@rigour-labs/mcp 6.6.1 → 6.6.3

package/dist/advertised-tools.d.ts

@@ -12,7 +12,7 @@ export type ToolGroup = keyof typeof TOOL_GROUPS;
 export declare const GOVERNANCE_TOOLS: readonly ["rigour_agent_register", "rigour_agent_deregister", "rigour_checkpoint", "rigour_handoff", "rigour_handoff_accept", "rigour_hooks_check", "rigour_hooks_init", "rigour_run", "rigour_run_supervised"];
 /** Tool names for a RIGOUR_MCP_TOOLS value; core is always included, unknown groups are ignored. */
 export declare function advertisedToolNames(spec?: string | undefined): Set<string>;
-export declare function getAdvertisedToolDefinitions(spec?: string): ({
+export declare function getAdvertisedToolDefinitions(spec?: string | undefined, cwd?: string): ({
     name: string;
     description: string;
     inputSchema: {

package/dist/advertised-tools.js

@@ -4,9 +4,14 @@
  * Every advertised tool costs every agent session its definition in context
  * and one more choice to get wrong, so the default is the core loop a single
  * agent needs. Other groups are opt-in through RIGOUR_MCP_TOOLS in the MCP
- * client's config, e.g. "governance,telemetry" or "full". Tools outside the
+ * client's config, e.g. "governance,telemetry" or "full". A repository whose
+ * rigour.yml turns on agent teams or checkpoints gets the governance group too,
+ * since its gates expect agents to register and check in. Tools outside the
  * advertised set stay callable; they are just not listed.
  */
+import fs from 'fs';
+import path from 'path';
+import yaml from 'yaml';
 import { TOOL_DEFINITIONS } from './tools/definitions.js';
 export const TOOL_GROUPS = {
     /** Load memory, scope context, avoid reinvention, gate and review the change, learn. */
@@ -54,7 +59,17 @@ export function advertisedToolNames(spec = process.env.RIGOUR_MCP_TOOLS) {
     const groups = requested.includes('full') ? Object.keys(TOOL_GROUPS) : ['core', ...requested];
     return new Set(groups.filter((g) => g in TOOL_GROUPS).flatMap(g => [...TOOL_GROUPS[g]]));
 }
-export function getAdvertisedToolDefinitions(spec) {
-    const names = advertisedToolNames(spec);
+/** The repository's rigour.yml enables a gate that needs the governance tools (agent_team, checkpoint). */
+function repoNeedsGovernance(cwd) {
+    try {
+        const gates = yaml.parse(fs.readFileSync(path.join(cwd, 'rigour.yml'), 'utf8'))?.gates ?? {};
+        return gates.agent_team?.enabled === true || gates.checkpoint?.enabled === true;
+    }
+    catch {
+        return false;
+    }
+}
+export function getAdvertisedToolDefinitions(spec = process.env.RIGOUR_MCP_TOOLS, cwd = process.env.RIGOUR_CWD || process.cwd()) {
+    const names = advertisedToolNames([spec, repoNeedsGovernance(cwd) ? 'governance' : ''].filter(Boolean).join(','));
     return TOOL_DEFINITIONS.filter(t => names.has(t.name));
 }

package/dist/bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+// The `rigour-mcp` server: apply the profile for the repository it serves (RIGOUR_CWD, else where it
+// started) before the rest of Rigour loads; each call is then checked against it (index.ts).
+import { applyProfile } from '@rigour-labs/core/profile';
+applyProfile(process.env.RIGOUR_CWD || process.cwd());
+await import('./index.js');

package/dist/index.js

@@ -16,6 +16,7 @@ import { randomUUID } from "crypto";
 import { GateRunner, countUsage, flushDailyUsage } from "@rigour-labs/core";
 // Utils
 import { loadConfig, loadMcpSettings, logStudioEvent, resolveCwd } from './utils/config.js';
+import { profileMismatch } from '@rigour-labs/core/profile';
 import { bindServer } from './utils/notifications.js';
 import { getMcpVersion } from './utils/package-version.js';
 import { buildMcpResultMeta, buildStudioImpact } from './utils/impact-receipt.js';
@@ -87,6 +88,9 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args } = request.params;
     const cwd = resolveCwd(args);
     const requestId = randomUUID();
+    const foreign = profileMismatch(cwd);
+    if (foreign)
+        return { content: [{ type: "text", text: `ERROR: ${foreign}` }], isError: true };
     try {
         await logStudioEvent(cwd, { type: "tool_call", requestId, tool: name, arguments: args });
         try {

package/dist/tools/review-handler.js

@@ -39,6 +39,7 @@ export async function handleReview(config, cwd, args) {
             advisory_count: result.advisory.length,
             muted_count: result.muted,
             excluded_outside_changed_lines: result.excludedOutsideChangedLines,
+            preexisting_not_reported: result.preexisting,
             unlocated_failures: result.unlocated,
             gate_errors: result.gateErrors,
             ...qualityReceipt(config, cwd, diff),

package/dist/utils/config.d.ts

@@ -234,6 +234,23 @@ export declare function loadConfig(cwd: string): Promise<{
             enabled: boolean;
             registry?: string | undefined;
         };
+        unused_exports: {
+            enabled: boolean;
+            allow: string[];
+        };
+        query_patterns: {
+            enabled: boolean;
+        };
+        optional_params: {
+            enabled: boolean;
+        };
+        duplicate_functions: {
+            enabled: boolean;
+        };
+        orphan_files: {
+            enabled: boolean;
+            allow: string[];
+        };
         migration_order: {
             enabled: boolean;
             dirs: string[];
@@ -282,6 +299,14 @@ export declare function loadConfig(cwd: string): Promise<{
     };
     review: {
         include_heuristics: boolean;
+        show_preexisting: boolean;
+        reviewer: {
+            enabled: boolean;
+            timeout_ms: number;
+            command: string;
+            model?: string | undefined;
+        };
+        github_account?: string | undefined;
     };
     planned: string[];
     preset?: string | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/mcp",
-  "version": "6.6.1",
+  "version": "6.6.3",
   "description": "MCP server + live dashboard for AI code governance — OWASP LLM Top 10 (10/10), real-time MCP App UI, 25+ security patterns, memory and lessons recalled by meaning, hallucinated import detection, multi-agent governance. Works with Claude, Cursor, VS Code, ChatGPT, Goose, Windsurf. Industry presets for HIPAA, SOC2, FedRAMP.",
   "engines": {
     "node": ">=22"
@@ -50,7 +50,7 @@
     "README.md"
   ],
   "bin": {
-    "rigour-mcp": "dist/index.js"
+    "rigour-mcp": "dist/bin.js"
   },
   "repository": {
     "type": "git",
@@ -65,7 +65,7 @@
     "execa": "^8.0.1",
     "fs-extra": "^11.4.0",
     "yaml": "^2.8.2",
-    "@rigour-labs/core": "6.6.1"
+    "@rigour-labs/core": "6.6.3"
   },
   "devDependencies": {
     "@types/node": "^25.0.3",