From repos to a governed change.

8 factors · Σ weight 25

score = round( Σ(severity × weight) / Σ(weight) × 100 )

severity  low 0.1 · medium 0.4 · high 0.7 · critical 1.0
level     ≥70 critical · ≥45 high · ≥25 medium · else low

All factors low scores 10 (low). Only non-low factors appear in the PR comment.

Worked examples: docs-only stays low; a new endpoint reaches medium; a shared-DB migration reaches critical.

.mcp.json · project root · Claude Code / Cursor

{
  "mcpServers": {
    "rigel": {
      "type": "http",
      "url":  "https://rigel-mcp.internal.example/mcp"
    }
  }
}

# tools (read-only)
# list_repositories · get_service_info · get_dependency_graph
# get_api_surface · get_communication_channels · semantic_search
# find_consumers · cross_repo_impact · get_callers · get_callees
# get_imports · get_class_hierarchy · get_subgraph · …

One entry gives your agent the whole chart. Read-only by contract: no tool on this server can write. Remote over stateless Streamable HTTP at /mcp, or stdio locally. Run the remote endpoint inside your network until endpoint auth ships. Hostnames are examples.

find_consumers · MCP tool call · JSON

// request
{
  "name": "find_consumers",
  "arguments": {
    "source_repository_id": "orders-api",
    "package_names": ["@your-org/orders-client"]
  }
}

// result
[
  { "repository": "fulfillment", "service": "fulfillment-service",
    "matchType": "package", "severity": "warning",
    "reason": "depends on @your-org/orders-client" },
  { "repository": "billing", "service": "billing-worker",
    "matchType": "package", "severity": "warning", … }
]

Ask who breaks before you change it. Matches a change against every onboarded repo's snapshot by package, endpoint or queue. Package matching is exact; endpoint and queue matching are Beta. Severity is info or warning, never a guess at "breaking".

risk-scorer.ts · core/analysis

const WEIGHTS = {
  serviceCount:      3,
  crossService:      4,
  migrations:        4,
  schemaDestruction: 5,
  apiChanges:        3,
  changeVolume:      2,
  configOrCi:        2,
  deletions:         2,
};
// severity ∈ {0.1, 0.4, 0.7, 1.0}
score = Σ(weight × severity) / Σ weight × 100

// ≥ 70 critical · ≥ 45 high · ≥ 25 medium · else low

A heuristic you can read, not a model. Eight weighted factors, each graded on a four-step severity scale. The PR comment shows every factor that moved the score.

merge gates · orchestrator/activities · dependency-advisor origin

pathGate(files)
  allow  **/package.json · lockfiles · e2e-tests/**
  deny   .github/ · .aws/ · template.yaml · .gitmodules

semverGate(manifestDiff)
  patch | minor                         → merge
  internal major ∧ sole change
    ∧ ¬denyList ∧ title starts "[major]" → merge
  external major | downgrade | prerelease
    | added / removed dep | unparseable → hold

brake(title)
  "[needs-review]"                      → hold  # always wins

on hold of a green PR → upsert decision comment

Deterministic gates, re-derived from the diff. The supervisor never trusts the agent's own summary: it re-reads every changed manifest between merge-base and head. Per-org policies are coming soon; today the policy is in code.

sandbox policy · core/sandbox/bash-sandbox.ts

sandbox:
  clone:      shallow, token-scoped, /tmp/rigel-sandbox-*
  commands:   [npm, npx, pnpm, yarn, knip, node, git, …read/text tools]
  rejected:   ["$(", "`", path escapes outside the clone]
  env:
    npm_config_ignore_scripts: 1
  limits:
    per_command: 5m      # 2m default
    commands:    200
    output:      16KB
  protected:
    - ".github/**"     # write time · pre-push diff · pre-push hook

A sandbox tool, inside a fence. Code-changing agents get a sandbox tool, not a shell: a shallow clone, a first-token command allowlist and no shell interpreter. It reduces risk but is not a VM: allowed tools can still execute code, so pair it with branch protection.