@rigour-labs/mcp 6.5.4 → 6.6.1

package/README.md

@@ -132,6 +132,8 @@ No global install: npx fetches the server when your agent starts it. Keep a vers
 
 Only Rigour's core tools are listed by default; add `"RIGOUR_MCP_TOOLS": "governance,telemetry"` (or `"full"`) to `env` for the rest. Node.js 22 or later is required.
 
+To keep a server apart from your other work (one per employer or client), add `"RIGOUR_USER_MEMORY": "off"`: it then never reads or writes the memories you keep for all your repositories.
+
 ---
 
 ## 📖 Documentation

package/dist/index.js

@@ -15,7 +15,7 @@ import { CallToolRequestSchema, ListToolsRequestSchema, ListPromptsRequestSchema
 import { randomUUID } from "crypto";
 import { GateRunner, countUsage, flushDailyUsage } from "@rigour-labs/core";
 // Utils
-import { loadConfig, loadMcpSettings, logStudioEvent } from './utils/config.js';
+import { loadConfig, loadMcpSettings, logStudioEvent, resolveCwd } from './utils/config.js';
 import { bindServer } from './utils/notifications.js';
 import { getMcpVersion } from './utils/package-version.js';
 import { buildMcpResultMeta, buildStudioImpact } from './utils/impact-receipt.js';
@@ -85,7 +85,7 @@ server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
 // ─── Tool Dispatch ────────────────────────────────────────────────
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args } = request.params;
-    const cwd = args?.cwd || process.cwd();
+    const cwd = resolveCwd(args);
     const requestId = randomUUID();
     try {
         await logStudioEvent(cwd, { type: "tool_call", requestId, tool: name, arguments: args });
@@ -369,7 +369,7 @@ server.setRequestHandler(ListPromptsRequestSchema, async () => ({
 }));
 server.setRequestHandler(GetPromptRequestSchema, async (request) => {
     const { name, arguments: promptArgs } = request.params;
-    const cwd = promptArgs?.cwd || process.env.RIGOUR_CWD || process.cwd();
+    const cwd = resolveCwd(promptArgs);
     const mcpSettings = await loadMcpSettings(cwd);
     const deepMode = mcpSettings.deep_default_mode;
     const prompt = PROMPT_DEFINITIONS.find((p) => p.name === name);

package/dist/tools/context-handlers.js

@@ -11,7 +11,7 @@
 import fs from 'fs-extra';
 import path from 'path';
 import { createHash } from 'crypto';
-import { getTaskContextStats, getTaskCostStats, getCacheStats, explainContext, getSemanticQueryCache, setSemanticQueryCache, findRelatedSemanticQueryCache, filterExistingEditScope, estimateTokenCount, ensureAutomaticIndex, getApplicableLessons, searchTeamKnowledge, recordScopeOffer, } from '@rigour-labs/core';
+import { getTaskContextStats, getTaskCostStats, getCacheStats, explainContext, getSemanticQueryCache, setSemanticQueryCache, findRelatedSemanticQueryCache, filterExistingEditScope, estimateTokenCount, ensureAutomaticIndex, getApplicableLessons, recordLessonsServed, searchTeamKnowledge, recordScopeOffer, } from '@rigour-labs/core';
 import { loadPatternIndex, getDefaultIndexPath, generateEmbedding, semanticSearch, } from '@rigour-labs/core/pattern-index';
 import { buildTelemetryMeta, getWorkspaceCommitSha } from '../utils/context-telemetry.js';
 import { appendContextFooter } from '../utils/context-footer.js';
@@ -262,6 +262,7 @@ export async function handleContextScope(cwd, query, limit = 10, taskId, agentId
         getApplicableLessons(cwd, agentId, process.env.RIGOUR_TEAM_ID),
         searchTeamKnowledge(query, Math.min(limit, 8)),
     ]);
+    recordLessonsServed(cwd, 'context', applicableLearning.lessons.map(lesson => lesson.subject));
     let fullFileTokens = 0;
     const offered = [];
     for (const file of editScope) {

package/dist/tools/index-handlers.js

@@ -3,50 +3,11 @@
  *
  * Wraps PatternIndexer for agent-accessible index build/update.
  */
-import path from 'path';
 import { PatternIndexer, savePatternIndex, loadPatternIndex, getDefaultIndexPath, } from '@rigour-labs/core/pattern-index';
-import { setStaticCache, setComponentCache, recordIndexChoice, } from '@rigour-labs/core';
+import { recordIndexChoice } from '@rigour-labs/core';
 import { notifyProgress } from '../utils/notifications.js';
-import { buildTelemetryMeta, getWorkspaceCommitSha } from '../utils/context-telemetry.js';
+import { buildTelemetryMeta } from '../utils/context-telemetry.js';
 import { appendContextFooter } from '../utils/context-footer.js';
-import fs from 'fs-extra';
-async function syncIndexToCache(cwd, index) {
-    const commitSha = await getWorkspaceCommitSha(cwd);
-    const repo = path.basename(cwd);
-    const byFile = new Map();
-    for (const pattern of index.patterns) {
-        const list = byFile.get(pattern.file) ?? [];
-        list.push(pattern);
-        byFile.set(pattern.file, list);
-    }
-    for (const [filePath, patterns] of byFile) {
-        const absPath = path.join(cwd, filePath);
-        let content = '';
-        try {
-            if (await fs.pathExists(absPath)) {
-                content = await fs.readFile(absPath, 'utf-8');
-            }
-        }
-        catch {
-            content = patterns.map(p => p.signature ?? p.name).join('\n');
-        }
-        await setStaticCache(repo, 'main', filePath, content || filePath, {
-            exports: patterns.map(p => p.name),
-            rigourPatterns: patterns.map(p => `${p.type}:${p.name}`),
-            ownership: path.dirname(filePath),
-        }, cwd);
-        const componentName = path.dirname(filePath) || filePath;
-        const dossier = {
-            component: componentName,
-            responsibility: `Indexed patterns in ${filePath}`,
-            canonicalFiles: [filePath],
-            contracts: patterns.filter(p => p.type === 'interface' || p.type === 'type').map(p => p.name),
-            directConsumers: [],
-            validationCommands: [],
-        };
-        await setComponentCache(componentName, commitSha, dossier, `index-${index.lastUpdated}`, '3', cwd);
-    }
-}
 export async function handleIndex(cwd, options = {}) {
     const indexPath = options.output || getDefaultIndexPath(cwd);
     const candidateEstimate = 'Full codebase AST scan for pattern extraction';
@@ -63,7 +24,6 @@ export async function handleIndex(cwd, options = {}) {
             index = await indexer.buildIndex();
         }
         await savePatternIndex(index, indexPath);
-        await syncIndexToCache(cwd, index);
         await recordIndexChoice(cwd, index, semantic);
         notifyProgress('info', 'Pattern index complete');
         const byType = Object.entries(index.stats.byType)
@@ -76,7 +36,7 @@ export async function handleIndex(cwd, options = {}) {
         text += `- Duration: ${index.stats.indexDurationMs}ms\n`;
         text += `- Search by meaning: ${semantic ? (index.patterns.some(p => p.embedding?.length) ? 'on' : 'unavailable (local model did not load; name matching still works)') : 'off'}\n`;
         text += `- Types: ${byType}\n\n`;
-        text += `Index synced to context cache layers. Use rigour_context_scope before reading files.`;
+        text += `Use rigour_context_scope before reading files.`;
         const telemetry = buildTelemetryMeta({
             candidateText: candidateEstimate,
             returnedText: text,

package/dist/tools/memory-handlers.js

@@ -14,7 +14,7 @@
  * @since v2.17.0 — extracted from monolithic index.ts
  * @since v4.2.0  — DLP gate on memory persistence
  */
-import { loadMemory, saveMemory } from '../utils/config.js';
+import { loadMemory, saveMemory, USER_MEMORY_OFF, userMemoryEnabled } from '../utils/config.js';
 import { scanInputForCredentials, formatDLPAlert, createDLPAuditEntry, loadTeamConfiguration, shareMemoryLesson, } from '@rigour-labs/core';
 import { loadPatternIndex, getDefaultIndexPath, } from '@rigour-labs/core/pattern-index';
 import { buildTelemetryMeta } from '../utils/context-telemetry.js';
@@ -95,6 +95,8 @@ export async function handleRemember(cwd, key, value, scope = 'repo') {
                 }],
         };
     }
+    if (scope === 'user' && !userMemoryEnabled())
+        return { content: [{ type: "text", text: `MEMORY NOT STORED: ${USER_MEMORY_OFF}` }] };
     // ── DLP Gate: deep-scan key + value (including JSON interiors) ──
     const textToScan = deepScanValue(key, value);
     const dlpResult = scanInputForCredentials(textToScan);
@@ -145,9 +147,11 @@ async function shareWithTeam(cwd, key, value) {
     if (!(await loadTeamConfiguration())) {
         return '\nKept as a team candidate on this machine; it is shared once team mode is configured (rigour team configure).';
     }
-    return '\nShared with your team as a candidate. Teammates\' agents receive it once someone promotes it in Studio (Knowledge › Lessons).';
+    return '\nShared with your team as a candidate. Teammates\' agents receive it once someone shares it from Studio (How it learns).';
 }
 export async function handleForget(cwd, key, scope = 'repo') {
+    if (scope === 'user' && !userMemoryEnabled())
+        return { content: [{ type: "text", text: `NOTHING FORGOTTEN: ${USER_MEMORY_OFF}` }] };
     const store = await loadMemory(cwd, scope);
     if (!store.memories[key]) {
         return { content: [{ type: "text", text: `NO MEMORY FOUND for key "${key}" in ${scope} memory. Nothing to forget.` }] };

package/dist/tools/memory-recall.js

@@ -10,7 +10,7 @@
  *
  * Every returned memory passes the credential scan first; nothing is cached.
  */
-import { formatDLPAlert, createDLPAuditEntry, listKnowledgeLessons, rankByMeaning, rankMemories, scanInputForCredentials, searchTeamKnowledge } from '@rigour-labs/core';
+import { formatDLPAlert, createDLPAuditEntry, listKnowledgeLessons, rankByMeaning, rankMemories, recordLessonsServed, scanInputForCredentials, searchTeamKnowledge } from '@rigour-labs/core';
 import { loadMemory } from '../utils/config.js';
 import { appendDLPAudit, getIndexHealthBlock, wrapRecallResult } from './memory-handlers.js';
 export async function handleRecall(cwd, args = {}) {
@@ -51,6 +51,7 @@ async function recallQuery(cwd, query, entries, candidateText) {
         searchTeamKnowledge(query, 3),
     ]);
     const teamOnly = team.status === 'ready' ? team.candidates.filter(c => !lessons.some(l => l.id === c.lessonId)) : [];
+    recordLessonsServed(cwd, 'recall', [...lessons.map(l => l.subject), ...teamOnly.map(c => c.subject)]);
     const sections = [];
     if (ranked.length) {
         sections.push(`MEMORIES MATCHING "${query}":\n\n` + ranked.map(m => `## ${m.key} (${m.scope}, ${m.match} ${m.score.toFixed(2)})\n${m.value}`).join('\n\n'));

package/dist/tools/pattern-handlers.js

@@ -9,7 +9,7 @@ import path from "path";
 import yaml from "yaml";
 import fs from "fs-extra";
 import { assessPattern, loadPatternIndex, getDefaultIndexPath, SecurityDetector, } from "@rigour-labs/core/pattern-index";
-import { ConfigSchema, estimateTokenCount } from "@rigour-labs/core";
+import { ConfigSchema, estimateTokenCount, recordReuseSuggested } from "@rigour-labs/core";
 import { notifyProgress } from '../utils/notifications.js';
 import { buildTelemetryMeta } from '../utils/context-telemetry.js';
 import { appendContextFooter } from '../utils/context-footer.js';
@@ -90,6 +90,8 @@ export async function handleCheckPattern(cwd, patternName, type, intent, file, s
             resultText += action === 'BLOCK' ? `🚨 PATTERN REINVENTION DETECTED\n` : `💡 SIMILAR PATTERN EXISTS\n`;
             resultText += `"${best.pattern.name}" in ${best.pattern.file}:${best.pattern.line} (${best.matchType}, ${best.confidence}%)\n`;
             resultText += `SUGGESTION: ${assessment.suggestion}\n\n`;
+            if (action !== 'ALLOW')
+                recordReuseSuggested(cwd, patternName, `${best.pattern.name} in ${best.pattern.file}:${best.pattern.line}`, action);
         }
         if (assessment.deprecations.length) {
             resultText += `⚠️ THE EXISTING "${matchedPattern?.name}" USES SOMETHING DEPRECATED\n`;

package/dist/tools/review-handler.js

@@ -5,15 +5,26 @@
  * With no diff, the change is taken from git: uncommitted work (what the
  * agent just wrote, new files included), or the branch against `base`.
  */
-import { acknowledgeReview, buildReviewTask, diffFromGit, recordFixLessons, recordReviewOutcome, reviewChange, toReviewFinding } from "@rigour-labs/core";
+import { acknowledgeReview, buildQualityReceipt, buildReviewTask, receiptReport, diffFromGit, recordFixLessons, recordLessonsServed, recordReviewOutcome, reviewChange, toReviewFinding } from "@rigour-labs/core";
 import { notifyProgress } from '../utils/notifications.js';
+/** What is known about each changed function before a model looks; never fails the review. */
+function qualityReceipt(config, cwd, diff) {
+    try {
+        return { quality_receipt: receiptReport(buildQualityReceipt(cwd, diff, { policy: config.gates.deep?.router, lessonMode: config.gates.deep?.review_lessons })) };
+    }
+    catch {
+        return {};
+    }
+}
 export async function handleReview(config, cwd, args) {
     notifyProgress("info", args.diff ? "Reviewing the provided diff..." : `Reviewing ${args.base ? `this branch against ${args.base}` : "uncommitted changes"}...`);
     try {
         const diff = args.diff ?? diffFromGit(cwd, args.base ? { mode: 'base', base: args.base } : { mode: 'working' });
         const result = await reviewChange({ cwd, config, diff, files: args.files });
         const task = args.mode === 'agent' ? buildReviewTask(cwd, diff, config.gates.deep?.router, config.gates.deep?.review_lessons, config.gates.deep?.repo_rules) : undefined;
-        const capture = recordReviewOutcome(cwd, result.findings, Object.keys(result.changedLines));
+        const capture = recordReviewOutcome(cwd, result.findings, Object.keys(result.changedLines), 'review');
+        if (task)
+            recordLessonsServed(cwd, 'review', task.lessons.map(l => l.text));
         await recordFixLessons(cwd, capture.fixes).catch(() => undefined); // learning never fails a review
         const stats = result.report?.stats;
         return text({
@@ -30,6 +41,7 @@ export async function handleReview(config, cwd, args) {
             excluded_outside_changed_lines: result.excludedOutsideChangedLines,
             unlocated_failures: result.unlocated,
             gate_errors: result.gateErrors,
+            ...qualityReceipt(config, cwd, diff),
             ...(task ? { review_task: { items: task.items, already_reviewed: task.alreadyReviewed, team_lessons: task.lessons, repo_rules: task.rules, instructions: task.instructions } } : {}),
             next_step: nextStep(result.findings.length, task?.items.length ?? 0),
         });

package/dist/utils/config.d.ts

@@ -295,6 +295,15 @@ export interface MemoryStore {
 }
 /** The home whose .rigour/ holds user-scope memory: RIGOUR_HOME when set (tests, sandboxes), else the OS home. */
 export declare function userHome(): string;
+/**
+ * False when RIGOUR_USER_MEMORY=off. A server kept apart from the user's other work (a private
+ * HOME per employer, a sandbox) then never reads or writes ~/.rigour/memory.json, even if it is
+ * started with the real home by mistake.
+ */
+export declare function userMemoryEnabled(): boolean;
+export declare const USER_MEMORY_OFF = "User memory is off on this server (RIGOUR_USER_MEMORY=off); use scope \"repo\".";
+/** The repository a call works in: the call's own cwd, else RIGOUR_CWD, else where the server was started. */
+export declare function resolveCwd(args: unknown): string;
 /** Where memories live: `repo` in this checkout's .rigour/, `user` in ~/.rigour/ for every repository. */
 export type LocalMemoryScope = 'repo' | 'user';
 export declare function getMemoryPath(cwd: string, scope?: LocalMemoryScope): Promise<string>;

package/dist/utils/config.js

@@ -38,12 +38,28 @@ function noteMissingConfig(cwd) {
 export function userHome() {
     return process.env.RIGOUR_HOME || os.homedir();
 }
+/**
+ * False when RIGOUR_USER_MEMORY=off. A server kept apart from the user's other work (a private
+ * HOME per employer, a sandbox) then never reads or writes ~/.rigour/memory.json, even if it is
+ * started with the real home by mistake.
+ */
+export function userMemoryEnabled() {
+    return process.env.RIGOUR_USER_MEMORY?.trim().toLowerCase() !== 'off';
+}
+export const USER_MEMORY_OFF = 'User memory is off on this server (RIGOUR_USER_MEMORY=off); use scope "repo".';
+/** The repository a call works in: the call's own cwd, else RIGOUR_CWD, else where the server was started. */
+export function resolveCwd(args) {
+    const given = args?.cwd;
+    return typeof given === 'string' && given ? given : process.env.RIGOUR_CWD || process.cwd();
+}
 export async function getMemoryPath(cwd, scope = 'repo') {
     const rigourDir = scope === 'user' ? path.join(userHome(), ".rigour") : path.join(cwd, ".rigour");
     await fs.ensureDir(rigourDir);
     return path.join(rigourDir, "memory.json");
 }
 export async function loadMemory(cwd, scope = 'repo') {
+    if (scope === 'user' && !userMemoryEnabled())
+        return { memories: {} };
     const memPath = await getMemoryPath(cwd, scope);
     if (await fs.pathExists(memPath)) {
         const content = await fs.readFile(memPath, "utf-8");
@@ -60,6 +76,8 @@ export async function loadMemory(cwd, scope = 'repo') {
     return { memories: {} };
 }
 export async function saveMemory(cwd, store, scope = 'repo') {
+    if (scope === 'user' && !userMemoryEnabled())
+        throw new Error(USER_MEMORY_OFF);
     const memPath = await getMemoryPath(cwd, scope);
     await fs.writeFile(memPath, JSON.stringify(store, null, 2));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/mcp",
-  "version": "6.5.4",
+  "version": "6.6.1",
   "description": "MCP server + live dashboard for AI code governance — OWASP LLM Top 10 (10/10), real-time MCP App UI, 25+ security patterns, memory and lessons recalled by meaning, hallucinated import detection, multi-agent governance. Works with Claude, Cursor, VS Code, ChatGPT, Goose, Windsurf. Industry presets for HIPAA, SOC2, FedRAMP.",
   "engines": {
     "node": ">=22"
@@ -65,7 +65,7 @@
     "execa": "^8.0.1",
     "fs-extra": "^11.4.0",
     "yaml": "^2.8.2",
-    "@rigour-labs/core": "6.5.4"
+    "@rigour-labs/core": "6.6.1"
   },
   "devDependencies": {
     "@types/node": "^25.0.3",