# aiglare [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/nugehs/aiglare  
**GitHub Stars:** 1  
**npm Downloads (last month):** 180  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/aiglare

## Description
Audit AI/LLM features for governance guardrails: confidence, fallback, validation, human-in-loop.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "aiglare": {
    "command": "npx",
    "args": ["-y","@nugehs/aiglare"]
  }
}
```

## Documentation

## What the aiglare MCP server does

The aiglare MCP server provides static analysis for AI features in JavaScript and TypeScript repositories. It identifies AI surfaces—places where model output is returned to a user, rendered in an interface, logged or cached, or passed into an action such as a payment, booking, email, database write, file write, or shell command.

Each surface receives a sink classification and a severity based on five areas: confidence handling, an uncertain or fallback path, output validation, human approval for side effects, and error isolation. Red findings indicate that model output reaches a user or side effect without detected guardrails; amber indicates partial coverage; green indicates detected safeguards.

The analysis is advisory static analysis rather than runtime verification. It can miss guardrails several call hops away and can treat a variable such as `confidence` as protective even when it does not actually control behavior.

## How it works

The scanner uses a provider registry to recognize integrations from OpenAI, Anthropic, Google, Cohere, Mistral, Replicate, the Vercel AI SDK, LangChain and LangGraph, Ollama, AWS Bedrock, Cloudflare Workers AI, and Hugging Face. It also checks raw `fetch` and `axios` requests to recognized inference hosts.

When a `.dev-context/index.json` index from repoctx is available, aiglare uses its file metadata to prioritize likely AI files and improve sink classification. Without that index, the built-in TypeScript compiler scanner performs the audit with lower call-graph fidelity.

The MCP process communicates through stdio JSON-RPC. It can return the same structured report available from the command-line JSON format, including compliance violations when compliance frameworks are requested.

## Setup and configuration

Install or run the package with npm, then start the MCP server using:

```bash
npx -y @nugehs/aiglare mcp
```

An MCP host can register it with a command of `npx`, the package argument `-y @nugehs/aiglare`, and the `mcp` subcommand. The README names Claude Desktop, Cursor, and VS Code as compatible hosts.

The command-line scanner accepts repository paths and options for severity, sink filters, compliance frameworks, and output format. Multiple paths can be supplied for one combined report. Supported compliance identifiers are `soc2`, `eu-ai-act`, `nist`, and `owasp`; `all` selects every supported framework.

## Tools and capabilities

The aiglare MCP server exposes three tools:

- `ai_surface_audit`: audits a repository using `path`, with optional `sinks`, `severity`, and compliance settings, and returns a structured surface report.
- `ai_surface_gate`: returns a pass/fail result and the number of blocking red, side-effectful surfaces.
- `list_providers`: returns the provider registry used by the scanner.

The command-line implementation can emit terminal, JSON, lint, Markdown, or HTML output. Its CI mode exits unsuccessfully only when it finds a red side-effectful surface, which targets unreviewed actions with irreversible consequences.

## Limitations and notes

Results should be treated as reviewable surfaces, not definitive violations. The standalone scanner cannot follow every call-graph path, so a guardrail implemented elsewhere may be missed. Conversely, syntactic indicators can produce a positive result without proving that a guardrail is effective. The repoctx integration improves prioritization and sink classification but remains optional.

The project is licensed under MIT. The MCP server does not itself add runtime validators or change application behavior; it identifies locations where those controls may be missing.

_Full upstream README: https://allmcps.com/mcp/aiglare/readme_