This server is a read-only DocGuard MCP server that validates, scores, and diagnoses a project's documentation against its code.
docguard_guard: Run all enabled validators and get the full guard result — status, structured findings with stable codes, suggestions, next step, doc coverage map, and per-validator results.
docguard_score: Compute the project's CDD maturity score (0-100) with letter grade and per-category breakdown.
docguard_explain: Explain a stable finding code (e.g. STR001, ENV003) — which validator emits it and how to suppress confirmed false positives.
docguard_verify_evidence: Evaluate .docguard-evidence.json against local sources, distinguishing verified, contradicted, stale, inconclusive, and unsupported evidence.
docguard_verify_claims: Extract documented numbers, limits, and enums from canonical docs as a verification task list for an agent to check against code.
docguard_report: Generate a commit-stamped compliance-evidence bundle with guard verdict, findings by code, CDD score, ALCOA+ attributes, fix history, and a tamper-evident sha256 hash.
docguard_diagnose: Run guard and return only what needs fixing — failing/warning validators, messages, structured findings, and suggested next actions for an agent.
Integrates with GitHub Spec Kit to validate specifications, plans, and tasks created by Spec Kit's AI-driven slash commands.
Provides a GitHub Action for continuous integration, enabling DocGuard validation to run as part of CI/CD pipelines.
Provides a GitLab CI component for integrating DocGuard validation into GitLab pipelines.
Provides a pre-commit hook to run DocGuard validation on changed files before committing.
English · Português (BR) · Español
The enforcement layer for Spec-Driven Development. Validate. Score. Enforce. Ship documentation that AI agents can actually use.
✨ See what DocGuard catches in 30 seconds — no install, no setup:
npx docguard-cli demoRuns against a baked-in sample project with intentional drift and shows you the findings + a clear path to fixing them.
Related MCP server: docs-mcp-server
DocGuard enforces Canonical-Driven Development (CDD) — a methodology where documentation is the source of truth, not an afterthought. AI writes the docs, DocGuard validates them.
Traditional Development | Canonical-Driven Development |
Code first, docs maybe | Docs first, code conforms |
Docs rot silently | Drift is tracked and enforced |
Docs are optional | Docs are required and validated |
One AI agent, one context | Any agent, shared context via canonical docs |
DocGuard is an official GitHub Spec Kit community extension. It validates the artifacts that Spec Kit creates, ensuring your specs stay high-quality throughout the development lifecycle.
📖 Philosophy · 📋 CDD Standard · ⚖️ Comparisons · 🔬 Validation · 🗺️ Roadmap
graph TD
CLI["CLI Entry<br/>docguard.mjs"] --> Commands["Commands (23)"]
Commands --> guard["guard"]
Commands --> generate["generate"]
Commands --> score["score"]
Commands --> diagnose["diagnose"]
Commands --> setup["setup wizard"]
Commands --> other["diff · init · fix · trace · impact · sync · reconcile · retire · specs<br/>explain · memory · upgrade · agents · hooks · badge · ci · watch"]
guard --> Validators["Validators (29)"]
generate --> Scanners["Scanners (4)<br/>routes · schemas · doc-tools · speckit"]
score --> Scoring["Weighted Scoring<br/>8 categories"]
diagnose --> Validators
diagnose --> AIPrompts["AI-Ready<br/>Fix Prompts"]
Validators --> Output["Output"]
Scanners --> Output
Scoring --> Output
Output --> Terminal["Terminal"]
Output --> JSON["JSON"]
Output --> Badge["Badge"]
style CLI fill:#2d5016,color:#fff
style Validators fill:#1a3a5c,color:#fff
style Scanners fill:#1a3a5c,color:#fff
style Output fill:#5c3a1a,color:#fffDistribution: Node.js core (npm) · Python wrapper (PyPI) · GitHub Action (
action.yml) · Spec Kit Extension (ZIP)
DocGuard checks declared documentation facts against repository evidence and gives agents structured repair tasks. Deterministic checks cover supported facts, references, and generated sections. Human-authored requirements and architectural decisions retain their authority when implementation diverges.
A guard result describes the checks performed. The CDD grade measures structural maturity. Exact declarations in .docguard-evidence.json can verify selected statements against current local evidence; every other statement remains unverified. Coverage and unresolved claims remain visible, so teams can choose an appropriate enforcement policy.
Research motivates evaluation of this approach. A 2026 study found that repository context files did not generally improve task success and increased inference cost in its evaluated settings. It also found agents generally followed the instructions. These results support testing concise, relevant context and measuring actual task outcomes; they do not establish DocGuard's effectiveness. Evaluating AGENTS.md, revised June 2026.
The current roadmap prioritizes accurate detection, reproducible evidence, document lifecycle management, and contributor-supplied regression cases. Released plans and superseded specifications are removed from active AI context and remain recoverable from Git.
Package naming: this repo is
raccioly/docguard; the published package isdocguard-clion both npm and PyPI; the installed command isdocguard. Same project — the-clisuffix is just the registry name. The package runs no install scripts, sonpm i -g docguard-cli --ignore-scriptsis equivalent.
# No install needed — run directly
npx docguard-cli diagnose
# Or install globally
npm i -g docguard-cli
docguard diagnosepip install docguard-cli
docguard diagnoseNote: The Python package is a thin wrapper that delegates to
npx. Node.js 18+ is required on the system.
The MCP server ships as a container image on GHCR — no Node.js install required. Public image, so no authentication is needed to pull it:
# Run the MCP server against the current directory
docker run -i --rm -v "$PWD":/workspace ghcr.io/raccioly/docguard:latestThe entrypoint is the stdio MCP transport: stdout is the JSON-RPC channel, so don't pipe anything else into it. Mount the project you want inspected at /workspace and pass {"projectDir": "/workspace"} in tool calls (or rely on the default working directory).
Pin a version rather than tracking latest in CI:
docker run -i --rm -v "$PWD":/workspace ghcr.io/raccioly/docguard:0.34.9The server is read-only — it never writes to the mounted project.
pre-commit — changed-only guard on every commit:
repos:
- repo: https://github.com/raccioly/docguard
rev: v0.29.0
hooks: [{ id: docguard-guard }] # docguard-guard-full for pre-pushMCP (Claude, Cursor, any MCP client) — claude mcp add docguard -- npx -y docguard-cli mcp; 5 read-only tools (guard, score, explain, verify-claims, diagnose). Registry manifest ships in-repo (server.json, Smithery-ready).
GitLab CI — component staged at templates/ci/gitlab-component.yml (guard/score/ci job with a SARIF artifact).
Homebrew — brew install raccioly/tap/docguard (formula in packaging/homebrew/).
# 1. Initialize docs for your project
npx docguard-cli init
# 2. Or reverse-engineer docs from existing code
npx docguard-cli generate
# 3. AI diagnoses issues and generates fix prompts
npx docguard-cli diagnose
# 4. Validate — use as CI gate
npx docguard-cli guard
# 5. Check maturity score
npx docguard-cli scorediagnose → AI reads prompts → AI fixes docs → guard verifies
↑ ↓
└───────────────── issues found? ←──────────────────────┘diagnose is the primary command. It runs all validators, maps every failure to an AI-actionable fix prompt, and outputs a remediation plan. Your AI agent runs it, fixes the docs, and runs guard to verify.
DocGuard splits drift into two kinds and is explicit about which is which:
Kind | Example | How it's fixed |
Mechanical (deterministic) | An endpoint documented in |
|
Agent (needs judgment) | Rewriting an X-Ray prose section as CloudWatch; writing a new endpoint's request/response | Routed to an AI agent via |
docguard fix --write only touches docs marked <!-- docguard:generated true --> (override with --force), is idempotent, and prints exactly what changed. It never rewrites prose — that stays with the agent.
guard ──▶ fix --write (mechanical, auto) ──▶ guard ──▶ diagnose (agent prompts for the rest)CI / pre-commit: docguard hooks --type pre-commit --auto-fix installs a hook that applies mechanical fixes, re-stages the docs, then runs guard; anything left is surfaced as agent prompts.
Agent-driven: docguard diagnose --auto scaffolds missing docs and applies mechanical fixes, then emits prompts for the content rewrites that remain.
JSON for automation: guard/diagnose --format json include a mechanicalFixes array and tag each issue mechanical vs agent, so an agent can apply or delegate precisely.
DocGuard is a community extension for GitHub's Spec Kit framework. While Spec Kit focuses on creating specifications (via AI slash commands like /speckit.specify and /speckit.plan), DocGuard focuses on validating their quality.
┌─────────────────┐ ┌──────────────────┐
│ Spec Kit │ │ DocGuard │
│ │ │ │
│ /speckit.specify│ ──────→ │ docguard guard │
│ Creates specs │ │ Validates specs │
│ (AI-driven) │ │ (automated) │
└─────────────────┘ └──────────────────┘Phase | Tool | What happens |
1. Initialize |
| Creates |
2. Write specs |
| AI creates |
3. Validate |
| Checks spec quality (mandatory sections, FR/SC IDs) |
4. Plan |
| AI creates |
5. Validate |
| Checks plan quality (sections, structure) |
6. Tasks |
| AI creates |
7. Validate |
| Checks task quality (phases, T-IDs) |
8. Implement |
| AI writes code |
9. Enforce |
| Final quality gate — CI/CD |
spec.md — Mandatory sections (User Scenarios, Requirements, Success Criteria), FR-xxx IDs, SC-xxx IDs
plan.md — Summary, Technical Context, Project Structure sections
tasks.md — Phased task breakdown (Phase 1, 2, 3+), T-xxx task IDs
constitution.md — Detected at .specify/memory/constitution.md or project root
Requirement traceability — FR, SC, NFR, US, AC, UC, SYS, ARCH, MOD, T IDs
specify extension add docguardThis installs DocGuard's slash commands (/docguard.init, /docguard.guard, /docguard.review, /docguard.fix, /docguard.update) into your AI agent's command palette.
DocGuard ships 23 commands (the "Daily 5" + 18 situational tools, including lifecycle reconciliation, retirement and spec tracking, the zero-install demo, the mcp server, and the ci pipeline gate). Six additional one-shot scaffolders are accessed via docguard init --with <name>. Legacy command forms remain compatible until v1.0 and print their replacements.
The Daily 5 — what you'll reach for 95% of the time:
Command | What It Does |
| Bootstrap a project ( |
| Validate against canonical docs — 29 validators |
| Show gaps between docs and code ( |
| Refresh code-truth doc sections — keeps memory always up to date |
| Structural CDD maturity score (0-100; not a guard verdict; |
Tools (situational, but day-to-day useful):
Command | Purpose |
| Zero-install showcase — runs guard against a baked-in drifting fixture ( |
| AI orchestrator — guard → emit fix prompts in one command |
| Generate AI fix instructions for specific docs ( |
| Apply deterministic fixes (no AI — version bumps, counts, anchors, sections) |
| Audit log of every mechanical fix applied (from |
| Reverse-engineer docs from existing codebase ( |
| One-shot agent task graph, or a bounded current-evidence packet for one task ( |
| Paste any warning — or a finding code like |
| Evaluate strict statement-to-source declarations for typed JSON values, bounded collection counts, saved oasdiff JSON, and saved Buf JSON Lines. Results distinguish scoped verification, contradiction, stale inputs, inconclusive evidence, and unsupported formats. |
| Extract documented numbers/limits/enums (retention days, rate limits, GSI/role counts, status enums) as a task list for an agent to check against code — the semantic-drift class regex/AST can't see |
| Audit AGENTS.md/CLAUDE.md themselves for drift: duplicate rules, never-vs-always contradictions, stale file pointers, unknown commands — plus clustered rule pairs as agent judgment tasks |
| Review any finding or a synthetic false-positive/false-negative/unsupported fixture; verify its opposite control, reduce it deterministically, search open and closed duplicates, and optionally emit a test-only contribution. Nothing is submitted automatically. |
| Find completed or superseded planning material ( |
| Build a read-only code↔spec review graph since a Git ref. Classifies mechanical facts, approved intent, decisions, unrelated changes, and unsupported evidence; |
| Maintain the versioned spec registry, preflight new specs, and apply evidence-gated completion transactions with bounded outcomes and active-context regeneration. Verified living specs can record later reviewed maintenance without reopening or duplicating the specification. |
| Validate or refresh |
| Before specification, print current spec lifecycle and evidence. Before planning, check the generated draft for structural blockers and report semantic overlap as review-only evidence. |
| MCP server — exposes guard/score/explain/verify/report/diagnose as native tools for Claude, Cursor, and any MCP client. Stdio: |
| Compliance-evidence bundle for audits — combined readiness, guard verdict, structural maturity, ALCOA+ attributes, and fix history, stamped with git commit and a tamper-evident sha256 integrity hash ( |
| Pipeline gate: guard + structural maturity in one command with READY/ATTENTION/BLOCKED assessment — never scaffolds or touches source; its only write is its own |
| Score trajectory from recorded |
| Per-domain accuracy headline (endpoints / entities / env / tech) |
| Drill into which specific claims don't match code |
| Write |
| Drill into which checks pulled each category down |
| Requirements traceability — forward AND reverse |
| Per-feature spec-adherence scores (requirement coverage, task completion, task evidence, artifacts) — worst-first with fix hints |
| Check + migrate |
| Live mode: re-run guard on file changes |
init --with <name> scaffolders — picked at init time:
Scaffolder | What It Generates |
|
|
| Git pre-commit / pre-push hooks |
| GitHub Actions / pipeline YAML |
| Shields.io score badges for README |
|
|
| External doc-site config (Mintlify) — experimental |
Run them solo (docguard init --with hooks) or stacked (docguard init --with agents,hooks,badge,ci).
To declare an exact fact, copy templates/evidence-manifest.json to
.docguard-evidence.json, point its literal Markdown template at one unique
statement, and bind that value to a supported local source. Run
docguard verify --evidence --format json before enabling the guard in CI.
External compatibility declarations consume saved oasdiff or Buf output and
require current SHA-256 identities for every declared repository input.
Deprecation aliases — setup · agents · hooks · badge · llms · publish · impact remain compatible until v1.0 with a yellow stderr warning. audit → guard is permanent and silent; ci is a current first-class pipeline command.
Flag | Description | Commands |
| Project directory (default: | All |
| Show detailed output | All |
| Suppress banner — for hooks, CI loops, scripts | All |
| Machine-readable output (clean JSON, no ANSI bleed) | guard, score, diff, trace, diagnose, memory, impact, explain, verify, reconcile, retire, specs |
| SARIF 2.1.0 output — findings as rules/results for GitHub Code Scanning and SARIF dashboards | guard |
| JUnit XML output — one testcase per validator, for GitLab CI ( | guard |
| Adopt DocGuard on a legacy repo without a red day one: freeze today's findings into a committed | guard |
| Generate | llms |
| Write | memory |
| Regenerate the agent-file family (CLAUDE.md, Copilot, Cursor, …) from AGENTS.md; hash-marked, never touches hand-written files without | agents |
| CI gate for the synced agent-file family — exit 2 when a variant is stale | agents |
| Overwrite existing files (creates | generate, agents, init |
| Bypass ping-pong suppression in | fix --write |
| Starter / standard / enterprise | init |
| Skip auto-init of | init |
| Pre-commit lite mode (6 fast validators on changed files only) | guard |
| Per-validator wall-time profile (slowest first) | guard |
| Show warnings/errors even when status is PASS | guard |
| Record running CLI version into | guard |
| Per-category drill-down | score, memory |
| Exit 1 if behind (for CI) | upgrade |
| Actually run the migration | upgrade |
| Open a PR with the migration | upgrade |
| Reverse traceability (code → docs) | trace |
| Skip the reverse-import-graph analysis (docs about modules that import a changed file) | impact, diff --since |
| Open-PR doc-conflict analysis — two PRs impacting the same canonical doc = merge-order risk (needs the | impact |
| Serve MCP over Streamable HTTP instead of stdio (team-shared server; loopback-only unless an api-key is set) | mcp |
| Show fix audit log | fix |
When run from a nested package without --dir, DocGuard checks only that
selected directory. If a bounded ancestor scan finds a .docguard.json or an
npm/pnpm workspace declaration that owns the package, stderr shows an exact
repository-scope rerun command. DocGuard never changes scope automatically. JSON,
SARIF, and JUnit stdout remain valid; machine runs receive one typed
docguard.repository-root-guidance JSON diagnostic on stderr. A local config,
an explicit --dir, an unmatched workspace, or a nested Git boundary suppresses
the suggestion.
$ npx docguard-cli generate
🔮 DocGuard Generate — my-project
Scanning codebase to generate canonical documentation...
Detected Stack:
language: TypeScript ^5.0
framework: Next.js ^14.0
database: PostgreSQL
orm: Drizzle 0.33
testing: Vitest
hosting: AWS Amplify
✅ ARCHITECTURE.md (4 components, 6 tech)
✅ DATA-MODEL.md (12 entities detected)
✅ ENVIRONMENT.md (18 env vars detected)
✅ TEST-SPEC.md (45 tests, 8/10 services mapped)
✅ SECURITY.md (auth: NextAuth.js)
✅ REQUIREMENTS.md (spec-kit aligned)
✅ AGENTS.md
✅ CHANGELOG.md
✅ DRIFT-LOG.md
Generated: 9 Skipped: 0DocGuard runs 29 automated validators on every guard check. Source-facing validators are language-aware where their evidence model applies; repository and document validators operate independently of source language.
Counting note:
guardprints 30 result rows, not 29.Structureemits a second check result (Doc Sections) under the same validator key, so rows are checks, not validators. The published number is the count of shippedcli/validators/*.mjsmodules and is enforced by tests — don't derive it by counting output rows.
# | Validator | What It Checks | Default |
1 | Structure | Required CDD files exist | ✅ On |
2 | Doc Sections | Canonical docs have required sections (or N/A markers) | ✅ On |
3 | Docs-Sync | Routes/services referenced in docs + OpenAPI cross-check | ✅ On |
4 | Drift-Comments |
| ✅ On |
5 | Changelog | CHANGELOG.md has [Unreleased] section | ✅ On |
6 | Test-Spec | Tests exist per TEST-SPEC.md rules | ✅ On |
7 | Environment | Env vars documented, | ✅ On |
8 | Security | No hardcoded secrets in source code | ✅ On |
9 | Architecture | Imports follow layer boundaries (honors | ✅ On |
10 | Freshness | Docs not stale relative to code changes (rename-aware via | ✅ On |
11 | Traceability | Requirement IDs (FR, SC, NFR, US, AC, T) trace to tests | ✅ On |
12 | Docs-Diff | Code artifacts match documented entities | ✅ On |
13 | API-Surface | API-REFERENCE.md endpoints match real routes (OpenAPI cross-check) | ✅ On |
14 | Metadata-Sync | Version refs consistent across docs | ✅ On |
15 | Docs-Coverage | Code features referenced in documentation | ✅ On |
16 | Doc-Quality | Writing quality (readability, passive voice, atomicity, IEEE 830) | ✅ On |
17 | TODO-Tracking | Untracked TODOs/FIXMEs and skipped tests (skips test files by default) | ✅ On |
18 | Schema-Sync | Database models documented in DATA-MODEL.md | ✅ On |
19 | Spec-Kit | Spec quality validation (FR-IDs, mandatory sections, phased tasks) | ✅ On |
20 | Document-Lifecycle | Exact terminal states, advisory completion signals, incomplete coverage, and manifest/working-tree inconsistencies | ✅ On |
21 | Spec-Registry | Immutable spec identities, byte-stable evidence projection, reviewed lifecycle preservation, and archive/storage consistency | ✅ On |
22 | Evidence | Exact declared Markdown statements match current typed JSON, bounded collections, or saved compatibility reports; unsupported and missing evidence stays visible | ✅ On |
23 | Cross-Reference | Internal markdown links + anchors resolve (with "did you mean?" hints); Obsidian wikilinks validated when the repo uses them as file links ( | ✅ On |
24 | Generated-Staleness |
| ✅ On |
25 | Canonical-Sync | DocGuard's own README count claims match code-truth (DocGuard repo only — N/A elsewhere) | ✅ On |
26 | Metrics-Consistency | Hardcoded numbers match actual counts | ✅ On |
27 | Surface-Sync | Item-level enumerable drift — names in doc tables/lists (commands, checks, etc.) match code-truth (opt-in via | ✅ On |
28 | Diff-Suspicion | Change-driven: a doc/agent-instruction file that references code changed since the ref AND shares removed domain symbols is flagged for review (arXiv 2010.01625, F1 74.7) | ✅ On |
29 | Reference-Existence | Two-revision check: a backticked code symbol present when the doc was last updated but gone at HEAD is flagged as outdated (arXiv 2212.01479) | ✅ On |
30 | API-Doc-Smells | Bloated (≥300 words) / Lazy (≤6 prose words) API documentation units, keyed on signature-headed sections (F1 0.90/0.95) | ✅ On |
Per-validator controls (in .docguard.json):
{
"validators": {
"test-spec": false, // disable (kebab-case OR camelCase both accepted)
"freshness": true
},
"severity": {
"todoTracking": "high", // warnings fail CI
"freshness": "low" // warnings ignored for exit code
},
"findingSeverity": {
"TRC004": "low", // only this finding becomes informational
"SEC001": "high" // this exact code always blocks
}
}Exact findingSeverity entries take precedence over validator severity. Guard
JSON, SARIF, and JUnit retain the detector's intrinsic severity and add the
effective severity plus the policy source. Intrinsic errors stay blocking unless
their exact stable code is explicitly configured.
DocGuard ships 18 professional templates with metadata, badges, and revision history:
Template | Type | Purpose |
ARCHITECTURE.md | Canonical | System design, components, layer boundaries |
DATA-MODEL.md | Canonical | Schemas, entities, relationships |
SECURITY.md | Canonical | Auth, permissions, secrets management |
TEST-SPEC.md | Canonical | Test strategy, coverage requirements |
ENVIRONMENT.md | Canonical | Environment variables, deployment config |
REQUIREMENTS.md | Canonical | Spec-kit aligned FR/SC IDs, user stories |
DEPLOYMENT.md | Canonical | Infrastructure, CI/CD, DNS |
ADR.md | Canonical | Architecture Decision Records |
ROADMAP.md | Canonical | Project phases, feature tracking |
KNOWN-GOTCHAS.md | Implementation | Symptom → gotcha → fix entries |
TROUBLESHOOTING.md | Implementation | Error diagnosis guides |
RUNBOOKS.md | Implementation | Operational procedures |
VENDOR-BUGS.md | Implementation | Third-party issue tracker |
CURRENT-STATE.md | Implementation | Deployment status, tech debt |
AGENTS.md | Agent | AI agent behavior rules |
CHANGELOG.md | Tracking | Change log |
DRIFT-LOG.md | Tracking | Deviation tracking |
llms.txt | Generated | AI-friendly project summary (llmstxt.org) |
Claude Code: claude mcp add docguard -- npx docguard-cli mcp
Claude Desktop: download docguard-v<version>.mcpb from the latest release and drag it into Settings → Extensions — you'll be asked which project folder to analyze. No npm, no JSON editing.
Anything MCP: DocGuard is a verified namespace on the official MCP registry (io.github.raccioly/docguard).
DocGuard works with every major AI coding agent. All canonical docs are plain markdown — no vendor lock-in.
Agent | Compatibility | Auto-Generate Config |
Google Antigravity | ✅ |
|
Claude Code | ✅ |
|
GitHub Copilot | ✅ |
|
Cursor | ✅ |
|
Windsurf | ✅ |
|
Cline | ✅ |
|
Google Gemini CLI | ✅ |
|
Kiro (AWS) | ✅ | — |
docguard hooks --claude # install (remove: docguard hooks --claude --remove)Registers a PostToolUse hook in the project's .claude/settings.json. After the
agent edits a canonical doc it is nudged to run docguard guard --changed-only;
after it edits a code file the docs reference, it is nudged toward docguard impact.
Merge-safe (only DocGuard's own entry is ever added/removed), throttled to one nudge
per file per 30 minutes, and the hook runtime can never break a session (errors are
silent by contract). Explicit opt-in — init never installs it for you.
DocGuard provides AI agent slash commands for integrated workflows. Installed automatically via docguard init or specify extension add docguard:
Command | What It Does |
| Initialize Canonical-Driven Development in a new or existing project |
| Run quality validation — check all 29 validators |
| Analyze doc quality and suggest improvements |
| Generate targeted fix prompts for specific issues |
| Update canonical docs after code changes — detect drift and sync documentation |
These commands are installed into your AI agent's command directory:
.github/commands/ → GitHub Copilot
.cursor/rules/ → Cursor
.gemini/commands/ → Google Gemini
.claude/commands/ → Claude Code
.agents/workflows/ → AntigravityBeyond slash commands, DocGuard provides 4 enterprise-grade AI skills — deep behavior protocols that tell AI agents not just what to run, but how to think, validate, and iterate. Skills are modeled after Spec Kit's skill architecture.
Skill | Lines | What It Does |
| 155 | 6-step quality gate with severity triage (CRITICAL→LOW), structured reporting, remediation |
| 195 | 7-step research workflow with per-document codebase research and 3-iteration validation loops |
| 170 | Read-only semantic cross-document analysis with 6 analysis passes and quality scoring |
| 165 | CDD maturity assessment with ROI-based improvement roadmap and grade progression |
DocGuard integrates into the spec-kit workflow as an automated quality gate:
Hook | When | Behavior |
| After | Mandatory — always runs DocGuard guard |
| Before | Optional — reviews doc consistency |
| After | Optional — shows CDD maturity score |
For advanced users and CI/CD pipelines, DocGuard includes bash scripts with --json output:
Script | Purpose |
| Discover project docs, return JSON inventory with metadata |
| Run guard, parse results, output prioritized fixes |
| Initialize canonical doc with metadata header |
Three real-world projects to see DocGuard in action:
Example | Scenario | What You'll See |
Node.js API with zero docs | Cold-start: | |
Python app with drifted docs | Drift detection: catch when docs lie | |
Full CDD + Spec Kit | Gold standard: what maturity looks like |
See examples/README.md for step-by-step instructions.
npm test # 33 tests across 18 describe blocksCovers all 15 CLI commands, project type detection, compliance profiles, JSON output format, and help completeness.
Node.js | OS | Status |
18 | ubuntu-latest | ✅ |
20 | ubuntu-latest | ✅ |
22 | ubuntu-latest | ✅ |
DocGuard runs its own guard, score, diff, diagnose, and badge commands against itself in CI — ensuring the tool passes its own checks.
Everything runs local or in your CI — no SaaS, no data leaving your infra. The pieces that matter at company scale:
Need | DocGuard answer |
Adopt on a legacy repo without a red pipeline on day one |
|
Audit trail for compliance reviews |
|
Every CI system, not just GitHub |
|
Trajectory, not snapshots |
|
AI agents on the team | MCP server (stdio or team-shared HTTP) exposes guard/score/explain/verify/report/diagnose as read-only tools; |
Data-integrity framing auditors know | ALCOA+ scoring (FDA 21 CFR Part 11 / EMA Annex 11 vocabulary) built into |
Full recipes: see
docs-canonical/CI-RECIPES.mdfor guard, auto-fix (commits mechanical fixes back to PRs), nightly sync, score-on-PR, and pre-commit configs.
name: DocGuard Guard
on: [pull_request, push]
permissions: { pull-requests: write } # for the sticky PR comment (optional)
jobs:
docguard:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with: { fetch-depth: 0 }
- uses: raccioly/docguard@v0.12.0
with:
command: guardOn pull requests, guard mode also gives inline PR feedback (both default on):
Input | Default | Description |
|
| Inline |
|
| Sticky PR comment with the guard verdict, top findings (by code), and which canonical docs the PR's changed files impact ( |
Both run even when guard fails — that's when the feedback matters. Prefer native
code-scanning integration? docguard guard --format sarif uploads straight to
GitHub Code Scanning via github/codeql-action/upload-sarif.
name: DocGuard Auto-Fix
on: { pull_request: { types: [opened, synchronize, reopened] } }
permissions: { contents: write, pull-requests: write }
jobs:
autofix:
runs-on: ubuntu-latest
if: github.event.pull_request.head.repo.full_name == github.repository
steps:
- uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.ref }}
token: ${{ secrets.GITHUB_TOKEN }}
fetch-depth: 0
- uses: raccioly/docguard@v0.12.0
with: { command: fix, auto-commit: 'true', comment-on-pr: 'true' }npx docguard-cli hooks --type pre-commitTwo ready-to-use templates ship with the Spec Kit extension and as standalone files:
extensions/spec-kit-docguard/templates/github-workflows/docguard-guard.yml — mandatory CI gate
extensions/spec-kit-docguard/templates/github-workflows/docguard-autofix.yml — PR auto-fix
Highlights from recent releases:
Adoption baseline — guard --update-baseline freezes a legacy repo's existing findings
into a committed .docguard.baseline.json; guard/ci then gate only NEW drift, with suppression
always visible. Adopt today, burn down at your own pace.
docguard report — commit-stamped compliance-evidence bundle (guard verdict, findings by
code, CDD score, ALCOA+ attributes, fix history) with a tamper-evident sha256 integrity hash.
Also exposed as the docguard_report MCP tool.
Score history + score --trend — docguard ci records every run to
.docguard/history.jsonl; the trend view shows the sparkline and delta over time.
Three machine formats for guard — --format json, --format sarif (GitHub Code
Scanning), and --format junit (GitLab, Jenkins, Azure DevOps, CircleCI).
MCP server, stdio + team HTTP — guard/score/explain/verify/report/diagnose as read-only
agent tools: claude mcp add docguard -- npx docguard-cli mcp.
Agent-file family sync — agents --sync treats AGENTS.md as canonical and regenerates
CLAUDE.md / .cursor/rules / Copilot / Gemini variants with drift-proof source-hash markers.
verify --evidence, verify --semantic, and verify --instructions — check exact local
evidence declarations first, extract remaining numbers/limits/enums as agent tasks, and audit
agent-instruction files for contradictions and stale pointers.
docguard agent — one-shot ordered task graph with pre-filled code-truth, collapsing ~10
agent round-trips into one call.
docguard agent --task <text> — opt-in task context from approved current
specs and canonical docs, with hashed excerpts, source/test pointers, strict
budgets, and honest abstention. The frozen 27-run evaluation preserved every
tested behavior and cut median steps by 50% and latency by 17% versus the
context pack, while using 80% more uncached input tokens.
See CHANGELOG.md for the full history.
your-project/
├── .specify/ # Spec Kit (if using specify init)
│ ├── specs/
│ │ └── 001-feature/
│ │ ├── spec.md # Requirements (FR-IDs, user stories)
│ │ ├── plan.md # Implementation plan
│ │ └── tasks.md # Task breakdown
│ ├── memory/
│ │ └── constitution.md # Project principles
│ └── templates/
│
├── docs-canonical/ # CDD canonical docs (the "blueprint")
│ ├── ARCHITECTURE.md # System design, components
│ ├── DATA-MODEL.md # Database schemas
│ ├── SECURITY.md # Auth, permissions, secrets
│ ├── TEST-SPEC.md # Required tests, coverage
│ ├── ENVIRONMENT.md # Environment variables
│ └── REQUIREMENTS.md # Spec-kit aligned FR/SC IDs
│
├── docs-implementation/ # Current state (optional)
│ ├── KNOWN-GOTCHAS.md
│ ├── TROUBLESHOOTING.md
│ ├── RUNBOOKS.md
│ └── CURRENT-STATE.md
│
├── AGENTS.md # AI agent behavior rules
├── CHANGELOG.md # Change tracking
├── DRIFT-LOG.md # Documented deviations
├── llms.txt # AI-friendly summary
└── .docguard.json # DocGuard configurationCreate .docguard.json in your project root (auto-generated by docguard init):
{
"projectName": "my-project",
"version": "0.4",
"profile": "standard",
"projectType": "webapp",
"validators": {
"structure": true,
"docsSync": true,
"drift": true,
"changelog": true,
"testSpec": true,
"security": true,
"environment": true,
"docQuality": true,
"specKit": true
}
}See Configuration Guide for all options.
DocGuard's quality evaluation and documentation generation patterns are informed by peer-reviewed research from the University of Arizona and the Joint Interoperability Test Command (JITC), U.S. Department of Defense:
AITPG — AI-driven Test Plan Generator using Multi-Agent Debate and RAG (Lopez et al., IEEE TSE 2026)
TRACE — Telecom Root Cause Analysis through Calibrated Explainability (Lopez et al., IEEE TMLCN 2026)
Lead researcher: Martin Manuel Lopez · ORCID 0009-0002-7652-2385
See CONTRIBUTING.md for full citations.
DocGuard is local-first: no telemetry, no analytics, no phone-home — the full (short) policy is in PRIVACY.md. npm releases are published with provenance attestation, so you can verify each tarball was built by GitHub Actions from this repository.
MIT — Free to use, modify, and distribute.
Made with ❤️ by Ricardo Accioly
Run guard and return only what needs fixing: failing/warning validators with their messages, structured findings, and suggested next actions — shaped for an agent to act on.
| Name | Required | Description | Default |
|---|---|---|---|
| projectDir | No | Path to the project to inspect (absolute, or relative to the server's working directory). Defaults to the working directory the server was started in. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, idempotent, non-destructive. Description adds value by specifying the output format (structured findings, suggested actions) and the focus on actionable items, but does not detail all behavioral aspects like response structure or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that is front-loaded with the core action and outcome, no wasted words. Efficient and clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity (1 optional param, read-only, no output schema), the description adequately covers the tool's purpose and output. Lack of explicit return format is a minor gap, but the description's mention of 'structured findings' provides enough context for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single parameter, so baseline 3 is appropriate. Description does not add extra meaning beyond the parameter's existing description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb 'run guard' and specific resource 'only what needs fixing', listing concrete outputs: failing/warning validators, messages, structured findings, suggested next actions. Distinguishes from sibling tools like docguard_guard (full run) and docguard_explain (explanation).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage for actionable diagnostics, but no explicit 'when to use' vs. alternatives like docguard_guard or docguard_score. Does not provide exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Explain a stable DocGuard finding code (e.g. STR001, ENV003): what it means, which validator emits it, and the inline suppression to use if it's a confirmed false positive.
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | The finding code guard prints next to each finding, e.g. STR001 or ENV003. Case-insensitive. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnly, idempotent, non-destructive. The description adds value by detailing what the tool returns (meaning, validator, suppression), and specifies it works on 'stable' codes, providing clarity beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with verb and examples, no wasted words. Every part earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given low complexity (one parameter, no output schema), the description fully explains the tool's purpose, behavior, and return value. No gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with the 'code' parameter described. The description adds context about stability and case-insensitivity, and provides examples, reinforcing schema details with minimal redundancy.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Explain a stable DocGuard finding code', specifying verb (explain), resource (finding code), and outputs (meaning, validator, suppression). It distinguishes from siblings like docguard_diagnose by focusing on explanation rather than diagnosis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context on when to use it (for stable codes, e.g., STR001), and hints at usage for false positives. However, it lacks explicit when-not or alternatives, though the context is sufficient for an agent to decide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run every enabled DocGuard validator against the project's canonical docs. Returns the full guard JSON contract: status (PASS/WARN/FAIL), structured findings with stable codes and suggestions, nextStep, doc coverage map, semantic-claim count, and per-validator results.
| Name | Required | Description | Default |
|---|---|---|---|
| projectDir | No | Path to the project to inspect (absolute, or relative to the server's working directory). Defaults to the working directory the server was started in. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds valuable behavioral context beyond annotations by detailing the return contract structure (status, findings, suggestions, nextStep, etc.), which helps the agent understand what to expect. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sentences: the first states the action, the second lists the output. Every sentence adds value, and it is front-loaded with the purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema, the description thoroughly explains the return value (full guard JSON contract with fields like status, findings, suggestions, etc.). The tool is simple (one optional param), and the description covers everything needed for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter (projectDir), and the description does not add any additional meaning beyond the schema. The baseline of 3 is appropriate as the schema already documents the parameter fully.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Run every enabled DocGuard validator'), the resource ('project's canonical docs'), and the output ('full guard JSON contract'). It distinguishes this tool from siblings like docguard_diagnose or docguard_score by indicating it runs all validators comprehensively.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for a full validation run but lacks explicit guidance on when to choose this tool over siblings (e.g., diagnose for specific issues, score for scoring). No 'when to use' or 'when not to use' is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Generate the commit-stamped compliance-evidence bundle: guard verdict per validator, findings grouped by stable code, CDD score, ALCOA+ data-integrity attributes, fix history, and a tamper-evident sha256 integrity hash. Evidence, not a gate — it reports state without failing.
| Name | Required | Description | Default |
|---|---|---|---|
| projectDir | No | Path to the project to inspect (absolute, or relative to the server's working directory). Defaults to the working directory the server was started in. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool as read-only, idempotent, and non-destructive. The description adds valuable behavioral context: it reports state without failing, includes a tamper-evident sha256 hash, and outlines bundle contents. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two well-structured sentences. The first sentence lists the bundle contents, and the second clarifies the purpose. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with one optional parameter and no output schema, the description provides sufficient context about what the bundle includes and that it reports state without failing. Complete for its complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'projectDir' has a clear schema description. The tool description does not add additional semantic detail beyond the schema, but schema coverage is 100% and the parameter is straightforward, meeting the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool generates a 'commit-stamped compliance-evidence bundle' and lists its contents (verdict, findings, CDD score, etc.). It distinguishes from siblings by noting it reports state without failing, making it unique among the sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clarifies that this tool produces evidence, not a gate, implying it should be used when reporting state rather than enforcing compliance. It implicitly distinguishes from other tools like docguard_guard, but does not explicitly state when to use alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Compute the project's CDD maturity score (0-100) with letter grade and per-category breakdown.
| Name | Required | Description | Default |
|---|---|---|---|
| projectDir | No | Path to the project to inspect (absolute, or relative to the server's working directory). Defaults to the working directory the server was started in. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, so the description adds minimal behavioral context beyond stating the output format (letter grade and breakdown). It does not contradict annotations but also does not disclose additional traits like performance characteristics or required environment setup.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that immediately conveys the tool's purpose and output format. Every word adds value, and there is no redundancy or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the single optional parameter, rich annotations, and clear output description (score range, letter grade, breakdown), the description is sufficiently complete for the tool's complexity. It lacks only a mention of whether the score is computed immediately or cached, but this is minor.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides full coverage for the single parameter (projectDir), including its type, description, and default behavior. The tool description adds no further parameter-specific semantics, so it meets the baseline for complete schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool computes a CDD maturity score with a specific range (0-100), letter grade, and per-category breakdown. It uses a specific verb ('Compute') and identifies the resource ('project's CDD maturity score'), distinguishing it from sibling tools like docguard_diagnose or docguard_explain.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus its siblings. The description only states what the tool does without mentioning prerequisites, preferred scenarios, or trade-offs relative to other tools like docguard_verify_claims.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Extract the semantic claims in the project's canonical docs — documented numbers, limits, and enums — as a verification task list. Deterministic discovery, LLM judgment — the caller verifies each claim against the code.
| Name | Required | Description | Default |
|---|---|---|---|
| projectDir | No | Path to the project to inspect (absolute, or relative to the server's working directory). Defaults to the working directory the server was started in. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description adds 'Deterministic discovery, LLM judgment' and clarifies the caller's role, providing useful behavioral context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the main action ('Extract...'), and every part adds value. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one parameter and full schema coverage, the description explains the output (task list of claims) and the process (deterministic discovery, LLM judgment, caller verification). It is complete without needing output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 100% of the single parameter (projectDir) with a clear description. The tool description does not repeat param info, which is acceptable given full schema coverage. Baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Extract the semantic claims in the project's canonical docs' with a specific verb and resource. It distinguishes from sibling tools like docguard_diagnose, docguard_explain, etc., by focusing on extraction for verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for extracting claims to verify against code, with 'the caller verifies each claim against the code.' It provides context but does not explicitly state when not to use or alternatives, though sibling names suggest differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Evaluate .docguard-evidence.json against bounded local sources. Returns explicit verified-within-scope, contradicted, stale, inconclusive, and unsupported states; verification applies only to each selected statement.
| Name | Required | Description | Default |
|---|---|---|---|
| projectDir | No | Path to the project to inspect (absolute, or relative to the server's working directory). Defaults to the working directory the server was started in. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only, non-destructive, and idempotent behavior. The description adds meaningful behavioral context beyond that: it clarifies that only bounded local sources are considered, states the exact outcome categories ('verified-within-scope, contradicted, stale, inconclusive, unsupported'), and emphasizes per-statement scope. This is substantial transparency for an annotation-backed tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two efficient, front-loaded sentences. The main action and scope appear first, followed by the useful result-state taxonomy. No filler or redundant restatement of the tool name or annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-optional-parameter tool with full schema coverage and safety annotations, the description is largely complete: it explains what is evaluated, which sources are considered, and the possible result states. The only minor gap is that 'bounded local sources' and 'selected statement' are not precisely delimited, but the provided outcomes mitigate the absence of an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is only one parameter, `projectDir`, and its schema description covers it 100%, including the default behavior. The tool description does not need to add parameter-level detail; baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Evaluate'), a specific resource (`.docguard-evidence.json`), and a defined scope ('bounded local sources'). It also enumerates distinct result states, which separates it from the sibling `docguard_verify_claims` by focusing on evidence-file verification rather than general claim verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is for verifying declared evidence against local sources)Skip, and notes that verification applies only to each selected statement. However, it provides no explicit guidance on when to choose this tool over siblings like `docguard_verify_claims` or `docguard_guard`, nor any exclusions or alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.41.3docguard_verify_evidencev0.33.0docguard_reportv0.30.1docguard_diagnosedocguard_explaindocguard_guarddocguard_scoredocguard_verify_claimsScored across 7 tools
Each tool has a distinct output role—full guard run, actionable subset, explanation, report, score, evidence verification, and claim extraction. The only potential confusion is docguard_guard vs docguard_diagnose, but their descriptions clearly separate full JSON from fix-oriented results.
All tools share the docguard_ prefix and use clear action verbs, but the pattern is not fully uniform: some are bare verbs (diagnose, explain, report, score, guard) while others use verb_noun (verify_evidence, verify_claims). docguard_guard is also slightly redundant, though the set remains predictable and readable.
Seven tools is well-scoped for a documentation-compliance utility; each tool addresses a distinct stage of the guard/report/verify workflow. No tool feels redundant, and the count is neither thin nor bloated.
The set covers the full read-only lifecycle: running validators, prioritizing fixes, explaining codes, scoring, reporting, and verifying both evidence files and semantic claims. Minor gaps like a validator-listing or configuration tool are possible, but agents can work around them using the guard output and explain tool.
Guarded MCP server for agent-readable business truth, provenance, readiness, and discovery.
DocBase MCP server for AI agents
Document-to-Markdown MCP server — convert PDF, Office and HTML into LLM-ready Markdown.
MCP server providing access to the Scorecard API to evaluate and optimize LLM systems.
