How do I use Rigour MCP?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Rigour MCP scan current repository for hardcoded secrets and structural issues" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

Rigour MCP

Official

by rigour-labs

Overview Schema Related Servers Score Discussions

TypeScript

Local

Rigour

npm version cli downloads mcp downloads License: MIT MCP Registry OWASP

Your AI agent just tried to commit an AWS secret. Rigour blocked it in <100ms.

Agent Transaction Firewall (v6): treat the agent as an untrusted proposer. Rigour decides—deterministically—what it may write, run, call, and ship. No AI judge on the allow/deny path.

Try it now (zero config)

npx rigour-scan

Works on any repo. No init, no config, no setup. Instant results in your terminal:

  HARDCODED SECRET DETECTED
  AWS_SECRET_ACCESS_KEY found in src/config.ts:23

  + 22 more violations across 847 files (2.1s)

  Score        ████░░░░░░░░░░░░░░░░  34/100
  AI Health    ███░░░░░░░░░░░░░░░░░░  28/100

  Gates:  ✅ file-size  ❌ security  ❌ ast  ✅ deps

  Brain: learned 12 patterns · trend: improving ↑

Related MCP server: Metsuke

Add to your AI IDE (30 seconds)

{ "mcpServers": { "rigour": { "command": "npx", "args": ["-y", "@rigour-labs/mcp@latest"] } } }

IDE / Agent	MCP Tools	Live Dashboard	Real-Time Feed
Claude Desktop	✅	✅ MCP App	✅ Logging
VS Code Copilot	✅	✅ MCP App	✅ Logging
ChatGPT	✅	✅ MCP App	✅ Logging
Goose	✅	✅ MCP App	✅ Logging
Claude Code	✅	—	✅ Logging
Cursor	✅	—	✅ Logging
Cline	✅	—	✅ Logging
Windsurf	✅	—	✅ Logging
Codex	✅	—	✅ Logging

Then install hooks so writes are checked in real time:

npx @rigour-labs/cli hooks init --tool cursor   # or claude, cline, windsurf
# or via MCP: rigour_hooks_init

Does the firewall run automatically?

Short answer: quality gates + DLP + mediated rigour_run paths run when MCP/hooks are installed. It does not yet sit in front of every third-party MCP tool (GitHub/Slack/etc.)—that gateway is designed but not the default proxy.

Surface	Automatic once installed?	What you get
MCP server (`@rigour-labs/mcp`)	Yes for Rigour tools the agent calls	`rigour_check`, Fix Packets, memory DLP, agent register, Studio events
`rigour_run` / `rigour_run_supervised`	Yes when those tools are used	Typed argv allowlist (no free-form `shell: true`), fail-closed human arbitration (timeout = deny), one-time Studio token
IDE hooks (Cursor/Claude/Cline/Windsurf)	Yes after `hooks init`	Per-write checks (secrets, imports, size, protected paths). If agents are registered, set `RIGOUR_AGENT_ID` so scope binds to the writer (fail-closed; no union-allow)
`rigour_agent_register`	Yes when called	Rejects `*/` / sensitive globs unless operator scopes or `RIGOUR_ALLOW_AGENT_SCOPE_AUTHORITY=1`
CLI firewall	On demand / CI	`firewall adversarial`, `firewall transact`, `firewall admit`
Third-party MCP proxy	Not yet	Capability broker + `McpGateway` interfaces exist; Rigour is not yet a MITM for all MCP servers

Agent proposes action
        ↓
Hooks / MCP mediation (when on the path)
        ↓
Deterministic deny/allow + rule id
        ↓
Studio evidence  ·  CI attestation (admit)

Agent Transaction Firewall

npx @rigour-labs/cli firewall status
npx @rigour-labs/cli firewall adversarial   # deterministic corpus — unexpected allows fail CI
npx @rigour-labs/cli firewall transact --agent <id> --scope 'packages/foo/**'
npx @rigour-labs/cli firewall admit         # CI: valid attestation + PASS + bound git tree
npx @rigour-labs/cli studio                 # Firewall tab: decisions, attestation, mediation health

Guarantees (on mediated paths): fail-closed arbitration · typed commands · per-agent scope · signed attestation bound to commit/tree · adversarial replay as regression fuel—not an AI red-team product.

See ADR 001.

Live governance dashboard (MCP App)

In supported editors, a real-time dashboard appears automatically as your agent works:

┌─ Rigour Governance ──────────────────────────┐
│  Score: 94/100  ✅ PASS                      │
│                                               │
│  14:32:01  rigour_check → FAIL (34/100)       │
│  14:32:03  fix_packet → 8 fixes               │
│  14:32:15  rigour_check → 71/100 (+37)        │
│  14:32:22  rigour_check → ✅ PASS 94/100      │
│                                               │
│  Brain: 47 patterns · trend: improving ↑      │
└───────────────────────────────────────────────┘

No extra commands. The dashboard appears when the agent calls Rigour tools. Watch your agent self-heal in real time. Open Firewall in Studio for allow/deny decisions and mediation status (partial until the MCP gateway is fully wired).

What it catches

Category	Gates
Security	Hardcoded secrets (29+ patterns), SQL injection, XSS, CSRF, prototype pollution, Shannon entropy
Structural	File size, cyclomatic complexity, method count, parameter count, nesting depth, TODO/FIXME
AI Drift	Hallucinated imports, phantom APIs, context drift, retry loop detection
Governance	Agent team isolation, checkpoint supervision, memory DLP
Firewall	Out-of-scope writes, undeclared MCP tools, disallowed shell, fail-closed timeouts

AST-based. Not heuristics. TypeScript, JavaScript, Python, Go, Ruby, C#, Java, Kotlin, Rust.

How it works

Agent writes code → Hooks / gates fire → FAIL? → Fix Packet (JSON)
                                           ↓
                                    Agent reads exact instructions
                                           ↓
                                    Agent fixes → PASS ✓

Mediated run (rigour_run) → typed allowlist → human arbitration (fail-closed)
                                           ↓
                                    execute or deny + evidence

Voluntary rigour_check is a quality workflow, not the security boundary. Hard guarantees require installed hooks/MCP mediation and (for CI) firewall admit.

The Brain — learns your codebase

Every scan reinforces patterns. Patterns decay when absent. At strength: 0.9, they promote to hard rules. Your project's own immune system — trained locally, zero telemetry.

First week:  catches 12 violations
First month: catches 8 violations  ← learning your patterns
Third month: catches 3 violations  ← your agents have adapted

How it's different

	Rigour	ESLint	“AI security agents”
Runs locally, zero telemetry	✅	✅	often ❌
Learns YOUR codebase (Brain)	✅	❌	❌
Agent self-healing (Fix Packets)	✅	❌	❌
Deterministic execution firewall	✅	❌	usually LLM judge
Works offline (GGUF sidecar)	✅	✅	❌
AI-native drift detection	✅	❌	❌
MCP-native	✅	❌	varies

Used in production

19,000+ total installs across CLI and MCP
Organically forked by Alibaba iFlow
OWASP project — listed
Cursor MCP directory — listed

Quick reference

npx rigour-scan                              # zero-config scan
npx @rigour-labs/cli init                    # add gates to your project
npx @rigour-labs/cli hooks init --tool cursor
npx @rigour-labs/cli check                   # run gates
npx @rigour-labs/cli check --deep            # + local AI analysis
npx @rigour-labs/cli check --deep --provider claude -k sk-ant-xxx  # cloud AI
npx @rigour-labs/cli studio                  # monitoring + Firewall tab
npx @rigour-labs/cli firewall adversarial
npx @rigour-labs/cli firewall admit

Architecture

Package	Purpose
`@rigour-labs/core`	Gate engine, AST, Fix Packets, Brain, firewall kernel
`@rigour-labs/cli`	`init`, `check`, `scan`, `run`, `studio`, `firewall`
`@rigour-labs/mcp`	MCP server — governance tools for agent integration
`rigour-scan`	Zero-config shortcut: `npx rigour-scan`

Stack: TypeScript strict, web-tree-sitter, Zod, Vitest.

Full docs | Technical Spec | Philosophy | Firewall ADR

MIT © Rigour Labs — Built by Ashutosh

If Rigour caught something real in your codebase — tell us.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

No tool schema history has been recorded yet.

This server cannot be installed

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Maintenance

ActivityMaintained

ResponsivenessUnresponsive

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

architect
com.hirosecure
Security reviews for coding agents: diffs checked against your org policy and live infrastructure.
Security Code Analysis CI/CD & DevOps
1
governance-platform A
ai.geodesiclabs
Pre-execution governance for AI agents. Deterministic PASS/FAIL/REVIEW verdicts, replayable proof.
AI & Machine Learning Testing & QA Tools Monitoring
373
Korext: AI Code Governance A
io.github.Korext
Governance copilot for AI-assisted coding. 72 packs, 532 rules, proof bundles.
Code Analysis Developer Tools Autonomous Agents
524
agentlock
io.github.Olum289
Security gateway for AI agents: policy, approval, and audited execution, no secrets shared.
Security Agent Orchestration
2

Related MCP Servers

MCP Policy Gatekeeper
Autonomous Agents Security Developer Tools
GILSMON
F
license
A
quality
D
maintenance
Provides real-time policy enforcement for AI coding agents by intercepting and validating their actions against organizational standards like naming conventions, security policies, and compliance rules before execution. Prevents violations through immediate feedback and auto-correction suggestions.
Updated a year ago (2025-10-15 07:07 UTC)
5
-
Metsukeofficial
Security Developer Tools
plenoai
A
license
Not graded
quality
B
maintenance
Provides SDLC compliance verification as tools that AI agents can invoke, continuously monitoring and evaluating development processes.
Updated a day ago (2026-09-04 21:44 UTC)
MIT
CodeMore MCP Server
Code Analysis Developer Tools
abhinavteja123
A
license
Not graded
quality
A
maintenance
Enables AI agents to scan code for security and quality issues and receive machine-readable reports with suggested fixes and verification criteria.
Updated 2 months ago (2026-07-18 16:29 UTC)
72
2
MIT
corbatofficial
Developer Tools Code Analysis
corbat-tech
A
license
A
quality
B
maintenance
Policy and quality engine for AI coding agents that enforces team coding standards and provides validation gates for agent-assisted software delivery.
Updated 20 days ago (2026-08-17 07:08 UTC)
7
54
4
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/rigour-labs/rigour'

If you have feedback or need assistance with the MCP directory API, please join our Discord server