Rigour

🚀 Rigour

AI Agent Governance. One command. Every agent.

Rigour is the security and quality layer that sits between AI coding agents and your codebase. It can be regarded as an antivirus for AI-generated code, featuring both local intelligence and cloud-powered deep analysis.

It governs three aspects that no other solution does:

1. What goes IN — DLP intercepts credentials before they reach any agent.
2. What comes OUT — Quality gates catch hallucinated imports, unsafe patterns, and drift.
3. What gets PERSISTED — Memory governance prevents secrets from leaking into agent memory.

It works with Claude Code, Cursor, Cline, Windsurf, and GitHub Copilot. One rigour init command sets up everything, including hooks, MCP tools, rules, DLP, and pattern indexing.

🚀 Quick Start

npx @rigour-labs/cli init

This single command:

• Creates rigour.yml with auto-detected project settings.
• Installs real-time hooks for every detected agent (block mode).
• Configures the MCP server for agent-cooperative governance.
• Enables DLP, intercepting credentials before they reach agents.
• Builds a pattern index for instant duplicate detection.
• It's all local-first, and your code never leaves your machine.

✨ Features

How It Works

Rigour uses a two-tier supervision model:

• Tier 1 — Hooks (automatic, <100ms): Inline checks that fire on every file write. The agent cannot bypass these. It catches secrets, hallucinated imports, file size violations, and command injection in real time.
• Tier 2 — MCP Tools (agent-cooperative): The agent is instructed to call Rigour tools at key moments, such as rigour_recall before starting, rigour_check_pattern before creating code, and rigour_check before declaring done. Rules files (.cursor/rules/rigour.mdc, CLAUDE.md, .clinerules) enforce this workflow.

AI Agent DLP (Data Loss Prevention)

Every AI agent gets a pre-input hook that scans for 29 credential patterns in real time (<50ms), including cloud keys (AWS, GCP, Azure), API tokens (OpenAI, GitHub, Stripe, etc.), private keys (RSA, EC, ED25519), database URLs, JWTs, and more. It includes anti-evasion hardening with Unicode normalization, entropy detection, and JSON deserialization scanning.

Quality Gates (27+ deterministic)

Deterministic PASS/FAIL gates that catch what AI agents get wrong:

• Hallucinated imports — Language-aware resolution for 8 languages.
• Phantom APIs — Non-existent stdlib/framework methods the LLM invented.
• Duplication drift — Three-pass detection: MD5 exact → AST Jaccard (tree-sitter) → semantic embedding (all-MiniLM-L6-v2).
• Style drift — Fingerprints naming conventions against the project baseline.
• Logic drift — Tracks comparison operators, branch counts, return statements.
• Security patterns — Hardcoded secrets, command injection, SQL injection, XSS.
• Dependency bloat — Unused deps, heavy alternatives (moment→dayjs).
• Test quality — Empty tests, tautological assertions, mock abuse.

Deep Analysis (Local RL + Cloud Learning)

Rigour's deep analysis is not "ask an LLM to review code." It runs a three-stage pipeline where the model is constrained by ground truth:

1. Fact extraction (deterministic) — AST parsing, semantic embeddings, style fingerprints, logic baselines, dependency graphs. No LLM is involved.
2. LLM interpretation — The model receives structured facts (not raw code). It focuses on SOLID principles, design patterns, and architecture.
3. Verification (deterministic) — Every LLM finding is cross-referenced against AST facts. Hallucinated findings are discarded.

Local mode ships a GGUF sidecar model (Qwen2.5-Coder) that runs on any CPU, requiring no GPU, no API key, and no data leaving your machine. The Rigour Brain (SQLite) learns from every scan. Patterns are reinforced when seen repeatedly, decay when absent, and promote to hard rules at high strength. This is the "local RL" — your project's own learned immune system.

Cloud mode sends structured facts to your chosen provider (Claude, OpenAI, Gemini, etc.) via BYOK for deeper analysis. It follows the same three-stage pipeline but with a more powerful model.

rigour check --deep              # Local sidecar (lite, any CPU)
rigour check --deep --pro        # Local sidecar (full, code-specialized)
rigour check --deep --provider claude -k sk-ant-xxx  # Cloud BYOK

Pattern Index

A pre-built index of all functions, classes, and components in your codebase (.rigour/patterns.json). It enables O(1) duplicate detection via the rigour_check_pattern MCP tool, instead of the agent scanning every file and wasting tokens.

rigour index                     # Build/update pattern index
rigour index --semantic          # Include semantic embeddings

Memory & Skills Governance

Agents write to native memory files (.cursorrules, CLAUDE.md, .windsurf/memories/). Rigour intercepts these writes and forces agents to use rigour_remember instead. Every value is DLP-scanned before persistence. Recall is also gated, and credentials stored before DLP was installed are blocked on read.

📦 Installation

# npx (fastest)
npx @rigour-labs/cli --version

# Homebrew
brew tap rigour-labs/tap && brew install rigour

# Global npm
npm install -g @rigour-labs/cli

💻 Usage Examples

Basic Usage

rigour init                          # Full setup: config, hooks, MCP, DLP, pattern index
rigour check                         # Run all quality gates
rigour check --deep                  # + local LLM deep analysis
rigour check --deep --pro            # + full deep model
rigour scan                          # Zero-config scan (no rigour.yml needed)
rigour hooks init --tool cursor      # Install hooks for a specific tool
rigour hooks check --files src/a.ts  # Fast file check (<100ms)
rigour index                         # Build pattern index
rigour brain                         # Show local memory status
rigour brain --compact               # Prune old data, reclaim disk
rigour studio                        # Visual dashboard
rigour doctor                        # Diagnose install + readiness

Advanced Usage

{
  "mcpServers": {
    "rigour": {
      "command": "npx",
      "args": ["-y", "@rigour-labs/mcp"]
    }
  }
}

Key MCP tools:

📚 Documentation

• Quick Start
• Configuration
• Deep Analysis
• Accuracy Policy
• MCP Integration
• OWASP Mapping
• Docs Site

📄 License

MIT © Rigour Labs