# Rules MCP (npm · @akr1166org/rules-mcp)

MCP for rules/skills/knowledge evaluation for Cursor, Claude, VS Code, and Antigravity.

- Trust score: 68/100 (medium)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-19

## Components

- npm · `@akr1166org/rules-mcp`: 68/100 (this document), [markdown](https://verifymcp.io/servers/akr1166-rules-mcp/akr1166org-rules-mcp.md), [page](https://verifymcp.io/servers/akr1166-rules-mcp/akr1166org-rules-mcp)

## Channel facts

- Registry: `npm`
- Package: `@akr1166org/rules-mcp`
- Version: `0.3.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-19.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 30 of 96 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 19/100
  - Repository check failed: the declared repository URL returned HTTP 404.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 7 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 85/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1578 tokens (~75/item across 21 items; 19 tools + 2 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 86/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 58% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add akr1166-rules-mcp -- npx -y @akr1166org/rules-mcp
```

### Codex

```bash
codex mcp add akr1166-rules-mcp -- npx -y @akr1166org/rules-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "akr1166-rules-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@akr1166org/rules-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add akr1166-rules-mcp --command npx --arg -y --arg @akr1166org/rules-mcp
```

### Hermes

```yaml
mcp_servers:
  akr1166-rules-mcp:
    command: "npx"
    args: ["-y", "@akr1166org/rules-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "akr1166-rules-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@akr1166org/rules-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-19 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-18 (score 67, +3)

- [functional improvement] Stability: unverified → 0.23

### 2026-08-12 (score 64, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-08-11 (score 49)

First indexed and scored.

## MCP tools (19)

### `ping` (~35 tokens)

Ping

Health check for Rules MCP. Returns server version, phase, and configured paths.

Input parameters:

- `message` (string): Optional message to echo back

### `server_info` (~18 tokens)

Server info

Describe Rules MCP capabilities available in the current phase.

### `list_rules` (~105 tokens)

List rules

List project coding/governance rules from rules/*.yaml (enforceable standards and policies). For Cursor agent skills (Markdown/MDC under cursor skills/), use list_skills instead.

Input parameters:

- `category` (string)
- `kind` (string)
- `priority` (string)
- `status` (string)
- `summary` (boolean): If true (default), return compact summaries instead of full rules
- `tags` (array): Tags that must all match

### `get_rule` (~61 tokens)

Get rule

Fetch full details for one YAML governance rule by ID (e.g. TS001, SEC001). For Markdown skills, use get_skill with a skill slug (e.g. typescript-expert).

Input parameters:

- `id` (string, required): Rule ID such as TS001

### `search_rules` (~46 tokens)

Search rules

Search YAML governance rules by keyword (security, logging, python, secrets, etc.). For Cursor skills under cursor skills/, use search_skills.

Input parameters:

- `query` (string, required): Search query

### `list_skills` (~99 tokens)

List skills

List Cursor agent skills loaded from cursor skills/ as Markdown (.md) or MDC (.mdc). Use when the user asks what skills exist or which skill guidance applies.

Input parameters:

- `category` (string)
- `kind` (string)
- `parentId` (string): Parent skill id for nested skill-rules
- `summary` (boolean): If true (default), return compact summaries instead of full bodies
- `tags` (array)

### `get_skill` (~65 tokens)

Get skill

Fetch one skill by slug/id from cursor skills/ (e.g. typescript-expert, nestjs-best-practices/security-validate-all-input). Skills are MD/MDC, not YAML.

Input parameters:

- `id` (string, required): Skill id/slug such as typescript-expert

### `search_skills` (~41 tokens)

Search skills

Search Markdown/MDC skills under cursor skills/ by keyword (nestjs, typescript, prompt, security, etc.).

Input parameters:

- `query` (string, required): Search query

### `select_skills` (~98 tokens)

Select skills

PRIMARY first step for any coding/governance prompt: automatically pick relevant cursor skills for the user's task and return a ready-to-paste 'Skills used' disclosure (id, why, score). Call this (or get_context) before answering, then paste skillsDisclosure at the start of your reply.

Input parameters:

- `limit` (integer)
- `tags` (array)
- `task` (string, required): The user's prompt / what they asked for

### `get_knowledge` (~57 tokens)

Get knowledge

Retrieve project knowledge (architecture, FAQs, module docs). Use when the user asks how the project is structured or about architecture/domain knowledge.

Input parameters:

- `id` (string)
- `query` (string)
- `tags` (array)

### `search_knowledge` (~60 tokens)

Search knowledge

Ranked search across project knowledge docs (architecture, FAQ, modules). Use when the user asks to find docs about a topic with relevance ranking.

Input parameters:

- `limit` (integer)
- `query` (string, required): Search query
- `tags` (array)

### `get_context` (~115 tokens)

Get context

Gather relevant YAML rules, Markdown/MDC skills (from cursor skills/), and knowledge for a coding task. Returns skillsDisclosure — paste that block at the start of your reply before answering. Prefer calling this or select_skills first on every coding prompt.

Input parameters:

- `files` (array): Relevant file paths
- `profile` (string): AI profile id: cursor, claude, default
- `tags` (array)
- `task` (string, required): What the agent is trying to do
- `tokenBudget` (integer)

### `enrich_prompt` (~79 tokens)

Enrich prompt

Turn a short feature request into a full governed instruction set using project YAML rules, cursor skills (MD/MDC), and knowledge. Includes skillsDisclosure — the agent must open the user-visible reply with that section (skills chosen + why).

Input parameters:

- `files` (array)
- `intent` (string, required): Short user request
- `profile` (string)

### `validate_code` (~158 tokens)

Validate code

Check a single code snippet against enforceable YAML rules under rules/ and return line-level issues (rule id, message, suggestion). Markdown skills are advisory via list_skills/get_context — they are not machine-validated here. For folders or multiple files, use the multi-file evaluation tool instead.

Input parameters:

- `code` (string, required): Source code to validate
- `filePath` (string): Virtual or real path for glob/exception/language detection
- `language` (string): Any language id/alias: typescript, python, java, go, rust, csharp, … Detected from filePath if omitted.
- `runExternal` (boolean): Also run optional external checkers (tsc/complexity/secrets) with timeouts

### `validate_paths` (~184 tokens)

Evaluate files against rules

PRIMARY tool when the user wants to evaluate, review, scan, audit, or check source files/folders for enforceable YAML rule violations (any languages: js, ts, py, java, go, …). Reads files from disk, applies matching rules under rules/ as ground truth, and returns every issue with file, line, ruleId, rule text, and suggestion. Skills under cursor skills/ are MD/MDC guidance (use list_skills / get_context), not validators. Prefer this over single-snippet validation whenever paths or folders are involved.

Input parameters:

- `cwd` (string): Base directory for relative paths (default: process.cwd() / project root)
- `paths` (array, required): File or directory paths to evaluate (e.g. ['src/demo'] or ['src'])
- `recursive` (boolean): When a path is a directory, scan recursively (default true)

### `review_diff` (~98 tokens)

Review diff

Review a unified git diff/patch against project rules. Reports violations on new/changed lines. Use when the user asks to review a PR diff, patch, or staged changes for standards compliance.

Input parameters:

- `baseFiles` (object): Optional map of path → full file content when the patch lacks full context
- `newViolationsOnly` (boolean): Only report violations on added lines (default true)
- `patch` (string, required): Unified diff text

### `score_output` (~74 tokens)

Score output

Produce a governance scorecard (aiScore, category scores, blocking, failedCritical) for code. Use when the user asks for a quality/compliance score.

Input parameters:

- `code` (string): Source code to score
- `filePath` (string)
- `language` (string)
- `runExternal` (boolean)

### `explain_violation` (~66 tokens)

Explain violation

Explain a rule/violation by ID: rule text, reason, good/bad examples, exceptions, and related knowledge. Use when the user asks why a rule failed or what TS001/SEC001 means.

Input parameters:

- `ruleId` (string, required): Rule ID such as TS001

### `generate_artifacts` (~97 tokens)

Generate artifacts

Generate agent instruction files from the YAML rule source of truth: .cursor/rules, AGENTS.md, CLAUDE.md, STYLEGUIDE.md, SECURITY.md, CONTRIBUTING.md, PR checklist, and prompt templates. Use when the user asks to sync or regenerate governance artifacts.

Input parameters:

- `outputDir` (string): Directory to write into (default: process.cwd())
- `targets` (array): Defaults to all Phase 2 targets

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/akr1166-rules-mcp/akr1166org-rules-mcp#diagnostics

## Score history

- 2026-08-19: 68
- 2026-08-18: 67
- 2026-08-17: 64
- 2026-08-16: 64
- 2026-08-15: 64
- 2026-08-14: 64
- 2026-08-13: 64
- 2026-08-12: 64
- 2026-08-11: 49

## Links

- npm package: https://www.npmjs.com/package/@akr1166org/rules-mcp
- Socket report: https://socket.dev/npm/package/@akr1166org/rules-mcp
- Changelog RSS feed: https://verifymcp.io/servers/akr1166-rules-mcp/akr1166org-rules-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/akr1166-rules-mcp/akr1166org-rules-mcp.json
- HTML version of this page: https://verifymcp.io/servers/akr1166-rules-mcp/akr1166org-rules-mcp