sentinel-ir-mcp 0.4.6 → 0.5.1

package/README.md

@@ -3,7 +3,7 @@
 MCP server for [`sentinel-ir`](https://www.npmjs.com/package/sentinel-ir):
 it lets AI agents in Claude Desktop, Cursor, Windsurf or any other
 [Model Context Protocol](https://modelcontextprotocol.io) client read a
-compact **structural IR** of JavaScript, TypeScript and Python files instead of the raw source.
+compact **structural IR** of JavaScript, TypeScript, Python and Rust files instead of the raw source.
 
 - npm: <https://www.npmjs.com/package/sentinel-ir-mcp>
 - GitLab (main repository): <https://gitlab.com/jakubrojicek11/sentinel-ir-mcp>
@@ -18,15 +18,55 @@ hundred characters. The agent can triage a folder first and then read the raw
 source only of the files that matter.
 
 **Supported:** JavaScript (`.js`, `.mjs`, `.cjs`), TypeScript (`.ts`, `.mts`,
-`.cts`, `.tsx`; since 0.2.0) and Python (`.py`, `.pyi`; since 0.3.0). The
+`.cts`, `.tsx`; since 0.2.0), Python (`.py`, `.pyi`; since 0.3.0) and Rust
+(`.rs`; since 0.5.0). The
 language is picked from the file extension; `analyze_code` also takes `target`
-or an explicit `language` (`javascript` | `typescript` | `tsx` | `python`). Every result carries `language` and
+or an explicit `language` (`javascript` | `typescript` | `tsx` | `python` | `rust`). Every result carries `language` and
 `analysisStatus`; a file that does not parse cleanly (including JSX in a `.ts`
 file) is `"incomplete"`, and a low risk on an incomplete result is not evidence
 of safety. Other languages are not supported yet. What is detected in Python
-(and what is not) is listed in the
+and Rust (and what is not) is listed in the
 [sentinel-ir README](https://gitlab.com/jakubrojicek11/sentinel-ir#python).
 
+**0.5.1** makes sure an installed server gets fixes:
+
+- It needs `sentinel-ir` 0.5.6 or newer. 0.5.3–0.5.6 fix a comment between
+  two tokens hiding dangerous code, a broken Python or Rust file showing
+  `low`, a parser that could hang for minutes on one file, and the line of
+  Rust `use std::process::Command` signals.
+- `setup` writes `sentinel-ir-mcp@stable-0.5`, an npm tag that points at the
+  newest 0.5.x. `npx` keeps starting the copy it downloaded first for a
+  version or range such as `@0.5` and never picks up a fix; a tag is looked
+  up again on every start. Measured with npm 10.8.3 and 11.21.2 against a
+  local registry: after the tag moved, the next start ran the new version;
+  with the registry unreachable (connection refused), the cached copy still
+  started.
+- `doctor` warns about an entry that pins a version or range (`@0.5`,
+  `@0.5.0`, ...) and about every copy in npm's `_npx` cache whose
+  `sentinel-ir` is older than 0.5.6, with the folder to delete. It fails when
+  the server itself runs an older `sentinel-ir`.
+
+If you set up 0.5.0 or older, run `setup` again **with the new tag** (`npx -y
+sentinel-ir-mcp@0.5 ...` would start your cached 0.5.0):
+
+```bash
+npx -y sentinel-ir-mcp@stable-0.5 setup --client cursor
+npx -y sentinel-ir-mcp@stable-0.5 doctor --client cursor
+```
+
+**0.5.0** reads Rust (`.rs`) with `sentinel-ir` 0.5.2: `unsafe` and FFI,
+`std::process::Command`, file deletes and writes, HTTP clients and routes
+(`axum`, `actix-web`, ...). A `build.rs` or procedural macro that touches
+files, the network or secret environment variables is at least `high`,
+because it runs on your machine during `cargo build`.
+
+- `analyze_directory` skips Cargo's build folder: a `target` folder with
+  Cargo's `CACHEDIR.TAG` file, listed in `skipped.cargoTarget`. A plain folder
+  named `target` (e.g. in a JS project) is still scanned.
+- `setup` writes `sentinel-ir-mcp@0.5`; `doctor` asks entries pinned to 0.4
+  or older to run `setup` again (since 0.5.1 `setup` writes
+  `sentinel-ir-mcp@stable-0.5`, see above).
+
 **0.4.6** is listed in the official
 [MCP Registry](https://registry.modelcontextprotocol.io) as
 `io.github.jakcmencz/sentinel-ir-mcp`, so clients that browse the registry
@@ -41,7 +81,7 @@ can check later which version of a file the agent was shown (see
 - **One question in `setup`:** *"Keep a log of what the agent asks for (file
   names and results, never your code)? [y/N]"*. Or `setup --audit-log`;
   `--no-audit-log` turns it off. Running `setup` again keeps the setting.
-- **One command to read it:** `npx -y sentinel-ir-mcp@0.4 log` prints the last
+- **One command to read it:** `npx -y sentinel-ir-mcp@stable-0.5 log` prints the last
   50 entries as plain lines, `--all` everything, `--json` for scripts:
 
   ```text
@@ -170,9 +210,9 @@ nothing to compile (the parser is WebAssembly).
 Run it in your project folder:
 
 ```bash
-npx -y sentinel-ir-mcp@0.4 setup --client cursor     # or windsurf, claude-desktop, vscode, claude-code
-npx -y sentinel-ir-mcp@0.4 doctor --client cursor    # after restarting the client
-npx -y sentinel-ir-mcp@0.4 guide                     # optional: text for AGENTS.md / client rules
+npx -y sentinel-ir-mcp@stable-0.5 setup --client cursor     # or windsurf, claude-desktop, vscode, claude-code
+npx -y sentinel-ir-mcp@stable-0.5 doctor --client cursor    # after restarting the client
+npx -y sentinel-ir-mcp@stable-0.5 guide                     # optional: text for AGENTS.md / client rules
 ```
 
 `setup` (without `--client` it asks which client):
@@ -186,8 +226,8 @@ npx -y sentinel-ir-mcp@0.4 guide                     # optional: text for AGENTS
   touched;
 - gives the agent one folder (`--project`, default: the current folder) and
   refuses your home folder or a whole disk;
-- writes `sentinel-ir-mcp@0.4`, so clients get 0.4.x fixes but no unexpected
-  new features;
+- writes `sentinel-ir-mcp@stable-0.5`, an npm tag for the newest 0.5.x, so
+  clients get 0.5.x fixes on their next start but no unexpected new features;
 - asks which files or folders the agent must not read (`--exclude <name>`,
   repeatable, skips the question; see [Excluding files](#excluding-files));
 - for VS Code and Claude Code it writes nothing and prints their own install
@@ -201,7 +241,7 @@ npx -y sentinel-ir-mcp@0.4 guide                     # optional: text for AGENTS
 | `vscode`, `claude-code` | nothing; prints the command to run |
 
 On Windows the entry is `"command": "cmd", "args": ["/c", "npx", "-y",
-"sentinel-ir-mcp@0.4", "<folder>"]`: there `npx` is `npx.cmd`, and starting it
+"sentinel-ir-mcp@stable-0.5", "<folder>"]`: there `npx` is `npx.cmd`, and starting it
 without a shell failed with `ENOENT` on a real Windows runner. For VS Code and
 Claude Code, `setup` prints a PowerShell and a Command Prompt version of the
 command. What was measured on which system: [COMPATIBILITY.md](COMPATIBILITY.md).
@@ -225,21 +265,26 @@ Open Cursor Settings → Customize → MCPs and turn on the switch next to
 *Connected* and 3 tools. A server installed with the link below (user-level
 `~/.cursor/mcp.json`) connected without this step.
 
-### Getting a newer 0.2.x
-
-`npx` keeps the package it downloaded for `sentinel-ir-mcp@0.2` and keeps
-starting that copy, even when a newer 0.2.x is on npm (measured with npm
-10.8.2, 10.8.3 and 10.9.9: a cached 0.2.2 kept running after 0.2.3 was
-released; `--prefer-online` and `npm cache clean --force` did not change it).
-To get the newest 0.2.x:
-
-1. Check what runs: `npx -y sentinel-ir-mcp@0.2 doctor` prints
-   `sentinel-ir-mcp <version>`.
-2. Close the client app and delete the `_npx` folder in npm's cache
+### Getting a newer version
+
+`npx` keeps the package it downloaded for a version or range
+(`sentinel-ir-mcp@0.5`, `@0.2`, ...) and keeps starting that copy, together
+with the `sentinel-ir` it got then, even when newer versions are on npm
+(measured with npm 10.8.2, 10.8.3, 10.9.9 and 11.21.2; on npm 10
+`--prefer-online` and `npm cache clean --force` did not change it). The tag
+`setup` writes since 0.5.1 (`@stable-0.5`) is looked up again on every start
+instead. If a client still starts an old copy:
+
+1. Run `npx -y sentinel-ir-mcp@stable-0.5 doctor`. It prints the versions it
+   runs and lists every cached copy with a `sentinel-ir` older than 0.5.6,
+   with its folder.
+2. Close the client app and delete those folders (npm 11: `npm cache npx rm
+   <key>`). Deleting the whole `_npx` folder in npm's cache also works
    (`npm config get cache` shows where it is; usually `~/.npm/_npx`, on
-   Windows `%LocalAppData%\npm-cache\_npx`). This removes all packages cached
-   by `npx`, not only this one; they are downloaded again when needed.
-3. Start the client again. The next start downloads the newest 0.2.x.
+   Windows `%LocalAppData%\npm-cache\_npx`); it removes all packages cached
+   by `npx`, which are downloaded again when needed.
+3. Run `npx -y sentinel-ir-mcp@stable-0.5 setup` for your client and start the
+   client again.
 
 A folder that is literally named `setup`, `doctor` or `guide` must now be
 passed as `./setup` (or an absolute path); the bare word is the command.
@@ -261,8 +306,8 @@ VS Code 1.143 and Cursor 3.26 (see [COMPATIBILITY.md](COMPATIBILITY.md)). A link
 project path, so it uses `${workspaceFolder}`; if your client does not expand
 it, use `setup` instead.
 
-- Cursor: [Install in Cursor](cursor://anysphere.cursor-deeplink/mcp/install?name=sentinel-ir&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsInNlbnRpbmVsLWlyLW1jcEAwLjMiLCIke3dvcmtzcGFjZUZvbGRlcn0iXX0=)
-- VS Code: [Install in VS Code](vscode:mcp/install?%7B%22name%22%3A%22sentinel-ir%22%2C%22type%22%3A%22stdio%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22sentinel-ir-mcp%400.3%22%2C%22%24%7BworkspaceFolder%7D%22%5D%7D)
+- Cursor: [Install in Cursor](cursor://anysphere.cursor-deeplink/mcp/install?name=sentinel-ir&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsInNlbnRpbmVsLWlyLW1jcEBzdGFibGUtMC41IiwiJHt3b3Jrc3BhY2VGb2xkZXJ9Il19)
+- VS Code: [Install in VS Code](vscode:mcp/install?%7B%22name%22%3A%22sentinel-ir%22%2C%22type%22%3A%22stdio%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22sentinel-ir-mcp%40stable-0.5%22%2C%22%24%7BworkspaceFolder%7D%22%5D%7D)
 
 Some sites (including GitLab and npm) may not open `cursor://` or `vscode:`
 links; copy the link into the browser address bar or use `setup`.
@@ -281,7 +326,7 @@ Settings → Developer → Edit Config opens `claude_desktop_config.json`
   "mcpServers": {
     "sentinel-ir": {
       "command": "npx",
-      "args": ["-y", "sentinel-ir-mcp@0.4", "/Users/you/projects/my-app"]
+      "args": ["-y", "sentinel-ir-mcp@stable-0.5", "/Users/you/projects/my-app"]
     }
   }
 }
@@ -300,7 +345,7 @@ project entry has to be switched on once in Cursor Settings → Customize → MC
   "mcpServers": {
     "sentinel-ir": {
       "command": "npx",
-      "args": ["-y", "sentinel-ir-mcp@0.4", "${workspaceFolder}"]
+      "args": ["-y", "sentinel-ir-mcp@stable-0.5", "${workspaceFolder}"]
     }
   }
 }
@@ -316,8 +361,8 @@ with your project's absolute path.
 #### Other clients
 
 Any MCP client that starts stdio servers works with
-`command: "npx"`, `args: ["-y", "sentinel-ir-mcp@0.4", "<folder>"]`
-(on Windows: `command: "cmd"`, `args: ["/c", "npx", "-y", "sentinel-ir-mcp@0.4", "<folder>"]`).
+`command: "npx"`, `args: ["-y", "sentinel-ir-mcp@stable-0.5", "<folder>"]`
+(on Windows: `command: "cmd"`, `args: ["/c", "npx", "-y", "sentinel-ir-mcp@stable-0.5", "<folder>"]`).
 Without folder arguments the server uses the client's
 [MCP roots](https://modelcontextprotocol.io/specification/latest/client/roots)
 if the client offers them; if it offers none, only `analyze_code` works.
@@ -325,7 +370,7 @@ if the client offers them; if it offers none, only `analyze_code` works.
 ### Excluding files
 
 ```bash
-npx -y sentinel-ir-mcp@0.4 setup --client cursor --exclude secrets --exclude "*.min.js"
+npx -y sentinel-ir-mcp@stable-0.5 setup --client cursor --exclude secrets --exclude "*.min.js"
 ```
 
 | you write | excludes |
@@ -350,8 +395,8 @@ other tools of its client is told about them, but this server cannot stop it.
 ### Audit log
 
 ```bash
-npx -y sentinel-ir-mcp@0.4 setup --client cursor --audit-log   # or answer "y" in setup
-npx -y sentinel-ir-mcp@0.4 log                                 # what the agent asked for
+npx -y sentinel-ir-mcp@stable-0.5 setup --client cursor --audit-log   # or answer "y" in setup
+npx -y sentinel-ir-mcp@stable-0.5 log                                 # what the agent asked for
 ```
 
 | system | folder |
@@ -508,7 +553,10 @@ A second CI job runs on a real Windows runner (Node 20/22/24): the full test
 suite, the packed package with `setup`/`doctor` against the real `%APPDATA%`,
 starting the published package through `npx`, and the printed VS Code/Claude
 Code commands pasted into PowerShell 5.1, PowerShell 7 and cmd.exe. See
-[COMPATIBILITY.md](COMPATIBILITY.md).
+[COMPATIBILITY.md](COMPATIBILITY.md). On every push it runs on GitHub Actions
+in the mirror (`.github/workflows/windows.yml`); on GitLab it runs on release
+tags before `publish`, and by hand on other branches. The informational
+large-file size probe runs on release tags only.
 
 Release: bump `version` in `package.json` and both `version` fields in
 `server.json` (a test checks they match), push a protected tag `vX.Y.Z`;

package/bin/sentinel-ir-mcp.js

@@ -12,7 +12,7 @@ const { normalizePattern, ExcludeError, MAX_PATTERNS } = require("../src/exclude
 const { AuditLogError, defaultAuditDir, normalizeAuditDir, assertOutsideProjects } = require("../src/auditLog");
 const { version } = require("../package.json");
 
-const USAGE = `sentinel-ir-mcp ${version} — MCP server for sentinel-ir (JavaScript, TypeScript and Python)
+const USAGE = `sentinel-ir-mcp ${version} — MCP server for sentinel-ir (JavaScript, TypeScript, Python and Rust)
 
 Usage: sentinel-ir-mcp [options] [folder ...]
        sentinel-ir-mcp setup | doctor | guide | log [--help]

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "sentinel-ir-mcp",
-  "version": "0.4.6",
+  "version": "0.5.1",
   "mcpName": "io.github.jakcmencz/sentinel-ir-mcp",
-  "description": "MCP server for sentinel-ir: lets AI agents (Claude Desktop, Cursor, Windsurf, ...) read a compact structural IR of JavaScript, TypeScript and Python files instead of the raw source. Read-only, sandboxed to allowed folders.",
+  "description": "MCP server for sentinel-ir: lets AI agents (Claude Desktop, Cursor, Windsurf, ...) read a compact structural IR of JavaScript, TypeScript, Python and Rust files instead of the raw source. Read-only, sandboxed to allowed folders.",
   "main": "src/server.js",
   "bin": {
     "sentinel-ir-mcp": "bin/sentinel-ir-mcp.js"
@@ -20,11 +20,12 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "sentinel-ir": "^0.4.5",
+    "sentinel-ir": "^0.5.6",
     "zod": "^4.1.0"
   },
   "keywords": [
     "python",
+    "rust",
     "mcp",
     "model-context-protocol",
     "mcp-server",

package/src/analyze.js

@@ -87,6 +87,25 @@ function realNative(p) {
 }
 
 const SKIP_DIRS = new Set(["node_modules", ".git", "__pycache__", "venv", "site-packages"]);
+// Cargo marks its build folder with a CACHEDIR.TAG (cache directory tagging
+// spec); a plain folder named "target" in a JS project is still scanned.
+const CACHEDIR_SIGNATURE = "Signature: 8a477f597d28d172789f06886806bc55";
+async function isCargoTarget(dir) {
+    let handle;
+    try {
+        const tag = path.join(dir, "CACHEDIR.TAG");
+        if (!(await fs.lstat(tag)).isFile()) return false;
+        handle = await fs.open(tag, OPEN_FLAGS);
+        const buffer = Buffer.alloc(CACHEDIR_SIGNATURE.length);
+        const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+        return buffer.toString("latin1", 0, bytesRead) === CACHEDIR_SIGNATURE;
+    } catch {
+        return false;
+    } finally {
+        await handle?.close();
+    }
+}
+
 const RISK_ORDER = { critical: 0, high: 1, medium: 2, low: 3 };
 
 async function analyzeCode(code, target, language) {
@@ -102,7 +121,7 @@ async function analyzeFile(requested, roots, { maxFileBytes, excluder = NONE, ha
     const stat = await fs.stat(real);
     if (!stat.isFile()) throw new AccessError(`Not a file: ${requested}`);
     if (!isSourceFile(real)) {
-        throw new AccessError(`Unsupported file type: ${requested} (only .js, .mjs, .cjs, .ts, .mts, .cts, .tsx, .py and .pyi)`);
+        throw new AccessError(`Unsupported file type: ${requested} (only .js, .mjs, .cjs, .ts, .mts, .cts, .tsx, .py, .pyi and .rs)`);
     }
     if (stat.size > maxFileBytes) {
         throw new AccessError(`File too large: ${requested} is ${stat.size} bytes, limit is ${maxFileBytes}`);
@@ -112,11 +131,12 @@ async function analyzeFile(requested, roots, { maxFileBytes, excluder = NONE, ha
 }
 
 // Breadth-first, sorted walk. Symlinks are never followed; node_modules, .git,
-// __pycache__, venv, site-packages and hidden folders are skipped. Excluded
+// __pycache__, venv, site-packages, hidden folders and Cargo build folders
+// (target/ with a CACHEDIR.TAG, listed in skipped.cargoTarget) are skipped. Excluded
 // files and folders are only counted: their names can be private too.
 async function collectFiles(dir, root, { maxFiles, maxFileBytes, recursive, excluder = NONE }) {
     const files = [];
-    const skipped = { excluded: 0, tooLarge: [], symlinks: 0, unreadable: [], hardlinks: [] };
+    const skipped = { excluded: 0, tooLarge: [], symlinks: 0, unreadable: [], hardlinks: [], cargoTarget: [] };
     // Exclusions match the real names: on Windows dir may be spelled with
     // short names (SRC~1) that the patterns do not know.
     const prefix = excluder.active ? path.relative(realNative(root), realNative(dir)) : "";
@@ -142,7 +162,9 @@ async function collectFiles(dir, root, { maxFiles, maxFileBytes, recursive, excl
             } else if (entry.isSymbolicLink()) {
                 skipped.symlinks++;
             } else if (entry.isDirectory()) {
-                if (recursive && !SKIP_DIRS.has(entry.name) && !entry.name.startsWith(".")) queue.push(full);
+                if (!recursive || SKIP_DIRS.has(entry.name) || entry.name.startsWith(".")) continue;
+                if (entry.name === "target" && await isCargoTarget(full)) skipped.cargoTarget.push(rel);
+                else queue.push(full);
             } else if (entry.isFile() && isSourceFile(entry.name)) {
                 let size;
                 try {

package/src/clients.js

@@ -3,8 +3,13 @@
 const os = require("os");
 const path = require("path");
 
+const { version } = require("../package.json");
+
 const SERVER_NAME = "sentinel-ir";
-const PACKAGE_SPEC = "sentinel-ir-mcp@0.4";
+// An npm dist-tag, not a range: npx keeps starting a cached copy that still
+// satisfies a range such as @0.5, but resolves a tag again on every start.
+const STABLE_TAG = `stable-${version.split(".").slice(0, 2).join(".")}`;
+const PACKAGE_SPEC = `sentinel-ir-mcp@${STABLE_TAG}`;
 const WORKSPACE_VAR = "${workspaceFolder}";
 
 function homeOf(env) {
@@ -169,6 +174,6 @@ function installLinks() {
 }
 
 module.exports = {
-    SERVER_NAME, PACKAGE_SPEC, WORKSPACE_VAR, CLIENTS, CLIENT_NAMES, FILE_CLIENTS,
+    SERVER_NAME, STABLE_TAG, PACKAGE_SPEC, WORKSPACE_VAR, CLIENTS, CLIENT_NAMES, FILE_CLIENTS,
     homeOf, npxEntry, serverEntry, excludeArgs, entryExcludes, serverFlags, entryAuditLog, isWindowsNpxWrapper, shellQuote, powershellQuote, installCommand, installLinks
 };

package/src/doctor.js

@@ -4,8 +4,8 @@ const fs = require("fs");
 const path = require("path");
 const { Client } = require("@modelcontextprotocol/sdk/client/index.js");
 const { StdioClientTransport } = require("@modelcontextprotocol/sdk/client/stdio.js");
-const { version } = require("../package.json");
-const { SERVER_NAME, PACKAGE_SPEC, WORKSPACE_VAR, CLIENTS, FILE_CLIENTS, isWindowsNpxWrapper, entryExcludes, entryAuditLog, serverFlags } = require("./clients");
+const { version, dependencies } = require("../package.json");
+const { SERVER_NAME, PACKAGE_SPEC, homeOf, WORKSPACE_VAR, CLIENTS, FILE_CLIENTS, isWindowsNpxWrapper, entryExcludes, entryAuditLog, serverFlags } = require("./clients");
 const { AuditLogError, defaultAuditDir, normalizeAuditDir, assertOutsideProjects, logFiles, dayName, createAuditLog } = require("./auditLog");
 const { readConfig } = require("./setup");
 const { createExcluder, ExcludeError } = require("./exclude");
@@ -16,6 +16,8 @@ const BIN = path.join(__dirname, "..", "bin", "sentinel-ir-mcp.js");
 const EXPECTED_TOOLS = ["analyze_code", "analyze_directory", "analyze_file"];
 const VALUE_OPTIONS = new Set(["--max-file-bytes", "--max-files", "--time-budget-ms", "--exclude"]);
 
+const IR_MIN = dependencies["sentinel-ir"].replace(/^[\^~>=]+/, "");
+
 function irVersion() {
     try {
         return require("sentinel-ir/package.json").version;
@@ -24,6 +26,87 @@ function irVersion() {
     }
 }
 
+// true when version a is older than b ("unknown" or junk counts as older).
+function olderThan(a, b) {
+    const pa = /^(\d+)\.(\d+)\.(\d+)/.exec(String(a));
+    if (!pa) return true;
+    const pb = b.split(".").map(Number);
+    for (let i = 0; i < 3; i++) if (Number(pa[i + 1]) !== pb[i]) return Number(pa[i + 1]) < pb[i];
+    return false;
+}
+
+function readVersion(file) {
+    try {
+        const v = JSON.parse(fs.readFileSync(file, "utf8")).version;
+        return typeof v === "string" ? v : "unknown";
+    } catch {
+        return "unknown";
+    }
+}
+
+// The _npx/<key> folder this copy was started from, or null.
+function npxCopyDir() {
+    const m = new RegExp(`^(.*\\${path.sep}_npx\\${path.sep}[^\\${path.sep}]+)\\${path.sep}`).exec(__dirname);
+    return m ? m[1] : null;
+}
+
+// npm's cache folder: the one this copy was started from by npx, else npm's default.
+function npmCacheDir(env, platform) {
+    const marker = `${path.sep}_npx${path.sep}`;
+    const i = __dirname.lastIndexOf(marker);
+    if (i > 0) return __dirname.slice(0, i);
+    if (env.npm_config_cache) return env.npm_config_cache;
+    if (platform === "win32") return path.join(env.LOCALAPPDATA || path.join(homeOf(env), "AppData", "Local"), "npm-cache");
+    return path.join(homeOf(env), ".npm");
+}
+
+// Copies of sentinel-ir-mcp that npx cached and whose sentinel-ir is older
+// than this release needs. npx keeps starting such a copy for its spec.
+function staleNpxCopies(cacheDir) {
+    const root = path.join(cacheDir, "_npx");
+    let keys;
+    try { keys = fs.readdirSync(root); } catch { return []; }
+    const stale = [];
+    for (const key of keys.sort()) {
+        const dir = path.join(root, key);
+        const mod = path.join(dir, "node_modules");
+        if (!fs.existsSync(path.join(mod, "sentinel-ir-mcp", "package.json"))) continue;
+        // npm nests sentinel-ir under the server when another package in this
+        // npx folder needs a different sentinel-ir at the top level.
+        const nested = path.join(mod, "sentinel-ir-mcp", "node_modules", "sentinel-ir", "package.json");
+        const ir = readVersion(fs.existsSync(nested) ? nested : path.join(mod, "sentinel-ir", "package.json"));
+        if (!olderThan(ir, IR_MIN)) continue;
+        let spec = "sentinel-ir-mcp";
+        try {
+            const pkg = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
+            const named = pkg._npx && Array.isArray(pkg._npx.packages) && pkg._npx.packages.find((p) => /^sentinel-ir-mcp(@|$)/.test(p));
+            if (named) spec = named;
+            else if (pkg.dependencies && typeof pkg.dependencies["sentinel-ir-mcp"] === "string") spec = `sentinel-ir-mcp@${pkg.dependencies["sentinel-ir-mcp"]}`;
+        } catch { /* keep the bare name */ }
+        stale.push({ key, dir, spec, mcp: readVersion(path.join(mod, "sentinel-ir-mcp", "package.json")), ir });
+    }
+    return stale;
+}
+
+function checkNpxCache(env, platform, add) {
+    const cacheDir = npmCacheDir(env, platform);
+    const stale = staleNpxCopies(cacheDir);
+    if (stale.length === 0) {
+        add("ok", "npx.cache", `npx cache (${path.join(cacheDir, "_npx")}): no copy with sentinel-ir older than ${IR_MIN}`);
+        return;
+    }
+    for (const c of stale) {
+        add("warn", "npx.cache", `npx keeps starting a cached ${c.spec} (sentinel-ir-mcp ${c.mcp}, sentinel-ir ${c.ir}) from ${c.dir}; sentinel-ir older than ${IR_MIN} misses security fixes`,
+            `Close the client, delete that folder (npm 11: npm cache npx rm ${c.key}), then run: npx -y ${PACKAGE_SPEC} setup`);
+    }
+}
+
+// The version part of the configured sentinel-ir-mcp argument, "" when none.
+function entrySpec(args) {
+    const a = args.find((x) => typeof x === "string" && /^sentinel-ir-mcp(@|$)/.test(x));
+    return a ? a.slice("sentinel-ir-mcp@".length) : "";
+}
+
 // Folders the configured entry passes to the server (arguments after the package).
 function entryFolders(args) {
     const i = args.findIndex((a) => typeof a === "string" && /^sentinel-ir-mcp(@|$)/.test(a));
@@ -84,8 +167,10 @@ function checkConfig(client, file, explicit, project, add, platform, env) {
     const runs = `${label}: "${SERVER_NAME}" runs ${entry.command} ${args.join(" ")}`;
     if (entry.command === "npx" && platform === "win32") {
         add("warn", `${client}.entry`, runs, `On Windows a client may not find "npx" without a shell. Run: npx -y ${PACKAGE_SPEC} setup --client ${client}`);
-    } else if (args.some(a => /^sentinel-ir-mcp@0\.[0-3](\.|$)/.test(a))) {
-        add("warn", `${client}.entry`, runs, `This entry stays on an older version without native-code detection, whose parser stops working in long sessions. Run: npx -y ${PACKAGE_SPEC} setup --client ${client}`);
+    } else if (/^[\^~=v]*0\.[0-4](\.|$)/.test(entrySpec(args))) {
+        add("warn", `${client}.entry`, runs, `This entry stays on an older version without Rust support. Run: npx -y ${PACKAGE_SPEC} setup --client ${client}`);
+    } else if (/^[\^~=v<>]*\d/.test(entrySpec(args))) {
+        add("warn", `${client}.entry`, runs, `npx keeps starting the copy it downloaded first for a version or range and misses later fixes. Run: npx -y ${PACKAGE_SPEC} setup --client ${client}`);
     } else if (entry.command === "npx" || isWindowsNpxWrapper(entry)) {
         add("ok", `${client}.entry`, runs);
     } else {
@@ -189,7 +274,12 @@ async function runDoctor(opts, io) {
     const nodeVersion = io.nodeVersion || process.versions.node;
     if (Number(nodeVersion.split(".")[0]) >= 20) add("ok", "node", `Node.js v${nodeVersion}`);
     else add("fail", "node", `Node.js v${nodeVersion} is too old`, "Install Node.js 20 or newer.");
-    add("ok", "package", `sentinel-ir-mcp ${version}, sentinel-ir ${irVersion()}`);
+    const ir = irVersion();
+    if (olderThan(ir, IR_MIN)) {
+        add("fail", "package", `sentinel-ir-mcp ${version} runs sentinel-ir ${ir}, needs ${IR_MIN} or newer`,
+            npxCopyDir() ? `Close the client, delete ${npxCopyDir()}, then run: npx -y ${PACKAGE_SPEC} setup` : `Reinstall it so that npm installs sentinel-ir ${dependencies["sentinel-ir"]}.`);
+    } else add("ok", "package", `sentinel-ir-mcp ${version}, sentinel-ir ${ir}`);
+    checkNpxCache(io.env, io.platform, add);
 
     const project = path.resolve(io.cwd, opts.project || ".");
     if (opts.client && !Object.prototype.hasOwnProperty.call(CLIENTS, opts.client)) {
@@ -238,4 +328,4 @@ async function runDoctor(opts, io) {
     return failed ? 1 : 0;
 }
 
-module.exports = { runDoctor, entryFolders };
+module.exports = { runDoctor, entryFolders, olderThan, staleNpxCopies, IR_MIN };

package/src/paths.js

@@ -7,7 +7,8 @@ const { fileURLToPath } = require("url");
 const JS_EXTENSIONS = new Set([".js", ".mjs", ".cjs"]);
 const TS_EXTENSIONS = new Set([".ts", ".mts", ".cts", ".tsx"]);
 const PY_EXTENSIONS = new Set([".py", ".pyi"]);
-const SOURCE_EXTENSIONS = new Set([...JS_EXTENSIONS, ...TS_EXTENSIONS, ...PY_EXTENSIONS]);
+const RS_EXTENSIONS = new Set([".rs"]);
+const SOURCE_EXTENSIONS = new Set([...JS_EXTENSIONS, ...TS_EXTENSIONS, ...PY_EXTENSIONS, ...RS_EXTENSIONS]);
 
 class AccessError extends Error {}
 

package/src/server.js

@@ -39,10 +39,10 @@ const RISK_NOTE =
     "is unknown: e.g. readFileSync(req.query.f) is low. Start with critical files, and report a problem only after reading the code.";
 
 const INSTRUCTIONS =
-    "sentinel-ir-mcp turns JavaScript, TypeScript and Python source into a compact structural IR (risk level, dangerous " +
+    "sentinel-ir-mcp turns JavaScript, TypeScript, Python and Rust source into a compact structural IR (risk level, dangerous " +
     "capabilities, routes, exports, imports, env reads, network/filesystem/process/crypto calls). " +
     "Prefer analyze_file or analyze_directory over reading raw source when you only need structure " +
-    "or risk, then read the raw source of the files that matter. Supported: JavaScript (.js, .mjs, .cjs), TypeScript (.ts, .mts, .cts, .tsx) and Python (.py, .pyi); the language is picked from the file extension. " +
+    "or risk, then read the raw source of the files that matter. Supported: JavaScript (.js, .mjs, .cjs), TypeScript (.ts, .mts, .cts, .tsx), Python (.py, .pyi) and Rust (.rs); the language is picked from the file extension. " +
     "Rely on analysisStatus, world.risk, forbidden and facts; analysisStatus \"incomplete\" means the file did not parse cleanly. " +
     "analyze_directory lists such files separately in 'incomplete'; their low risk is not evidence of safety. " +
     "Suggested order: analyze_directory first, check 'incomplete', 'skipped.unreadable' and 'notAnalyzed' (set when the time budget ran out), pick the relevant files, " +
@@ -131,45 +131,45 @@ function createServer(options = {}) {
     }
 
     server.registerTool("analyze_code", {
-        title: "Analyze JavaScript, TypeScript or Python source",
+        title: "Analyze JavaScript, TypeScript, Python or Rust source",
         description:
-            "Analyze JavaScript, TypeScript or Python source text and return its compact structural IR: " +
+            "Analyze JavaScript, TypeScript, Python or Rust source text and return its compact structural IR: " +
             "{analysisStatus, language, mission, world.risk, constraints, forbidden, summary, facts}. " +
             "Use analyze_file instead when the code is on disk, so the source does not have to pass " +
             "through the conversation. " + UNTRUSTED_NOTE,
         inputSchema: {
-            code: z.string().max(limits.maxFileBytes).describe("JavaScript, TypeScript or Python source"),
-            target: z.string().max(1024).optional().describe("Optional file name shown as mission.target; its extension (.ts, .tsx, .py, ...) selects the language"),
-            language: z.enum(["javascript", "typescript", "tsx", "python"]).optional().describe("Overrides the language picked from target (default javascript)")
+            code: z.string().max(limits.maxFileBytes).describe("JavaScript, TypeScript, Python or Rust source"),
+            target: z.string().max(1024).optional().describe("Optional file name shown as mission.target; its extension (.ts, .tsx, .py, .rs, ...) selects the language"),
+            language: z.enum(["javascript", "typescript", "tsx", "python", "rust"]).optional().describe("Overrides the language picked from target (default javascript)")
         },
-        annotations: { title: "Analyze JavaScript, TypeScript or Python source", ...READ_ONLY }
+        annotations: { title: "Analyze JavaScript, TypeScript, Python or Rust source", ...READ_ONLY }
     }, ({ code, target, language }) => guarded(() => analyzeCode(code, target, language), auditor("analyze_code", { code, target, language })));
 
     server.registerTool("analyze_file", {
-        title: "Analyze a JavaScript, TypeScript or Python file",
+        title: "Analyze a JavaScript, TypeScript, Python or Rust file",
         description:
-            "Read one .js/.mjs/.cjs/.ts/.mts/.cts/.tsx/.py/.pyi file inside the allowed folders and return its compact structural IR. " +
+            "Read one .js/.mjs/.cjs/.ts/.mts/.cts/.tsx/.py/.pyi/.rs file inside the allowed folders and return its compact structural IR. " +
             `Relative paths are resolved against the first allowed folder. Files over ${limits.maxFileBytes} bytes are refused. ` +
             UNTRUSTED_NOTE + excludeNote,
         inputSchema: {
             path: z.string().min(1).describe("File path, absolute or relative to the first allowed folder")
         },
-        annotations: { title: "Analyze a JavaScript, TypeScript or Python file", ...READ_ONLY }
+        annotations: { title: "Analyze a JavaScript, TypeScript, Python or Rust file", ...READ_ONLY }
     }, async ({ path }) => {
         const hashes = auditLog.active ? new Map() : null;
         return guarded(async () => analyzeFile(path, await allowedRoots(), { ...limits, excluder, hashes }), auditor("analyze_file", { path, hashes }));
     });
 
     server.registerTool("analyze_directory", {
-        title: "Analyze a folder of JavaScript, TypeScript and Python files",
+        title: "Analyze a folder of JavaScript, TypeScript, Python and Rust files",
         description:
-            "Scan a folder inside the allowed folders and return one short entry per JavaScript, TypeScript or Python file, " +
+            "Scan a folder inside the allowed folders and return one short entry per JavaScript, TypeScript, Python or Rust file, " +
             "sorted from highest to lowest risk, plus risk counts. By default (detail \"summary\") each entry is " +
             "{path, risk, analysisStatus, language, lines, operations, riskSignals, moreRiskSignals?, parseError?}: " +
             "riskSignals are up to 3 'kind:code@line' signals (code cut to 120 characters) that set the file's risk level (empty when the risk comes from " +
             "the text fallback of an incomplete file or from a path containing 'crypto'), moreRiskSignals counts the rest. " +
             "detail \"full\" adds forbidden, objective and all facts per file instead (much larger). " + RISK_NOTE + " " +
-            "Skips node_modules, .git, __pycache__, venv, site-packages, hidden folders " +
+            "Skips node_modules, .git, __pycache__, venv, site-packages, hidden folders, Cargo build folders (target/ with a CACHEDIR.TAG, listed in skipped.cargoTarget) " +
             `and symlinks. Analyzes at most max_files files (default ${limits.maxFiles}); 'truncated' tells ` +
             "you when there were more. 'incomplete' lists files whose analysis did not finish (e.g. parse errors); " +
             "their risk is not reliable, check them separately. statusCounts counts complete vs incomplete. " +
@@ -186,7 +186,7 @@ function createServer(options = {}) {
             detail: z.enum(["summary", "full"]).optional()
                 .describe("\"summary\" (default): short entries; \"full\": all facts per file, much larger")
         },
-        annotations: { title: "Analyze a folder of JavaScript, TypeScript and Python files", ...READ_ONLY }
+        annotations: { title: "Analyze a folder of JavaScript, TypeScript, Python and Rust files", ...READ_ONLY }
     }, async ({ path, max_files, recursive, detail }) => {
         const hashes = auditLog.active ? new Map() : null;
         return guarded(async () => analyzeDirectory(path ?? ".", await allowedRoots(), {