The DocGuard MCP server provides tools to validate, score, and diagnose documentation quality in projects following Canonical-Driven Development (CDD). AI agents (Claude, Cursor, etc.) can use it to inspect and analyze a project's canonical documentation against its codebase.
Validate documentation (docguard_guard): Run all enabled DocGuard validators against a project's canonical docs, returning a full report with status (PASS/WARN/FAIL), structured findings with stable codes and suggestions, a doc coverage map, and per-validator results.
Compute CDD maturity score (docguard_score): Calculate a CDD maturity score (0–100) with a letter grade and per-category breakdown to assess how well the project's documentation meets quality standards.
Explain finding codes (docguard_explain): Look up any stable DocGuard finding code (e.g., STR001, ENV003) to understand what it means, which validator emits it, and how to suppress it inline if it's a confirmed false positive.
Extract semantic claims for verification (docguard_verify_claims): Discover documented numbers, limits, and enums from canonical docs as a structured verification task list, enabling manual or AI-driven checks against the actual code.
Diagnose issues to fix (docguard_diagnose): Run the guard and return only actionable findings — failing and warning validators with their messages and suggested next steps — shaped specifically for an AI agent to act on.
Integrates with GitHub Spec Kit to validate specifications, plans, and tasks created by Spec Kit's AI-driven slash commands.
Provides a GitHub Action for continuous integration, enabling DocGuard validation to run as part of CI/CD pipelines.
Provides a GitLab CI component for integrating DocGuard validation into GitLab pipelines.
Provides a pre-commit hook to run DocGuard validation on changed files before committing.
English · Português (BR) · Español
The enforcement layer for Spec-Driven Development. Validate. Score. Enforce. Ship documentation that AI agents can actually use.
✨ See what DocGuard catches in 30 seconds — no install, no setup:
npx docguard-cli demoRuns against a baked-in sample project with intentional drift and shows you the findings + a clear path to fixing them.
Related MCP server: docs-mcp-server
DocGuard enforces Canonical-Driven Development (CDD) — a methodology where documentation is the source of truth, not an afterthought. AI writes the docs, DocGuard validates them.
Traditional Development | Canonical-Driven Development |
Code first, docs maybe | Docs first, code conforms |
Docs rot silently | Drift is tracked and enforced |
Docs are optional | Docs are required and validated |
One AI agent, one context | Any agent, shared context via canonical docs |
DocGuard is an official GitHub Spec Kit community extension. It validates the artifacts that Spec Kit creates, ensuring your specs stay high-quality throughout the development lifecycle.
📖 Philosophy · 📋 CDD Standard · ⚖️ Comparisons · 🔬 Validation · 🗺️ Roadmap
graph TD
CLI["CLI Entry<br/>docguard.mjs"] --> Commands["Commands (20)"]
Commands --> guard["guard"]
Commands --> generate["generate"]
Commands --> score["score"]
Commands --> diagnose["diagnose"]
Commands --> setup["setup wizard"]
Commands --> other["diff · init · fix · trace · impact · sync<br/>explain · memory · upgrade · agents · hooks · badge · ci · watch"]
guard --> Validators["Validators (27)"]
generate --> Scanners["Scanners (4)<br/>routes · schemas · doc-tools · speckit"]
score --> Scoring["Weighted Scoring<br/>8 categories"]
diagnose --> Validators
diagnose --> AIPrompts["AI-Ready<br/>Fix Prompts"]
Validators --> Output["Output"]
Scanners --> Output
Scoring --> Output
Output --> Terminal["Terminal"]
Output --> JSON["JSON"]
Output --> Badge["Badge"]
style CLI fill:#2d5016,color:#fff
style Validators fill:#1a3a5c,color:#fff
style Scanners fill:#1a3a5c,color:#fff
style Output fill:#5c3a1a,color:#fffDistribution: Node.js core (npm) · Python wrapper (PyPI) · GitHub Action (
action.yml) · Spec Kit Extension (ZIP)
Documentation that drifts from code is worse than no documentation — it confidently misleads humans and AI agents alike. DocGuard treats your canonical docs as an enforced contract: deterministic validators diff what the docs claim against what the code does, on every commit, with no LLM required. The full thesis (and the research behind it) lives in PHILOSOPHY.md; recent feature highlights moved below.
The field data backs the enforcement-over-instructions bet: an ETH Zurich study across 138 repos / 5,694 agent PRs found the most popular style of agent-instruction file hurts agent performance, and practitioners keep converging on the same lesson — written rules are routinely ignored; programmatic checks are what agents (and humans) actually respect. That is exactly the layer DocGuard provides: not another instructions file, but the validator suite that makes the instructions and docs verifiably true.
Package naming: this repo is
raccioly/docguard; the published package isdocguard-clion both npm and PyPI; the installed command isdocguard. Same project — the-clisuffix is just the registry name. The package runs no install scripts, sonpm i -g docguard-cli --ignore-scriptsis equivalent.
# No install needed — run directly
npx docguard-cli diagnose
# Or install globally
npm i -g docguard-cli
docguard diagnosepip install docguard-cli
docguard diagnoseNote: The Python package is a thin wrapper that delegates to
npx. Node.js 18+ is required on the system.
pre-commit — changed-only guard on every commit:
repos:
- repo: https://github.com/raccioly/docguard
rev: v0.29.0
hooks: [{ id: docguard-guard }] # docguard-guard-full for pre-pushMCP (Claude, Cursor, any MCP client) — claude mcp add docguard -- npx -y docguard-cli mcp; 5 read-only tools (guard, score, explain, verify-claims, diagnose). Registry manifest ships in-repo (server.json, Smithery-ready).
GitLab CI — component staged at templates/ci/gitlab-component.yml (guard/score/ci job with a SARIF artifact).
Homebrew — brew install raccioly/tap/docguard (formula in packaging/homebrew/).
# 1. Initialize docs for your project
npx docguard-cli init
# 2. Or reverse-engineer docs from existing code
npx docguard-cli generate
# 3. AI diagnoses issues and generates fix prompts
npx docguard-cli diagnose
# 4. Validate — use as CI gate
npx docguard-cli guard
# 5. Check maturity score
npx docguard-cli scorediagnose → AI reads prompts → AI fixes docs → guard verifies
↑ ↓
└───────────────── issues found? ←──────────────────────┘diagnose is the primary command. It runs all validators, maps every failure to an AI-actionable fix prompt, and outputs a remediation plan. Your AI agent runs it, fixes the docs, and runs guard to verify.
DocGuard splits drift into two kinds and is explicit about which is which:
Kind | Example | How it's fixed |
Mechanical (deterministic) | An endpoint documented in |
|
Agent (needs judgment) | Rewriting an X-Ray prose section as CloudWatch; writing a new endpoint's request/response | Routed to an AI agent via |
docguard fix --write only touches docs marked <!-- docguard:generated true --> (override with --force), is idempotent, and prints exactly what changed. It never rewrites prose — that stays with the agent.
guard ──▶ fix --write (mechanical, auto) ──▶ guard ──▶ diagnose (agent prompts for the rest)CI / pre-commit: docguard hooks --type pre-commit --auto-fix installs a hook that applies mechanical fixes, re-stages the docs, then runs guard; anything left is surfaced as agent prompts.
Agent-driven: docguard diagnose --auto scaffolds missing docs and applies mechanical fixes, then emits prompts for the content rewrites that remain.
JSON for automation: guard/diagnose --format json include a mechanicalFixes array and tag each issue mechanical vs agent, so an agent can apply or delegate precisely.
DocGuard is a community extension for GitHub's Spec Kit framework. While Spec Kit focuses on creating specifications (via AI slash commands like /speckit.specify and /speckit.plan), DocGuard focuses on validating their quality.
┌─────────────────┐ ┌──────────────────┐
│ Spec Kit │ │ DocGuard │
│ │ │ │
│ /speckit.specify│ ──────→ │ docguard guard │
│ Creates specs │ │ Validates specs │
│ (AI-driven) │ │ (automated) │
└─────────────────┘ └──────────────────┘Phase | Tool | What happens |
1. Initialize |
| Creates |
2. Write specs |
| AI creates |
3. Validate |
| Checks spec quality (mandatory sections, FR/SC IDs) |
4. Plan |
| AI creates |
5. Validate |
| Checks plan quality (sections, structure) |
6. Tasks |
| AI creates |
7. Validate |
| Checks task quality (phases, T-IDs) |
8. Implement |
| AI writes code |
9. Enforce |
| Final quality gate — CI/CD |
spec.md — Mandatory sections (User Scenarios, Requirements, Success Criteria), FR-xxx IDs, SC-xxx IDs
plan.md — Summary, Technical Context, Project Structure sections
tasks.md — Phased task breakdown (Phase 1, 2, 3+), T-xxx task IDs
constitution.md — Detected at .specify/memory/constitution.md or project root
Requirement traceability — FR, SC, NFR, US, AC, UC, SYS, ARCH, MOD, T IDs
specify extension add docguardThis installs DocGuard's slash commands (/docguard.init, /docguard.guard, /docguard.review, /docguard.fix, /docguard.update) into your AI agent's command palette.
DocGuard ships 20 commands (the "Daily 5" + 15 situational tools, including the zero-install demo, the mcp server, and the ci pipeline gate). Six additional one-shot scaffolders are accessed via docguard init --with <name>. Seven v0.19 commands continue to work as deprecation aliases through v0.20.x — see MIGRATION-v0.20.md.
The Daily 5 — what you'll reach for 95% of the time:
Command | What It Does |
| Bootstrap a project ( |
| Validate against canonical docs — 27 validators |
| Show gaps between docs and code ( |
| Refresh code-truth doc sections — keeps memory always up to date |
| CDD maturity score (0-100; |
Tools (situational, but day-to-day useful):
Command | Purpose |
| Zero-install showcase — runs guard against a baked-in drifting fixture ( |
| AI orchestrator — guard → emit fix prompts in one command |
| Generate AI fix instructions for specific docs ( |
| Apply deterministic fixes (no AI — version bumps, counts, anchors, sections) |
| Audit log of every mechanical fix applied (from |
| Reverse-engineer docs from existing codebase ( |
| One-shot agent task graph — ordered, pre-filled code-truth, per-task verify ( |
| Paste any warning — or a finding code like |
| Extract documented numbers/limits/enums (retention days, rate limits, GSI/role counts, status enums) as a task list for an agent to check against code — the semantic-drift class regex/AST can't see |
| Audit AGENTS.md/CLAUDE.md themselves for drift: duplicate rules, never-vs-always contradictions, stale file pointers, unknown commands — plus clustered rule pairs as agent judgment tasks |
| Report likely false positives back to DocGuard — local-first record + a 1-click prefilled, redacted GitHub issue (zero typing) |
| MCP server — exposes guard/score/explain/verify/report/diagnose as native tools for Claude, Cursor, and any MCP client. Stdio: |
| Compliance-evidence bundle for audits — guard verdict + CDD score + ALCOA+ attributes + fix history, stamped with git commit and a tamper-evident sha256 integrity hash ( |
| Pipeline gate: guard + score in one command — never scaffolds or touches source; its only write is its own |
| Score trajectory from recorded |
| Per-domain accuracy headline (endpoints / entities / env / tech) |
| Drill into which specific claims don't match code |
| Write |
| Drill into which checks pulled each category down |
| Requirements traceability — forward AND reverse |
| Per-feature spec-adherence scores (requirement coverage, task completion, task evidence, artifacts) — worst-first with fix hints |
| Check + migrate |
| Live mode: re-run guard on file changes |
init --with <name> scaffolders — picked at init time:
Scaffolder | What It Generates |
|
|
| Git pre-commit / pre-push hooks |
| GitHub Actions / pipeline YAML |
| Shields.io score badges for README |
|
|
| External doc-site config (Mintlify) — experimental |
Run them solo (docguard init --with hooks) or stacked (docguard init --with agents,hooks,badge,ci).
Deprecation aliases — setup · agents · hooks · ci · badge · llms · publish · impact keep working in v0.20.x with a yellow stderr warning. audit → guard is permanent (no warning). See MIGRATION-v0.20.md.
Flag | Description | Commands |
| Project directory (default: | All |
| Show detailed output | All |
| Suppress banner — for hooks, CI loops, scripts | All |
| Machine-readable output (clean JSON, no ANSI bleed) | guard, score, diff, trace, diagnose, memory, impact, explain |
| SARIF 2.1.0 output — findings as rules/results for GitHub Code Scanning and SARIF dashboards | guard |
| JUnit XML output — one testcase per validator, for GitLab CI ( | guard |
| Adopt DocGuard on a legacy repo without a red day one: freeze today's findings into a committed | guard |
| Generate | llms |
| Write | memory |
| Regenerate the agent-file family (CLAUDE.md, Copilot, Cursor, …) from AGENTS.md; hash-marked, never touches hand-written files without | agents |
| CI gate for the synced agent-file family — exit 2 when a variant is stale | agents |
| Overwrite existing files (creates | generate, agents, init |
| Bypass ping-pong suppression in | fix --write |
| Starter / standard / enterprise | init |
| Skip auto-init of | init |
| Pre-commit lite mode (5 fast validators on changed files only) | guard |
| Per-validator wall-time profile (slowest first) | guard |
| Show warnings/errors even when status is PASS | guard |
| Record running CLI version into | guard |
| Per-category drill-down | score, memory |
| Exit 1 if behind (for CI) | upgrade |
| Actually run the migration | upgrade |
| Open a PR with the migration | upgrade |
| Reverse traceability (code → docs) | trace |
| Skip the reverse-import-graph analysis (docs about modules that import a changed file) | impact, diff --since |
| Open-PR doc-conflict analysis — two PRs impacting the same canonical doc = merge-order risk (needs the | impact |
| Serve MCP over Streamable HTTP instead of stdio (team-shared server; loopback-only unless an api-key is set) | mcp |
| Show fix audit log | fix |
$ npx docguard-cli generate
🔮 DocGuard Generate — my-project
Scanning codebase to generate canonical documentation...
Detected Stack:
language: TypeScript ^5.0
framework: Next.js ^14.0
database: PostgreSQL
orm: Drizzle 0.33
testing: Vitest
hosting: AWS Amplify
✅ ARCHITECTURE.md (4 components, 6 tech)
✅ DATA-MODEL.md (12 entities detected)
✅ ENVIRONMENT.md (18 env vars detected)
✅ TEST-SPEC.md (45 tests, 8/10 services mapped)
✅ SECURITY.md (auth: NextAuth.js)
✅ REQUIREMENTS.md (spec-kit aligned)
✅ AGENTS.md
✅ CHANGELOG.md
✅ DRIFT-LOG.md
Generated: 9 Skipped: 0DocGuard runs 27 automated validators on every guard check. Every one is language-aware as of v0.16 — patterns for Python (test_*.py), Rust (tests/*.rs), Go (*_test.go), Java (*Test.java), Ruby (*_spec.rb), PHP, and JS/TS all match.
# | Validator | What It Checks | Default |
1 | Structure | Required CDD files exist | ✅ On |
2 | Doc Sections | Canonical docs have required sections (or N/A markers) | ✅ On |
3 | Docs-Sync | Routes/services referenced in docs + OpenAPI cross-check | ✅ On |
4 | Drift-Comments |
| ✅ On |
5 | Changelog | CHANGELOG.md has [Unreleased] section | ✅ On |
6 | Test-Spec | Tests exist per TEST-SPEC.md rules | ✅ On |
7 | Environment | Env vars documented, | ✅ On |
8 | Security | No hardcoded secrets in source code | ✅ On |
9 | Architecture | Imports follow layer boundaries (honors | ✅ On |
10 | Freshness | Docs not stale relative to code changes (rename-aware via | ✅ On |
11 | Traceability | Requirement IDs (FR, SC, NFR, US, AC, T) trace to tests | ✅ On |
12 | Docs-Diff | Code artifacts match documented entities | ✅ On |
13 | API-Surface | API-REFERENCE.md endpoints match real routes (OpenAPI cross-check) | ✅ On |
14 | Metadata-Sync | Version refs consistent across docs | ✅ On |
15 | Docs-Coverage | Code features referenced in documentation | ✅ On |
16 | Doc-Quality | Writing quality (readability, passive voice, atomicity, IEEE 830) | ✅ On |
17 | TODO-Tracking | Untracked TODOs/FIXMEs and skipped tests (skips test files by default) | ✅ On |
18 | Schema-Sync | Database models documented in DATA-MODEL.md | ✅ On |
19 | Spec-Kit | Spec quality validation (FR-IDs, mandatory sections, phased tasks) | ✅ On |
20 | Cross-Reference | Internal markdown links + anchors resolve (with "did you mean?" hints); Obsidian wikilinks validated when the repo uses them as file links ( | ✅ On |
21 | Generated-Staleness |
| ✅ On |
22 | Canonical-Sync | DocGuard's own README count claims match code-truth (DocGuard repo only — N/A elsewhere) | ✅ On |
23 | Metrics-Consistency | Hardcoded numbers match actual counts | ✅ On |
24 | Surface-Sync | Item-level enumerable drift — names in doc tables/lists (commands, checks, etc.) match code-truth (opt-in via | ✅ On |
25 | Diff-Suspicion | Change-driven: a doc/agent-instruction file that references code changed since the ref AND shares removed domain symbols is flagged for review (arXiv 2010.01625, F1 74.7) | ✅ On |
26 | Reference-Existence | Two-revision check: a backticked code symbol present when the doc was last updated but gone at HEAD is flagged as outdated (arXiv 2212.01479) | ✅ On |
27 | API-Doc-Smells | Bloated (≥300 words) / Lazy (≤6 prose words) API documentation units, keyed on signature-headed sections (F1 0.90/0.95) | ✅ On |
Per-validator controls (in .docguard.json):
{
"validators": {
"test-spec": false, // disable (kebab-case OR camelCase both accepted)
"freshness": true
},
"severity": {
"todoTracking": "high", // warnings fail CI
"freshness": "low" // warnings ignored for exit code
}
}DocGuard ships 18 professional templates with metadata, badges, and revision history:
Template | Type | Purpose |
ARCHITECTURE.md | Canonical | System design, components, layer boundaries |
DATA-MODEL.md | Canonical | Schemas, entities, relationships |
SECURITY.md | Canonical | Auth, permissions, secrets management |
TEST-SPEC.md | Canonical | Test strategy, coverage requirements |
ENVIRONMENT.md | Canonical | Environment variables, deployment config |
REQUIREMENTS.md | Canonical | Spec-kit aligned FR/SC IDs, user stories |
DEPLOYMENT.md | Canonical | Infrastructure, CI/CD, DNS |
ADR.md | Canonical | Architecture Decision Records |
ROADMAP.md | Canonical | Project phases, feature tracking |
KNOWN-GOTCHAS.md | Implementation | Symptom → gotcha → fix entries |
TROUBLESHOOTING.md | Implementation | Error diagnosis guides |
RUNBOOKS.md | Implementation | Operational procedures |
VENDOR-BUGS.md | Implementation | Third-party issue tracker |
CURRENT-STATE.md | Implementation | Deployment status, tech debt |
AGENTS.md | Agent | AI agent behavior rules |
CHANGELOG.md | Tracking | Change log |
DRIFT-LOG.md | Tracking | Deviation tracking |
llms.txt | Generated | AI-friendly project summary (llmstxt.org) |
Claude Code: claude mcp add docguard -- npx docguard-cli mcp
Claude Desktop: download docguard-v<version>.mcpb from the latest release and drag it into Settings → Extensions — you'll be asked which project folder to analyze. No npm, no JSON editing.
Anything MCP: DocGuard is a verified namespace on the official MCP registry (io.github.raccioly/docguard).
DocGuard works with every major AI coding agent. All canonical docs are plain markdown — no vendor lock-in.
Agent | Compatibility | Auto-Generate Config |
Google Antigravity | ✅ |
|
Claude Code | ✅ |
|
GitHub Copilot | ✅ |
|
Cursor | ✅ |
|
Windsurf | ✅ |
|
Cline | ✅ |
|
Google Gemini CLI | ✅ |
|
Kiro (AWS) | ✅ | — |
docguard hooks --claude # install (remove: docguard hooks --claude --remove)Registers a PostToolUse hook in the project's .claude/settings.json. After the
agent edits a canonical doc it is nudged to run docguard guard --changed-only;
after it edits a code file the docs reference, it is nudged toward docguard impact.
Merge-safe (only DocGuard's own entry is ever added/removed), throttled to one nudge
per file per 30 minutes, and the hook runtime can never break a session (errors are
silent by contract). Explicit opt-in — init never installs it for you.
DocGuard provides AI agent slash commands for integrated workflows. Installed automatically via docguard init or specify extension add docguard:
Command | What It Does |
| Initialize Canonical-Driven Development in a new or existing project |
| Run quality validation — check all 27 validators |
| Analyze doc quality and suggest improvements |
| Generate targeted fix prompts for specific issues |
| Update canonical docs after code changes — detect drift and sync documentation |
These commands are installed into your AI agent's command directory:
.github/commands/ → GitHub Copilot
.cursor/rules/ → Cursor
.gemini/commands/ → Google Gemini
.claude/commands/ → Claude Code
.agents/workflows/ → AntigravityBeyond slash commands, DocGuard provides 4 enterprise-grade AI skills — deep behavior protocols that tell AI agents not just what to run, but how to think, validate, and iterate. Skills are modeled after Spec Kit's skill architecture.
Skill | Lines | What It Does |
| 155 | 6-step quality gate with severity triage (CRITICAL→LOW), structured reporting, remediation |
| 195 | 7-step research workflow with per-document codebase research and 3-iteration validation loops |
| 170 | Read-only semantic cross-document analysis with 6 analysis passes and quality scoring |
| 165 | CDD maturity assessment with ROI-based improvement roadmap and grade progression |
DocGuard integrates into the spec-kit workflow as an automated quality gate:
Hook | When | Behavior |
| After | Mandatory — always runs DocGuard guard |
| Before | Optional — reviews doc consistency |
| After | Optional — shows CDD maturity score |
For advanced users and CI/CD pipelines, DocGuard includes bash scripts with --json output:
Script | Purpose |
| Discover project docs, return JSON inventory with metadata |
| Run guard, parse results, output prioritized fixes |
| Initialize canonical doc with metadata header |
Three real-world projects to see DocGuard in action:
Example | Scenario | What You'll See |
Node.js API with zero docs | Cold-start: | |
Python app with drifted docs | Drift detection: catch when docs lie | |
Full CDD + Spec Kit | Gold standard: what maturity looks like |
See examples/README.md for step-by-step instructions.
npm test # 33 tests across 18 describe blocksCovers all 15 CLI commands, project type detection, compliance profiles, JSON output format, and help completeness.
Node.js | OS | Status |
18 | ubuntu-latest | ✅ |
20 | ubuntu-latest | ✅ |
22 | ubuntu-latest | ✅ |
DocGuard runs its own guard, score, diff, diagnose, and badge commands against itself in CI — ensuring the tool passes its own checks.
Everything runs local or in your CI — no SaaS, no data leaving your infra. The pieces that matter at company scale:
Need | DocGuard answer |
Adopt on a legacy repo without a red pipeline on day one |
|
Audit trail for compliance reviews |
|
Every CI system, not just GitHub |
|
Trajectory, not snapshots |
|
AI agents on the team | MCP server (stdio or team-shared HTTP) exposes guard/score/explain/verify/report/diagnose as read-only tools; |
Data-integrity framing auditors know | ALCOA+ scoring (FDA 21 CFR Part 11 / EMA Annex 11 vocabulary) built into |
Full recipes: see
docs-canonical/CI-RECIPES.mdfor guard, auto-fix (commits mechanical fixes back to PRs), nightly sync, score-on-PR, and pre-commit configs.
name: DocGuard Guard
on: [pull_request, push]
permissions: { pull-requests: write } # for the sticky PR comment (optional)
jobs:
docguard:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with: { fetch-depth: 0 }
- uses: raccioly/docguard@v0.12.0
with:
command: guardOn pull requests, guard mode also gives inline PR feedback (both default on):
Input | Default | Description |
|
| Inline |
|
| Sticky PR comment with the guard verdict, top findings (by code), and which canonical docs the PR's changed files impact ( |
Both run even when guard fails — that's when the feedback matters. Prefer native
code-scanning integration? docguard guard --format sarif uploads straight to
GitHub Code Scanning via github/codeql-action/upload-sarif.
name: DocGuard Auto-Fix
on: { pull_request: { types: [opened, synchronize, reopened] } }
permissions: { contents: write, pull-requests: write }
jobs:
autofix:
runs-on: ubuntu-latest
if: github.event.pull_request.head.repo.full_name == github.repository
steps:
- uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.ref }}
token: ${{ secrets.GITHUB_TOKEN }}
fetch-depth: 0
- uses: raccioly/docguard@v0.12.0
with: { command: fix, auto-commit: 'true', comment-on-pr: 'true' }npx docguard-cli hooks --type pre-commitTwo ready-to-use templates ship with the Spec Kit extension and as standalone files:
extensions/spec-kit-docguard/templates/github-workflows/docguard-guard.yml — mandatory CI gate
extensions/spec-kit-docguard/templates/github-workflows/docguard-autofix.yml — PR auto-fix
Highlights of the current line (v0.29 → v0.33):
Adoption baseline — guard --update-baseline freezes a legacy repo's existing findings
into a committed .docguard.baseline.json; guard/ci then gate only NEW drift, with suppression
always visible. Adopt today, burn down at your own pace.
docguard report — commit-stamped compliance-evidence bundle (guard verdict, findings by
code, CDD score, ALCOA+ attributes, fix history) with a tamper-evident sha256 integrity hash.
Also exposed as the docguard_report MCP tool.
Score history + score --trend — docguard ci records every run to
.docguard/history.jsonl; the trend view shows the sparkline and delta over time.
Three machine formats for guard — --format json, --format sarif (GitHub Code
Scanning), and --format junit (GitLab, Jenkins, Azure DevOps, CircleCI).
MCP server, stdio + team HTTP — guard/score/explain/verify/report/diagnose as read-only
agent tools: claude mcp add docguard -- npx docguard-cli mcp.
Agent-file family sync — agents --sync treats AGENTS.md as canonical and regenerates
CLAUDE.md / .cursor/rules / Copilot / Gemini variants with drift-proof source-hash markers.
verify --semantic and verify --instructions — extract documented numbers/limits/enums
as agent verification tasks; audit the agent-instruction files themselves for contradictions
and stale pointers.
docguard agent — one-shot ordered task graph with pre-filled code-truth, collapsing ~10
agent round-trips into one call.
See CHANGELOG.md for the full history.
your-project/
├── .specify/ # Spec Kit (if using specify init)
│ ├── specs/
│ │ └── 001-feature/
│ │ ├── spec.md # Requirements (FR-IDs, user stories)
│ │ ├── plan.md # Implementation plan
│ │ └── tasks.md # Task breakdown
│ ├── memory/
│ │ └── constitution.md # Project principles
│ └── templates/
│
├── docs-canonical/ # CDD canonical docs (the "blueprint")
│ ├── ARCHITECTURE.md # System design, components
│ ├── DATA-MODEL.md # Database schemas
│ ├── SECURITY.md # Auth, permissions, secrets
│ ├── TEST-SPEC.md # Required tests, coverage
│ ├── ENVIRONMENT.md # Environment variables
│ └── REQUIREMENTS.md # Spec-kit aligned FR/SC IDs
│
├── docs-implementation/ # Current state (optional)
│ ├── KNOWN-GOTCHAS.md
│ ├── TROUBLESHOOTING.md
│ ├── RUNBOOKS.md
│ └── CURRENT-STATE.md
│
├── AGENTS.md # AI agent behavior rules
├── CHANGELOG.md # Change tracking
├── DRIFT-LOG.md # Documented deviations
├── llms.txt # AI-friendly summary
└── .docguard.json # DocGuard configurationCreate .docguard.json in your project root (auto-generated by docguard init):
{
"projectName": "my-project",
"version": "0.4",
"profile": "standard",
"projectType": "webapp",
"validators": {
"structure": true,
"docsSync": true,
"drift": true,
"changelog": true,
"testSpec": true,
"security": true,
"environment": true,
"docQuality": true,
"specKit": true
}
}See Configuration Guide for all options.
DocGuard's quality evaluation and documentation generation patterns are informed by peer-reviewed research from the University of Arizona and the Joint Interoperability Test Command (JITC), U.S. Department of Defense:
AITPG — AI-driven Test Plan Generator using Multi-Agent Debate and RAG (Lopez et al., IEEE TSE 2026)
TRACE — Telecom Root Cause Analysis through Calibrated Explainability (Lopez et al., IEEE TMLCN 2026)
Lead researcher: Martin Manuel Lopez · ORCID 0009-0002-7652-2385
See CONTRIBUTING.md for full citations.
DocGuard is local-first: no telemetry, no analytics, no phone-home — the full (short) policy is in PRIVACY.md. npm releases are published with provenance attestation, so you can verify each tarball was built by GitHub Actions from this repository.
MIT — Free to use, modify, and distribute.
Made with ❤️ by Ricardo Accioly
Run guard and return only what needs fixing: failing/warning validators with their messages, structured findings, and suggested next actions — shaped for an agent to act on.
| Name | Required | Description | Default |
|---|---|---|---|
| projectDir | No | Path to the project to inspect (absolute, or relative to the server's working directory). Defaults to the working directory the server was started in. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, idempotent, non-destructive. Description adds value by specifying the output format (structured findings, suggested actions) and the focus on actionable items, but does not detail all behavioral aspects like response structure or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that is front-loaded with the core action and outcome, no wasted words. Efficient and clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity (1 optional param, read-only, no output schema), the description adequately covers the tool's purpose and output. Lack of explicit return format is a minor gap, but the description's mention of 'structured findings' provides enough context for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single parameter, so baseline 3 is appropriate. Description does not add extra meaning beyond the parameter's existing description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb 'run guard' and specific resource 'only what needs fixing', listing concrete outputs: failing/warning validators, messages, structured findings, suggested next actions. Distinguishes from sibling tools like docguard_guard (full run) and docguard_explain (explanation).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage for actionable diagnostics, but no explicit 'when to use' vs. alternatives like docguard_guard or docguard_score. Does not provide exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Explain a stable DocGuard finding code (e.g. STR001, ENV003): what it means, which validator emits it, and the inline suppression to use if it's a confirmed false positive.
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | The finding code guard prints next to each finding, e.g. STR001 or ENV003. Case-insensitive. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnly, idempotent, non-destructive. The description adds value by detailing what the tool returns (meaning, validator, suppression), and specifies it works on 'stable' codes, providing clarity beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with verb and examples, no wasted words. Every part earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given low complexity (one parameter, no output schema), the description fully explains the tool's purpose, behavior, and return value. No gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with the 'code' parameter described. The description adds context about stability and case-insensitivity, and provides examples, reinforcing schema details with minimal redundancy.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Explain a stable DocGuard finding code', specifying verb (explain), resource (finding code), and outputs (meaning, validator, suppression). It distinguishes from siblings like docguard_diagnose by focusing on explanation rather than diagnosis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context on when to use it (for stable codes, e.g., STR001), and hints at usage for false positives. However, it lacks explicit when-not or alternatives, though the context is sufficient for an agent to decide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run every enabled DocGuard validator against the project's canonical docs. Returns the full guard JSON contract: status (PASS/WARN/FAIL), structured findings with stable codes and suggestions, nextStep, doc coverage map, semantic-claim count, and per-validator results.
| Name | Required | Description | Default |
|---|---|---|---|
| projectDir | No | Path to the project to inspect (absolute, or relative to the server's working directory). Defaults to the working directory the server was started in. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds valuable behavioral context beyond annotations by detailing the return contract structure (status, findings, suggestions, nextStep, etc.), which helps the agent understand what to expect. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sentences: the first states the action, the second lists the output. Every sentence adds value, and it is front-loaded with the purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema, the description thoroughly explains the return value (full guard JSON contract with fields like status, findings, suggestions, etc.). The tool is simple (one optional param), and the description covers everything needed for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter (projectDir), and the description does not add any additional meaning beyond the schema. The baseline of 3 is appropriate as the schema already documents the parameter fully.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Run every enabled DocGuard validator'), the resource ('project's canonical docs'), and the output ('full guard JSON contract'). It distinguishes this tool from siblings like docguard_diagnose or docguard_score by indicating it runs all validators comprehensively.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for a full validation run but lacks explicit guidance on when to choose this tool over siblings (e.g., diagnose for specific issues, score for scoring). No 'when to use' or 'when not to use' is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Generate the commit-stamped compliance-evidence bundle: guard verdict per validator, findings grouped by stable code, CDD score, ALCOA+ data-integrity attributes, fix history, and a tamper-evident sha256 integrity hash. Evidence, not a gate — it reports state without failing.
| Name | Required | Description | Default |
|---|---|---|---|
| projectDir | No | Path to the project to inspect (absolute, or relative to the server's working directory). Defaults to the working directory the server was started in. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool as read-only, idempotent, and non-destructive. The description adds valuable behavioral context: it reports state without failing, includes a tamper-evident sha256 hash, and outlines bundle contents. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two well-structured sentences. The first sentence lists the bundle contents, and the second clarifies the purpose. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with one optional parameter and no output schema, the description provides sufficient context about what the bundle includes and that it reports state without failing. Complete for its complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'projectDir' has a clear schema description. The tool description does not add additional semantic detail beyond the schema, but schema coverage is 100% and the parameter is straightforward, meeting the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool generates a 'commit-stamped compliance-evidence bundle' and lists its contents (verdict, findings, CDD score, etc.). It distinguishes from siblings by noting it reports state without failing, making it unique among the sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clarifies that this tool produces evidence, not a gate, implying it should be used when reporting state rather than enforcing compliance. It implicitly distinguishes from other tools like docguard_guard, but does not explicitly state when to use alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Compute the project's CDD maturity score (0-100) with letter grade and per-category breakdown.
| Name | Required | Description | Default |
|---|---|---|---|
| projectDir | No | Path to the project to inspect (absolute, or relative to the server's working directory). Defaults to the working directory the server was started in. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, so the description adds minimal behavioral context beyond stating the output format (letter grade and breakdown). It does not contradict annotations but also does not disclose additional traits like performance characteristics or required environment setup.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that immediately conveys the tool's purpose and output format. Every word adds value, and there is no redundancy or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the single optional parameter, rich annotations, and clear output description (score range, letter grade, breakdown), the description is sufficiently complete for the tool's complexity. It lacks only a mention of whether the score is computed immediately or cached, but this is minor.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides full coverage for the single parameter (projectDir), including its type, description, and default behavior. The tool description adds no further parameter-specific semantics, so it meets the baseline for complete schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool computes a CDD maturity score with a specific range (0-100), letter grade, and per-category breakdown. It uses a specific verb ('Compute') and identifies the resource ('project's CDD maturity score'), distinguishing it from sibling tools like docguard_diagnose or docguard_explain.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus its siblings. The description only states what the tool does without mentioning prerequisites, preferred scenarios, or trade-offs relative to other tools like docguard_verify_claims.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Extract the semantic claims in the project's canonical docs — documented numbers, limits, and enums — as a verification task list. Deterministic discovery, LLM judgment — the caller verifies each claim against the code.
| Name | Required | Description | Default |
|---|---|---|---|
| projectDir | No | Path to the project to inspect (absolute, or relative to the server's working directory). Defaults to the working directory the server was started in. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description adds 'Deterministic discovery, LLM judgment' and clarifies the caller's role, providing useful behavioral context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the main action ('Extract...'), and every part adds value. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one parameter and full schema coverage, the description explains the output (task list of claims) and the process (deterministic discovery, LLM judgment, caller verification). It is complete without needing output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 100% of the single parameter (projectDir) with a clear description. The tool description does not repeat param info, which is acceptable given full schema coverage. Baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Extract the semantic claims in the project's canonical docs' with a specific verb and resource. It distinguishes from sibling tools like docguard_diagnose, docguard_explain, etc., by focusing on extraction for verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for extracting claims to verify against code, with 'the caller verifies each claim against the code.' It provides context but does not explicitly state when not to use or alternatives, though sibling names suggest differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v0.33.0docguard_reportv0.30.1docguard_diagnosedocguard_explaindocguard_guarddocguard_scoredocguard_verify_claimsEach tool has a distinct, non-overlapping purpose: diagnose finds issues, explain clarifies finding codes, guard runs validation, report generates compliance evidence, score computes maturity, and verify_claims extracts semantic claims. No ambiguity.
All tools follow a consistent verb-based pattern (docguard_verb) with clear, descriptive verbs (diagnose, explain, guard, report, score, verify_claims). No mixing of conventions.
With 6 tools, the server covers the core workflow of documentation validation and compliance without being too sparse or overwhelming. Each tool earns its place.
The tool set covers diagnosis, explanation, full validation, compliance evidence, maturity scoring, and claim extraction. A minor gap is the lack of a tool to directly apply fixes or manage suppressions, but diagnose provides actionable suggestions.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Guarded MCP server for agent-readable business truth, provenance, readiness, and discovery.
Document-to-Markdown MCP server — convert PDF, Office and HTML into LLM-ready Markdown.
MCP server providing access to the Scorecard API to evaluate and optimize LLM systems.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/raccioly/docguard'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
