docguard-cli 0.33.0 → 0.33.1

package/PRIVACY.md

@@ -0,0 +1,45 @@
+# Privacy Policy — DocGuard
+
+**Effective: 2026-07-16**
+
+DocGuard is a local-first command-line tool. This policy is short because the
+honest answer is short: **DocGuard collects nothing.**
+
+## What DocGuard does with your data
+
+- **All analysis runs locally.** Validators, scoring, reports, the MCP server —
+  everything reads files on your machine and writes output to your machine.
+  Nothing is uploaded, sampled, or "improved" with your code or docs.
+- **No telemetry, no analytics, no crash reporting.** There is no phone-home
+  code path. The deterministic core makes no network calls at all.
+- **No accounts.** DocGuard has no sign-up, no API keys of its own, and no
+  server-side component operated by us.
+
+## The explicit, user-initiated exceptions
+
+Three commands can *prepare* outbound actions — each is opt-in, visible, and
+executed by you or your own tooling, never silently by DocGuard:
+
+| Command | What happens |
+|---------|--------------|
+| `docguard feedback` | Builds a **prefilled GitHub issue URL** (redacted and length-capped) and saves a local record. Nothing is sent unless you open the URL and submit it yourself. |
+| `docguard upgrade --pr` / `impact --prs` | Shell out to **your** locally-authenticated `gh` CLI to interact with **your** repositories. DocGuard never holds credentials. |
+| `docguard mcp --transport http` | Serves read-only tools over HTTP. Binds to loopback by default; binding a non-loopback address **refuses to start** without an `--api-key`. |
+
+## Data written to disk (yours, locally)
+
+State lives under `.docguard/` in your repo (fix history, score history,
+caches) and `.docguard.baseline.json` if you create one. All of it is plain
+text, in your repository, under your version control — delete it any time.
+
+## Dependencies
+
+One pinned runtime dependency (`@babel/parser`). The npm package is published
+from GitHub Actions with provenance attestation, so you can verify the tarball
+was built from this repository.
+
+## Changes & contact
+
+Changes to this policy land in this file with a dated entry in
+[CHANGELOG.md](CHANGELOG.md). Questions: open an issue at
+<https://github.com/raccioly/docguard/issues> (see [SUPPORT.md](SUPPORT.md)).

package/README.md

@@ -454,6 +454,15 @@ DocGuard ships **18 professional templates** with metadata, badges, and revision
 
 ## 🤖 AI Agent Support
 
+### One-click MCP install
+
+[![Add to Cursor](https://img.shields.io/badge/Cursor-Add_MCP_Server-000000?logo=cursor)](cursor://anysphere.cursor-deeplink/mcp/install?name=docguard&config=eyJjb21tYW5kIjogIm5weCIsICJhcmdzIjogWyIteSIsICJkb2NndWFyZC1jbGkiLCAibWNwIl19)
+[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install_MCP_Server-0098FF?logo=githubcopilot)](vscode:mcp/install?%7B%22name%22%3A%22docguard%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22docguard-cli%22%2C%22mcp%22%5D%7D)
+
+- **Claude Code**: `claude mcp add docguard -- npx docguard-cli mcp`
+- **Claude Desktop**: download `docguard-v<version>.mcpb` from the [latest release](https://github.com/raccioly/docguard/releases/latest) and drag it into Settings → Extensions — you'll be asked which project folder to analyze. No npm, no JSON editing.
+- **Anything MCP**: DocGuard is a verified namespace on the [official MCP registry](https://registry.modelcontextprotocol.io/v0/servers?search=docguard) (`io.github.raccioly/docguard`).
+
 DocGuard works with **every major AI coding agent**. All canonical docs are plain markdown — no vendor lock-in.
 
 | Agent | Compatibility | Auto-Generate Config |
@@ -769,6 +778,13 @@ See [CONTRIBUTING.md](CONTRIBUTING.md#research--academic-credits) for full citat
 
 ---
 
+## 🔒 Privacy & Supply Chain
+
+DocGuard is local-first: no telemetry, no analytics, no phone-home — the full
+(short) policy is in [PRIVACY.md](PRIVACY.md). npm releases are published with
+[provenance attestation](https://docs.npmjs.com/generating-provenance-statements),
+so you can verify each tarball was built by GitHub Actions from this repository.
+
 ## 📄 License
 
 [MIT](LICENSE) — Free to use, modify, and distribute.

package/docs/faq.md

@@ -119,6 +119,25 @@ Exit code 0 = pass, 1 = fail. Use `--threshold` to set minimum score.
 
 Yes — DocGuard ships a template at `templates/ci/github-actions.yml`. Copy it to `.github/workflows/` or use the reusable action in `action.yml`.
 
+### Claude (or my AI agent) says DocGuard is "unknown" and wants a legitimacy check. Why?
+
+That's the agent's default posture toward **any** third-party MCP server or
+npx package — MCP servers run code with your permissions, so unknown ones get
+a trust prompt. It's not a DocGuard-specific flag. What DocGuard provides so
+the check can pass:
+
+- **npm provenance** — releases are signed by GitHub Actions (Sigstore), so
+  the tarball is verifiably built from this repository.
+- **Official MCP registry** — `io.github.raccioly/docguard` is a verified
+  namespace at registry.modelcontextprotocol.io.
+- **Read-only annotations** — every MCP tool declares `readOnlyHint`; the
+  server never writes or reaches the network.
+- **[PRIVACY.md](../PRIVACY.md)** — no telemetry, no data collection.
+
+To stop the prompt on your own machines: approve with "Always allow", or
+pre-trust it for a whole team via a project-scoped `.mcp.json` /
+enterprise managed-settings allowlist.
+
 ### Does DocGuard block commits?
 
 Only if you install hooks (`docguard hooks`). Without hooks, it's advisory only.

package/extensions/spec-kit-docguard/extension.yml

@@ -3,7 +3,7 @@ schema_version: "1.0"
 extension:
   id: "docguard"
   name: "DocGuard — CDD Enforcement"
-  version: "0.33.0"
+  version: "0.33.1"
   description: "Canonical-Driven Development enforcement as a true spec-kit extension. LLM-first design with automated validators, 4 AI behavior skills, spec-kit skill chaining, and workflow hooks. One pinned runtime dependency (@babel/parser); pure Node.js otherwise."
   author: "Ricardo Accioly"
   repository: "https://github.com/raccioly/docguard"

package/extensions/spec-kit-docguard/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.33.0
+  version: 0.33.1
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.33.0 -->
+<!-- docguard:version: 0.33.1 -->
 
 # DocGuard Fix Skill
 

package/extensions/spec-kit-docguard/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.33.0
+  version: 0.33.1
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.33.0 -->
+<!-- docguard:version: 0.33.1 -->
 
 # DocGuard Guard Skill
 

package/extensions/spec-kit-docguard/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.33.0
+  version: 0.33.1
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.33.0 -->
+<!-- docguard:version: 0.33.1 -->
 
 # DocGuard Review Skill
 

package/extensions/spec-kit-docguard/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.33.0
+  version: 0.33.1
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.33.0 -->
+<!-- docguard:version: 0.33.1 -->
 
 # DocGuard Score Skill
 

package/extensions/spec-kit-docguard/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.33.0
+  version: 0.33.1
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.33.0 -->
+<!-- docguard:version: 0.33.1 -->
 
 # DocGuard Sync Skill
 

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "docguard-cli",
-  "version": "0.33.0",
+  "version": "0.33.1",
   "description": "The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation.",
   "type": "module",
   "bin": {
-    "docguard": "./cli/docguard.mjs"
+    "docguard": "cli/docguard.mjs"
   },
   "scripts": {
     "docguard": "node cli/docguard.mjs",
@@ -36,7 +36,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/raccioly/docguard"
+    "url": "git+https://github.com/raccioly/docguard.git"
   },
   "homepage": "https://github.com/raccioly/docguard#readme",
   "mcpName": "io.github.raccioly/docguard",
@@ -57,6 +57,7 @@
     "docs/",
     "schemas/",
     "STANDARD.md",
+    "PRIVACY.md",
     "PHILOSOPHY.md",
     "README.md",
     "LICENSE"