rigscore v0.4.0

March 19, 2026 rigscore, security, ai, devtools, mcp, open-source

Changes: v0.3.0 → v0.4.0

Four additions. Check count goes from 9 to 10.

Feature	What it does
`--watch`	Monitors project directory, re-scans affected checks on file change, reports score deltas
Windows/WSL security	Advisory check — WSL interop exposure, Windows PATH injection, mount permissions, Defender exclusion gaps
Plugin system	Custom checks via JS modules that export the rigscore check interface
`--init-hook`	Runs a script before scanning starts — bootstrap config, pull allowlists, set up fixtures

Watch mode

The original workflow was: change something, remember to run rigscore, look at the score. The problem is the “remember to” part. Configurations drift between scans — new MCP servers get added, .env files show up outside .gitignore, extensions change agent scope.

--watch keeps rigscore running. It watches config files and re-evaluates on change. Output shows which checks were affected and the score delta.

1
npx rigscore --watch

Windows/WSL security

10th check. Advisory-only — no point impact, but it flags attack surfaces specific to WSL2 development:

WSL interop — whether Windows binaries can execute from the Linux side by default
PATH injection — whether Windows executables can shadow Linux tools
Mount permissions — whether Windows drives are mounted with permissive defaults
Defender exclusions — whether dev directories are excluded from AV scanning, creating blind spots

This matters because a lot of AI development happens in WSL2, and the boundary between the Windows and Linux sides is more porous than most people assume.

Plugins and init hooks

Plugins let organizations codify their own checks — internal MCP server allowlists, required governance patterns, custom secret formats. A plugin is a JS module that exports the standard check interface. It runs alongside the built-in checks and contributes to the score.

Init hooks run a script before scanning starts. Use case: pulling a dynamic allowlist, bootstrapping project config, or setting up test fixtures before rigscore evaluates the environment.

1
2
3
4
5
# Run with a custom check plugin
npx rigscore --plugin ./our-org-policy.js

# Run a setup script before scanning
npx rigscore --init-hook ./bootstrap.sh

Scoring weight unchanged

The moat checks still carry the majority of the score:

Check	Points
MCP supply chain	18
Cross-config coherence	18
Skill file safety	12
CLAUDE.md governance	12

60 of 100 points come from AI-specific configuration. The remaining 40 cover secrets, containers, git hooks, and permissions. Windows/WSL is advisory and doesn’t affect the numeric score.

Rationale for the weighting: MCP server misconfiguration and governance contradictions are the highest-impact risks in an AI dev environment, and they’re the checks that don’t exist in other tools.

Install

1
npx rigscore

No accounts, no telemetry, no network calls. MIT licensed.

github.com/joepetjr/rigscore

Configuration details reflect a production environment at time of writing. Implementation specifics vary based on tooling versions, platform updates, and organizational requirements. Validate approaches against current documentation before deployment.

← Back to Journal