@rigour-labs/mcp 6.6.0 → 6.6.1

package/README.md

@@ -132,6 +132,8 @@ No global install: npx fetches the server when your agent starts it. Keep a vers
 
 Only Rigour's core tools are listed by default; add `"RIGOUR_MCP_TOOLS": "governance,telemetry"` (or `"full"`) to `env` for the rest. Node.js 22 or later is required.
 
+To keep a server apart from your other work (one per employer or client), add `"RIGOUR_USER_MEMORY": "off"`: it then never reads or writes the memories you keep for all your repositories.
+
 ---
 
 ## 📖 Documentation

package/dist/index.js

@@ -15,7 +15,7 @@ import { CallToolRequestSchema, ListToolsRequestSchema, ListPromptsRequestSchema
 import { randomUUID } from "crypto";
 import { GateRunner, countUsage, flushDailyUsage } from "@rigour-labs/core";
 // Utils
-import { loadConfig, loadMcpSettings, logStudioEvent } from './utils/config.js';
+import { loadConfig, loadMcpSettings, logStudioEvent, resolveCwd } from './utils/config.js';
 import { bindServer } from './utils/notifications.js';
 import { getMcpVersion } from './utils/package-version.js';
 import { buildMcpResultMeta, buildStudioImpact } from './utils/impact-receipt.js';
@@ -85,7 +85,7 @@ server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
 // ─── Tool Dispatch ────────────────────────────────────────────────
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args } = request.params;
-    const cwd = args?.cwd || process.cwd();
+    const cwd = resolveCwd(args);
     const requestId = randomUUID();
     try {
         await logStudioEvent(cwd, { type: "tool_call", requestId, tool: name, arguments: args });
@@ -369,7 +369,7 @@ server.setRequestHandler(ListPromptsRequestSchema, async () => ({
 }));
 server.setRequestHandler(GetPromptRequestSchema, async (request) => {
     const { name, arguments: promptArgs } = request.params;
-    const cwd = promptArgs?.cwd || process.env.RIGOUR_CWD || process.cwd();
+    const cwd = resolveCwd(promptArgs);
     const mcpSettings = await loadMcpSettings(cwd);
     const deepMode = mcpSettings.deep_default_mode;
     const prompt = PROMPT_DEFINITIONS.find((p) => p.name === name);

package/dist/tools/memory-handlers.js

@@ -14,7 +14,7 @@
  * @since v2.17.0 — extracted from monolithic index.ts
  * @since v4.2.0  — DLP gate on memory persistence
  */
-import { loadMemory, saveMemory } from '../utils/config.js';
+import { loadMemory, saveMemory, USER_MEMORY_OFF, userMemoryEnabled } from '../utils/config.js';
 import { scanInputForCredentials, formatDLPAlert, createDLPAuditEntry, loadTeamConfiguration, shareMemoryLesson, } from '@rigour-labs/core';
 import { loadPatternIndex, getDefaultIndexPath, } from '@rigour-labs/core/pattern-index';
 import { buildTelemetryMeta } from '../utils/context-telemetry.js';
@@ -95,6 +95,8 @@ export async function handleRemember(cwd, key, value, scope = 'repo') {
                 }],
         };
     }
+    if (scope === 'user' && !userMemoryEnabled())
+        return { content: [{ type: "text", text: `MEMORY NOT STORED: ${USER_MEMORY_OFF}` }] };
     // ── DLP Gate: deep-scan key + value (including JSON interiors) ──
     const textToScan = deepScanValue(key, value);
     const dlpResult = scanInputForCredentials(textToScan);
@@ -148,6 +150,8 @@ async function shareWithTeam(cwd, key, value) {
     return '\nShared with your team as a candidate. Teammates\' agents receive it once someone shares it from Studio (How it learns).';
 }
 export async function handleForget(cwd, key, scope = 'repo') {
+    if (scope === 'user' && !userMemoryEnabled())
+        return { content: [{ type: "text", text: `NOTHING FORGOTTEN: ${USER_MEMORY_OFF}` }] };
     const store = await loadMemory(cwd, scope);
     if (!store.memories[key]) {
         return { content: [{ type: "text", text: `NO MEMORY FOUND for key "${key}" in ${scope} memory. Nothing to forget.` }] };

package/dist/tools/review-handler.js

@@ -5,8 +5,17 @@
  * With no diff, the change is taken from git: uncommitted work (what the
  * agent just wrote, new files included), or the branch against `base`.
  */
-import { acknowledgeReview, buildReviewTask, diffFromGit, recordFixLessons, recordLessonsServed, recordReviewOutcome, reviewChange, toReviewFinding } from "@rigour-labs/core";
+import { acknowledgeReview, buildQualityReceipt, buildReviewTask, receiptReport, diffFromGit, recordFixLessons, recordLessonsServed, recordReviewOutcome, reviewChange, toReviewFinding } from "@rigour-labs/core";
 import { notifyProgress } from '../utils/notifications.js';
+/** What is known about each changed function before a model looks; never fails the review. */
+function qualityReceipt(config, cwd, diff) {
+    try {
+        return { quality_receipt: receiptReport(buildQualityReceipt(cwd, diff, { policy: config.gates.deep?.router, lessonMode: config.gates.deep?.review_lessons })) };
+    }
+    catch {
+        return {};
+    }
+}
 export async function handleReview(config, cwd, args) {
     notifyProgress("info", args.diff ? "Reviewing the provided diff..." : `Reviewing ${args.base ? `this branch against ${args.base}` : "uncommitted changes"}...`);
     try {
@@ -32,6 +41,7 @@ export async function handleReview(config, cwd, args) {
             excluded_outside_changed_lines: result.excludedOutsideChangedLines,
             unlocated_failures: result.unlocated,
             gate_errors: result.gateErrors,
+            ...qualityReceipt(config, cwd, diff),
             ...(task ? { review_task: { items: task.items, already_reviewed: task.alreadyReviewed, team_lessons: task.lessons, repo_rules: task.rules, instructions: task.instructions } } : {}),
             next_step: nextStep(result.findings.length, task?.items.length ?? 0),
         });

package/dist/utils/config.d.ts

@@ -295,6 +295,15 @@ export interface MemoryStore {
 }
 /** The home whose .rigour/ holds user-scope memory: RIGOUR_HOME when set (tests, sandboxes), else the OS home. */
 export declare function userHome(): string;
+/**
+ * False when RIGOUR_USER_MEMORY=off. A server kept apart from the user's other work (a private
+ * HOME per employer, a sandbox) then never reads or writes ~/.rigour/memory.json, even if it is
+ * started with the real home by mistake.
+ */
+export declare function userMemoryEnabled(): boolean;
+export declare const USER_MEMORY_OFF = "User memory is off on this server (RIGOUR_USER_MEMORY=off); use scope \"repo\".";
+/** The repository a call works in: the call's own cwd, else RIGOUR_CWD, else where the server was started. */
+export declare function resolveCwd(args: unknown): string;
 /** Where memories live: `repo` in this checkout's .rigour/, `user` in ~/.rigour/ for every repository. */
 export type LocalMemoryScope = 'repo' | 'user';
 export declare function getMemoryPath(cwd: string, scope?: LocalMemoryScope): Promise<string>;

package/dist/utils/config.js

@@ -38,12 +38,28 @@ function noteMissingConfig(cwd) {
 export function userHome() {
     return process.env.RIGOUR_HOME || os.homedir();
 }
+/**
+ * False when RIGOUR_USER_MEMORY=off. A server kept apart from the user's other work (a private
+ * HOME per employer, a sandbox) then never reads or writes ~/.rigour/memory.json, even if it is
+ * started with the real home by mistake.
+ */
+export function userMemoryEnabled() {
+    return process.env.RIGOUR_USER_MEMORY?.trim().toLowerCase() !== 'off';
+}
+export const USER_MEMORY_OFF = 'User memory is off on this server (RIGOUR_USER_MEMORY=off); use scope "repo".';
+/** The repository a call works in: the call's own cwd, else RIGOUR_CWD, else where the server was started. */
+export function resolveCwd(args) {
+    const given = args?.cwd;
+    return typeof given === 'string' && given ? given : process.env.RIGOUR_CWD || process.cwd();
+}
 export async function getMemoryPath(cwd, scope = 'repo') {
     const rigourDir = scope === 'user' ? path.join(userHome(), ".rigour") : path.join(cwd, ".rigour");
     await fs.ensureDir(rigourDir);
     return path.join(rigourDir, "memory.json");
 }
 export async function loadMemory(cwd, scope = 'repo') {
+    if (scope === 'user' && !userMemoryEnabled())
+        return { memories: {} };
     const memPath = await getMemoryPath(cwd, scope);
     if (await fs.pathExists(memPath)) {
         const content = await fs.readFile(memPath, "utf-8");
@@ -60,6 +76,8 @@ export async function loadMemory(cwd, scope = 'repo') {
     return { memories: {} };
 }
 export async function saveMemory(cwd, store, scope = 'repo') {
+    if (scope === 'user' && !userMemoryEnabled())
+        throw new Error(USER_MEMORY_OFF);
     const memPath = await getMemoryPath(cwd, scope);
     await fs.writeFile(memPath, JSON.stringify(store, null, 2));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/mcp",
-  "version": "6.6.0",
+  "version": "6.6.1",
   "description": "MCP server + live dashboard for AI code governance — OWASP LLM Top 10 (10/10), real-time MCP App UI, 25+ security patterns, memory and lessons recalled by meaning, hallucinated import detection, multi-agent governance. Works with Claude, Cursor, VS Code, ChatGPT, Goose, Windsurf. Industry presets for HIPAA, SOC2, FedRAMP.",
   "engines": {
     "node": ">=22"
@@ -65,7 +65,7 @@
     "execa": "^8.0.1",
     "fs-extra": "^11.4.0",
     "yaml": "^2.8.2",
-    "@rigour-labs/core": "6.6.0"
+    "@rigour-labs/core": "6.6.1"
   },
   "devDependencies": {
     "@types/node": "^25.0.3",