Rebar Mcp
About
Reinforcement for AI-generated code. Enforcement hooks, quality audits, and compliance packs that prevent AI coding tools from shipping broken code.
Details
- Author
- RCOLKITT
- Downloads
- 285
- Categories
- Other, Security, Developer Tools
Jump to
- 20 MCP tools across 4 tiers
- 7 compliance packs (HIPAA, SOC2, PCI-DSS, SOX, GDPR, ISO27001, FedRAMP)
- 3 strictness profiles with enforcement hooks
- Multi-platform support: Claude Code, Cursor, Windsurf, Codex
- HTTP transport for cloud deployments
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Rebar McpCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
rebar_init_project
[Rebar] Full project bootstrap with enforcement hooks, opinionated templates, and quality guardrails. Reads package.json, Cargo.toml, go.mod, pom.xml, and other project manifests to generate perfectly tailored CLAUDE.md, .claude/ directory, settings.json with smart permissions, agents, .mcp.json, and .claudeignore. The generated CLAUDE.md includes real build commands, actual dependencies, framework-specific architecture rules, and detected patterns — not generic templates. Examples: rebar_init_project({ project_path: '.', tech_stack: ['nextjs'], team_size: 5 }) rebar_init_project({ project_path: './api', tech_stack: ['fastapi'], team_size: 12, compliance: ['hipaa'] }) rebar_init_project({ project_path: '.', tech_stack: ['springboot'], team_size: 50, compliance: ['sox', 'soc2'] }) Returns: List of all generated files with descriptions. Error handling: Returns actionable suggestions if project_path doesn't exist or isn't writable.
rebar_generate_claudemd
[Rebar] Creates a deeply customized CLAUDE.md by analyzing your actual project. Reads package.json, detects frameworks, finds real build/test/lint commands, identifies ORMs, CSS frameworks, state management, auth libraries, and generates architecture rules specific to your stack. The output reflects what your project actually IS — not a generic template. Examples: rebar_generate_claudemd({ project_path: '.', scope: 'root' }) rebar_generate_claudemd({ project_path: './apps/web', scope: 'subdir', merge_existing: true }) rebar_generate_claudemd({ project_path: '.', tech_stack: ['nextjs', 'express'] }) Returns: Path to generated file, detected stack summary, line count. Error: Returns if no tech stack detected (suggests providing tech_stack parameter).
rebar_create_skill
[Rebar] Scaffolds a production-ready skill in .claude/skills/<name>/ with SKILL.md containing valid YAML frontmatter. Skills are reusable AI capabilities — code review, test generation, documentation, security scanning, etc. The YAML frontmatter controls behavior: • invocation: 'user' (slash command), 'auto' (triggered by context), 'both' • context: 'inline' (runs in main session), 'fork' (runs in subagent) • allowed_tools: restricts which tools the skill can use Examples: rebar_create_skill({ name: 'code-review', description: 'Reviews code changes for quality and security', invocation: 'auto', context: 'fork', allowed_tools: ['Read', 'Grep', 'Glob'] }) rebar_create_skill({ name: 'db-migrate', description: 'Generates and applies database migrations', invocation: 'user', context: 'inline', allowed_tools: ['Read', 'Write', 'Bash'] }) Returns: Skill location, frontmatter summary, next steps. Error: If skill name already exists (suggests different name).
rebar_create_agent
[Rebar] Scaffolds a subagent definition in .claude/agents/. Subagents are specialized AI workers with restricted tool access and focused system prompts. Built-in roles with smart defaults: • explore: Read-only codebase investigation (Read, Grep, Glob) • plan: Architecture planning without code changes (Read, Grep, Glob) • general: Full-capability agent • custom: Blank template for custom behavior Examples: rebar_create_agent({ name: 'security-auditor', description: 'Scans for OWASP vulnerabilities', role: 'explore' }) rebar_create_agent({ name: 'db-migrator', description: 'Plans and executes database migrations', role: 'general', allowed_tools: ['Read', 'Write', 'Bash'] }) Returns: Agent file path, role, next steps. Error: If agent name already exists.
rebar_create_hook
[Rebar] Adds a lifecycle hook to .claude/settings.json. Hooks run shell commands in response to Claude Code events — format code after writes, lint changes, block dangerous commands, etc. Supported events: • PreToolCall: Before a tool executes (use to block or validate) • PostToolCall: After a tool executes (use to format, lint, test) • Notification: On status notifications • Stop: When Claude stops generating • SubagentStop: When a subagent stops • PreCompact: Before context compaction • PostCompact: After context compaction • SessionStart: When a new session begins Environment variables available: $TOOL_INPUT_COMMAND, $TOOL_INPUT_FILE_PATH, etc. Examples: rebar_create_hook({ event: "PostToolCall", matcher: "Write|Edit", command: 'npx prettier --write "$TOOL_INPUT_FILE_PATH"', exit_behavior: "notify", description: "Format on write" }) rebar_create_hook({ event: "PreToolCall", matcher: "Bash", command: 'echo "$TOOL_INPUT_COMMAND" | grep -qE "rm -rf|DROP TABLE" && exit 1', exit_behavior: "block", description: "Block dangerous commands" }) Returns: Hook details, updated settings path. Idempotent: Re-running with same command+matcher updates the existing hook.
rebar_create_command
[Rebar] Creates a slash command (e.g., /review, /deploy, /docs) as a skill with user invocation. Slash commands are the primary way teams standardize Claude Code workflows. When a user types /command-name, Claude receives the prompt_body as instructions. Examples: rebar_create_command({ name: "review", description: "Review current changes", prompt_body: "Review the current git diff. Check for security issues, performance problems, and code quality. Output findings as Critical/Warning/Suggestion." }) rebar_create_command({ name: "deploy-check", description: "Pre-deploy checklist", prompt_body: "Run through the deployment checklist: 1. All tests pass 2. No TODO/FIXME in changed files 3. No console.log statements 4. Database migrations are reversible", arguments: [{ name: "env", description: "Target environment", required: true }] }) Returns: Slash command usage, file location. Error: If command name already exists.
rebar_set_strictness
[Rebar] Changes the enforcement strictness level for the current project. Rewrites the hooks in .claude/settings.json to match the selected profile. Profiles: • standard: Hooks notify on issues but don't block (except dangerous commands and secrets) • strict: Hooks block on test/lint failures • paranoid: All strict hooks + file size limits, any-type blocking, commit completeness Examples: rebar_set_strictness({ project_path: '.', strictness: 'strict' }) rebar_set_strictness({ project_path: '.', strictness: 'paranoid' }) Idempotent: Safe to run multiple times.
rebar_create_knowledge
[Rebar] Adds a reference document to .claude/docs/ that Claude Code can use as context. Use this for ADRs, runbooks, API specs, data schemas, and style guides. Knowledge documents give Claude deep domain context — the kind of information that turns generic AI suggestions into expert-level guidance specific to your system. Categories: • adr: Architecture Decision Records • runbook: Operational procedures • api: API documentation and contracts • schema: Data model definitions • style: Code style guides and conventions Examples: rebar_create_knowledge({ title: 'Payment Processing Flow', category: 'api', content: '## Overview\nPayments go through 3 stages...', tags: ['payments', 'stripe'] }) rebar_create_knowledge({ title: 'Incident Response', category: 'runbook', content: '## When PagerDuty fires...', tags: ['ops', 'oncall'] }) Returns: Document location, category, and tags. Error: If document with same title already exists.
rebar_create_adr
[Rebar] Generates an Architecture Decision Record following the standard ADR template. ADRs are the most valuable knowledge documents for AI — they explain WHY architectural decisions were made, which prevents Claude from suggesting approaches that were already considered and rejected. Auto-numbers ADRs sequentially (0001, 0002, etc.). Examples: rebar_create_adr({ title: 'Use PostgreSQL over MongoDB', status: 'accepted', context: 'We need ACID transactions for payment processing...', decision: 'Use PostgreSQL with Prisma ORM...', consequences: 'Must manage migrations, but get strong consistency...' }) rebar_create_adr({ title: 'Adopt tRPC for API layer', status: 'proposed', context: 'REST endpoints lack type safety across client/server boundary...', decision: 'Replace REST with tRPC...', consequences: 'Tight coupling to TypeScript, but eliminates entire class of bugs...' }) Returns: ADR number, file path, status.
rebar_list_artifacts
[Rebar] Lists all Claude Code configuration artifacts in the project with type, location, validation status, and issue details. Supports filtering by artifact type. Artifact types discovered: • claudemd: CLAUDE.md files (root and subdirectory) • skill: Skills in .claude/skills/ • agent: Subagents in .claude/agents/ • hook: Hooks in .claude/settings.json • knowledge: Docs in .claude/docs/ • mcp-config: .mcp.json configuration • settings: .claude/settings.json Examples: rebar_list_artifacts({ project_path: '.' }) rebar_list_artifacts({ project_path: '.', type_filter: 'skill' }) rebar_list_artifacts({ project_path: '.', type_filter: 'hook' }) Returns: Formatted list with validation status per artifact. Error: If project_path doesn't exist.
rebar_validate_config
[Rebar] Deep validation of all Claude Code configuration files. Catches real problems before they cause confusing behavior in Claude Code sessions. Checks performed: • CLAUDE.md: Exists, not empty, starts with heading, under 500 lines • Skills: Valid YAML frontmatter, required 'name' and 'description' fields, name under 64 chars, description under 200 chars • Settings: Valid JSON, proper hook structure • .mcp.json: Valid JSON structure • Agents: Files exist and are readable auto_fix mode can repair: • Trailing commas in JSON • Missing frontmatter fields (adds placeholders) Examples: rebar_validate_config({ project_path: '.', fix_mode: 'report' }) rebar_validate_config({ project_path: '.', fix_mode: 'auto_fix' }) Returns: Validation report with errors, warnings, and applied fixes.
rebar_audit_context
[Rebar] Analyzes how much of Claude's context window your configuration artifacts consume. Every token spent on CLAUDE.md, skills, agents, and knowledge docs is a token NOT available for your actual code and conversation. Budget guidelines: • Skills should use < 2% of context window (~4,000 tokens) • Total config should use < 5% (~10,000 tokens) • Individual skills over 500 tokens should be trimmed Examples: rebar_audit_context({ project_path: '.' }) Returns: Token breakdown by category, budget percentage, specific warnings. Read-only: Does not modify any files.
rebar_doctor
[Rebar] Comprehensive health check for your Rebar enforcement setup. Performs 10 diagnostic checks and returns PASS/WARN/FAIL status for each. Checks performed: 1. CLAUDE.md exists with mandatory sections 2. Enforcement hooks installed 3. Skills installed and valid 4. Agents installed 5. .claudeignore exists 6. Test command configured 7. Strictness profile consistency 8. Context budget within limits 9. Cross-platform config consistency 10. No configuration conflicts Examples: rebar_doctor({ project_path: '.' }) rebar_doctor({ project_path: '.', output_format: 'json' }) Returns: Health report with overall status (Healthy/Needs Attention/Broken).
rebar_metrics
[Rebar] View or record quality score metrics over time. Tracks trends and helps identify when code quality is improving or declining. Actions: • view: Display historical quality scores and trends • record: Calculate and store current quality score Metrics stored in .rebar/metrics.json include: • Overall score (0-100) • Category breakdown (CLAUDE.md, hooks, skills, context, practices) • Timestamp for trend analysis Examples: rebar_metrics({ project_path: '.', action: 'view' }) rebar_metrics({ project_path: '.', action: 'record' }) Returns: Quality score history with trend indicators.
rebar_badge
[Rebar] Generates an SVG badge showing the project's quality score. Perfect for README files to showcase code quality. Badge colors: • Green (80-100): Excellent quality • Yellow-green (60-79): Good quality • Yellow (40-59): Fair quality • Red (0-39): Needs work The badge is saved to .rebar/badge.svg and can be embedded in README.md. Examples: rebar_badge({ project_path: '.' }) rebar_badge({ project_path: '.', style: 'flat-square' }) Returns: SVG badge content and embedding instructions.
rebar_custom_rules
[Rebar] Manage custom quality rules defined in .rebar/rules.yaml. Custom rules extend the built-in checks with project-specific requirements. Actions: • list: Show configured custom rules • init: Create a default rules.yaml template • evaluate: Run all custom rules and report results Rule types supported: • file-exists: Check if a file exists • file-contains: Check if file contains a pattern • file-not-contains: Check file doesn't contain a pattern • glob-count: Count files matching a pattern (min/max) Examples: rebar_custom_rules({ project_path: '.', action: 'init' }) rebar_custom_rules({ project_path: '.', action: 'evaluate' }) Returns: Rule list, template, or evaluation results.
rebar_apply_compliance
[Rebar] Applies a compliance template pack to the project — generates hooks for audit logging, skills for compliance-aware code review, and CLAUDE.md sections with regulatory requirements. Supported standards: • hipaa: PHI handling, audit logging, encryption requirements, data classification • soc2: Access controls, audit trails, change management, encryption • pci-dss: Card number blocking, tokenization requirements, OWASP checks • sox: Financial calculation review, audit trails, separation of duties Scope options: • full: Hooks + skills + CLAUDE.md section • hooks_only: Just audit/blocking hooks • skills_only: Just compliance review skills Examples: rebar_apply_compliance({ project_path: '.', standard: 'hipaa', scope: 'full' }) rebar_apply_compliance({ project_path: '.', standard: 'soc2', scope: 'hooks_only' }) Idempotent: Safe to run multiple times — won't duplicate hooks.
rebar_create_ci_workflow
[Rebar] Generates a GitHub Actions workflow that enables Claude Code to review pull requests. Creates a .github/workflows/claude-review.yml file that triggers on PRs and @claude mentions. Review focus options: • security: OWASP vulnerabilities, auth issues, data exposure • performance: N+1 queries, memory leaks, bundle size • style: Code conventions, naming, organization • all: Comprehensive review covering all areas Examples: rebar_create_ci_workflow({ repo_path: '.', review_focus: 'all', branch_pattern: 'main' }) rebar_create_ci_workflow({ repo_path: '.', review_focus: 'security', branch_pattern: 'develop' }) Requires: ANTHROPIC_API_KEY in repository secrets. Idempotent: Updates existing workflow if present.
rebar_create_security_hook
[Rebar] Generates a comprehensive security hook system that blocks dangerous commands and detects secret leaks before they happen. Creates a blocker script and hooks it into Claude Code's PreToolCall lifecycle. Strictness levels: • standard: Blocks rm -rf, force push, DROP TABLE, TRUNCATE (8 patterns) • strict: + git reset --hard, chmod 777, curl|sh, wget|sh (13 patterns) • paranoid: + eval(), exec(), sudo, su, pkill, killall (19 patterns) Also detects secret patterns: AWS keys, API keys, GitHub tokens, private keys. Examples: rebar_create_security_hook({ project_path: '.', strictness: 'standard' }) rebar_create_security_hook({ project_path: '.', strictness: 'paranoid' }) Idempotent: Updates existing security hook if present.
rebar_generate_mcp_config
[Rebar] Creates a .mcp.json file with pre-configured MCP server entries for your services. Each entry includes the correct npx command and environment variable placeholders. Supported services: github, sentry, postgres, slack, linear, jira, datadog, pagerduty, vercel, supabase Scope: • project: Creates .mcp.json in project root (team-shared) • user: Creates in ~/.claude/.mcp.json (personal) Examples: rebar_generate_mcp_config({ project_path: '.', services: ['github', 'slack'], scope: 'project' }) rebar_generate_mcp_config({ project_path: '.', services: ['github', 'sentry', 'postgres'], scope: 'project' }) Returns: Config file location, list of configured services, next steps.
rebar_enable_prereview
Enables LLM pre-review system that intercepts Write/Edit/Bash operations BEFORE they execute. This creates a defensible moat by embedding intelligent code review into the AI's decision loop - not as a post-hoc CI/CD check, but at the moment of creation. ## Tiers - **free**: Local regex-based pattern matching (secrets, dangerous commands, code smells) - **pro**: LLM semantic analysis + cross-session memory (requires API key) - **team**: Custom LLM provider + SSO + extended audit retention ## What gets installed 1. PreToolCall hooks in .claude/settings.json 2. Configuration in .rebar/prereview.json 3. Audit trail directory at .rebar/decisions/ ## Examples ``` // Enable with default settings (free tier, standard strictness) rebar_enable_prereview({ project_path: "." }) // Enable strict mode rebar_enable_prereview({ project_path: ".", strictness: "strict" }) // Enable paid tier with LLM review rebar_enable_prereview({ project_path: ".", tier: "pro", api_key: "rb_live_xxx" }) ```
rebar_prereview_history
View the audit trail of pre-review decisions. Shows all decisions made by the pre-review engine, including: - What was blocked/warned/approved - Pattern matches and reasoning - Timestamps and latency Useful for: - Compliance audits - Understanding what the AI tried to do - Tuning strictness levels
rebar_prereview_rules
Manage custom pre-review rules for project-specific patterns. Add rules that go beyond the built-in patterns to encode your team's architectural decisions and code standards. ## Example rules - Block direct axios imports (use API client instead) - Warn on direct database queries (use repository pattern) - Block console.log in production code
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"rebar mcp": {
"rebar": {
"command": "npx",
"args": [
"-y",
"rebar-mcp"
]
}
}
}
}
McpServers
{
"rebar": {
"command": "npx",
"args": [
"-y",
"rebar-mcp"
]
}
}
20 MCP tools across 4 tiers
7 compliance packs (HIPAA, SOC2, PCI-DSS, SOX, GDPR, ISO27001, FedRAMP)
3 strictness profiles with enforcement hooks
Multi-platform: Claude Code, Cursor, Windsurf, Codex
HTTP transport for cloud deployments
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.





