# raccioly/docguard [Health: Active] **Category:** ๐Ÿ’ป Developer Tools **Repository:** https://github.com/raccioly/docguard **GitHub Stars:** 27 **npm Downloads (last month):** 1341 **Views:** 2 **Installs:** 0 **Upvotes:** 0 **Directory Page:** https://allmcps.com/mcp/raccioly-docguard ## Description Deterministic documentation-drift detection for AI agents. Validates a project's canonical docs against its actual code โ€” no LLM guessing; every finding has a stable code and a suggested fix. Five read-only tools over stdio: guard, score, explain, verify-claims, diagnose. npx -y docguard-cli mcp ## Claude Desktop Quick Installation Install path detected from listing signals. Uses `npx` (confidence: high): ```json "mcpServers": { "docguard": { "command": "npx", "args": ["-y","docguard-cli"] } } ``` ## Documentation & README # ๐Ÿ›ก๏ธ DocGuard **English** ยท [Portuguรชs (BR)](https://github.com/raccioly/docguard/blob/HEAD/README.pt-BR.md) ยท [Espaรฑol](https://github.com/raccioly/docguard/blob/HEAD/README.es.md) > **The enforcement layer for Spec-Driven Development.** > Validate. Score. Enforce. Ship documentation that AI agents can actually use. [![CI](https://github.com/raccioly/docguard/actions/workflows/ci.yml/badge.svg)](https://github.com/raccioly/docguard/actions/workflows/ci.yml) [![npm](https://img.shields.io/npm/v/docguard-cli)](https://www.npmjs.com/package/docguard-cli) [![npm downloads](https://img.shields.io/npm/dw/docguard-cli)](https://www.npmjs.com/package/docguard-cli) [![PyPI](https://img.shields.io/pypi/v/docguard-cli)](https://pypi.org/project/docguard-cli/) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![Node.js](https://img.shields.io/badge/Node.js-18%2B-green)](https://nodejs.org) [![Runtime deps](https://img.shields.io/badge/runtime_deps-1_(pinned)-green)](package.json) [![Spec Kit Extension](https://img.shields.io/badge/Spec_Kit-Extension-blueviolet)](https://github.com/github/spec-kit) [![Glama](https://glama.ai/mcp/servers/raccioly/docguard/badges/score.svg)](https://glama.ai/mcp/servers/raccioly/docguard) [![MCP Registry](https://img.shields.io/badge/MCP_Registry-listed-0a7ea4)](https://registry.modelcontextprotocol.io/) --- > **โœจ See what DocGuard catches in 30 seconds โ€” no install, no setup:** > ```bash > npx docguard-cli demo > ``` > Runs against a baked-in sample project with intentional drift and shows you the findings + a clear path to fixing them. ![DocGuard demo](https://raw.githubusercontent.com/raccioly/docguard/HEAD/assets/demo.gif) --- ## Table of Contents - [What is DocGuard?](#what-is-docguard) - [Why DocGuard?](#why-docguard) - [Quick Start](#-quick-start) - [Spec Kit Integration](#-spec-kit-integration) - [Usage](#usage) - [Validators](#-validators) - [Templates](#-templates) - [AI Agent Support](#-ai-agent-support) - [Slash Commands](#-slash-commands) - [Examples](#-examples) - [Testing](#-testing) - [Enterprise Adoption](#-enterprise-adoption) - [CI/CD Integration](#%EF%B8%8F-cicd-integration) - [What's New](#-whats-new) - [File Structure](#-file-structure) - [Configuration](#%EF%B8%8F-configuration) - [Research Credits](#-research-credits) --- ## What is DocGuard? DocGuard enforces **Canonical-Driven Development (CDD)** โ€” a methodology where documentation is the source of truth, not an afterthought. AI writes the docs, DocGuard validates them. | Traditional Development | Canonical-Driven Development | |:----|:----| | Code first, docs maybe | Docs first, code conforms | | Docs rot silently | Drift is tracked and enforced | | Docs are optional | Docs are required and validated | | One AI agent, one context | Any agent, shared context via canonical docs | DocGuard is an official [GitHub Spec Kit](https://github.com/github/spec-kit) community extension. It validates the artifacts that Spec Kit creates, ensuring your specs stay high-quality throughout the development lifecycle. ๐Ÿ“– **[Philosophy](https://github.com/raccioly/docguard/blob/HEAD/PHILOSOPHY.md)** ยท ๐Ÿ“‹ **[CDD Standard](https://github.com/raccioly/docguard/blob/HEAD/STANDARD.md)** ยท โš–๏ธ **[Comparisons](https://github.com/raccioly/docguard/blob/HEAD/COMPARISONS.md)** ยท ๐Ÿ”ฌ **[Validation](https://github.com/raccioly/docguard/blob/HEAD/VALIDATION.md)** ยท ๐Ÿ—บ๏ธ **[Roadmap](https://github.com/raccioly/docguard/blob/HEAD/ROADMAP.md)** ### Architecture ```mermaid graph TD CLI["CLI Entry
docguard.mjs"] --> Commands["Commands (20)"] Commands --> guard["guard"] Commands --> generate["generate"] Commands --> score["score"] Commands --> diagnose["diagnose"] Commands --> setup["setup wizard"] Commands --> other["diff ยท init ยท fix ยท trace ยท impact ยท sync
explain ยท memory ยท upgrade ยท agents ยท hooks ยท badge ยท ci ยท watch"] guard --> Validators["Validators (27)"] generate --> Scanners["Scanners (4)
routes ยท schemas ยท doc-tools ยท speckit"] score --> Scoring["Weighted Scoring
8 categories"] diagnose --> Validators diagnose --> AIPrompts["AI-Ready
Fix Prompts"] Validators --> Output["Output"] Scanners --> Output Scoring --> Output Output --> Terminal["Terminal"] Output --> JSON["JSON"] Output --> Badge["Badge"] style CLI fill:#2d5016,color:#fff style Validators fill:#1a3a5c,color:#fff style Scanners fill:#1a3a5c,color:#fff style Output fill:#5c3a1a,color:#fff ``` > **Distribution**: Node.js core (npm) ยท Python wrapper (PyPI) ยท GitHub Action (`action.yml`) ยท Spec Kit Extension (ZIP) --- ## Why DocGuard? DocGuard checks declared documentation facts against repository evidence and gives agents structured repair tasks. Deterministic checks cover supported facts, references, and generated sections. Human-authored requirements and architectural decisions retain their authority when implementation diverges. A guard result describes the checks performed. The CDD grade measures structural maturity. Factual accuracy stays explicitly unverified until the relevant claims have supporting evidence. Coverage and unresolved claims remain visible, so teams can choose an appropriate enforcement policy. Research motivates evaluation of this approach. A 2026 study found that repository context files did not generally improve task success and increased inference cost in its evaluated settings. It also found agents generally followed the instructions. These results support testing concise, relevant context and measuring actual task outcomes; they do not establish DocGuard's effectiveness. [Evaluating AGENTS.md, revised June 2026](https://arxiv.org/abs/2602.11988v2). The development plan prioritizes accurate detection, reproducible evidence, and contributor-supplied regression cases. See [the trust roadmap](https://github.com/raccioly/docguard/blob/HEAD/docs-implementation/TRUST-ROADMAP.md) for implementation status, proposed experiments, and acceptance criteria. --- ## โšก Quick Start > **Package naming:** this repo is `raccioly/docguard`; the published package is **`docguard-cli`** on both [npm](https://www.npmjs.com/package/docguard-cli) and [PyPI](https://pypi.org/project/docguard-cli/); the installed command is `docguard`. Same project โ€” the `-cli` suffix is just the registry name. The package runs **no install scripts**, so `npm i -g docguard-cli --ignore-scripts` is equivalent. ### Node.js (npm) ```bash # No install needed โ€” run directly npx docguard-cli diagnose # Or install globally npm i -g docguard-cli docguard diagnose ``` ### Python (PyPI) ```bash pip install docguard-cli docguard diagnose ``` > **Note:** The Python package is a thin wrapper that delegates to `npx`. Node.js 18+ is required on the system. ### Docker (MCP server) The MCP server ships as a container image on GHCR โ€” no Node.js install required. Public image, so no authentication is needed to pull it: ```bash # Run the MCP server against the current directory docker run -i --rm -v "$PWD":/workspace ghcr.io/raccioly/docguard:latest ``` The entrypoint is the **stdio** MCP transport: stdout is the JSON-RPC channel, so don't pipe anything else into it. Mount the project you want inspected at `/workspace` and pass `{"projectDir": "/workspace"}` in tool calls (or rely on the default working directory). Pin a version rather than tracking `latest` in CI: ```bash docker run -i --rm -v "$PWD":/workspace ghcr.io/raccioly/docguard:0.34.9 ``` The server is **read-only** โ€” it never writes to the mounted project. ### More ways to integrate - **pre-commit** โ€” changed-only guard on every commit: ```yaml repos: - repo: https://github.com/raccioly/docguard rev: v0.29.0 hooks: [{ id: docguard-guard }] # docguard-guard-full for pre-push ``` - **MCP** (Claude, Cursor, any MCP client) โ€” `claude mcp add docguard -- npx -y docguard-cli mcp`; 5 read-only tools (guard, score, explain, verify-claims, diagnose). Registry manifest ships in-repo (`server.json`, Smithery-ready). - **GitLab CI** โ€” component staged at [`templates/ci/gitlab-component.yml`](https://github.com/raccioly/docguard/blob/HEAD/templates/ci/gitlab-component.yml) (guard/score/ci job with a SARIF artifact). - **Homebrew** โ€” `brew install raccioly/tap/docguard` (formula in [`packaging/homebrew/`](https://github.com/raccioly/docguard/blob/HEAD/packaging/homebrew/)). ### Core Workflow ```bash # 1. Initialize docs for your project npx docguard-cli init # 2. Or reverse-engineer docs from existing code npx docguard-cli generate # 3. AI diagnoses issues and generates fix prompts npx docguard-cli diagnose # 4. Validate โ€” use as CI gate npx docguard-cli guard # 5. Check maturity score npx docguard-cli score ``` ### The AI Loop ``` diagnose โ†’ AI reads prompts โ†’ AI fixes docs โ†’ guard verifies โ†‘ โ†“ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ issues found? โ†โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ ``` `diagnose` is the primary command. It runs all validators, maps every failure to an AI-actionable fix prompt, and outputs a remediation plan. Your AI agent runs it, fixes the docs, and runs `guard` to verify. ### Mechanical vs. agent fixes DocGuard splits drift into two kinds and is explicit about which is which: | Kind | Example | How it's fixed | |------|---------|----------------| | **Mechanical** (deterministic) | An endpoint documented in `API-REFERENCE.md` that the OpenAPI spec confirms is gone | `docguard fix --write` deletes the row + detail block itself โ€” **no AI** | | **Agent** (needs judgment) | Rewriting an X-Ray prose section as CloudWatch; writing a new endpoint's request/response | Routed to an AI agent via `diagnose` / `fix --doc` prompts | `docguard fix --write` only touches docs marked `` (override with `--force`), is idempotent, and prints exactly what changed. It never rewrites prose โ€” that stays with the agent. ### Continuous documentation workflow ``` guard โ”€โ”€โ–ถ fix --write (mechanical, auto) โ”€โ”€โ–ถ guard โ”€โ”€โ–ถ diagnose (agent prompts for the rest) ``` - **CI / pre-commit:** `docguard hooks --type pre-commit --auto-fix` installs a hook that applies mechanical fixes, re-stages the docs, then runs `guard`; anything left is surfaced as agent prompts. - **Agent-driven:** `docguard diagnose --auto` scaffolds missing docs **and** applies mechanical fixes, then emits prompts for the content rewrites that remain. - **JSON for automation:** `guard`/`diagnose --format json` include a `mechanicalFixes` array and tag each issue `mechanical` vs `agent`, so an agent can apply or delegate precisely. --- ## ๐ŸŒฑ Spec Kit Integration DocGuard is a [community extension](https://github.com/github/spec-kit/blob/main/extensions/README.md) for GitHub's **Spec Kit** framework. While Spec Kit focuses on **creating** specifications (via AI slash commands like `/speckit.specify` and `/speckit.plan`), DocGuard focuses on **validating** their quality. ### How They Work Together ``` โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ Spec Kit โ”‚ โ”‚ DocGuard โ”‚ โ”‚ โ”‚ โ”‚ โ”‚ โ”‚ /speckit.specifyโ”‚ โ”€โ”€โ”€โ”€โ”€โ”€โ†’ โ”‚ docguard guard โ”‚ โ”‚ Creates specs โ”‚ โ”‚ Validates specs โ”‚ โ”‚ (AI-driven) โ”‚ โ”‚ (automated) โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ ``` | Phase | Tool | What happens | |:------|:-----|:-------------| | 1. Initialize | `specify init` | Creates `.specify/` directory and templates | | 2. Write specs | `/speckit.specify` | AI creates `spec.md` with FR-IDs, user stories | | 3. **Validate** | **`docguard guard`** | Checks spec quality (mandatory sections, FR/SC IDs) | | 4. Plan | `/speckit.plan` | AI creates `plan.md` with technical context | | 5. **Validate** | **`docguard guard`** | Checks plan quality (sections, structure) | | 6. Tasks | `/speckit.tasks` | AI creates `tasks.md` with phased breakdown | | 7. **Validate** | **`docguard guard`** | Checks task quality (phases, T-IDs) | | 8. Implement | `/speckit.implement` | AI writes code | | 9. **Enforce** | **`docguard guard`** | Final quality gate โ€” CI/CD | ### What DocGuard Validates in Spec Kit Projects - **spec.md** โ€” Mandatory sections (User Scenarios, Requirements, Success Criteria), FR-xxx IDs, SC-xxx IDs - **plan.md** โ€” Summary, Technical Context, Project Structure sections - **tasks.md** โ€” Phased task breakdown (Phase 1, 2, 3+), T-xxx task IDs - **constitution.md** โ€” Detected at `.specify/memory/constitution.md` or project root - **Requirement traceability** โ€” FR, SC, NFR, US, AC, UC, SYS, ARCH, MOD, T IDs ### Installing as a Spec Kit Extension ```bash specify extension add docguard ``` This installs DocGuard's slash commands (`/docguard.init`, `/docguard.guard`, `/docguard.review`, `/docguard.fix`, `/docguard.update`) into your AI agent's command palette. --- ## Usage DocGuard ships **20 commands** (the "Daily 5" + 15 situational tools, including the zero-install `demo`, the `mcp` server, and the `ci` pipeline gate). Six additional one-shot scaffolders are accessed via `docguard init --with `. Seven v0.19 commands continue to work as deprecation aliases through v0.20.x โ€” see [MIGRATION-v0.20.md](https://github.com/raccioly/docguard/blob/HEAD/docs-implementation/MIGRATION-v0.20.md). **The Daily 5** โ€” what you'll reach for 95% of the time: | Command | What It Does | |:--------|:-------------| | `init` | Bootstrap a project (`--wizard` for interactive ยท `--with ` for scaffolders) | | `guard` | Validate against canonical docs โ€” 27 validators | | `diff` | Show gaps between docs and code (`--since ` for impact mode) | | `sync` | Refresh code-truth doc sections โ€” keeps memory always up to date | | `score` | CDD maturity score (0-100; `--diff` for delta between refs) | **Tools (situational, but day-to-day useful):** | Command | Purpose | |:--------|:--------| | `demo` | Zero-install showcase โ€” runs guard against a baked-in drifting fixture (`npx docguard-cli demo`) | | `diagnose` | AI orchestrator โ€” guard โ†’ emit fix prompts in one command | | `fix` | Generate AI fix instructions for specific docs (`--doc --format prompt`) | | `fix --write` | Apply deterministic fixes (no AI โ€” version bumps, counts, anchors, sections) | | `fix --history` | Audit log of every mechanical fix applied (from `.docguard/fixed.json`) | | `generate` | Reverse-engineer docs from existing codebase (`--plan` for AI scan) โ€” includes auto-generated Mermaid ER diagrams from your detected schemas (Prisma/Drizzle/TypeORM/Sequelize/Django/Rails) in DATA-MODEL.md | | `agent` | One-shot agent task graph โ€” ordered, pre-filled code-truth, per-task verify (`--format json`) | | `explain ` | Paste any warning โ€” or a finding code like `SEC001` โ€” to get the validator's docstring, fix path, and how to suppress | | `verify --semantic` | Extract documented numbers/limits/enums (retention days, rate limits, GSI/role counts, status enums) as a task list for an agent to check against code โ€” the semantic-drift class regex/AST can't see | | `verify --instructions` | Audit AGENTS.md/CLAUDE.md themselves for drift: duplicate rules, never-vs-always contradictions, stale file pointers, unknown commands โ€” plus clustered rule pairs as agent judgment tasks | | `feedback` | Report likely false positives back to DocGuard โ€” local-first record + a 1-click prefilled, redacted GitHub issue (zero typing) | | `mcp` | MCP server โ€” exposes guard/score/explain/verify/report/diagnose as native tools for Claude, Cursor, and any MCP client. Stdio: `claude mcp add docguard -- npx docguard-cli mcp`. Team-shared HTTP: `docguard mcp --transport http --port 8585` (loopback by default; non-loopback binds require `--api-key`) | | `report` | Compliance-evidence bundle for audits โ€” guard verdict + CDD score + ALCOA+ attributes + fix history, stamped with git commit and a tamper-evident sha256 integrity hash (`--format json`, `--out `). Evidence, not a gate: always exits 0 | | `ci` | Pipeline gate: guard + score in one command โ€” never scaffolds or touches source; its only write is its own `.docguard/history.jsonl` (opt out: `--no-history`). `--threshold ` fails below a score, `--fail-on-warning` for strict mode, `--format json` for parsers | | `score --trend` | Score trajectory from recorded `ci` runs โ€” sparkline, delta, and the last 10 runs with commit stamps | | `memory` | Per-domain accuracy headline (endpoints / entities / env / tech) | | `memory --diff` | Drill into which specific claims don't match code | | `memory --pack` | Write `.docguard/context-pack.md` โ€” compact, code-truth-stamped session-start context for AI agents | | `score --diff` | Drill into which checks pulled each category down | | `trace` / `trace --reverse ` | Requirements traceability โ€” forward AND reverse | | `trace --features` | Per-feature spec-adherence scores (requirement coverage, task completion, task evidence, artifacts) โ€” worst-first with fix hints | | `upgrade [--apply] [--pr]` | Check + migrate `.docguard.json` schema; `--pr` opens a PR | | `watch` | Live mode: re-run guard on file changes | **`init --with ` scaffolders** โ€” picked at init time: | Scaffolder | What It Generates | |:-----------|:------------------| | `agents` | `AGENTS.md`, `CLAUDE.md`, `.cursor/rules/`, `.github/copilot-instructions.md` | | `hooks` | Git pre-commit / pre-push hooks | | `ci` | GitHub Actions / pipeline YAML | | `badge` | Shields.io score badges for README | | `llms` | `llms.txt` (AI-friendly summary) | | `publish` | External doc-site config (Mintlify) โ€” experimental | Run them solo (`docguard init --with hooks`) or stacked (`docguard init --with agents,hooks,badge,ci`). **Deprecation aliases** โ€” `setup` ยท `agents` ยท `hooks` ยท `ci` ยท `badge` ยท `llms` ยท `publish` ยท `impact` keep working in v0.20.x with a yellow stderr warning. `audit โ†’ guard` is permanent (no warning). See [MIGRATION-v0.20.md](https://github.com/raccioly/docguard/blob/HEAD/docs-implementation/MIGRATION-v0.20.md). ### CLI Flags | Flag | Description | Commands | |:-----|:------------|:---------| | `--dir ` | Project directory (default: `.`) | All | | `--verbose` | Show detailed output | All | | `--quiet` / `-q` | Suppress banner โ€” for hooks, CI loops, scripts | All | | `--format json` | Machine-readable output (clean JSON, no ANSI bleed) | guard, score, diff, trace, diagnose, memory, impact, explain | | `--format sarif` | SARIF 2.1.0 output โ€” findings as rules/results for GitHub Code Scanning and SARIF dashboards | guard | | `--format junit` | JUnit XML output โ€” one testcase per validator, for GitLab CI (`artifacts:reports:junit`), Jenkins, Azure DevOps, CircleCI | guard | | `--update-baseline` | Adopt DocGuard on a legacy repo without a red day one: freeze today's findings into a committed `.docguard.baseline.json`; guard/ci then gate only NEW drift. Suppression is always visible ("N pre-existing finding(s) suppressed"), and `--no-baseline` shows the full picture | guard | | `--full` | Generate `llms-full.txt` (full doc bodies inlined) instead of the `llms.txt` link index | llms | | `--pack` | Write `.docguard/context-pack.md` โ€” agent session-start context | memory | | `--sync` | Regenerate the agent-file family (CLAUDE.md, Copilot, Cursor, โ€ฆ) from AGENTS.md; hash-marked, never touches hand-written files without `--force` | agents | | `--check` | CI gate for the synced agent-file family โ€” exit 2 when a variant is stale | agents | | `--force` | Overwrite existing files (creates `.bak` backups) | generate, agents, init | | `--force-redo` | Bypass ping-pong suppression in `.docguard/fixed.json` | fix --write | | `--profile ` | Starter / standard / enterprise | init | | `--no-spec-kit` | Skip auto-init of `.specify/` / `.agent/` scaffolding | init | | `--changed-only [--since ]` | Pre-commit lite mode (5 fast validators on changed files only) | guard | | `--timings` | Per-validator wall-time profile (slowest first) | guard | | `--show-failing` | Show warnings/errors even when status is PASS | guard | | `--pin` | Record running CLI version into `.docguard.json` (reproducibility) | guard | | `--diff` | Per-category drill-down | score, memory | | `--check-only` | Exit 1 if behind (for CI) | upgrade | | `--apply` | Actually run the migration | upgrade | | `--pr` | Open a PR with the migration | upgrade | | `--reverse ` | Reverse traceability (code โ†’ docs) | trace | | `--no-indirect` | Skip the reverse-import-graph analysis (docs about modules that import a changed file) | impact, diff --since | | `--prs` | Open-PR doc-conflict analysis โ€” two PRs impacting the same canonical doc = merge-order risk (needs the `gh` CLI) | impact | | `--transport http` `--port` `--host` `--api-key` `--path` | Serve MCP over Streamable HTTP instead of stdio (team-shared server; loopback-only unless an api-key is set) | mcp | | `--history` | Show fix audit log | fix | ### Example Output ``` $ npx docguard-cli generate ๐Ÿ”ฎ DocGuard Generate โ€” my-project Scanning codebase to generate canonical documentation... Detected Stack: language: TypeScript ^5.0 framework: Next.js ^14.0 database: PostgreSQL orm: Drizzle 0.33 testing: Vitest hosting: AWS Amplify โœ… ARCHITECTURE.md (4 components, 6 tech) โœ… DATA-MODEL.md (12 entities detected) โœ… ENVIRONMENT.md (18 env vars detected) โœ… TEST-SPEC.md (45 tests, 8/10 services mapped) โœ… SECURITY.md (auth: NextAuth.js) โœ… REQUIREMENTS.md (spec-kit aligned) โœ… AGENTS.md โœ… CHANGELOG.md โœ… DRIFT-LOG.md Generated: 9 Skipped: 0 ``` --- ## ๐Ÿ” Validators DocGuard runs **27 automated validators** on every `guard` check. Every one is **language-aware** as of v0.16 โ€” patterns for Python (`test_*.py`), Rust (`tests/*.rs`), Go (`*_test.go`), Java (`*Test.java`), Ruby (`*_spec.rb`), PHP, and JS/TS all match. | # | Validator | What It Checks | Default | |:--|:----------|:--------------|:--------| | 1 | **Structure** | Required CDD files exist | โœ… On | | 2 | **Doc Sections** | Canonical docs have required sections (or N/A markers) | โœ… On | | 3 | **Docs-Sync** | Routes/services referenced in docs + OpenAPI cross-check | โœ… On | | 4 | **Drift-Comments** | `// DRIFT:` comments logged in DRIFT-LOG.md (skips test files by default) | โœ… On | | 5 | **Changelog** | CHANGELOG.md has [Unreleased] section | โœ… On | | 6 | **Test-Spec** | Tests exist per TEST-SPEC.md rules | โœ… On | | 7 | **Environment** | Env vars documented, `.env.example` exists | โœ… On | | 8 | **Security** | No hardcoded secrets in source code | โœ… On | | 9 | **Architecture** | Imports follow layer boundaries (honors `config.ignore`) | โœ… On | | 10 | **Freshness** | Docs not stale relative to code changes (rename-aware via `git log --follow`) | โœ… On | | 11 | **Traceability** | Requirement IDs (FR, SC, NFR, US, AC, T) trace to tests | โœ… On | | 12 | **Docs-Diff** | Code artifacts match documented entities | โœ… On | | 13 | **API-Surface** | API-REFERENCE.md endpoints match real routes (OpenAPI cross-check) | โœ… On | | 14 | **Metadata-Sync** | Version refs consistent across docs | โœ… On | | 15 | **Docs-Coverage** | Code features referenced in documentation | โœ… On | | 16 | **Doc-Quality** | Writing quality (readability, passive voice, atomicity, IEEE 830) | โœ… On | | 17 | **TODO-Tracking** | Untracked TODOs/FIXMEs and skipped tests (skips test files by default) | โœ… On | | 18 | **Schema-Sync** | Database models documented in DATA-MODEL.md | โœ… On | | 19 | **Spec-Kit** | Spec quality validation (FR-IDs, mandatory sections, phased tasks) | โœ… On | | 20 | **Cross-Reference** | Internal markdown links + anchors resolve (with "did you mean?" hints); Obsidian wikilinks validated when the repo uses them as file links (`.obsidian` present or a target resolves) | โœ… On | | 21 | **Generated-Staleness** | `source=code` sections match scanner output; `status: draft` doc age | โœ… On | | 22 | **Canonical-Sync** | DocGuard's own README count claims match code-truth (DocGuard repo only โ€” N/A elsewhere) | โœ… On | | 23 | **Metrics-Consistency** | Hardcoded numbers match actual counts | โœ… On | | 24 | **Surface-Sync** | Item-level enumerable drift โ€” names in doc tables/lists (commands, checks, etc.) match code-truth (opt-in via `surfaceSync.surfaces`; N/A unless configured) | โœ… On | | 25 | **Diff-Suspicion** | Change-driven: a doc/agent-instruction file that references code changed since the ref AND shares removed domain symbols is flagged for review (arXiv 2010.01625, F1 74.7) | โœ… On | | 26 | **Reference-Existence** | Two-revision check: a backticked code symbol present when the doc was last updated but gone at HEAD is flagged as outdated (arXiv 2212.01479) | โœ… On | | 27 | **API-Doc-Smells** | Bloated (โ‰ฅ300 words) / Lazy (โ‰ค6 prose words) API documentation units, keyed on signature-headed sections (F1 0.90/0.95) | โœ… On | **Per-validator controls** (in `.docguard.json`): ```json { "validators": { "test-spec": false, // disable (kebab-case OR camelCase both accepted) "freshness": true }, "severity": { "todoTracking": "high", // warnings fail CI "freshness": "low" // warnings ignored for exit code } } ``` --- ## ๐Ÿ“„ Templates DocGuard ships **18 professional templates** with metadata, badges, and revision history: | Template | Type | Purpose | |:---------|:-----|:--------| | ARCHITECTURE.md | Canonical | System design, components, layer boundaries | | DATA-MODEL.md | Canonical | Schemas, entities, relationships | | SECURITY.md | Canonical | Auth, permissions, secrets management | | TEST-SPEC.md | Canonical | Test strategy, coverage requirements | | ENVIRONMENT.md | Canonical | Environment variables, deployment config | | REQUIREMENTS.md | Canonical | Spec-kit aligned FR/SC IDs, user stories | | DEPLOYMENT.md | Canonical | Infrastructure, CI/CD, DNS | | ADR.md | Canonical | Architecture Decision Records | | ROADMAP.md | Canonical | Project phases, feature tracking | | KNOWN-GOTCHAS.md | Implementation | Symptom โ†’ gotcha โ†’ fix entries | | TROUBLESHOOTING.md | Implementation | Error diagnosis guides | | RUNBOOKS.md | Implementation | Operational procedures | | VENDOR-BUGS.md | Implementation | Third-party issue tracker | | CURRENT-STATE.md | Implementation | Deployment status, tech debt | | AGENTS.md | Agent | AI agent behavior rules | | CHANGELOG.md | Tracking | Change log | | DRIFT-LOG.md | Tracking | Deviation tracking | | llms.txt | Generated | AI-friendly project summary (llmstxt.org) | --- ## ๐Ÿค– AI Agent Support ### One-click MCP install [![Add to Cursor](https://img.shields.io/badge/Cursor-Add_MCP_Server-000000?logo=cursor)](cursor://anysphere.cursor-deeplink/mcp/install?name=docguard&config=eyJjb21tYW5kIjogIm5weCIsICJhcmdzIjogWyIteSIsICJkb2NndWFyZC1jbGkiLCAibWNwIl19) [![Install in VS Code](https://img.shields.io/badge/VS_Code-Install_MCP_Server-0098FF?logo=githubcopilot)](vscode:mcp/install?%7B%22name%22%3A%22docguard%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22docguard-cli%22%2C%22mcp%22%5D%7D) - **Claude Code**: `claude mcp add docguard -- npx docguard-cli mcp` - **Claude Desktop**: download `docguard-v.mcpb` from the [latest release](https://github.com/raccioly/docguard/releases/latest) and drag it into Settings โ†’ Extensions โ€” you'll be asked which project folder to analyze. No npm, no JSON editing. - **Anything MCP**: DocGuard is a verified namespace on the [official MCP registry](https://registry.modelcontextprotocol.io/v0/servers?search=docguard) (`io.github.raccioly/docguard`). DocGuard works with **every major AI coding agent**. All canonical docs are plain markdown โ€” no vendor lock-in. | Agent | Compatibility | Auto-Generate Config | |:------|:---:|:---:| | Google Antigravity | โœ… | `docguard agents --agent antigravity` | | Claude Code | โœ… | `docguard agents --agent claude` | | GitHub Copilot | โœ… | `docguard agents --agent copilot` | | Cursor | โœ… | `docguard agents --agent cursor` | | Windsurf | โœ… | `docguard agents --agent windsurf` | | Cline | โœ… | `docguard agents --agent cline` | | Google Gemini CLI | โœ… | `docguard agents --agent gemini` | | Kiro (AWS) | โœ… | โ€” | ### Always-on nudge hook (Claude Code) ```bash docguard hooks --claude # install (remove: docguard hooks --claude --remove) ``` Registers a `PostToolUse` hook in the project's `.claude/settings.json`. After the agent edits a canonical doc it is nudged to run `docguard guard --changed-only`; after it edits a code file the docs reference, it is nudged toward `docguard impact`. Merge-safe (only DocGuard's own entry is ever added/removed), throttled to one nudge per file per 30 minutes, and the hook runtime can never break a session (errors are silent by contract). Explicit opt-in โ€” `init` never installs it for you. --- ## โšก Slash Commands DocGuard provides AI agent slash commands for integrated workflows. Installed automatically via `docguard init` or `specify extension add docguard`: | Command | What It Does | |:--------|:-------------| | `/docguard.init` | Initialize Canonical-Driven Development in a new or existing project | | `/docguard.guard` | Run quality validation โ€” check all 27 validators | | `/docguard.review` | Analyze doc quality and suggest improvements | | `/docguard.fix` | Generate targeted fix prompts for specific issues | | `/docguard.update` | Update canonical docs after code changes โ€” detect drift and sync documentation | These commands are installed into your AI agent's command directory: ``` .github/commands/ โ†’ GitHub Copilot .cursor/rules/ โ†’ Cursor .gemini/commands/ โ†’ Google Gemini .claude/commands/ โ†’ Claude Code .agents/workflows/ โ†’ Antigravity ``` --- ## ๐Ÿง  AI Skills (Enterprise) Beyond slash commands, DocGuard provides **4 enterprise-grade AI skills** โ€” deep behavior protocols that tell AI agents not just *what* to run, but *how to think, validate, and iterate*. Skills are modeled after [Spec Kit's](https://github.com/github/spec-kit) skill architecture. | Skill | Lines | What It Does | |:------|:-----:|:-------------| | `docguard-guard` | 155 | 6-step quality gate with severity triage (CRITICALโ†’LOW), structured reporting, remediation | | `docguard-fix` | 195 | 7-step research workflow with per-document codebase research and 3-iteration validation loops | | `docguard-review` | 170 | Read-only semantic cross-document analysis with 6 analysis passes and quality scoring | | `docguard-score` | 165 | CDD maturity assessment with ROI-based improvement roadmap and grade progression | ### Workflow Hooks DocGuard integrates into the spec-kit workflow as an automated quality gate: | Hook | When | Behavior | |:-----|:-----|:---------| | `after_implement` | After `/speckit.implement` | **Mandatory** โ€” always runs DocGuard guard | | `before_tasks` | Before `/speckit.tasks` | Optional โ€” reviews doc consistency | | `after_tasks` | After `/speckit.tasks` | Optional โ€” shows CDD maturity score | ### Orchestration Scripts For advanced users and CI/CD pipelines, DocGuard includes bash scripts with `--json` output: | Script | Purpose | |:-------|:--------| | `docguard-check-docs.sh` | Discover project docs, return JSON inventory with metadata | | `docguard-suggest-fix.sh` | Run guard, parse results, output prioritized fixes | | `docguard-init-doc.sh` | Initialize canonical doc with metadata header | --- ## ๐Ÿ“ Examples Three real-world projects to see DocGuard in action: | Example | Scenario | What You'll See | |---------|----------|----------------| | [01-express-api](https://github.com/raccioly/docguard/blob/HEAD/examples/01-express-api/) | Node.js API with **zero docs** | Cold-start: `generate` โ†’ instant coverage | | [02-python-flask](https://github.com/raccioly/docguard/blob/HEAD/examples/02-python-flask/) | Python app with **drifted docs** | Drift detection: catch when docs lie | | [03-spec-kit-project](https://github.com/raccioly/docguard/blob/HEAD/examples/03-spec-kit-project/) | Full CDD + Spec Kit | Gold standard: what maturity looks like | See [examples/README.md](https://github.com/raccioly/docguard/blob/HEAD/examples/README.md) for step-by-step instructions. --- ## ๐Ÿงช Testing ### Test Suite ```bash npm test # 33 tests across 18 describe blocks ``` Covers all 15 CLI commands, project type detection, compliance profiles, JSON output format, and help completeness. ### CI Matrix | Node.js | OS | Status | |---------|-----|--------| | 18 | ubuntu-latest | โœ… | | 20 | ubuntu-latest | โœ… | | 22 | ubuntu-latest | โœ… | ### Self-Validation (Dogfooding) DocGuard runs its own `guard`, `score`, `diff`, `diagnose`, and `badge` commands against itself in CI โ€” ensuring the tool passes its own checks. --- ## ๐Ÿข Enterprise Adoption Everything runs local or in your CI โ€” no SaaS, no data leaving your infra. The pieces that matter at company scale: | Need | DocGuard answer | |------|-----------------| | **Adopt on a legacy repo** without a red pipeline on day one | `guard --update-baseline` freezes existing findings into a committed `.docguard.baseline.json`; only NEW drift gates from then on (suppression always visible) | | **Audit trail** for compliance reviews | `docguard report` โ€” commit-stamped evidence bundle (guard verdict, findings by code, CDD score, ALCOA+ data-integrity attributes, fix history) with a tamper-evident sha256 integrity hash | | **Every CI system**, not just GitHub | `guard --format sarif` (GitHub Code Scanning) ยท `--format junit` (GitLab, Jenkins, Azure DevOps, CircleCI) ยท `--format json` (anything else) | | **Trajectory, not snapshots** | `docguard ci` records every run to `.docguard/history.jsonl`; `score --trend` shows the sparkline + delta | | **AI agents on the team** | MCP server (stdio or team-shared HTTP) exposes guard/score/explain/verify/report/diagnose as read-only tools; `agents --sync` keeps the whole agent-file family drift-proof | | **Data-integrity framing auditors know** | ALCOA+ scoring (FDA 21 CFR Part 11 / EMA Annex 11 vocabulary) built into `score` and `report` | ## โš™๏ธ CI/CD Integration > **Full recipes:** see [`docs-canonical/CI-RECIPES.md`](https://github.com/raccioly/docguard/blob/HEAD/docs-canonical/CI-RECIPES.md) for guard, auto-fix (commits mechanical fixes back to PRs), nightly sync, score-on-PR, and pre-commit configs. ### GitHub Actions โ€” Guard (most common) ```yaml name: DocGuard Guard on: [pull_request, push] permissions: { pull-requests: write } # for the sticky PR comment (optional) jobs: docguard: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: { fetch-depth: 0 } - uses: raccioly/docguard@v0.12.0 with: command: guard ``` On pull requests, guard mode also gives inline PR feedback (both default on): | Input | Default | Description | |-------|---------|-------------| | `annotations` | `true` | Inline `::error`/`::warning` annotations on the PR diff, one per guard finding (capped at 50; a final notice reports how many were elided) | | `pr-comment` | `true` | Sticky PR comment with the guard verdict, top findings (by code), and which canonical docs the PR's changed files impact (`diff --since origin/`). Needs `permissions: pull-requests: write`; degrades to a log warning without it | Both run even when guard fails โ€” that's when the feedback matters. Prefer native code-scanning integration? `docguard guard --format sarif` uploads straight to GitHub Code Scanning via `github/codeql-action/upload-sarif`. ### GitHub Actions โ€” Auto-Fix (commits mechanical fixes back) ```yaml name: DocGuard Auto-Fix on: { pull_request: { types: [opened, synchronize, reopened] } } permissions: { contents: write, pull-requests: write } jobs: autofix: runs-on: ubuntu-latest if: github.event.pull_request.head.repo.full_name == github.repository steps: - uses: actions/checkout@v4 with: ref: ${{ github.event.pull_request.head.ref }} token: ${{ secrets.GITHUB_TOKEN }} fetch-depth: 0 - uses: raccioly/docguard@v0.12.0 with: { command: fix, auto-commit: 'true', comment-on-pr: 'true' } ``` ### Pre-commit Hook ```bash npx docguard-cli hooks --type pre-commit ``` ### Workflow starters (copy directly) Two ready-to-use templates ship with the Spec Kit extension and as standalone files: - `extensions/spec-kit-docguard/templates/github-workflows/docguard-guard.yml` โ€” mandatory CI gate - `extensions/spec-kit-docguard/templates/github-workflows/docguard-autofix.yml` โ€” PR auto-fix --- ## โœจ What's New Highlights of the current line (v0.29 โ†’ v0.33): - **Adoption baseline** โ€” `guard --update-baseline` freezes a legacy repo's existing findings into a committed `.docguard.baseline.json`; guard/ci then gate only NEW drift, with suppression always visible. Adopt today, burn down at your own pace. - **`docguard report`** โ€” commit-stamped compliance-evidence bundle (guard verdict, findings by code, CDD score, ALCOA+ attributes, fix history) with a tamper-evident sha256 integrity hash. Also exposed as the `docguard_report` MCP tool. - **Score history + `score --trend`** โ€” `docguard ci` records every run to `.docguard/history.jsonl`; the trend view shows the sparkline and delta over time. - **Three machine formats for guard** โ€” `--format json`, `--format sarif` (GitHub Code Scanning), and `--format junit` (GitLab, Jenkins, Azure DevOps, CircleCI). - **MCP server, stdio + team HTTP** โ€” guard/score/explain/verify/report/diagnose as read-only agent tools: `claude mcp add docguard -- npx docguard-cli mcp`. - **Agent-file family sync** โ€” `agents --sync` treats AGENTS.md as canonical and regenerates CLAUDE.md / `.cursor/rules` / Copilot / Gemini variants with drift-proof source-hash markers. - **`verify --semantic` and `verify --instructions`** โ€” extract documented numbers/limits/enums as agent verification tasks; audit the agent-instruction files themselves for contradictions and stale pointers. - **`docguard agent`** โ€” one-shot ordered task graph with pre-filled code-truth, collapsing ~10 agent round-trips into one call. See [CHANGELOG.md](https://github.com/raccioly/docguard/blob/HEAD/CHANGELOG.md) for the full history. --- ## ๐Ÿ“ File Structure ``` your-project/ โ”œโ”€โ”€ .specify/ # Spec Kit (if using specify init) โ”‚ โ”œโ”€โ”€ specs/ โ”‚ โ”‚ โ””โ”€โ”€ 001-feature/ โ”‚ โ”‚ โ”œโ”€โ”€ spec.md # Requirements (FR-IDs, user stories) โ”‚ โ”‚ โ”œโ”€โ”€ plan.md # Implementation plan โ”‚ โ”‚ โ””โ”€โ”€ tasks.md # Task breakdown โ”‚ โ”œโ”€โ”€ memory/ โ”‚ โ”‚ โ””โ”€โ”€ constitution.md # Project principles โ”‚ โ””โ”€โ”€ templates/ โ”‚ โ”œโ”€โ”€ docs-canonical/ # CDD canonical docs (the "blueprint") โ”‚ โ”œโ”€โ”€ ARCHITECTURE.md # System design, components โ”‚ โ”œโ”€โ”€ DATA-MODEL.md # Database schemas โ”‚ โ”œโ”€โ”€ SECURITY.md # Auth, permissions, secrets โ”‚ โ”œโ”€โ”€ TEST-SPEC.md # Required tests, coverage โ”‚ โ”œโ”€โ”€ ENVIRONMENT.md # Environment variables โ”‚ โ””โ”€โ”€ REQUIREMENTS.md # Spec-kit aligned FR/SC IDs โ”‚ โ”œโ”€โ”€ docs-implementation/ # Current state (optional) โ”‚ โ”œโ”€โ”€ KNOWN-GOTCHAS.md โ”‚ โ”œโ”€โ”€ TROUBLESHOOTING.md โ”‚ โ”œโ”€โ”€ RUNBOOKS.md โ”‚ โ””โ”€โ”€ CURRENT-STATE.md โ”‚ โ”œโ”€โ”€ AGENTS.md # AI agent behavior rules โ”œโ”€โ”€ CHANGELOG.md # Change tracking โ”œโ”€โ”€ DRIFT-LOG.md # Documented deviations โ”œโ”€โ”€ llms.txt # AI-friendly summary โ””โ”€โ”€ .docguard.json # DocGuard configuration ``` --- ## โš™๏ธ Configuration Create `.docguard.json` in your project root (auto-generated by `docguard init`): ```json { "projectName": "my-project", "version": "0.4", "profile": "standard", "projectType": "webapp", "validators": { "structure": true, "docsSync": true, "drift": true, "changelog": true, "testSpec": true, "security": true, "environment": true, "docQuality": true, "specKit": true } } ``` See [Configuration Guide](https://github.com/raccioly/docguard/blob/HEAD/docs/configuration.md) for all options. --- ## ๐Ÿ”ฌ Research Credits DocGuard's quality evaluation and documentation generation patterns are informed by peer-reviewed research from the University of Arizona and the Joint Interoperability Test Command (JITC), U.S. Department of Defense: - **AITPG** โ€” AI-driven Test Plan Generator using Multi-Agent Debate and RAG ([Lopez et al., IEEE TSE 2026](https://github.com/raccioly/docguard/blob/HEAD/Research/AITPG.pdf)) - **TRACE** โ€” Telecom Root Cause Analysis through Calibrated Explainability ([Lopez et al., IEEE TMLCN 2026](https://github.com/raccioly/docguard/blob/HEAD/Research/TRACE.pdf)) Lead researcher: **[Martin Manuel Lopez](https://github.com/martinmanuel9)** ยท [ORCID 0009-0002-7652-2385](https://orcid.org/0009-0002-7652-2385) See [CONTRIBUTING.md](https://github.com/raccioly/docguard/blob/HEAD/CONTRIBUTING.md#research--academic-credits) for full citations. --- ## โญ Star History [![Star History Chart](https://api.star-history.com/svg?repos=raccioly/docguard&type=Date)](https://star-history.com/#raccioly/docguard&Date) --- ## ๐Ÿ”’ Privacy & Supply Chain DocGuard is local-first: no telemetry, no analytics, no phone-home โ€” the full (short) policy is in [PRIVACY.md](https://github.com/raccioly/docguard/blob/HEAD/PRIVACY.md). npm releases are published with [provenance attestation](https://docs.npmjs.com/generating-provenance-statements), so you can verify each tarball was built by GitHub Actions from this repository. ## ๐Ÿ“„ License [MIT](https://github.com/raccioly/docguard/blob/HEAD/LICENSE) โ€” Free to use, modify, and distribute. --- **Made with โค๏ธ by [Ricardo Accioly](https://github.com/raccioly)**