run", "rigour_run_supervised"];
     /** Occasional context and security tools. */
@@ -623,6 +623,47 @@ export declare function getAdvertisedToolDefinitions(spec?: string): ({
                 };
                 description: string;
             };
+            mode: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            cwd: {
+                type: "string";
+                description: string;
+            };
+        };
+        required: string[];
+    };
+    annotations: {
+        title: string;
+        readOnlyHint: boolean;
+        destructiveHint: boolean;
+        idempotentHint: boolean;
+        openWorldHint: boolean;
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            file: {
+                type: string;
+                description: string;
+            };
+            function: {
+                type: string;
+                description: string;
+            };
+            verdict: {
+                type: string;
+                enum: string[];
+            };
+            note: {
+                type: string;
+                description: string;
+            };
             cwd: {
                 type: "string";
                 description: string;

package/dist/advertised-tools.js

@@ -17,6 +17,7 @@ export const TOOL_GROUPS = {
         'rigour_check_pattern',
         'rigour_check',
         'rigour_review',
+        'rigour_review_ack',
         'rigour_get_fix_packet',
         'rigour_remember',
     ],

package/dist/index.js

@@ -11,7 +11,7 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, ListPromptsRequestSchema, GetPromptRequestSchema, ListResourcesRequestSchema, ReadResourceRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { randomUUID } from "crypto";
-import { GateRunner } from "@rigour-labs/core";
+import { GateRunner, countUsage, flushDailyUsage } from "@rigour-labs/core";
 // Utils
 import { loadConfig, loadMcpSettings, logStudioEvent } from './utils/config.js';
 import { bindServer } from './utils/notifications.js';
@@ -27,7 +27,7 @@ import { handleRemember, handleRecall, handleForget } from './tools/memory-handl
 import { handleCheckPattern, handleSecurityAudit } from './tools/pattern-handlers.js';
 import { handleRun, handleRunSupervised } from './tools/execution-handlers.js';
 import { handleAgentRegister, handleCheckpoint, handleHandoff, handleAgentDeregister, handleHandoffAccept } from './tools/agent-handlers.js';
-import { handleReview } from './tools/review-handler.js';
+import { handleReview, handleReviewAck } from './tools/review-handler.js';
 import { handleHooksCheck, handleHooksInit } from './tools/hooks-handler.js';
 import { handleCheckDeep, handleDeepStats } from './tools/deep-handlers.js';
 import { handleMcpGetSettings, handleMcpSetSettings } from './tools/mcp-settings-handler.js';
@@ -216,6 +216,9 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             case "rigour_review":
                 result = await handleReview(config, cwd, args);
                 break;
+            case "rigour_review_ack":
+                result = handleReviewAck(cwd, args);
+                break;
             // Context Telemetry & Cost Tools
             case "rigour_context_stats":
                 result = await handleContextStats(cwd, args.taskId);
@@ -334,9 +337,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         catch {
             // Client doesn't support resource notifications — fine
         }
+        countUsage(`mcp:${name}`);
         return result;
     }
     catch (error) {
+        countUsage(`mcp_error:${name}`);
         const errorResponse = {
             content: [{ type: "text", text: `RIGOUR ERROR: ${error.message}` }],
             isError: true,
@@ -427,7 +432,7 @@ server.setRequestHandler(GetPromptRequestSchema, async (request) => {
                         role: "user",
                         content: {
                             type: "text",
-                            text: `Run a pre-commit quality check on ${cwd}. Execute \`rigour_check\` (default deep mode "${deepMode}") and \`rigour_hooks_check\` on all staged files. If any critical or high severity violations exist, list them and block the commit. For medium/low violations, warn but allow. Provide a one-line summary: PASS (safe to commit) or FAIL (must fix first).`,
+                            text: `Run a pre-commit review on ${cwd}. Call \`rigour_review\` with mode "agent". Fix every critical or high failure. Then review each review_task item yourself: read the function, its callers and what it calls, answer its questions against the code, fix any real defect, and call \`rigour_review_ack\` with what you checked. Call \`rigour_review\` again to confirm. Provide a one-line summary: PASS (safe to commit) or FAIL (must fix first).`,
                         },
                     },
                 ],
@@ -476,6 +481,7 @@ async function main() {
     }
     const transport = new StdioServerTransport();
     await server.connect(transport);
+    void flushDailyUsage(); // a day's agent activity, if a day has passed; never awaited by the agent
     console.error("Rigour MCP server v4.0.0 running on stdio");
 }
 main().catch((error) => {

package/dist/tools/definitions.d.ts

@@ -626,6 +626,47 @@ export declare const TOOL_DEFINITIONS: ({
                 };
                 description: string;
             };
+            mode: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            cwd: {
+                type: "string";
+                description: string;
+            };
+        };
+        required: string[];
+    };
+    annotations: {
+        title: string;
+        readOnlyHint: boolean;
+        destructiveHint: boolean;
+        idempotentHint: boolean;
+        openWorldHint: boolean;
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            file: {
+                type: string;
+                description: string;
+            };
+            function: {
+                type: string;
+                description: string;
+            };
+            verdict: {
+                type: string;
+                enum: string[];
+            };
+            note: {
+                type: string;
+                description: string;
+            };
             cwd: {
                 type: "string";
                 description: string;

package/dist/tools/definitions.js

@@ -519,6 +519,7 @@ export const TOOL_DEFINITIONS = [
                 base: { type: "string", description: "Review this branch against a base ref instead of uncommitted work, e.g. 'main'." },
                 diff: { type: "string", description: "A unified diff to review instead of reading git. Rarely needed." },
                 files: { type: "array", items: { type: "string" }, description: "Review exactly these files instead of the ones the change touches." },
+                mode: { type: "string", enum: ["gates", "agent"], description: "\"agent\": also return review_task, the risky changed functions for you to review yourself, with what to check in each. No model is called by Rigour." },
             },
             required: ["cwd"],
         },
@@ -530,6 +531,28 @@ export const TOOL_DEFINITIONS = [
             openWorldHint: false,
         },
     },
+    {
+        name: "rigour_review_ack",
+        description: "Record that you reviewed a function from rigour_review's review_task: verdict \"fixed\" (you fixed a defect) or \"no_issue\", with a note saying what you checked. Covers the function's current code only; editing it later puts it back in the task.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                ...cwdParam(),
+                file: { type: "string", description: "Repository-relative path, as in review_task." },
+                function: { type: "string", description: "Function name, as in review_task." },
+                verdict: { type: "string", enum: ["fixed", "no_issue"] },
+                note: { type: "string", description: "What you checked, e.g. 'callers pass a non-empty cursor; upsert conflict key matches the unique index'." },
+            },
+            required: ["cwd", "file", "function", "verdict", "note"],
+        },
+        annotations: {
+            title: "Acknowledge Review",
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+    },
     // ─── Context Telemetry & Cost Efficiency ───────────────
     {
         name: "rigour_context_stats",

package/dist/tools/prompts.js

@@ -42,7 +42,7 @@ export const PROMPT_DEFINITIONS = [
     },
     {
         name: "rigour-pre-commit",
-        description: "Pre-commit quality gate check. Runs fast hooks on staged files and full gate check. Returns PASS/FAIL verdict for commit safety.",
+        description: "Pre-commit review: Rigour's gates plus your own review of the risky changed functions it picks, acknowledged one by one. Returns PASS/FAIL.",
         arguments: [
             {
                 name: "cwd",

package/dist/tools/review-handler.d.ts

@@ -17,6 +17,16 @@ export interface ReviewArgs {
     diff?: string;
     base?: string;
     files?: string[];
+    /** "agent": also return the risky changed functions for the calling agent to review itself. */
+    mode?: 'gates' | 'agent';
+}
+export interface ReviewAckArgs {
+    file: string;
+    function: string;
+    verdict: string;
+    note: string;
 }
 export declare function handleReview(config: Config, cwd: string, args: ReviewArgs): Promise<ToolResult>;
+/** rigour_review_ack: record that a review-task function was checked (verdict and what was checked). */
+export declare function handleReviewAck(cwd: string, args: ReviewAckArgs): ToolResult;
 export {};

package/dist/tools/review-handler.js

@@ -5,16 +5,14 @@
  * With no diff, the change is taken from git: uncommitted work (what the
  * agent just wrote, new files included), or the branch against `base`.
  */
-import { recordReviewOutcome, reviewChange, toReviewFinding } from "@rigour-labs/core";
+import { acknowledgeReview, buildReviewTask, diffFromGit, recordReviewOutcome, reviewChange, toReviewFinding } from "@rigour-labs/core";
 import { notifyProgress } from '../utils/notifications.js';
 export async function handleReview(config, cwd, args) {
     notifyProgress("info", args.diff ? "Reviewing the provided diff..." : `Reviewing ${args.base ? `this branch against ${args.base}` : "uncommitted changes"}...`);
     try {
-        const result = await reviewChange({
-            cwd, config, diff: args.diff,
-            source: args.base ? { mode: 'base', base: args.base } : { mode: 'working' },
-            files: args.files,
-        });
+        const diff = args.diff ?? diffFromGit(cwd, args.base ? { mode: 'base', base: args.base } : { mode: 'working' });
+        const result = await reviewChange({ cwd, config, diff, files: args.files });
+        const task = args.mode === 'agent' ? buildReviewTask(cwd, diff, config.gates.deep?.router, config.gates.deep?.review_lessons, config.gates.deep?.repo_rules) : undefined;
         recordReviewOutcome(cwd, result.findings, Object.keys(result.changedLines));
         const stats = result.report?.stats;
         return text({
@@ -25,17 +23,32 @@ export async function handleReview(config, cwd, args) {
             changed_files: Object.keys(result.changedLines).length,
             failures: result.findings.map(toReviewFinding),
             file_findings: result.fileFindings.map(toReviewFinding),
+            context_findings: result.contextFindings.map(toReviewFinding),
+            advisory_count: result.advisory.length,
             excluded_outside_changed_lines: result.excludedOutsideChangedLines,
             unlocated_failures: result.unlocated,
-            next_step: result.findings.length
-                ? "Fix each failure at its file:line (see suggestion), then call rigour_review again."
-                : "No findings on changed lines.",
+            ...(task ? { review_task: { items: task.items, already_reviewed: task.alreadyReviewed, team_lessons: task.lessons, repo_rules: task.rules, instructions: task.instructions } } : {}),
+            next_step: nextStep(result.findings.length, task?.items.length ?? 0),
         });
     }
     catch (error) {
         return { ...text({ error: error instanceof Error ? error.message : String(error) }), isError: true };
     }
 }
+/** rigour_review_ack: record that a review-task function was checked (verdict and what was checked). */
+export function handleReviewAck(cwd, args) {
+    const result = acknowledgeReview(cwd, { ...args, reviewer: 'agent' });
+    if (!result.ok)
+        return { ...text({ error: result.error }), isError: true };
+    return text({ recorded: { file: result.entry.file, function: result.entry.function, verdict: result.entry.verdict } });
+}
+function nextStep(findings, unreviewed) {
+    if (findings)
+        return "Fix each failure at its file:line (see suggestion), then call rigour_review again.";
+    if (unreviewed)
+        return "Review each review_task item (read its callers and callees, answer its questions), fix real defects, then call rigour_review_ack for it.";
+    return "No findings on changed lines.";
+}
 function text(value) {
     return { content: [{ type: "text", text: JSON.stringify(value) }] };
 }

package/dist/utils/config.d.ts

@@ -37,6 +37,15 @@ export declare function loadConfig(cwd: string): Promise<{
             model_path?: string | undefined;
             max_tokens?: number | undefined;
             timeout_ms?: number | undefined;
+            budget_ms?: number | undefined;
+            agentic?: boolean | undefined;
+            repo_rules?: boolean | undefined;
+            review_lessons?: "verified" | "all" | "off" | undefined;
+            router?: {
+                enabled?: boolean | undefined;
+                min_score?: number | undefined;
+                max_functions?: number | undefined;
+            } | undefined;
         };
         max_file_lines: number;
         forbid_todos: boolean;
@@ -253,11 +262,15 @@ export declare function loadConfig(cwd: string): Promise<{
         timeout_ms: number;
         fast_gates: string[];
         block_on_failure: boolean;
+        require_review_ack: boolean;
         dlp: boolean;
     };
     output: {
         report_path: string;
     };
+    review: {
+        include_heuristics: boolean;
+    };
     planned: string[];
     preset?: string | undefined;
     paradigm?: string | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/mcp",
-  "version": "6.4.4",
+  "version": "6.5.1",
   "description": "MCP server + live dashboard for AI code governance — OWASP LLM Top 10 (10/10), real-time MCP App UI, 25+ security patterns, Bayesian learning Brain, hallucinated import detection, multi-agent governance. Works with Claude, Cursor, VS Code, ChatGPT, Goose, Windsurf. Industry presets for HIPAA, SOC2, FedRAMP.",
   "engines": {
     "node": ">=22"
@@ -65,7 +65,7 @@
     "execa": "^8.0.1",
     "fs-extra": "^11.4.0",
     "yaml": "^2.8.2",
-    "@rigour-labs/core": "6.4.4"
+    "@rigour-labs/core": "6.5.1"
   },
   "devDependencies": {
     "@types/node": "^25.0.3",