v0.5.0

S.C.R.U.B. v0.5.0

S.C.R.U.B. is a 22-tool MCP server and CI-ready CLI that enforces security and code quality standards for AI-generated code. It significantly cuts cloud LLM token usage by routing commodity tasks to deterministic tools and local LLMs.

Key Features

• Deterministic-First: Code must fail deterministic checks (Ruff, pyright, Bandit) before triggering an LLM. Zero tokens are wasted on compliant code.
• 22 MCP Tools: Capabilities span Code Hygiene, Refactoring, Architecture Exploration, and Security (Bandit scans, OSV.dev vulnerabilities, SBOM generation).
• CI-Ready CLI: Run diff-aware checks (scrub check) and security audits (scrub audit) without an LLM. Native SARIF 2.1.0 output for GitHub Code Scanning.

Quick Start

Install:

pip install "scrub-mcp[all] @ git+https://github.com/zombat/scrub-mcp.git"

Connect MCP Client (e.g., Claude Code):

python -m scrub_mcp.mcp.server --install-mcp claude-code
python -m scrub_mcp.mcp.server --agent-instructions .

Run Local Check:

scrub check src/ --fail-on missing-docstrings,missing-types,security:MEDIUM

Auto-Fix via Local LLM:

scrub fix src/ --steps docstrings types --commit