sentinel-ir-mcp 0.4.6 → 0.5.0

package/README.md

@@ -3,7 +3,7 @@
 MCP server for [`sentinel-ir`](https://www.npmjs.com/package/sentinel-ir):
 it lets AI agents in Claude Desktop, Cursor, Windsurf or any other
 [Model Context Protocol](https://modelcontextprotocol.io) client read a
-compact **structural IR** of JavaScript, TypeScript and Python files instead of the raw source.
+compact **structural IR** of JavaScript, TypeScript, Python and Rust files instead of the raw source.
 
 - npm: <https://www.npmjs.com/package/sentinel-ir-mcp>
 - GitLab (main repository): <https://gitlab.com/jakubrojicek11/sentinel-ir-mcp>
@@ -18,15 +18,28 @@ hundred characters. The agent can triage a folder first and then read the raw
 source only of the files that matter.
 
 **Supported:** JavaScript (`.js`, `.mjs`, `.cjs`), TypeScript (`.ts`, `.mts`,
-`.cts`, `.tsx`; since 0.2.0) and Python (`.py`, `.pyi`; since 0.3.0). The
+`.cts`, `.tsx`; since 0.2.0), Python (`.py`, `.pyi`; since 0.3.0) and Rust
+(`.rs`; since 0.5.0). The
 language is picked from the file extension; `analyze_code` also takes `target`
-or an explicit `language` (`javascript` | `typescript` | `tsx` | `python`). Every result carries `language` and
+or an explicit `language` (`javascript` | `typescript` | `tsx` | `python` | `rust`). Every result carries `language` and
 `analysisStatus`; a file that does not parse cleanly (including JSX in a `.ts`
 file) is `"incomplete"`, and a low risk on an incomplete result is not evidence
 of safety. Other languages are not supported yet. What is detected in Python
-(and what is not) is listed in the
+and Rust (and what is not) is listed in the
 [sentinel-ir README](https://gitlab.com/jakubrojicek11/sentinel-ir#python).
 
+**0.5.0** reads Rust (`.rs`) with `sentinel-ir` 0.5.2: `unsafe` and FFI,
+`std::process::Command`, file deletes and writes, HTTP clients and routes
+(`axum`, `actix-web`, ...). A `build.rs` or procedural macro that touches
+files, the network or secret environment variables is at least `high`,
+because it runs on your machine during `cargo build`.
+
+- `analyze_directory` skips Cargo's build folder: a `target` folder with
+  Cargo's `CACHEDIR.TAG` file, listed in `skipped.cargoTarget`. A plain folder
+  named `target` (e.g. in a JS project) is still scanned.
+- `setup` writes `sentinel-ir-mcp@0.5`; `doctor` asks entries pinned to 0.4
+  or older to run `setup` again.
+
 **0.4.6** is listed in the official
 [MCP Registry](https://registry.modelcontextprotocol.io) as
 `io.github.jakcmencz/sentinel-ir-mcp`, so clients that browse the registry
@@ -41,7 +54,7 @@ can check later which version of a file the agent was shown (see
 - **One question in `setup`:** *"Keep a log of what the agent asks for (file
   names and results, never your code)? [y/N]"*. Or `setup --audit-log`;
   `--no-audit-log` turns it off. Running `setup` again keeps the setting.
-- **One command to read it:** `npx -y sentinel-ir-mcp@0.4 log` prints the last
+- **One command to read it:** `npx -y sentinel-ir-mcp@0.5 log` prints the last
   50 entries as plain lines, `--all` everything, `--json` for scripts:
 
   ```text
@@ -170,9 +183,9 @@ nothing to compile (the parser is WebAssembly).
 Run it in your project folder:
 
 ```bash
-npx -y sentinel-ir-mcp@0.4 setup --client cursor     # or windsurf, claude-desktop, vscode, claude-code
-npx -y sentinel-ir-mcp@0.4 doctor --client cursor    # after restarting the client
-npx -y sentinel-ir-mcp@0.4 guide                     # optional: text for AGENTS.md / client rules
+npx -y sentinel-ir-mcp@0.5 setup --client cursor     # or windsurf, claude-desktop, vscode, claude-code
+npx -y sentinel-ir-mcp@0.5 doctor --client cursor    # after restarting the client
+npx -y sentinel-ir-mcp@0.5 guide                     # optional: text for AGENTS.md / client rules
 ```
 
 `setup` (without `--client` it asks which client):
@@ -186,7 +199,7 @@ npx -y sentinel-ir-mcp@0.4 guide                     # optional: text for AGENTS
   touched;
 - gives the agent one folder (`--project`, default: the current folder) and
   refuses your home folder or a whole disk;
-- writes `sentinel-ir-mcp@0.4`, so clients get 0.4.x fixes but no unexpected
+- writes `sentinel-ir-mcp@0.5`, so clients get 0.5.x fixes but no unexpected
   new features;
 - asks which files or folders the agent must not read (`--exclude <name>`,
   repeatable, skips the question; see [Excluding files](#excluding-files));
@@ -201,7 +214,7 @@ npx -y sentinel-ir-mcp@0.4 guide                     # optional: text for AGENTS
 | `vscode`, `claude-code` | nothing; prints the command to run |
 
 On Windows the entry is `"command": "cmd", "args": ["/c", "npx", "-y",
-"sentinel-ir-mcp@0.4", "<folder>"]`: there `npx` is `npx.cmd`, and starting it
+"sentinel-ir-mcp@0.5", "<folder>"]`: there `npx` is `npx.cmd`, and starting it
 without a shell failed with `ENOENT` on a real Windows runner. For VS Code and
 Claude Code, `setup` prints a PowerShell and a Command Prompt version of the
 command. What was measured on which system: [COMPATIBILITY.md](COMPATIBILITY.md).
@@ -281,7 +294,7 @@ Settings → Developer → Edit Config opens `claude_desktop_config.json`
   "mcpServers": {
     "sentinel-ir": {
       "command": "npx",
-      "args": ["-y", "sentinel-ir-mcp@0.4", "/Users/you/projects/my-app"]
+      "args": ["-y", "sentinel-ir-mcp@0.5", "/Users/you/projects/my-app"]
     }
   }
 }
@@ -300,7 +313,7 @@ project entry has to be switched on once in Cursor Settings → Customize → MC
   "mcpServers": {
     "sentinel-ir": {
       "command": "npx",
-      "args": ["-y", "sentinel-ir-mcp@0.4", "${workspaceFolder}"]
+      "args": ["-y", "sentinel-ir-mcp@0.5", "${workspaceFolder}"]
     }
   }
 }
@@ -316,8 +329,8 @@ with your project's absolute path.
 #### Other clients
 
 Any MCP client that starts stdio servers works with
-`command: "npx"`, `args: ["-y", "sentinel-ir-mcp@0.4", "<folder>"]`
-(on Windows: `command: "cmd"`, `args: ["/c", "npx", "-y", "sentinel-ir-mcp@0.4", "<folder>"]`).
+`command: "npx"`, `args: ["-y", "sentinel-ir-mcp@0.5", "<folder>"]`
+(on Windows: `command: "cmd"`, `args: ["/c", "npx", "-y", "sentinel-ir-mcp@0.5", "<folder>"]`).
 Without folder arguments the server uses the client's
 [MCP roots](https://modelcontextprotocol.io/specification/latest/client/roots)
 if the client offers them; if it offers none, only `analyze_code` works.
@@ -325,7 +338,7 @@ if the client offers them; if it offers none, only `analyze_code` works.
 ### Excluding files
 
 ```bash
-npx -y sentinel-ir-mcp@0.4 setup --client cursor --exclude secrets --exclude "*.min.js"
+npx -y sentinel-ir-mcp@0.5 setup --client cursor --exclude secrets --exclude "*.min.js"
 ```
 
 | you write | excludes |
@@ -350,8 +363,8 @@ other tools of its client is told about them, but this server cannot stop it.
 ### Audit log
 
 ```bash
-npx -y sentinel-ir-mcp@0.4 setup --client cursor --audit-log   # or answer "y" in setup
-npx -y sentinel-ir-mcp@0.4 log                                 # what the agent asked for
+npx -y sentinel-ir-mcp@0.5 setup --client cursor --audit-log   # or answer "y" in setup
+npx -y sentinel-ir-mcp@0.5 log                                 # what the agent asked for
 ```
 
 | system | folder |
@@ -508,7 +521,10 @@ A second CI job runs on a real Windows runner (Node 20/22/24): the full test
 suite, the packed package with `setup`/`doctor` against the real `%APPDATA%`,
 starting the published package through `npx`, and the printed VS Code/Claude
 Code commands pasted into PowerShell 5.1, PowerShell 7 and cmd.exe. See
-[COMPATIBILITY.md](COMPATIBILITY.md).
+[COMPATIBILITY.md](COMPATIBILITY.md). On every push it runs on GitHub Actions
+in the mirror (`.github/workflows/windows.yml`); on GitLab it runs on release
+tags before `publish`, and by hand on other branches. The informational
+large-file size probe runs on release tags only.
 
 Release: bump `version` in `package.json` and both `version` fields in
 `server.json` (a test checks they match), push a protected tag `vX.Y.Z`;

package/bin/sentinel-ir-mcp.js

@@ -12,7 +12,7 @@ const { normalizePattern, ExcludeError, MAX_PATTERNS } = require("../src/exclude
 const { AuditLogError, defaultAuditDir, normalizeAuditDir, assertOutsideProjects } = require("../src/auditLog");
 const { version } = require("../package.json");
 
-const USAGE = `sentinel-ir-mcp ${version} — MCP server for sentinel-ir (JavaScript, TypeScript and Python)
+const USAGE = `sentinel-ir-mcp ${version} — MCP server for sentinel-ir (JavaScript, TypeScript, Python and Rust)
 
 Usage: sentinel-ir-mcp [options] [folder ...]
        sentinel-ir-mcp setup | doctor | guide | log [--help]

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "sentinel-ir-mcp",
-  "version": "0.4.6",
+  "version": "0.5.0",
   "mcpName": "io.github.jakcmencz/sentinel-ir-mcp",
-  "description": "MCP server for sentinel-ir: lets AI agents (Claude Desktop, Cursor, Windsurf, ...) read a compact structural IR of JavaScript, TypeScript and Python files instead of the raw source. Read-only, sandboxed to allowed folders.",
+  "description": "MCP server for sentinel-ir: lets AI agents (Claude Desktop, Cursor, Windsurf, ...) read a compact structural IR of JavaScript, TypeScript, Python and Rust files instead of the raw source. Read-only, sandboxed to allowed folders.",
   "main": "src/server.js",
   "bin": {
     "sentinel-ir-mcp": "bin/sentinel-ir-mcp.js"
@@ -20,11 +20,12 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "sentinel-ir": "^0.4.5",
+    "sentinel-ir": "^0.5.2",
     "zod": "^4.1.0"
   },
   "keywords": [
     "python",
+    "rust",
     "mcp",
     "model-context-protocol",
     "mcp-server",

package/src/analyze.js

@@ -87,6 +87,25 @@ function realNative(p) {
 }
 
 const SKIP_DIRS = new Set(["node_modules", ".git", "__pycache__", "venv", "site-packages"]);
+// Cargo marks its build folder with a CACHEDIR.TAG (cache directory tagging
+// spec); a plain folder named "target" in a JS project is still scanned.
+const CACHEDIR_SIGNATURE = "Signature: 8a477f597d28d172789f06886806bc55";
+async function isCargoTarget(dir) {
+    let handle;
+    try {
+        const tag = path.join(dir, "CACHEDIR.TAG");
+        if (!(await fs.lstat(tag)).isFile()) return false;
+        handle = await fs.open(tag, OPEN_FLAGS);
+        const buffer = Buffer.alloc(CACHEDIR_SIGNATURE.length);
+        const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+        return buffer.toString("latin1", 0, bytesRead) === CACHEDIR_SIGNATURE;
+    } catch {
+        return false;
+    } finally {
+        await handle?.close();
+    }
+}
+
 const RISK_ORDER = { critical: 0, high: 1, medium: 2, low: 3 };
 
 async function analyzeCode(code, target, language) {
@@ -102,7 +121,7 @@ async function analyzeFile(requested, roots, { maxFileBytes, excluder = NONE, ha
     const stat = await fs.stat(real);
     if (!stat.isFile()) throw new AccessError(`Not a file: ${requested}`);
     if (!isSourceFile(real)) {
-        throw new AccessError(`Unsupported file type: ${requested} (only .js, .mjs, .cjs, .ts, .mts, .cts, .tsx, .py and .pyi)`);
+        throw new AccessError(`Unsupported file type: ${requested} (only .js, .mjs, .cjs, .ts, .mts, .cts, .tsx, .py, .pyi and .rs)`);
     }
     if (stat.size > maxFileBytes) {
         throw new AccessError(`File too large: ${requested} is ${stat.size} bytes, limit is ${maxFileBytes}`);
@@ -112,11 +131,12 @@ async function analyzeFile(requested, roots, { maxFileBytes, excluder = NONE, ha
 }
 
 // Breadth-first, sorted walk. Symlinks are never followed; node_modules, .git,
-// __pycache__, venv, site-packages and hidden folders are skipped. Excluded
+// __pycache__, venv, site-packages, hidden folders and Cargo build folders
+// (target/ with a CACHEDIR.TAG, listed in skipped.cargoTarget) are skipped. Excluded
 // files and folders are only counted: their names can be private too.
 async function collectFiles(dir, root, { maxFiles, maxFileBytes, recursive, excluder = NONE }) {
     const files = [];
-    const skipped = { excluded: 0, tooLarge: [], symlinks: 0, unreadable: [], hardlinks: [] };
+    const skipped = { excluded: 0, tooLarge: [], symlinks: 0, unreadable: [], hardlinks: [], cargoTarget: [] };
     // Exclusions match the real names: on Windows dir may be spelled with
     // short names (SRC~1) that the patterns do not know.
     const prefix = excluder.active ? path.relative(realNative(root), realNative(dir)) : "";
@@ -142,7 +162,9 @@ async function collectFiles(dir, root, { maxFiles, maxFileBytes, recursive, excl
             } else if (entry.isSymbolicLink()) {
                 skipped.symlinks++;
             } else if (entry.isDirectory()) {
-                if (recursive && !SKIP_DIRS.has(entry.name) && !entry.name.startsWith(".")) queue.push(full);
+                if (!recursive || SKIP_DIRS.has(entry.name) || entry.name.startsWith(".")) continue;
+                if (entry.name === "target" && await isCargoTarget(full)) skipped.cargoTarget.push(rel);
+                else queue.push(full);
             } else if (entry.isFile() && isSourceFile(entry.name)) {
                 let size;
                 try {

package/src/clients.js

@@ -4,7 +4,7 @@ const os = require("os");
 const path = require("path");
 
 const SERVER_NAME = "sentinel-ir";
-const PACKAGE_SPEC = "sentinel-ir-mcp@0.4";
+const PACKAGE_SPEC = "sentinel-ir-mcp@0.5";
 const WORKSPACE_VAR = "${workspaceFolder}";
 
 function homeOf(env) {

package/src/doctor.js

@@ -84,8 +84,8 @@ function checkConfig(client, file, explicit, project, add, platform, env) {
     const runs = `${label}: "${SERVER_NAME}" runs ${entry.command} ${args.join(" ")}`;
     if (entry.command === "npx" && platform === "win32") {
         add("warn", `${client}.entry`, runs, `On Windows a client may not find "npx" without a shell. Run: npx -y ${PACKAGE_SPEC} setup --client ${client}`);
-    } else if (args.some(a => /^sentinel-ir-mcp@0\.[0-3](\.|$)/.test(a))) {
-        add("warn", `${client}.entry`, runs, `This entry stays on an older version without native-code detection, whose parser stops working in long sessions. Run: npx -y ${PACKAGE_SPEC} setup --client ${client}`);
+    } else if (args.some(a => /^sentinel-ir-mcp@0\.[0-4](\.|$)/.test(a))) {
+        add("warn", `${client}.entry`, runs, `This entry stays on an older version without Rust support. Run: npx -y ${PACKAGE_SPEC} setup --client ${client}`);
     } else if (entry.command === "npx" || isWindowsNpxWrapper(entry)) {
         add("ok", `${client}.entry`, runs);
     } else {

package/src/paths.js

@@ -7,7 +7,8 @@ const { fileURLToPath } = require("url");
 const JS_EXTENSIONS = new Set([".js", ".mjs", ".cjs"]);
 const TS_EXTENSIONS = new Set([".ts", ".mts", ".cts", ".tsx"]);
 const PY_EXTENSIONS = new Set([".py", ".pyi"]);
-const SOURCE_EXTENSIONS = new Set([...JS_EXTENSIONS, ...TS_EXTENSIONS, ...PY_EXTENSIONS]);
+const RS_EXTENSIONS = new Set([".rs"]);
+const SOURCE_EXTENSIONS = new Set([...JS_EXTENSIONS, ...TS_EXTENSIONS, ...PY_EXTENSIONS, ...RS_EXTENSIONS]);
 
 class AccessError extends Error {}
 

package/src/server.js

@@ -39,10 +39,10 @@ const RISK_NOTE =
     "is unknown: e.g. readFileSync(req.query.f) is low. Start with critical files, and report a problem only after reading the code.";
 
 const INSTRUCTIONS =
-    "sentinel-ir-mcp turns JavaScript, TypeScript and Python source into a compact structural IR (risk level, dangerous " +
+    "sentinel-ir-mcp turns JavaScript, TypeScript, Python and Rust source into a compact structural IR (risk level, dangerous " +
     "capabilities, routes, exports, imports, env reads, network/filesystem/process/crypto calls). " +
     "Prefer analyze_file or analyze_directory over reading raw source when you only need structure " +
-    "or risk, then read the raw source of the files that matter. Supported: JavaScript (.js, .mjs, .cjs), TypeScript (.ts, .mts, .cts, .tsx) and Python (.py, .pyi); the language is picked from the file extension. " +
+    "or risk, then read the raw source of the files that matter. Supported: JavaScript (.js, .mjs, .cjs), TypeScript (.ts, .mts, .cts, .tsx), Python (.py, .pyi) and Rust (.rs); the language is picked from the file extension. " +
     "Rely on analysisStatus, world.risk, forbidden and facts; analysisStatus \"incomplete\" means the file did not parse cleanly. " +
     "analyze_directory lists such files separately in 'incomplete'; their low risk is not evidence of safety. " +
     "Suggested order: analyze_directory first, check 'incomplete', 'skipped.unreadable' and 'notAnalyzed' (set when the time budget ran out), pick the relevant files, " +
@@ -131,45 +131,45 @@ function createServer(options = {}) {
     }
 
     server.registerTool("analyze_code", {
-        title: "Analyze JavaScript, TypeScript or Python source",
+        title: "Analyze JavaScript, TypeScript, Python or Rust source",
         description:
-            "Analyze JavaScript, TypeScript or Python source text and return its compact structural IR: " +
+            "Analyze JavaScript, TypeScript, Python or Rust source text and return its compact structural IR: " +
             "{analysisStatus, language, mission, world.risk, constraints, forbidden, summary, facts}. " +
             "Use analyze_file instead when the code is on disk, so the source does not have to pass " +
             "through the conversation. " + UNTRUSTED_NOTE,
         inputSchema: {
-            code: z.string().max(limits.maxFileBytes).describe("JavaScript, TypeScript or Python source"),
-            target: z.string().max(1024).optional().describe("Optional file name shown as mission.target; its extension (.ts, .tsx, .py, ...) selects the language"),
-            language: z.enum(["javascript", "typescript", "tsx", "python"]).optional().describe("Overrides the language picked from target (default javascript)")
+            code: z.string().max(limits.maxFileBytes).describe("JavaScript, TypeScript, Python or Rust source"),
+            target: z.string().max(1024).optional().describe("Optional file name shown as mission.target; its extension (.ts, .tsx, .py, .rs, ...) selects the language"),
+            language: z.enum(["javascript", "typescript", "tsx", "python", "rust"]).optional().describe("Overrides the language picked from target (default javascript)")
         },
-        annotations: { title: "Analyze JavaScript, TypeScript or Python source", ...READ_ONLY }
+        annotations: { title: "Analyze JavaScript, TypeScript, Python or Rust source", ...READ_ONLY }
     }, ({ code, target, language }) => guarded(() => analyzeCode(code, target, language), auditor("analyze_code", { code, target, language })));
 
     server.registerTool("analyze_file", {
-        title: "Analyze a JavaScript, TypeScript or Python file",
+        title: "Analyze a JavaScript, TypeScript, Python or Rust file",
         description:
-            "Read one .js/.mjs/.cjs/.ts/.mts/.cts/.tsx/.py/.pyi file inside the allowed folders and return its compact structural IR. " +
+            "Read one .js/.mjs/.cjs/.ts/.mts/.cts/.tsx/.py/.pyi/.rs file inside the allowed folders and return its compact structural IR. " +
             `Relative paths are resolved against the first allowed folder. Files over ${limits.maxFileBytes} bytes are refused. ` +
             UNTRUSTED_NOTE + excludeNote,
         inputSchema: {
             path: z.string().min(1).describe("File path, absolute or relative to the first allowed folder")
         },
-        annotations: { title: "Analyze a JavaScript, TypeScript or Python file", ...READ_ONLY }
+        annotations: { title: "Analyze a JavaScript, TypeScript, Python or Rust file", ...READ_ONLY }
     }, async ({ path }) => {
         const hashes = auditLog.active ? new Map() : null;
         return guarded(async () => analyzeFile(path, await allowedRoots(), { ...limits, excluder, hashes }), auditor("analyze_file", { path, hashes }));
     });
 
     server.registerTool("analyze_directory", {
-        title: "Analyze a folder of JavaScript, TypeScript and Python files",
+        title: "Analyze a folder of JavaScript, TypeScript, Python and Rust files",
         description:
-            "Scan a folder inside the allowed folders and return one short entry per JavaScript, TypeScript or Python file, " +
+            "Scan a folder inside the allowed folders and return one short entry per JavaScript, TypeScript, Python or Rust file, " +
             "sorted from highest to lowest risk, plus risk counts. By default (detail \"summary\") each entry is " +
             "{path, risk, analysisStatus, language, lines, operations, riskSignals, moreRiskSignals?, parseError?}: " +
             "riskSignals are up to 3 'kind:code@line' signals (code cut to 120 characters) that set the file's risk level (empty when the risk comes from " +
             "the text fallback of an incomplete file or from a path containing 'crypto'), moreRiskSignals counts the rest. " +
             "detail \"full\" adds forbidden, objective and all facts per file instead (much larger). " + RISK_NOTE + " " +
-            "Skips node_modules, .git, __pycache__, venv, site-packages, hidden folders " +
+            "Skips node_modules, .git, __pycache__, venv, site-packages, hidden folders, Cargo build folders (target/ with a CACHEDIR.TAG, listed in skipped.cargoTarget) " +
             `and symlinks. Analyzes at most max_files files (default ${limits.maxFiles}); 'truncated' tells ` +
             "you when there were more. 'incomplete' lists files whose analysis did not finish (e.g. parse errors); " +
             "their risk is not reliable, check them separately. statusCounts counts complete vs incomplete. " +
@@ -186,7 +186,7 @@ function createServer(options = {}) {
             detail: z.enum(["summary", "full"]).optional()
                 .describe("\"summary\" (default): short entries; \"full\": all facts per file, much larger")
         },
-        annotations: { title: "Analyze a folder of JavaScript, TypeScript and Python files", ...READ_ONLY }
+        annotations: { title: "Analyze a folder of JavaScript, TypeScript, Python and Rust files", ...READ_ONLY }
     }, async ({ path, max_files, recursive, detail }) => {
         const hashes = auditLog.active ? new Map() : null;
         return guarded(async () => analyzeDirectory(path ?? ".", await allowedRoots(), {