rigscore v0.3.0

Installing today? This is a historical release note. npx rigscore now resolves to the deprecated npm package (0.4.1) — install the current release with npx github:Back-Road-Creative/rigscore (see the docs).

Changes: v0.2.0 → v0.3.0

The scoring model changes and rigscore becomes CI-ready.

Features

• Moat-heavy scoring — AI-specific checks (MCP, coherence, skills, governance) now carry 60% of the score
• SARIF v2.1.0 output — integrates with GitHub Advanced Security dashboards
• CI mode — --ci --fail-under 80 for pipeline gates
• Auto-fix — --fix --yes for safe, reversible remediations
• Recursive scanning — --recursive --depth N for monorepos
• Badge generation — --badge for README shields

Moat-heavy scoring

The original scoring weighted all checks roughly equally. That didn’t reflect reality — an exposed MCP server with filesystem access is a fundamentally different risk than a missing pre-commit hook.

v0.3.0 reweights so that AI-specific checks carry the majority of the score:

60 of 100 points come from checks that don’t exist in other security tools. That’s the moat — rigscore scores what matters for AI development environments specifically.

SARIF and CI mode

SARIF output integrates with GitHub Advanced Security so findings show up in the Security tab alongside GitHub code scanning results.

1# SARIF for security dashboards
2npx rigscore --sarif > results.sarif
3
4# CI gate — fail the build below 80
5npx rigscore --ci --fail-under 80

Auto-fix and recursive scanning

--fix identifies safe remediations — adding .env to .gitignore, fixing SSH key permissions — and applies them. --recursive scans monorepo subdirectories and reports per-project scores.

1npx rigscore --fix --yes
2npx rigscore --recursive --depth 2

github.com/Back-Road-Creative/rigscore