Log inSubmit server
Aiglare logo

Aiglare

Audits JavaScript and TypeScript repositories for missing AI governance guardrails and exposes the analysis through MCP tools.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Aiglare

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "aiglare": {
      "command": "npx",
      "args": [
        "-y",
        "@nugehs/aiglare"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y @nugehs/aiglare

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 8d ago.

Overview

The aiglare MCP server scans JavaScript and TypeScript repositories for AI outputs that reach users or trigger side effects. Its MCP tools return surface audits, CI-gate results, and the detected provider registry over stdio JSON-RPC. Findings cover confidence handling, fallback paths, output validation, human review, and error isolation. Use it when an agent needs to inspect AI governance risks before adding or changing code.

Use cases

  • Audit a JavaScript repository for unguarded AI outputs
  • Gate CI on red side-effectful AI surfaces
  • Generate compliance evidence for supported frameworks
  • Inspect detected AI providers through an MCP client

Key features

  • AI surface detection in JavaScript and TypeScript repositories
  • Sink classification for user-facing, side-effectful, and internal outputs
  • Checks for confidence, fallback, validation, human review, and error isolation
  • MCP tools for audits, CI gates, and provider listing
  • SOC 2, EU AI Act, NIST AI RMF, and OWASP mappings
  • Optional repoctx-based scan prioritization

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

11/11 checks healthy over the last 62d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 12d ago via OSV.dev · @nugehs/aiglare (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1Stargazers on the source repository.
npm downloads180Package downloads in the last 30 days.
Last commit4mo agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.

How Aiglare works

What the aiglare MCP server does

The aiglare MCP server provides static analysis for AI features in JavaScript and TypeScript repositories. It identifies AI surfaces—places where model output is returned to a user, rendered in an interface, logged or cached, or passed into an action such as a payment, booking, email, database write, file write, or shell command.

Each surface receives a sink classification and a severity based on five areas: confidence handling, an uncertain or fallback path, output validation, human approval for side effects, and error isolation. Red findings indicate that model output reaches a user or side effect without detected guardrails; amber indicates partial coverage; green indicates detected safeguards.

The analysis is advisory static analysis rather than runtime verification. It can miss guardrails several call hops away and can treat a variable such as confidence as protective even when it does not actually control behavior.

How it works

The scanner uses a provider registry to recognize integrations from OpenAI, Anthropic, Google, Cohere, Mistral, Replicate, the Vercel AI SDK, LangChain and LangGraph, Ollama, AWS Bedrock, Cloudflare Workers AI, and Hugging Face. It also checks raw fetch and axios requests to recognized inference hosts.

When a .dev-context/index.json index from repoctx is available, aiglare uses its file metadata to prioritize likely AI files and improve sink classification. Without that index, the built-in TypeScript compiler scanner performs the audit with lower call-graph fidelity.

The MCP process communicates through stdio JSON-RPC. It can return the same structured report available from the command-line JSON format, including compliance violations when compliance frameworks are requested.

Setup and configuration

Install or run the package with npm, then start the MCP server using:

Terminal
npx -y @nugehs/aiglare mcp

An MCP host can register it with a command of npx, the package argument -y @nugehs/aiglare, and the mcp subcommand. The README names Claude Desktop, Cursor, and VS Code as compatible hosts.

The command-line scanner accepts repository paths and options for severity, sink filters, compliance frameworks, and output format. Multiple paths can be supplied for one combined report. Supported compliance identifiers are soc2, eu-ai-act, nist, and owasp; all selects every supported framework.

Tools and capabilities

The aiglare MCP server exposes three tools:

  • ai_surface_audit: audits a repository using path, with optional sinks, severity, and compliance settings, and returns a structured surface report.
  • ai_surface_gate: returns a pass/fail result and the number of blocking red, side-effectful surfaces.
  • list_providers: returns the provider registry used by the scanner.

The command-line implementation can emit terminal, JSON, lint, Markdown, or HTML output. Its CI mode exits unsuccessfully only when it finds a red side-effectful surface, which targets unreviewed actions with irreversible consequences.

Limitations and notes

Results should be treated as reviewable surfaces, not definitive violations. The standalone scanner cannot follow every call-graph path, so a guardrail implemented elsewhere may be missed. Conversely, syntactic indicators can produce a positive result without proving that a guardrail is effective. The repoctx integration improves prioritization and sink classification but remains optional.

The project is licensed under MIT. The MCP server does not itself add runtime validators or change application behavior; it identifies locations where those controls may be missing.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Aiglare

aiglare is an MCP server that connects AI agents to JavaScript and TypeScript repository audits. Its main tools, ai_surface_audit, ai_surface_gate, and list_providers, find AI outputs reaching users or side effects, report missing governance guardrails, return CI-gate results, and show recognized model providers.

Run it with npx using `npx -y @nugehs/aiglare mcp`. Register that command and its `mcp` argument in an MCP host configuration. The server communicates through stdio JSON-RPC and does not require an SDK dependency.

The README names Claude Desktop, Cursor, and VS Code as MCP hosts for aiglare. Configure each host to launch `npx -y @nugehs/aiglare mcp` through its MCP server settings.

It reports AI surfaces classified as user-facing, side-effectful, or internal, with severity based on detected confidence handling, fallback paths, output validation, human-in-the-loop controls, and error isolation. Compliance options can add mapped violations to each surface.

Yes. The `ai_surface_gate` tool returns a verdict and blocking count, while command-line `--ci` exits non-zero for red side-effectful surfaces. This targets model outputs that can trigger irreversible actions without detected safeguards.

Related MCP servers

All in Developer Tools All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewAiglare AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/aiglare?style=directory)](https://allmcps.com/mcp/aiglare)
HTML Embed
<a href="https://allmcps.com/mcp/aiglare"><img src="https://allmcps.com/api/badge/aiglare?style=directory" alt="Aiglare on AllMCPs" /></a>