Rigour

npm version npm downloads License: MIT MCP Registry

Your coding agents write code. Rigour makes the codebase learn.

Rigour is a local-first engineering intelligence layer for coding agents. It gives agents the smallest useful context, enforces deterministic boundaries around observable work, and turns verified outcomes into reusable knowledge for the next task.

It is not another chat wrapper or a prettier linter dashboard. Rigour connects code, agent actions, decisions, proof, and learning into one evidence-backed system.

npx rigour-scan

▶ Watch Rigour in action

Run this in any repository to see the first signal. No account or hosted service required.

Why teams use Rigour

See how agent work improves the codebase

Rigour Studio is an evidence map for engineering work—not just a dependency graph.

intent → context → policy → agent action → verification → outcome → learning
                    │                         │               │
                    └──── advice + impact ────┴───────────────┘

Open Studio to trace an agent run from the recommendation it received to the code it changed, the checks that ran, the risk it prevented, and the knowledge it left behind.

npx @rigour-labs/cli init
npx @rigour-labs/cli hooks init
npx @rigour-labs/cli studio

The five product areas stay simple:

• Map — connect code structure, agent activity, decisions, proof, and outcomes.
• Agents — inspect scopes, run history, handoffs, and the guidance each agent received.
• Review — understand gates, policy decisions, conflicts, and Fix Packets.
• Knowledge — explore patterns, memory, lessons, semantic recall, drift, and cost evidence.
• Settings — see index, graph, cache, learning, storage, and connectivity health.

Start in three minutes

1. Scan a repository

npx rigour-scan

Rigour runs local quality, security, and AI-drift checks and returns an actionable result.

2. Add the Rigour loop

npx @rigour-labs/cli init
npx @rigour-labs/cli hooks init --tool cursor
npx @rigour-labs/cli skills install --target codex,cursor
npx @rigour-labs/cli check

hooks init supports Cursor, Claude Code, Cline, and Windsurf. It checks observable writes as agents work; check is the full project verification step.

3. Give every agent the same good workflow

rigour skills install --target codex,cursor

Rigour Skills turn its evidence loop into small, reusable agent workflows:

• rigour-context asks for the smallest explainable scope before an agent reads code.
• rigour-verify closes a change with proof and a Fix Packet repair loop.
• rigour-handoff transfers verified state without replaying an entire session.

Codex receives native repository skills in .agents/skills. Cursor receives focused slash commands in .cursor/commands. Portable copies land in docs/rigour-skills for other MCP-capable agents. Existing files are preserved unless --force is explicitly used.

4. Give your agent Rigour through MCP

{
  "mcpServers": {
    "rigour": {
      "command": "npx",
      "args": ["-y", "@rigour-labs/mcp@latest"]
    }
  }
}

Agents can ask Rigour for scoped context, register their work, receive Fix Packets, record checkpoints and handoffs, and leave evidence for Studio.

5. Mediate high-impact MCP tools (6.2)

Rigour can sit in front of selected MCP servers, expose only approved tools, normalize every call into a common action record, and issue a signed execution receipt. Start in observe mode to see what policy would block without interrupting work; switch to enforce only after reviewing the evidence.

rigour firewall gateway-configure --config ~/rigour-gateway.json
rigour firewall status
rigour firewall grant --agent coding-agent --task TASK-123 \
  --tool github__create_issue --ttl 300
rigour firewall receipts

Trusted state and canonical receipts live outside the repository. Studio reads them server-side and receives only safe evidence summaries for its Review panel and execution map—never keys, environment secrets, downstream commands, or receipt signatures. Follow MCP Integration for the configuration and exact security boundary.

What Rigour does differently

Context that can explain itself

Rigour builds a structural index immediately and enriches semantic retrieval in the background. When an agent asks for help, it returns the smallest evidence-backed scope it can justify—not a repository dump. Each recommendation records its sources, exclusions, cache reuse, and estimated context savings.

Learning with a proof boundary

Rigour records evidence from its hooks, MCP calls, context retrieval, Fix Packets, accepted changes, checkpoints, handoffs, tests, and human feedback. A lesson starts as a candidate. It becomes reusable only after deterministic verification, repeated successful outcomes, or explicit confirmation.

Model text, vector similarity, rejected fixes, and failed tests can inform investigation. They do not become enforcement rules on their own.

Governance agents can work with

Rigour’s deterministic checks catch security issues, structural regressions, hallucinated imports, phantom APIs, context drift, and more. On supported mediated paths, the Agent Transaction Firewall applies per-agent scopes, typed command allowlists, fail-closed arbitration, and signed attestations.

When work fails a check, Rigour gives the agent a Fix Packet: the rule, affected files, evidence, and concrete next action.

Local first. Team-ready when you are.

Rigour works fully in local-only mode with SQLite. Nothing requires an account.

For teams, PostgreSQL becomes the durable source for private-user and approved shared knowledge; encrypted SQLite remains the local cache and offline outbox. If pgvector is enabled, Rigour can use semantic recall as advisory input while repository scope and lesson state continue to control what applies.

rigour team init-schema --database-url 'postgresql://…' --pgvector
rigour team configure --database-url 'postgresql://…' \
  --organization acme --team platform --actor ashutosh --pgvector
rigour team import-local /path/to/repository --dry-run
rigour team import-local /path/to/repository
rigour team sync
rigour team doctor

team import-local safely adopts personal lessons created before team mode was configured. It is repository-scoped, dry-runnable, idempotent, and never promotes candidate knowledge or publishes it to the team.

When team storage is unavailable, local enforcement and evidence capture continue. Studio reports the state as offline — changes queued.

Guarantees and boundaries

Rigour is deliberately precise about what it does and does not claim.

• Core checks and storage are local-first; cloud deep analysis is opt-in.
• Rigour can enforce work that passes through its installed hooks or MCP gateway. A directly configured parallel MCP server bypasses that gateway unless the host or administrator removes that route.
• Advice is evidence of what Rigour recommended, not proof that an agent followed it or that it caused an outcome.
• Observed spend, measured estimates, and modelled savings are shown separately so cost numbers do not over-promise.

Read the architectural decisions behind these boundaries: Agent Transaction Firewall, Evidence Learning & Team Storage, Adaptive Execution Graph, and Trusted MCP Gateway.

Documentation

Build from source

pnpm install
pnpm build
pnpm test
node packages/rigour-cli/dist/cli.js studio

If a fresh clone reports ignored native build scripts, review and approve the required builds with pnpm approve-builds, then rerun the commands.

Documentation · Discussions · Issues

MIT © Rigour Labs · Built by Ashutosh