Supported clients
- #rigscore
- #clients
- #mcp
- #reference
- #devtools
Companion to the rigscore docs and command reference. rigscore reads a single client registry — one source of truth for every AI coding tool it knows about — and scans, scores, and rug-pull-pins whichever of these surfaces exist in your repo. No flag turns a client on; if the file is there, it is scanned.
Each row lists only the surfaces a client genuinely has: its instruction file (CLAUDE.md, AGENTS.md, GEMINI.md, …); its MCP config (a committed repo config is what a pull request can mutate, so it’s exactly what the CVE-2025-54136 rug-pull pin covers — a ~/ home config is scanned but never pinned); its sandbox boundary; and its skill dirs (slash-command / skill / prompt directories scanned for hijack and exfil, with home dirs gated behind --include-home-skills).
The registry
| Client | Instruction file | MCP config | Sandbox | Skill / command dirs |
|---|---|---|---|---|
| Claude Code | CLAUDE.md | .mcp.json (repo), ~/.claude.json | .claude/settings.json, .claude/settings.local.json | .claude/commands, .claude/skills (repo + home) |
| Claude Desktop | — | ~/.claude/claude_desktop_config.json | — | — |
| Cursor | .cursorrules | .cursor/mcp.json (repo + home) | .cursor/permissions.json | — |
| Windsurf | .windsurfrules | ~/.windsurf/mcp.json | — | — |
| Cline | .clinerules | ~/.cline/mcp_settings.json | — | — |
| Continue | .continuerules | ~/.continue/config.json | — | — |
| GitHub Copilot | copilot-instructions.md, .github/copilot-instructions.md | .vscode/mcp.json (repo) | — | — |
| Codex CLI | AGENTS.md | in .codex/config.toml (TOML) | .codex/config.toml (repo + home) | ~/.codex/prompts |
| Aider | .aider.conf.yml | — | — | — |
| Gemini CLI | GEMINI.md | .gemini/settings.json (repo + home) | .gemini/settings.json | .gemini/commands (repo + home) |
| opencode | AGENTS.md | opencode.json (repo), ~/.config/opencode/opencode.json | opencode.json / home config | .opencode/commands, ~/.config/opencode/commands |
| Amp | — | ~/.amp/mcp.json | — | — |
| Zed | — | ~/.config/zed/settings.json | — | — |
| Amazon Q Developer | .amazonq/rules/ (dir) | .amazonq/mcp.json, .amazonq/default.json (repo + ~/.aws/amazonq) | — | — |
| Roo Code | .roorules | .roo/mcp.json (repo) | — | — |
| Cody | — | .vscode/settings.json (cody.mcpServers) | — | — |
| JetBrains Junie | .junie/guidelines.md | .junie/mcp/mcp.json (repo + home) | — | — |
| Goose | .goosehints | in ~/.config/goose/config.yaml (YAML) | — | — |
| Warp | — | .warp/.mcp.json (repo + home) | — | — |
| Kiro | .kiro/steering/ (dir) | .kiro/settings/mcp.json (repo + home) | — | — |
| Qwen Code | QWEN.md | .qwen/settings.json (repo + home) | — | — |
| Crush | CRUSH.md | .crush.json / crush.json (repo), ~/.config/crush/crush.json | — | — |
| OpenClaw | — | ~/.openclaw/openclaw.json (mcp.servers) | — | — |
| Antigravity | AGENTS.md | ~/.gemini/antigravity/mcp_config.json | — | — |
A dash means the client has no such surface, or none at a stable path rigscore can resolve. Codex and Goose keep their MCP servers in TOML and YAML respectively, so the JSON MCP reader doesn’t parse them — their servers surface through the sandbox and credential readers instead.
Directory-form rule sets
Modern clients read a directory of rule files rather than one file. rigscore scans these by default, so a repo governed only by, say, .cursor/rules/*.mdc still counts as governed:
| Directory | Read by | Files |
|---|---|---|
.cursor/rules/ | Cursor | *.mdc |
.windsurf/rules/ | Windsurf | any non-dotfile |
.clinerules/ | Cline | any non-dotfile |
.github/instructions/ | GitHub Copilot | *.instructions.md |
.amazonq/rules/ | Amazon Q | *.md |
.kiro/steering/ | Kiro | *.md |
Example configs
Starter configurations for the common clients live in the product repo under docs/examples/ — ready-to-copy baselines for claude, cursor, cline, continue, copilot, windsurf, aider, and a vendor-neutral agents-md. For opinionated, check-targeting baselines you can install in place, use the guard packs (rigscore init --list-packs).
For how each surface is scored, see the rigscore docs; for the working commands, the command reference.