@rigour-labs/mcp 6.6.6 → 6.7.0

package/README.md

@@ -1,147 +1,42 @@
-# 🛡️ Rigour MCP Server
+# @rigour-labs/mcp
 
-**AI Agent Governance via Model Context Protocol — quality gates, DLP, drift detection, and deep analysis.**
+[![npm version](https://img.shields.io/npm/v/@rigour-labs/mcp?color=4f46e5)](https://www.npmjs.com/package/@rigour-labs/mcp)
 
-Rigour is a local-first MCP server that governs AI agents (Claude, Cursor, Cline, Windsurf) with deterministic quality gates, credential warnings, and memory governance.
+Rigour's MCP server. It gives a coding agent tools to review its own change before it says it is done, to
+check for an existing helper before writing a new one, and to recall what the repository and the team have
+learned. It runs on your machine over stdio and works with Claude Code, Cursor and other MCP clients.
 
-[![Registry](https://img.shields.io/badge/MCP-Registry-brightgreen)](https://github.com/mcp)
-[![npm version](https://img.shields.io/npm/v/@rigour-labs/mcp?color=cyan)](https://www.npmjs.com/package/@rigour-labs/mcp)
+## Set it up
 
----
+`rigour setup` (from [@rigour-labs/cli](https://www.npmjs.com/package/@rigour-labs/cli)) registers it for
+Claude Code and Cursor, together with the hooks that run Rigour's checks whether or not the agent asks. To
+register it by hand:
 
-## 🚀 Overview
-
-Rigour moves code quality enforcement from "Post-Commit" to "In-Progress." By running as an MCP server inside your editor, it provides the AI with a deterministic PASS/FAIL loop, preventing "Vibe Coding" and broken builds.
-
-### Key Features:
-
-- **27+ Quality Gates**: Deterministic checks for file size, complexity, hygiene, security, and AI-native drift detection.
-- **8-Language Hallucination Detection**: JS/TS, Python, Go, Ruby, C#/.NET, Rust, Java, and Kotlin — with stdlib whitelists, dependency manifest parsing, and project-relative import resolution.
-- **AI Agent DLP**: 29 credential patterns intercepted before agents see them (<50ms). Anti-evasion: unicode normalization, entropy detection, bidi stripping.
-- **Memory & Skills Governance**: Blocks agent writes to native memory files (CLAUDE.md, .clinerules, .windsurf/memories/); forces DLP-scanned `rigour_remember` instead.
-- **Real-Time Hooks**: Sub-200ms file-write hooks for Claude Code, Cursor, Cline, and Windsurf — catches issues as the AI writes, not after CI.
-- **Two-Score System**: Separate AI Health Score and Structural Score with provenance tracking (`ai-drift`, `traditional`, `security`, `governance`).
-- **Deep Analysis**: Five-signal LLM pipeline (AST facts, embeddings, style fingerprints, logic baselines, dependency graphs) with deterministic verification.
-- **Multi-Agent Governance**: Agent registration, scope isolation, checkpoint supervision, and verified handoffs.
-- **Industry Presets**: SOC2, HIPAA, FedRAMP-ready gate configurations.
-- **Local-First**: Deterministic gates run locally. Cloud deep analysis is opt-in BYOK.
-
----
-
-## 🛠️ Available Tools (25)
-
-### Core Quality Tools
-
-| Tool | Description |
-|:---|:---|
-| `rigour_check` | Runs all configured quality gates on the current workspace. |
-| `rigour_explain` | Explains why a specific gate failed with actionable fix instructions. |
-| `rigour_status` | Quick PASS/FAIL check with JSON-friendly output for polling. |
-| `rigour_get_fix_packet` | Retrieves prioritized Fix Packet (v2) with severity and provenance. |
-| `rigour_list_gates` | Lists all configured quality gates and their thresholds. |
-| `rigour_get_config` | Returns the current rigour.yml configuration. |
-| `rigour_check_pattern` | Checks if a proposed code pattern already exists in the codebase. |
-| `rigour_security_audit` | Runs a live CVE check on project dependencies. |
-| `rigour_review` | High-fidelity code review on a PR diff against all quality gates. |
-
-### Memory & Context Tools
-
-| Tool | Description |
-|:---|:---|
-| `rigour_remember` | Memory for this repository, all your repositories (`scope: "user"`), or your team (`scope: "team"`, served once promoted). Refuses values containing credentials. |
-| `rigour_recall` | `query`: the memories that match by meaning, plus promoted team knowledge; `key`: one memory. Withholds any memory containing a credential. |
-| `rigour_forget` | Removes a stored memory by key. |
-
-### Real-Time Hooks & DLP
-
-| Tool | Description |
-|:---|:---|
-| `rigour_hooks_check` | Fast hook checker on specific files (<200ms). Also accepts `text` param for DLP mode — scans user input for credentials (AWS keys, API tokens, database URLs, private keys, JWTs) before agent processing. |
-| `rigour_hooks_init` | Generate hook configs for Claude, Cursor, Cline, or Windsurf. Installs quality hooks + DLP pre-input hooks by default. Pass `dlp: false` to skip DLP. |
-
-### Deep Analysis
-
-| Tool | Description |
-|:---|:---|
-| `rigour_check_deep` | LLM-powered code review with five-signal extraction → verification pipeline. Local-first or cloud BYOK. |
-| `rigour_deep_stats` | Score history, trend analysis, and top issues from SQLite storage. |
-
-### Supervisor & Execution
-
-| Tool | Description |
-|:---|:---|
-| `rigour_run` | Executes a command under Rigour supervision with human arbitration. |
-| `rigour_run_supervised` | Full supervisor mode — iterative command + gate check loop. |
-
-### Settings
-
-| Tool | Description |
-|:---|:---|
-| `rigour_mcp_get_settings` | Get MCP runtime settings (.rigour/mcp-settings.json). |
-| `rigour_mcp_set_settings` | Set MCP runtime settings (e.g., deep_default_mode). |
-
-### Multi-Agent Governance
-
-| Tool | Description |
-|:---|:---|
-| `rigour_agent_register` | Register agent in session with scope conflict detection. |
-| `rigour_agent_deregister` | Remove agent from session when work is complete. |
-| `rigour_checkpoint` | Record quality checkpoint with drift detection. |
-| `rigour_handoff` | Initiate task handoff to another agent. |
-| `rigour_handoff_accept` | Accept a pending handoff from another agent. |
-
----
-
-## 🌐 Language Support
-
-Hallucinated import detection with full stdlib whitelists and dependency manifest parsing:
-
-| Language | Stdlib | Dependency Manifest | Import Patterns |
-|:---|:---|:---|:---|
-| **JavaScript/TypeScript** | Node.js 22.x builtins | `package.json` | `import`, `require()`, `export from` |
-| **Python** | 160+ stdlib modules (3.12+) | Local module resolution | `import`, `from ... import` |
-| **Go** | 150+ stdlib packages (1.22+) | `go.mod` module path | `import "..."`, aliased imports |
-| **Ruby** | 80+ stdlib gems (3.3+ MRI) | `Gemfile`, `.gemspec` | `require`, `require_relative` |
-| **C# / .NET** | .NET 8 framework namespaces | `.csproj` (NuGet PackageReference) | `using`, `using static` |
-| **Rust** | `std`/`core`/`alloc`/`proc_macro` | `Cargo.toml` (with `-` → `_`) | `use`, `extern crate`, `pub use` |
-| **Java** | `java.*`/`javax.*`/`jakarta.*` | `build.gradle`, `pom.xml` | `import`, `import static` |
-| **Kotlin** | `kotlin.*`/`kotlinx.*` + Java interop | `build.gradle.kts` | `import` |
-
----
-
-## 📦 Installation
-
-No global install: npx fetches the server when your agent starts it. Keep a version in the package name (`@latest`, or a major such as `@6`); with a bare `@rigour-labs/mcp`, npx runs any older copy installed globally instead. If you once ran `npm install -g @rigour-labs/mcp`, remove it with `npm rm -g @rigour-labs/mcp`.
+```bash
+claude mcp add --scope user rigour -- npx -y @rigour-labs/mcp@6
+```
 
-**Claude Code:** use the plugin (`/plugin marketplace add rigour-labs/rigour-plugin`, then `/plugin install rigour@rigour-labs`).
+Or, in any client's MCP configuration:
 
-**Cursor, Claude Desktop and other MCP clients:**
 ```json
-{
-  "mcpServers": {
-    "rigour": {
-      "command": "npx",
-      "args": ["-y", "@rigour-labs/mcp@latest"],
-      "env": {
-        "RIGOUR_CWD": "/path/to/your/project"
-      }
-    }
-  }
-}
+{ "mcpServers": { "rigour": { "command": "npx", "args": ["-y", "@rigour-labs/mcp@6"] } } }
 ```
 
-Only Rigour's core tools are listed by default; add `"RIGOUR_MCP_TOOLS": "governance,telemetry"` (or `"full"`) to `env` for the rest. Node.js 22 or later is required.
-
-To keep a server apart from your other work (one per employer or client), add `"RIGOUR_USER_MEMORY": "off"`: it then never reads or writes the memories you keep for all your repositories.
-
----
-
-## 📖 Documentation
+Node 22 or later. Each call works in the repository given by its `cwd` argument, else `RIGOUR_CWD`, else
+the directory the server started in.
 
-For full configuration and advanced usage, visit **[docs.rigour.run](https://docs.rigour.run)**.
+## The tools
 
----
+| Tool | What it is for |
+| --- | --- |
+| `rigour_review` | Review the change before calling it done: only findings on changed lines, each with a fix |
+| `rigour_review_ack` | Record the agent's verdict on a risky changed function |
+| `rigour_reviewer_verdict` | What the reviewer last decided for the branch (read-only) |
+| `rigour_check`, `rigour_get_fix_packet` | Run the checks, and get the violations a page at a time |
+| `rigour_index`, `rigour_context_scope`, `rigour_check_pattern` | Find the few files a task needs, and whether a helper already exists |
+| `rigour_recall`, `rigour_remember` | Recall and store conventions and lessons |
 
-## 📜 License
+More groups (agent teams, context, telemetry) are listed with `RIGOUR_MCP_TOOLS`. Every tool:
+[Coding agents and MCP](https://github.com/rigour-labs/rigour/blob/main/docs/AGENTS.md).
 
 MIT © [Rigour Labs](https://github.com/rigour-labs)

package/dist/advertised-tools.d.ts

@@ -1,6 +1,6 @@
 export declare const TOOL_GROUPS: {
     /** Load memory, scope context, avoid reinvention, gate and review the change, learn. */
-    readonly core: readonly ["rigour_recall", "rigour_index", "rigour_context_scope", "rigour_check_pattern", "rigour_check", "rigour_review", "rigour_review_ack", "rigour_get_fix_packet", "rigour_remember"];
+    readonly core: readonly ["rigour_recall", "rigour_index", "rigour_context_scope", "rigour_check_pattern", "rigour_check", "rigour_review", "rigour_review_ack", "rigour_reviewer_verdict", "rigour_get_fix_packet", "rigour_remember"];
     /** Multi-agent registration, checkpoints, handoffs, hooks and supervised runs. */
     readonly governance: readonly ["rigour_agent_register", "rigour_agent_deregister", "rigour_checkpoint", "rigour_handoff", "rigour_handoff_accept", "rigour_hooks_check", "rigour_hooks_init", "rigour_run", "rigour_run_supervised"];
     /** Occasional context and security tools. */

package/dist/advertised-tools.js

@@ -23,6 +23,7 @@ export const TOOL_GROUPS = {
         'rigour_check',
         'rigour_review',
         'rigour_review_ack',
+        'rigour_reviewer_verdict',
         'rigour_get_fix_packet',
         'rigour_remember',
     ],

package/dist/index.js

@@ -32,6 +32,7 @@ import { handleCheckPattern, handleSecurityAudit } from './tools/pattern-handler
 import { handleRun, handleRunSupervised } from './tools/execution-handlers.js';
 import { handleAgentRegister, handleCheckpoint, handleHandoff, handleAgentDeregister, handleHandoffAccept } from './tools/agent-handlers.js';
 import { handleReview, handleReviewAck } from './tools/review-handler.js';
+import { handleReviewerVerdict } from './tools/reviewer-verdict-handler.js';
 import { handleHooksCheck, handleHooksInit } from './tools/hooks-handler.js';
 import { handleCheckDeep, handleDeepStats } from './tools/deep-handlers.js';
 import { handleMcpGetSettings, handleMcpSetSettings } from './tools/mcp-settings-handler.js';
@@ -226,6 +227,9 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             case "rigour_review_ack":
                 result = handleReviewAck(cwd, args);
                 break;
+            case "rigour_reviewer_verdict":
+                result = await handleReviewerVerdict(cwd);
+                break;
             // Context Telemetry & Cost Tools
             case "rigour_context_stats":
                 result = await handleContextStats(cwd, args.taskId);

package/dist/tools/definitions.js

@@ -536,6 +536,22 @@ export const TOOL_DEFINITIONS = [
             openWorldHint: false,
         },
     },
+    {
+        name: "rigour_reviewer_verdict",
+        description: "What the model reviewer last decided for this branch: the confirmed items to fix (with id, file:line, consequence and evidence), the disputed ones that are not work, which mode ran, and whether the verdict is for the current commit. Read-only: never runs a model, never dismisses.",
+        inputSchema: {
+            type: "object",
+            properties: { ...cwdParam() },
+            required: ["cwd"],
+        },
+        annotations: {
+            title: "Reviewer Verdict",
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+    },
     {
         name: "rigour_review_ack",
         description: "Record that you reviewed a function from rigour_review's review_task: verdict \"fixed\" (you fixed a defect) or \"no_issue\", with a note saying what you checked. Covers the function's current code only; editing it later puts it back in the task.",
@@ -580,7 +596,7 @@ export const TOOL_DEFINITIONS = [
     },
     {
         name: "rigour_task_cost",
-        description: "Returns both verified actual model usage/cost (from Cursor Admin API or imported CSV) and Rigour estimated avoided context/cost USD.",
+        description: "Rigour's estimate of the context and cost its scoped reads avoided for a task, beside any model usage recorded for it.",
         inputSchema: {
             type: "object",
             properties: {

package/dist/tools/reviewer-verdict-handler.d.ts

@@ -0,0 +1,2 @@
+import type { ToolResult } from '../utils/context-telemetry.js';
+export declare function handleReviewerVerdict(cwd: string): Promise<ToolResult>;

package/dist/tools/reviewer-verdict-handler.js

@@ -0,0 +1,46 @@
+/**
+ * rigour_reviewer_verdict: what the model reviewer last decided for this branch, for the agent
+ * that does the fixing. Confirmed items are the work, each with the id a person can dismiss it by;
+ * disputed items have no majority and are not work. Read only: it never runs a model (that spends
+ * the person's money) and never dismisses (a person decides what is not a bug).
+ */
+import { execFileSync } from 'child_process';
+import { reviewStatus } from '@rigour-labs/core';
+const git = (cwd, args) => {
+    try {
+        return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    }
+    catch {
+        return '';
+    }
+};
+const brief = (item) => ({ id: item.id, class: item.class, file: item.file ?? null, line: item.line ?? null, issue: item.issue, consequence: item.consequence ?? null, evidence: item.evidence ?? null, judges: item.reviewer ?? null });
+export async function handleReviewerVerdict(cwd) {
+    const branch = git(cwd, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    const head = git(cwd, ['rev-parse', 'HEAD']);
+    const status = branch ? await reviewStatus(cwd, branch) : undefined;
+    if (!status)
+        return { content: [{ type: 'text', text: JSON.stringify({ error: 'not a git repository' }) }], isError: true };
+    const last = status.last;
+    const answer = {
+        branch,
+        running: status.running ? { head: status.running.head } : null,
+        last_attempt: status.attempt ? { head: status.attempt.head, outcome: status.attempt.outcome, reason: status.attempt.reason } : null,
+        verdict: last ? {
+            head: last.head,
+            current: last.head === head,
+            scope: last.mode,
+            ran: last.ran ?? null,
+            fix: last.open.map(brief),
+            disputed_not_work: last.disputed.map(brief),
+        } : null,
+        next: !last && status.attempt
+            ? `The last review ${status.attempt.outcome === 'skipped' ? 'was skipped' : 'could not run'}: ${status.attempt.reason}. Tell the person; there is nothing from the reviewer to fix yet.`
+            : !last
+                ? 'No reviewer verdict on this branch yet. A person runs `rigour review --reviewer`, or pushes with the reviewer on.'
+                : last.open.length
+                    ? `Fix each item in "fix", then push; the next review checks each by id.${last.head === head ? '' : ' This verdict is for an earlier commit: some items may already be fixed.'} If one is not a bug, say why to the person: only they can dismiss it.`
+                    : 'Nothing to fix from the reviewer.',
+    };
+    return { content: [{ type: 'text', text: JSON.stringify(answer, null, 2) }] };
+}

package/dist/utils/config.d.ts

@@ -5,7 +5,6 @@
  */
 export declare function loadConfig(cwd: string): Promise<{
     ignore: string[];
-    version: number;
     commands: {
         format?: string | undefined;
         lint?: string | undefined;
@@ -14,11 +13,6 @@ export declare function loadConfig(cwd: string): Promise<{
     };
     gates: {
         deep: {
-            enabled: boolean;
-            pro: boolean;
-            max: boolean;
-            provider: string;
-            threads: number;
             temperature: number;
             intent_checks: boolean;
             checks: {
@@ -31,10 +25,6 @@ export declare function loadConfig(cwd: string): Promise<{
                 error_handling: boolean;
                 code_smells: boolean;
             };
-            api_key?: string | undefined;
-            api_base_url?: string | undefined;
-            model_name?: string | undefined;
-            model_path?: string | undefined;
             max_tokens?: number | undefined;
             timeout_ms?: number | undefined;
             budget_ms?: number | undefined;
@@ -50,16 +40,11 @@ export declare function loadConfig(cwd: string): Promise<{
         max_file_lines: number;
         forbid_todos: boolean;
         forbid_fixme: boolean;
-        forbid_paths: string[];
         required_files: string[];
         ast: {
             complexity: number;
             max_methods: number;
             max_params: number;
-            max_nesting: number;
-            max_inheritance_depth: number;
-            max_class_dependencies: number;
-            max_function_lines: number;
         };
         staleness: {
             enabled: boolean;
@@ -71,7 +56,6 @@ export declare function loadConfig(cwd: string): Promise<{
             detect_heavy_alternatives: boolean;
             detect_duplicate_purpose: boolean;
             unused_allowlist: string[];
-            trusted_registry?: string | undefined;
         };
         architecture: {
             boundaries: {
@@ -88,11 +72,6 @@ export declare function loadConfig(cwd: string): Promise<{
             enabled: boolean;
             sensitivity: number;
             mining_depth: number;
-            ignored_patterns: string[];
-            cross_file_patterns: boolean;
-            naming_consistency: boolean;
-            import_relationships: boolean;
-            max_cross_file_depth: number;
         };
         environment: {
             enabled: boolean;
@@ -103,14 +82,11 @@ export declare function loadConfig(cwd: string): Promise<{
         retry_loop_breaker: {
             enabled: boolean;
             max_retries: number;
-            auto_classify: boolean;
             doc_sources: Record<string, string>;
         };
         agent_team: {
             enabled: boolean;
             max_concurrent_agents: number;
-            cross_agent_pattern_check: boolean;
-            handoff_verification: boolean;
             task_ownership: "strict" | "collaborative";
         };
         checkpoint: {
@@ -118,7 +94,6 @@ export declare function loadConfig(cwd: string): Promise<{
             interval_minutes: number;
             quality_threshold: number;
             drift_detection: boolean;
-            auto_save_on_failure: boolean;
         };
         security: {
             enabled: boolean;
@@ -141,13 +116,6 @@ export declare function loadConfig(cwd: string): Promise<{
             server_path_patterns: string[];
             allowlist_env_names: string[];
         };
-        adaptive: {
-            enabled: boolean;
-            base_coverage_threshold: number;
-            base_quality_threshold: number;
-            auto_detect_tier: boolean;
-            forced_tier?: "hobby" | "startup" | "enterprise" | undefined;
-        };
         duplication_drift: {
             enabled: boolean;
             similarity_threshold: number;
@@ -155,8 +123,6 @@ export declare function loadConfig(cwd: string): Promise<{
         };
         hallucinated_imports: {
             enabled: boolean;
-            check_relative: boolean;
-            check_packages: boolean;
             ignore_patterns: string[];
         };
         inconsistent_error_handling: {
@@ -201,11 +167,9 @@ export declare function loadConfig(cwd: string): Promise<{
         };
         test_quality: {
             enabled: boolean;
-            ignore_patterns: string[];
             check_empty_tests: boolean;
             check_tautological: boolean;
             check_mock_heavy: boolean;
-            check_snapshot_abuse: boolean;
             check_assertion_free_async: boolean;
             max_mocks_per_test: number;
         };
@@ -218,14 +182,6 @@ export declare function loadConfig(cwd: string): Promise<{
             protected_skills_paths: string[];
             exempt_paths: string[];
         };
-        input_validation: {
-            enabled: boolean;
-            ignore_patterns: string[];
-            block_on_detection: boolean;
-            min_secret_length: number;
-            custom_patterns: string[];
-            audit_log: boolean;
-        };
         unindexed_reads: {
             enabled: boolean;
             migrations: string[];
@@ -247,6 +203,7 @@ export declare function loadConfig(cwd: string): Promise<{
         redundancy: {
             enabled: boolean;
             wire_contracts: string[];
+            schema_migrations: string[];
         };
         optional_params: {
             enabled: boolean;
@@ -293,13 +250,7 @@ export declare function loadConfig(cwd: string): Promise<{
         };
     };
     hooks: {
-        enabled: boolean;
-        tools: ("claude" | "cursor" | "cline" | "windsurf")[];
-        timeout_ms: number;
-        fast_gates: string[];
-        block_on_failure: boolean;
         require_review_ack: boolean;
-        dlp: boolean;
     };
     output: {
         report_path: string;
@@ -314,11 +265,19 @@ export declare function loadConfig(cwd: string): Promise<{
             on_push: "off" | "background" | "wait";
             reviewers: string[];
             models: Record<string, string>;
+            panel: "off" | "on" | "required";
+            mode_required: boolean;
+            dismissals: boolean;
+            panel_max_items: number;
+            judges: 2 | 3;
+            escalate: "always" | "risk";
+            cross_models: Record<string, string>;
             model?: string | undefined;
+            max_runs_per_day?: number | undefined;
+            max_usd_per_day?: number | undefined;
         };
         github_account?: string | undefined;
     };
-    planned: string[];
     preset?: string | undefined;
     paradigm?: string | undefined;
 }>;

package/dist/utils/config.js

@@ -22,7 +22,7 @@ export async function loadConfig(cwd) {
     const configPath = path.join(cwd, "rigour.yml");
     if (!(await fs.pathExists(configPath))) {
         noteMissingConfig(cwd);
-        return ConfigSchema.parse({ version: 1 });
+        return ConfigSchema.parse({});
     }
     const configContent = await fs.readFile(configPath, "utf-8");
     return ConfigSchema.parse(yaml.parse(configContent));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rigour-labs/mcp",
-  "version": "6.6.6",
-  "description": "MCP server + live dashboard for AI code governance — OWASP LLM Top 10 (10/10), real-time MCP App UI, 25+ security patterns, memory and lessons recalled by meaning, hallucinated import detection, multi-agent governance. Works with Claude, Cursor, VS Code, ChatGPT, Goose, Windsurf. Industry presets for HIPAA, SOC2, FedRAMP.",
+  "version": "6.7.0",
+  "description": "Rigour's MCP server: lets coding agents review their change, check for an existing helper before writing a new one, and recall the team's lessons. Works with Claude Code, Cursor and other MCP clients.",
   "engines": {
     "node": ">=22"
   },
@@ -65,7 +65,7 @@
     "execa": "^8.0.1",
     "fs-extra": "^11.4.0",
     "yaml": "^2.8.2",
-    "@rigour-labs/core": "6.6.6"
+    "@rigour-labs/core": "6.7.0"
   },
   "devDependencies": {
     "@types/node": "^25.0.3",