Skip to contentNewRust Doctor now ships an MCP server and a Claude Code skill
RsDoctor

Changelog

Release notes for the rust-doctor CLI, read directly from the GitHub releases.

0.2.0Feature

Machine-output consumer? Read the Report V1 migration guide.

rust-doctor 0.2.0 is the largest release since the project went public — 31 commits spanning a new autofix engine, a workspace-deadlock fix, sharper diagnostics, and a hardened supply chain. npm packages are now published with Trusted Publishing (OIDC) and signed provenance attestations — no long-lived tokens anywhere in the pipeline.

Highlights

  • Autofix. rust-doctor can now apply machine-applicable fixes to your source, not just report them — turning diagnostics into one-command cleanups.
  • Workspace deadlock fixed. Scanning a workspace with more members than CPU cores could deadlock. Scan-root parallelism is now bounded by available OS threads.
  • Fewer false positives. The hardcoded-secrets rule is now gated on value entropy and shape, and skips test code — far less noise on real codebases.
  • Signed, tokenless publishing. Every npm artifact ships with a provenance attestation minted over OIDC. Nothing in CI holds a publishing credential.

Features

  • fixer: apply machine-applicable fixes to source files
  • scan: report per-pass timings and tracing-based logging
  • output: flag heuristic findings and clarify score / exit-code semantics
  • mcp: cancel on timeout, harden scope, and align score config
  • cli: run() extracted from main into the library, so the binary's full pipeline is reusable as a crate

Fixes & reliability

  • scan: bound scan-root parallelism with OS threads to fix the workspace deadlock
  • process: SIGKILL the whole subprocess group on timeout (no orphaned children)
  • scan: isolate the analysis target dir to avoid clobbering the project's own build
  • suppression: anchor inline suppressions to absolute path identity
  • config: reject unknown fields to catch config typos early
  • rules: gate hardcoded-secrets on value entropy/shape and skip test code
  • mcp: add pub(super) visibility to tool_router / prompt_router macros (#1) — thanks for the first community contribution

Supply chain & tooling

  • ci: npm publishing via Trusted Publishing (OIDC) + provenance, least-privilege workflow permissions, and a tag/crate-version guard
  • lints: enforce the panic/unwrap restriction lint set
  • Added rustfmt.toml, .editorconfig, issue/PR templates, security policy, and code of conduct

⚠️ Behavior changes (review before upgrading)

  • Exit-code & score semantics were clarified. If you gate CI on rust-doctor's exit code or score, re-check the thresholds against this release.
  • Unknown config keys now error. A rust-doctor.toml (or [package.metadata.rust-doctor]) with typos or stale keys that were previously ignored will now fail fast. Fix or remove unknown fields.

Install

# npm (prebuilt binary, all platforms)
npm i -g rust-doctor

# crates.io
cargo install rust-doctor

# shell installer (Linux / macOS)
curl -sL https://github.com/ArthurDEV44/rust-doctor/releases/latest/download/install.sh | bash

Full changelog: https://github.com/ArthurDEV44/rust-doctor/compare/v0.1.20...v0.2.0

0.1.20Patch

Remediation release: a full audit driven by rust-doctor's own findings took the repo score from 74.9 to 82+.

Code quality & architecture

  • Deduplicate six is_*_available() checks into a shared process::is_cargo_subcommand_available()
  • Decompose print_score_box into focused render helpers; extract the MCP ServerHandler into a dedicated mcp/handler.rs module
  • Enable nursery lints in Cargo.toml

Performance

  • Memoize file reads in the clippy filter (no more re-reading per diagnostic)
  • Eliminate double hashing in the cache via an is_fresh_with_hash / update_with_hash API

Security & supply chain

  • Add deny.toml with advisory, license, and ban policies (yanked = "deny"), plus a cargo deny check step in CI
  • Harden .gitignore with secrets/credential patterns

Testing & DX

  • Tests for terminal rendering, main.rs gate functions, and 6 more custom rules in the integration suite
  • Pre-commit hooks (cargo fmt + cargo clippy), CONTRIBUTING.md, and a Keep a Changelog CHANGELOG.md

Docs

  • Setup wizard demo video (12s, Remotion) in the README, plus setup docs on the website and FAQ
  • assets/ excluded from the crates.io package

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.19...v0.1.20

0.1.19Patch

Patch Changes

Dogfooding: rust-doctor scanned itself and three warnings got fixed.

  • mcp: replace a diags[0] index with filter_map + .first()
  • setup: replace an agents[i] index with filter_map + .get(i)
  • setup: replace Box<dyn Error> with a typed SetupError enum, following the project error convention

Reliability dimension 99 -> 100.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.18...v0.1.19

0.1.18Patch

Senior Rust reviewer skill

The setup wizard's SKILL.md now turns the agent into a senior Rust code reviewer instead of a linter wrapper. A new "Rust Expert Context" section carries 32 concrete flags across five domains (error handling, security, async/tokio, performance, architecture) that the agent applies while reading each flagged file, catching issues beyond what rust-doctor itself detects.

Sources: Rust API Guidelines, Alice Ryhl (Tokio), Luca Palmieri, RustSec advisories, the Rust Performance Book, Effective Rust, Oxide RFD 400.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.17...v0.1.18

0.1.17Patch

Deeper skill template

The SKILL.md installed by rust-doctor setup produced shallow scans: agents ran one command and summarized the output. The rewritten template enforces a three-pass pipeline:

  1. Scan & Capture: --json for structured data plus --plan for priorities
  2. Triage: P0-P3 classification by severity and category
  3. Investigate & Fix: mandatory source read before reporting, concrete before/after code for each P0/P1 finding, and a post-fix re-scan

Hard Rules and DO NOT sections explicitly ban shallow-analysis patterns (summary tables without source reads, generic advice without call sites, skipping verification).

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.16...v0.1.17

0.1.16Patch

Setup wizard UX

  • Default recommendation is now CLI + Skills rather than MCP Server
  • Agent selection offers "All" or a space-to-toggle multi-select for specific agents
  • The wizard now asks before overwriting an existing rust-doctor skill or MCP config instead of silently replacing it
  • The closing "try asking" message names rust-doctor explicitly so the agent knows which tool to invoke

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.15...v0.1.16

0.1.15Patch

Setup wizard

New rust-doctor setup subcommand: configure rust-doctor for AI coding agents (Claude Code, Cursor, Windsurf) in one interactive run. Two installation modes:

  • MCP Server: writes a stdio server entry into the agent's MCP config file (~/.claude.json, ~/.cursor/mcp.json, ...) with crash-safe atomic writes (tempfile + rename)
  • CLI + Skills: installs a SKILL.md that teaches the agent to drive the CLI directly

The wizard auto-detects installed agents, prompts via dialoguer, and guards against non-TTY environments so it can never hang CI.

Docs

  • Fix the score formula, lint count, and library example across README and website

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.14...v0.1.15

0.1.14Patch

Version bump only, cut to get a clean release pipeline run. No code changes over v0.1.13.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.13...v0.1.14

0.1.13Patch

Restructure

Flat src/*.rs reorganized into domain modules:

  • src/passes/{security,static_analysis,quality}/ for the analysis passes
  • src/output/{mod,score,terminal}.rs for rendering
  • src/mcp/{mod,tools,prompts,helpers,rules,types}.rs for the MCP server, with prompt templates extracted into their own module

No behavior change intended; the scan orchestrator gained pipeline documentation.

Cross-tool AI config

The repo now carries first-class configuration for AI coding agents contributing to rust-doctor itself: AGENTS.md, .cursor/rules/rust-doctor.mdc, .github/copilot-instructions.md, .aiexclude for Gemini Code Assist, and recommended hooks in CLAUDE.md.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.12...v0.1.13

0.1.12Patch

MCP: pure markdown reports

Claude Code renders structuredContent as raw JSON in the expand view, which made the v0.1.11 text+JSON split no better in practice. The scan tool now returns a single markdown report: score, dimensions, diagnostics grouped by severity with rule names, counts, example locations, and fix guidance. No JSON at all.

Report size: ~12K characters, versus ~30K grouped JSON (v0.1.10) and ~489K raw JSON (v0.1.8).

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.11...v0.1.12

0.1.11Patch

Patch Changes

  • mcp: the scan tool now returns the markdown summary as a text content block (what the LLM reads first) and the grouped diagnostics as structuredContent, instead of embedding the summary inside the JSON blob. Same pattern as production MCP servers like PostHog: text for the model, structured data for clients.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.10...v0.1.11

0.1.10Patch

MCP: scan output built for LLM consumption

The scan tool used to return every individual diagnostic: 1,574 items and ~489K characters on a 201-file project, blowing past Claude Code's context window and forcing manual jq extraction.

  • Diagnostics are now grouped by rule (sorted by severity then count) with up to 3 example locations each: ~25K characters for the same project
  • A markdown summary (score, dimensions, top issues) rides along in the output

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.9...v0.1.10

0.1.9Patch

MCP improvements

  • Complete tool annotations on all 4 tools: title, readOnlyHint, destructiveHint=false, idempotentHint=true, openWorldHint=false, with a test locking the values in
  • MCP logging (notifications/message) during scan and score execution for real-time visibility
  • Progress notifications on the score tool (previously scan only)
  • The deep-audit / health-check prompts and the skill now prefer Context7 for documentation lookup and Exa for web research when those MCP tools are available, with graceful fallback to native WebSearch/WebFetch

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.8...v0.1.9

0.1.8Patch

Claude Code skill

  • New /rust-doctor slash command as a skill-based alternative to the MCP server: skills/rust-doctor/ ships a SKILL.md with a 4-step pipeline (scope, scan, interpret, guide) plus reference docs for the rules, score interpretation, and suppression syntax. Installable via npx skills add or manual copy.

Rules

  • New high-cyclomatic-complexity rule (Architecture category), bringing the custom rule count to 19
  • Fix pre-existing severity mismatches between docs and source:
    • blocking-in-async: Warning -> Error
    • tokio-spawn-without-move: Warning -> Error
    • actix-blocking-handler: Error -> Warning
    • string-from-literal: Warning -> Info

MCP

  • New deep-audit prompt: a 6-phase expert Rust audit workflow

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.7...v0.1.8

0.1.7Patch

Patch Changes

  • packaging: exclude the Remotion video project (rust-doctor-video/) from the crates.io package. No code changes.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.6...v0.1.7

0.1.6Patch

Version bump only: the v0.1.5 npm publish partially succeeded, so 0.1.6 re-publishes all packages cleanly. No code changes.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.5...v0.1.6

0.1.5Patch

Features

  • cli: new --install-deps flag: checks the six external tools rust-doctor drives (clippy, cargo-deny, cargo-audit, cargo-geiger, cargo-machete, cargo-semver-checks) and installs the missing ones (clippy via rustup, the rest via cargo install)
  • output: skipped passes now show up in the terminal score box with an install hint, and --score warns when the score is incomplete because tools are missing
  • clippy: a missing tool is now reported as Skipped instead of Failed

Also in the repo

  • Project website (Next.js) with dark/light/system themes and SEO structured data, plus a Remotion project generating the README demo video

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.4...v0.1.5

0.1.4Patch

Patch Changes

  • output: compute the score box width from unicode display width instead of char count, fixing misaligned box borders when the content contains wide glyphs
  • tests: the discovery test now reads CARGO_PKG_VERSION instead of a hardcoded version string, so it no longer breaks on every release bump

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.3...v0.1.4

0.1.3Patch

Patch Changes

  • process: drain subprocess stderr on a background thread. A tool writing enough stderr to fill the pipe buffer could deadlock the whole scan; this was the cause of MCP scans hanging indefinitely.
  • geiger: send cargo-geiger stderr to null instead of piping it
  • mcp: add an absolute 5-minute timeout to the scan and score tools. A stuck subprocess now returns a clear error instead of hanging the agent session.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.2...v0.1.3

0.1.2Patch

Patch Changes

  • npm: remove the bin field from the five @rust-doctor/* platform packages. It conflicted with the main package's bin symlink at install time; the main package's install.js postinstall resolves the platform binary itself.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.1...v0.1.2

0.1.1Patch

Patch Changes

  • npm: fix the publish pipeline: publish.sh now creates each platform package's bin/ directory before extracting the binary (git does not track empty directories), so the @rust-doctor/* platform packages actually ship their binaries
  • npm: pin the main package's optionalDependencies to the matching platform-package version

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.0...v0.1.1

0.1.0Feature

Initial public release of rust-doctor: scan, score, and fix your Rust codebase with one command.

What's in the box

  • Unified scanning: 700+ clippy lints with severity overrides and category mapping, plus 18 custom AST rules (via syn) covering error handling, performance, security, async anti-patterns, and framework-specific issues (tokio, axum, actix-web)
  • Dependency auditing: CVE detection via cargo-audit, supply-chain policy via cargo-deny, unused dependencies via cargo-machete, unsafe-code metrics via cargo-geiger, API breakage via cargo-semver-checks
  • Health score: 0-100 with per-dimension breakdown and the ASCII doctor face
  • MCP server: plug into Claude Code, Cursor, or any MCP-compatible agent with npx rust-doctor --mcp
  • Diff mode: scan only changed files for fast CI feedback
  • Workspace support: scan all crates or select specific members
  • Inline suppression: // rust-doctor-disable-next-line <rule>
  • Output modes: terminal, --json, --score, NO_COLOR respected
  • Library crate: drive rust-doctor programmatically via lib.rs

Install

  • npm: npm install -g rust-doctor (prebuilt native binary, no Rust toolchain required)
  • crates.io: cargo install rust-doctor or cargo binstall rust-doctor
  • Shell installer (Linux/macOS) and PowerShell installer (Windows) attached below

Full Changelog: https://github.com/arthjean/rust-doctor/commits/v0.1.0