v1.1.0

Caliper v1.1.0

Three months and 60 commits since v1.0.21. Headline: a new single-shot CLI for CI use, a large noise-reduction pass on find_unchecked_error, cross-reconnect result caching, and a return to stock upstream mcp-go.

New — caliper-analyze, a single-shot CLI

The MCP server is built for LLM-driven interactive use; its session model is pure overhead when a consumer just wants one analysis and a report. caliper-analyze spawns, analyzes, writes SARIF to stdout, and exits — which is what CI gates, reviewdog, and GitHub Code Scanning uploads all actually want.

caliper-analyze -workspace . -format sarif > results.sarif

Flags: -workspace, -rules (comma-separated rule kinds; defaults to the PR-default set), -format (sarif or json), -version.

Analyzer signal

• find_unchecked_error — noise against the Go standard library dropped 1201 → ~800 hits (33%), via a built-in stdlib infallibility allowlist, a project-local infallible {} config block, a CFG-based cleanup-path detector, and a fmt.State recognizer that stops flagging writes inside Format(s fmt.State, c rune) methods (~50+ stdlib call sites).
• find_race_condition — now recognizes x++/x-- as writes. Goroutines capturing and incrementing a counter were silently producing no finding at all. Also honors Go 1.22+ per-iteration loop scoping, so loop-variable captures in a Go ≥ 1.22 module are no longer flagged unless the closure itself writes the variable.
• find_slice_append_race — recognizes mutex-protected appends.
• find_lock_violation — no longer flags a missing Unlock when the method value is returned, passed, or assigned; the obligation moved to the caller.
• find_error_swallow — re-implemented on top of find_unchecked_error's engine, inheriting its allowlist, cleanup-path detection and writer-arg transitivity while keeping its own value-use severity escalation. Tool name and input schema are unchanged, but it is stricter than before: bare f.Close() discards are now flagged by default where the old implementation required an explicit opt-in.

Configuration

• New infallible {} block in .caliper.pxf accepting methods, functions, writers and disable_* counterparts, with * glob support.
• Config now resolves per analysis path — each tool call walks up from its target looking for .caliper.pxf, instead of a single boot-time load.

Performance

• Persistent result cache at $TMPDIR/caliper-cache/, keyed on (tool, path, args, source fingerprint), with a 100 MB mtime-LRU cap (CALIPER_CACHE_MAX_BYTES). Repeat calls on unchanged source skip the cold packages.Load — this survives the MCP reconnects that Claude Code's transport causes after every tool batch.
• Engine cache lock fix — a fan-out of N parallel calls on a cold path no longer triggers N concurrent packages.Load invocations.

Transport

• mcp-go back on stock upstream v0.57.0, un-patched and un-forked. The interim fork's only patch — panic recovery in the stdio tool-call worker — landed upstream in mark3labs/mcp-go#882, and upstream's version replies INTERNAL_ERROR rather than dropping the message. The replace also leaked through go.work into sibling repos, which were compiling ~v0.49 code under a v0.57.0 label.
• stderr tee to $TMPDIR/caliper-mcp-YYYY-MM-DD.log with timestamps, for diagnosing MCP disconnects.

Build

• CI runs gofmt + vet + build + test -race + golangci-lint on a self-hosted runner pinned to the go-plus toolchain.
• -ldflags "-X main.Version=..." support in both binaries, falling back to dev-<vcs.revision>[-dirty] from runtime/debug.BuildInfo.
• Migrated from trendvidia/protowire to protowire-go.

Install

brew install trendvidia/tap/caliper

Or from source:

go install github.com/trendvidia/caliper/cmd/caliper-mcp@v1.1.0
go install github.com/trendvidia/caliper/cmd/caliper-analyze@v1.1.0

Full changelog: v1.0.21...v1.1.0