Ridge

Restricting scan roots (RIDGE_ALLOWED_DIRS)

Every scan tool returns short, masked source samples from whatever directory it is pointed at. By default ridge will scan any readable directory except a built-in denylist of sensitive locations (/etc,/proc,/sys,/dev, and home dotfiles like.ssh,.gnupg,.aws,.config/gcloud). That denylist is a floor, not an allowlist: it blocks known-sensitive paths but still permits scanning anywhere else.

To flip this to opt-in, setRIDGE_ALLOWED_DIRSto a colon-separated list of absolute directory paths (PATH-style). When set, ridge refuses any scan whose target resolves to a location outside those directories:

{ "mcpServers": { "ridge": { "command": "/path/to/ridge", "args": [], "env": { "RIDGE_ALLOWED_DIRS": "/home/you/Projects:/home/you/work/repos" } } } }

- Symlink-resolved containment.Both the scan target and the allowlisted directories are resolved withfilepath.EvalSymlinksbefore the containment check, so a symlink placed at or under an allowlisted directory cannot redirect a scan to an outside target.
- Fail closed when misconfigured.IfRIDGE_ALLOWED_DIRSis set but none of its entries resolve to a real directory, every scan is refused rather than reverting to permit-all.
- Startup notice.On launch, ridge logs whether the allowlist is active (with the resolved directories) or unset. An unset allowlist logs a one-line warning so the permissive default is visible in the server logs.

TheRIDGE_ALLOW_INREPO_RULESvariable is separate: it opts into loading a repo's own.arch-rules.yaml, which is otherwise ignored to prevent a scanned repo from downgrading its own architecture-rule violations.

make check # fmt-check + vet + tests (with race detector) make build # Build binary make test # Tests only

go test -tags integration -race -v ./tests/

cmd/ridge/ Entry point (stdio MCP transport) internal/ model/ ArchGraph, Node, Edge, Diff types scanner/ File walker, incremental change detection, analyzer orchestration analyzer/golang/ Go static analysis (go/ast) analyzer/typescript/ TypeScript analysis (tree-sitter) analyzer/python/ Python analysis (tree-sitter) analyzer/markdown/ Markdown link extraction (wiki-links, relative .md links) detector/ Boundary detection, topology, validation, metrics, recommendations, process traces drift/ Snapshot comparison, git ref diffing, history render/ Mermaid, PlantUML, C4, Structurizr, JSON, draw.io, Excalidraw, HTML, forcegraph infra/ Cache, persistent state (~/.mcp-context/) tools/ MCP tool definitions and handlers

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Local stdio MCP server that lets AI coding agents read and maintain structured architecture, rules, and decisions directly from your repository.

Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.

Enable AI agents to secure code with Semgrep.

Provides seamless integration with SonarQube Server or Cloud, and enables analysis of code snippets directly within the agent context