~ / headless_mode /
$ journal $ tools $ about
$ AI agent governance, security tooling, and mechanical enforcement.

rigscore v0.3.0

rigscore, security, ai, devtools, cli, open-source

Changes: v0.2.0 → v0.3.0

The scoring model changes and rigscore becomes CI-ready.

FeatureWhat it does
Moat-heavy scoringAI-specific checks (MCP, coherence, skills, governance) = 60% of score
SARIF v2.1.0 outputIntegration with GitHub Advanced Security, CodeQL, and security dashboards
CI mode--ci --fail-under 80 for pipeline gates
Auto-fix--fix --yes for safe, reversible remediations
Recursive scanning--recursive --depth N for monorepos
Badge generation--badge for README shields

Moat-heavy scoring

The original scoring weighted all checks roughly equally. That didn’t reflect reality — an exposed MCP server with filesystem access is a fundamentally different risk than a missing pre-commit hook.

v0.3.0 reweights so that AI-specific checks carry the majority of the score:

CheckPoints
MCP server configuration18
Cross-config coherence18
Skill file safety12
CLAUDE.md governance12
Deep source secrets10
Secret exposure10
Container security8
Git hooks6
Permissions hygiene6

60 of 100 points come from checks that don’t exist in other security tools. That’s the moat — rigscore scores what matters for AI development environments specifically.

SARIF and CI mode

SARIF output integrates with GitHub Advanced Security so findings show up in the Security tab alongside CodeQL results.

1
2
3
4
5

# SARIF for security dashboards
npx rigscore --sarif > results.sarif

# CI gate — fail the build below 80
npx rigscore --ci --fail-under 80

Auto-fix and recursive scanning

--fix identifies safe remediations — adding .env to .gitignore, fixing SSH key permissions — and applies them. --recursive scans monorepo subdirectories and reports per-project scores.

1
2

npx rigscore --fix --yes
npx rigscore --recursive --depth 2

Install

1

npx rigscore

MIT licensed. github.com/Back-Road-Creative/rigscore

Configuration details reflect a production environment at time of writing. Implementation specifics vary based on tooling versions, platform updates, and organizational requirements. Validate approaches against current documentation before deployment.

← Back to Journal