Changelog

0.3.3Breaking

Every URL the tool prints now points at rust-doctor.com. Until this version they pointed at a rust-doctor.vercel.app project that had been deleted, so a scan run with 0.3.0 through 0.3.2 handed its reader three dead links: the docs line, the rule page of every finding, and the share URL. Upgrade if you use any of them. Nothing else changed: same 62 rules, same score, same report, same schema_version: 14.

Breaking changes

The published host moved to rust-doctor.com

Breaking because a share link produced by a 0.3.2 scan resolves on a host this version no longer names, and because anything that asserted on the old host in a snapshot test or a scraped report now mismatches. There is no redirect from the deleted project: rewrite stored links to rust-doctor.com (f2f65bf).

The rule link printed under a finding (Rule: in the linear report, Learn more: in the interactive review) moves with it. The rule id stays percent-encoded, so clippy::same_warning reads https://rust-doctor.com/rules/clippy%3A%3Asame_warning. The --json report never carried these URLs and is unchanged.

Install

npx rust-doctor@latest

Full changelog: https://github.com/arthjean/rust-doctor/compare/v0.3.2...v0.3.3

0.3.2Patch

The binary now publishes its own rule catalog, and the GitHub Actions workflow it writes installs a pinned published launcher instead of compiling rust-doctor from git on every run. Nothing about how a scan behaves changed: same 62 rules, same score, same report, same schema_version: 14.

Added

• rust-doctor rules list prints every catalogued rule with its category, producer, default level, tier and help. It reads no filesystem and needs no workspace: the catalog is what the binary was compiled with, so the command answers the same thing everywhere.

  rust-doctor rules list          # one tab-separated line per rule: id, category, tier, help
  rust-doctor rules list --json   # the full record, including producer and default level
  

  It exists so that whatever publishes the rule list reads it from the tool. The website had drifted to 125 rules from before the rewrite, describing detectors that no longer exist, because nothing mechanical connected the two. The test compares the command against the shipped catalog rather than against a frozen count, so the two stay true as the catalog grows (8544eaf).

• rust_doctor::catalog() and rust_doctor::CatalogEntry are the same projection for library callers. CatalogEntry carries id, category, producer, default_level, tier and help, and is now the only public shape of a rule: RuleDefinition, which the scan compiles against, stays crate-private. No previously exported item was removed or renamed.

Changed

• The generated CI gate installs the published launcher, pinned. .github/workflows/rust-doctor.yml, written from the CI entry of the interactive report, used to run cargo install --locked --git https://github.com/arthjean/rust-doctor rust-doctor on every CI run, which compiled the tool from whatever the default branch happened to hold. It now runs npm install -g rust-doctor@<version>, pinned to the version of the binary that wrote the file. The pin comes from CARGO_PKG_VERSION rather than a string in the template, so a release cannot forget to move it, and a generated gate keeps scanning with the rule set its author saw.

  Workflow files already written by 0.3.0 or 0.3.1 are not touched: rust-doctor never overwrites an existing .github/workflows/rust-doctor.yml. Delete yours and re-run the CI entry to pick up the pinned form.

Install

npx rust-doctor@latest

Full changelog: https://github.com/arthjean/rust-doctor/compare/v0.3.1...v0.3.2

0.3.1Patch

A release-pipeline version. No file under src/ changed: the scanner, the catalog, the report and the CLI behave exactly as 0.3.0, and only the release workflow, the manifests and the lockfiles moved. Upgrading is safe and optional.

What it exists for: 0.3.0 was published to npm with a granular access token, because npm only accepts a trusted publisher for a package that already exists. This release is the first run of the token-free path the repository now declares, exercised on a real publication rather than on a dry run. The token was revoked afterwards.

Changed

• The release authenticates by OIDC instead of a stored token. Each of the six published packages names this repository's release.yml as its trusted publisher, so the registry authenticates the run by its workflow identity and the job carries no NPM_TOKEN. A leaked secret can no longer publish, and a workflow that is moved or renamed stops being trusted rather than staying authorized. Trusted publishing requires npm 11.5.1 and Node 22 ships npm 10, hence the upgrade step now in the job (634aab7).

Fixed

• A manual release run between two releases no longer fails. npm publish --dry-run still asks the registry and refuses a version it already serves, so validating the candidate ahead of the idempotence skip turned every workflow_dispatch run red for stating something true. The skip guards the dry-run as well, and the validation that matters happens on the run after a version bump, where nothing is published yet (dcd6dc1).

Unchanged from 0.3.0

Every tarball is still published with --provenance, tying it to the commit and the workflow run that built it. That was already true of 0.3.0 and is not new here.

Install

npx rust-doctor@latest

Full changelog: https://github.com/arthjean/rust-doctor/compare/v0.3.0...v0.3.1

0.3.0Breaking

Machine-output consumer? The report shape is versioned: read JSON report.

rust-doctor 0.3.0 is a rewrite, not an increment. The scan is now five producers over one source walk, the rule set is a catalog of 62 rules whose precision is measured against ten pinned public repositories, and a run on a terminal ends in an interactive review instead of a wall of text. Every 0.2.0 flag except --json and --verbose was removed or renamed, a rust-doctor.toml written for 0.2.0 is rejected at startup, and the five external tools the old passes shelled out to are gone along with the network access they needed.

Upgrading from 0.2.0 is a migration. Read the breaking changes before this version reaches CI.

Breaking changes

The CLI surface was replaced

Before and after, for the two CI shapes that break loudest:

# 0.2.0: fail the build on any error, scanning only what changed
rust-doctor --diff origin/main --fail-on error

# 0.3.0
rust-doctor --yes --scope baseline --base origin/main --blocking error

# 0.2.0: read the score
SCORE=$(rust-doctor --score)

# 0.3.0
SCORE=$(rust-doctor --yes --json | jq '.audit.score.value')

--scope files and --scope baseline both require --base <REF>, and --base without one of them is refused, so a half-written scope fails at parse time instead of silently scanning everything.

rust-doctor.toml has a new schema, and unknown keys are refused

The file name did not change. Everything inside it did, and the document is parsed with deny_unknown_fields, so a 0.2.0 configuration fails the scan rather than being partly ignored.

# 0.2.0
lint = true
dependencies = true
fail_on = "error"

[score]
fail_below = 80

[ignore]
rules = ["hardcoded-secrets"]

[rules_config.complexity]
severity = "warning"
threshold = 15

# 0.3.0
blocking = "error"

[categories]
performance = "off"

[rules]
"clippy::indexing_slicing" = "off"
"rust_doctor::structure::complex_function" = "warn"

[structure]
cyclomatic-threshold = 15
cognitive-threshold = 20

There is no replacement for score.fail_below, ignore.files or the per-rule enabled flag: a rule is switched off by setting its level to off, and the gate is decided by blocking alone.

Rule identifiers are namespaced

Every kebab-case identifier of 0.2.0 (hardcoded-secrets, complexity, and the rest) is gone. A rule id now names its producer: clippy::indexing_slicing, rust_doctor::source::disabled_tls_verification, rust_doctor::cargo::missing_lockfile, rust_doctor::structure::oversized_unit, rust_doctor::repo::tracked_secret_file. Any config key, ignore list, or JSON consumer keyed on an old identifier matches nothing. rust-doctor --json publishes the full active policy under .policy.rules, which is the shortest way to find the new name of a rule you used to configure.

Exit codes changed meaning

A CI job branching on exit code 3 will never fire again. The gate failure now returns 1 (b66d076, 31ac84c).

Inline suppression comments no longer exist

// rust-doctor-disable-line and // rust-doctor-disable-next-line are not read by any producer. Suppression is Rust's own #[allow(...)], and the structural pass reports the suppressions that carry no reason: rust_doctor::structure::unreasoned_allow_attribute, stacked_allow_attribute and crate_level_allow (47ccf89, 9df6f93).

The JSON report is a different document

--json emits a new shape carrying schema_version: 14, with audit, policy, scope, project, toolchain, scan, diagnostics, delta, errors, summary and gate at the top level. No 0.2.0 consumer survives. Paths in it stay workspace-relative, with no absolute path, no environment variable and no user data.

The external tool passes were removed

cargo-audit, cargo-deny, cargo-geiger, cargo-machete and cargo-semver-checks are no longer invoked, installed, or checked for. Advisory-database findings, license policy, unsafe counting and semver checks therefore disappear from the report. Keep running those tools directly if you depend on them: rust-doctor no longer speaks for them, and no longer reaches the network for anything.

The scan compiles fewer targets, and publishes fewer findings

Two deliberate reductions, both of which make a report smaller than the one a previous version printed on the same code:

• Cargo's default targets replace --all-targets. Tests, benches, examples and build scripts are no longer compiled. Measured on the corpus, 69.9% of the curated pack's findings came from there, and 1252 of the 1279 findings of the self-scan. A diagnostic that still comes from a non-shipped target carries the context it comes from, read from the Cargo target kind and never guessed from a path: it stays in the report and in both tallies, and stops weighing on the score and blocking the gate (7de61c4).
• A Clippy lint the catalog does not name is never raised. -A clippy::all opens the lint section of the Clippy command, before the -W flags that raise the catalogued rules. An uncatalogued warning used to arrive with no category, no tier and no help, and its presence alone cost the score its authoritative flag. rustc is not a Clippy lint group, so rustc's own diagnostics still reach the report (7c67882).

If your score rises on upgrade without a line of source changing, this is why.

The minimum supported Rust version is 1.95

Up from 1.85. The crate is edition 2024 in both versions.

Installation moved to npm

The release publishes six npm packages: the rust-doctor launcher plus five @rustdoctor/<platform> binaries (linux-x64, linux-arm64, darwin-x64, darwin-arm64, win32-x64) as exact-version optional dependencies (92cc32a). crates.io still serves 0.2.0, so cargo install rust-doctor installs the previous generation of the tool. Build from source or install through npm to get this one.

What the scan does now

• Five producers, one walk. Curated Clippy lints, a native source kernel, Cargo manifest health, a structural pass and a repository hygiene pass. A producer that fails degrades to a complete report carrying an error at its own stage rather than aborting the scan.
• 62 rules, measured rather than asserted. 37 selected Clippy lints, 16 native detectors and 9 structural rules. tests/corpus.json pins ten public repositories by commit and records the adjudicated false-positive rate of every rule (001a79c).
• The ranking is decided by that measurement. The three rules the report tells you to fix first are ranked by what repairing each is expected to be worth: its cost to the score discounted by how often the corpus found it wrong. clippy::string_slice fired 40 times across the ten repositories with not one true positive, and no longer heads a scan (31ac84c). The rate each rule was ranked by is published in the report (52302de).
• Structural rules. Duplicate and near-duplicate function bodies, complexity and size hotspots, orphan module files, unreferenced features, and unreasoned suppressions. A clone family is one finding naming every member, and its identity is its shape rather than its position, so a baseline comparison does not report an old family as introduced by the branch (b72f074, 2c31617, a53ab6e).
• An interactive report. On a terminal, the scan ends on the score, a review of the findings one rule at a time, an entry that writes .github/workflows/rust-doctor.yml, and a handoff that hands the work to Claude Code, Codex or Cursor. It never takes the alternate screen and never runs under --json, --yes or --verbose (b66d076, 5320963).
• Every finding is one the tool can explain. A published diagnostic carries a catalogued rule with its category, its tier and its help, or the report says so and drops its own authoritative flag rather than scoring what it cannot account for.

Trust boundary

Inspecting a workspace runs cargo clippy inside it, and Cargo executes that workspace's build.rs files and procedural macros. Inspect trusted local paths only. Never scan a path taken from an issue, a bug report, or any other untrusted source. The four native producers compile nothing: they parse source text, read manifests, and ask git what it tracks.

The tool reaches no network, uploads nothing, and emits no telemetry.

Install

npx rust-doctor@latest          # no install
npm install -g rust-doctor      # or globally

Scanning still needs a Rust toolchain in the workspace, since Clippy is one of the five producers.

Full changelog: https://github.com/arthjean/rust-doctor/compare/v0.2.0...v0.3.0

0.2.0Feature

rust-doctor 0.2.0 is the largest release since the project went public — 31 commits spanning a new autofix engine, a workspace-deadlock fix, sharper diagnostics, and a hardened supply chain. npm packages are now published with Trusted Publishing (OIDC) and signed provenance attestations — no long-lived tokens anywhere in the pipeline.

Highlights

• Autofix. rust-doctor can now apply machine-applicable fixes to your source, not just report them — turning diagnostics into one-command cleanups.
• Workspace deadlock fixed. Scanning a workspace with more members than CPU cores could deadlock. Scan-root parallelism is now bounded by available OS threads.
• Fewer false positives. The hardcoded-secrets rule is now gated on value entropy and shape, and skips test code — far less noise on real codebases.
• Signed, tokenless publishing. Every npm artifact ships with a provenance attestation minted over OIDC. Nothing in CI holds a publishing credential.

Features

• fixer: apply machine-applicable fixes to source files
• scan: report per-pass timings and tracing-based logging
• output: flag heuristic findings and clarify score / exit-code semantics
• mcp: cancel on timeout, harden scope, and align score config
• cli: run() extracted from main into the library, so the binary's full pipeline is reusable as a crate

Fixes & reliability

• scan: bound scan-root parallelism with OS threads to fix the workspace deadlock
• process: SIGKILL the whole subprocess group on timeout (no orphaned children)
• scan: isolate the analysis target dir to avoid clobbering the project's own build
• suppression: anchor inline suppressions to absolute path identity
• config: reject unknown fields to catch config typos early
• rules: gate hardcoded-secrets on value entropy/shape and skip test code
• mcp: add pub(super) visibility to tool_router / prompt_router macros (#1) — thanks for the first community contribution

Supply chain & tooling

• ci: npm publishing via Trusted Publishing (OIDC) + provenance, least-privilege workflow permissions, and a tag/crate-version guard
• lints: enforce the panic/unwrap restriction lint set
• Added rustfmt.toml, .editorconfig, issue/PR templates, security policy, and code of conduct

⚠️ Behavior changes (review before upgrading)

• Exit-code & score semantics were clarified. If you gate CI on rust-doctor's exit code or score, re-check the thresholds against this release.
• Unknown config keys now error. A rust-doctor.toml (or [package.metadata.rust-doctor]) with typos or stale keys that were previously ignored will now fail fast. Fix or remove unknown fields.

Install

# npm (prebuilt binary, all platforms)
npm i -g rust-doctor

# crates.io
cargo install rust-doctor

# shell installer (Linux / macOS)
curl -sL https://github.com/ArthurDEV44/rust-doctor/releases/latest/download/install.sh | bash

Full changelog: https://github.com/ArthurDEV44/rust-doctor/compare/v0.1.20...v0.2.0

0.1.20Patch

Remediation release: a full audit driven by rust-doctor's own findings took the repo score from 74.9 to 82+.

Code quality & architecture

• Deduplicate six is_*_available() checks into a shared process::is_cargo_subcommand_available()
• Decompose print_score_box into focused render helpers; extract the MCP ServerHandler into a dedicated mcp/handler.rs module
• Enable nursery lints in Cargo.toml

Performance

• Memoize file reads in the clippy filter (no more re-reading per diagnostic)
• Eliminate double hashing in the cache via an is_fresh_with_hash / update_with_hash API

Security & supply chain

• Add deny.toml with advisory, license, and ban policies (yanked = "deny"), plus a cargo deny check step in CI
• Harden .gitignore with secrets/credential patterns

Testing & DX

• Tests for terminal rendering, main.rs gate functions, and 6 more custom rules in the integration suite
• Pre-commit hooks (cargo fmt + cargo clippy), CONTRIBUTING.md, and a Keep a Changelog CHANGELOG.md

Docs

• Setup wizard demo video (12s, Remotion) in the README, plus setup docs on the website and FAQ
• assets/ excluded from the crates.io package

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.19...v0.1.20

0.1.19Patch

Patch Changes

Dogfooding: rust-doctor scanned itself and three warnings got fixed.

• mcp: replace a diags[0] index with filter_map + .first()
• setup: replace an agents[i] index with filter_map + .get(i)
• setup: replace Box<dyn Error> with a typed SetupError enum, following the project error convention

Reliability dimension 99 -> 100.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.18...v0.1.19

0.1.18Patch

Senior Rust reviewer skill

The setup wizard's SKILL.md now turns the agent into a senior Rust code reviewer instead of a linter wrapper. A new "Rust Expert Context" section carries 32 concrete flags across five domains (error handling, security, async/tokio, performance, architecture) that the agent applies while reading each flagged file, catching issues beyond what rust-doctor itself detects.

Sources: Rust API Guidelines, Alice Ryhl (Tokio), Luca Palmieri, RustSec advisories, the Rust Performance Book, Effective Rust, Oxide RFD 400.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.17...v0.1.18

0.1.17Patch

Deeper skill template

The SKILL.md installed by rust-doctor setup produced shallow scans: agents ran one command and summarized the output. The rewritten template enforces a three-pass pipeline:

1. Scan & Capture: --json for structured data plus --plan for priorities
2. Triage: P0-P3 classification by severity and category
3. Investigate & Fix: mandatory source read before reporting, concrete before/after code for each P0/P1 finding, and a post-fix re-scan

Hard Rules and DO NOT sections explicitly ban shallow-analysis patterns (summary tables without source reads, generic advice without call sites, skipping verification).

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.16...v0.1.17

0.1.16Patch

Setup wizard UX

• Default recommendation is now CLI + Skills rather than MCP Server
• Agent selection offers "All" or a space-to-toggle multi-select for specific agents
• The wizard now asks before overwriting an existing rust-doctor skill or MCP config instead of silently replacing it
• The closing "try asking" message names rust-doctor explicitly so the agent knows which tool to invoke

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.15...v0.1.16

0.1.15Patch

Setup wizard

New rust-doctor setup subcommand: configure rust-doctor for AI coding agents (Claude Code, Cursor, Windsurf) in one interactive run. Two installation modes:

• MCP Server: writes a stdio server entry into the agent's MCP config file (~/.claude.json, ~/.cursor/mcp.json, ...) with crash-safe atomic writes (tempfile + rename)
• CLI + Skills: installs a SKILL.md that teaches the agent to drive the CLI directly

The wizard auto-detects installed agents, prompts via dialoguer, and guards against non-TTY environments so it can never hang CI.

Docs

• Fix the score formula, lint count, and library example across README and website

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.14...v0.1.15

0.1.14Patch

Version bump only, cut to get a clean release pipeline run. No code changes over v0.1.13.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.13...v0.1.14

0.1.13Patch

Restructure

Flat src/*.rs reorganized into domain modules:

• src/passes/{security,static_analysis,quality}/ for the analysis passes
• src/output/{mod,score,terminal}.rs for rendering
• src/mcp/{mod,tools,prompts,helpers,rules,types}.rs for the MCP server, with prompt templates extracted into their own module

No behavior change intended; the scan orchestrator gained pipeline documentation.

Cross-tool AI config

The repo now carries first-class configuration for AI coding agents contributing to rust-doctor itself: AGENTS.md, .cursor/rules/rust-doctor.mdc, .github/copilot-instructions.md, .aiexclude for Gemini Code Assist, and recommended hooks in CLAUDE.md.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.12...v0.1.13

0.1.12Patch

MCP: pure markdown reports

Claude Code renders structuredContent as raw JSON in the expand view, which made the v0.1.11 text+JSON split no better in practice. The scan tool now returns a single markdown report: score, dimensions, diagnostics grouped by severity with rule names, counts, example locations, and fix guidance. No JSON at all.

Report size: ~12K characters, versus ~30K grouped JSON (v0.1.10) and ~489K raw JSON (v0.1.8).

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.11...v0.1.12

0.1.11Patch

Patch Changes

• mcp: the scan tool now returns the markdown summary as a text content block (what the LLM reads first) and the grouped diagnostics as structuredContent, instead of embedding the summary inside the JSON blob. Same pattern as production MCP servers like PostHog: text for the model, structured data for clients.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.10...v0.1.11

0.1.10Patch

MCP: scan output built for LLM consumption

The scan tool used to return every individual diagnostic: 1,574 items and ~489K characters on a 201-file project, blowing past Claude Code's context window and forcing manual jq extraction.

• Diagnostics are now grouped by rule (sorted by severity then count) with up to 3 example locations each: ~25K characters for the same project
• A markdown summary (score, dimensions, top issues) rides along in the output

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.9...v0.1.10

0.1.9Patch

MCP improvements

• Complete tool annotations on all 4 tools: title, readOnlyHint, destructiveHint=false, idempotentHint=true, openWorldHint=false, with a test locking the values in
• MCP logging (notifications/message) during scan and score execution for real-time visibility
• Progress notifications on the score tool (previously scan only)
• The deep-audit / health-check prompts and the skill now prefer Context7 for documentation lookup and Exa for web research when those MCP tools are available, with graceful fallback to native WebSearch/WebFetch

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.8...v0.1.9

0.1.8Patch

Claude Code skill

• New /rust-doctor slash command as a skill-based alternative to the MCP server: skills/rust-doctor/ ships a SKILL.md with a 4-step pipeline (scope, scan, interpret, guide) plus reference docs for the rules, score interpretation, and suppression syntax. Installable via npx skills add or manual copy.

Rules

• New high-cyclomatic-complexity rule (Architecture category), bringing the custom rule count to 19
• Fix pre-existing severity mismatches between docs and source:
  • blocking-in-async: Warning -> Error
  • tokio-spawn-without-move: Warning -> Error
  • actix-blocking-handler: Error -> Warning
  • string-from-literal: Warning -> Info

MCP

• New deep-audit prompt: a 6-phase expert Rust audit workflow

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.7...v0.1.8

0.1.7Patch

Patch Changes

• packaging: exclude the Remotion video project (rust-doctor-video/) from the crates.io package. No code changes.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.6...v0.1.7

0.1.6Patch

Version bump only: the v0.1.5 npm publish partially succeeded, so 0.1.6 re-publishes all packages cleanly. No code changes.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.5...v0.1.6

0.1.5Patch

Features

• cli: new --install-deps flag: checks the six external tools rust-doctor drives (clippy, cargo-deny, cargo-audit, cargo-geiger, cargo-machete, cargo-semver-checks) and installs the missing ones (clippy via rustup, the rest via cargo install)
• output: skipped passes now show up in the terminal score box with an install hint, and --score warns when the score is incomplete because tools are missing
• clippy: a missing tool is now reported as Skipped instead of Failed

Also in the repo

• Project website (Next.js) with dark/light/system themes and SEO structured data, plus a Remotion project generating the README demo video

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.4...v0.1.5

0.1.4Patch

Patch Changes

• output: compute the score box width from unicode display width instead of char count, fixing misaligned box borders when the content contains wide glyphs
• tests: the discovery test now reads CARGO_PKG_VERSION instead of a hardcoded version string, so it no longer breaks on every release bump

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.3...v0.1.4

0.1.3Patch

Patch Changes

• process: drain subprocess stderr on a background thread. A tool writing enough stderr to fill the pipe buffer could deadlock the whole scan; this was the cause of MCP scans hanging indefinitely.
• geiger: send cargo-geiger stderr to null instead of piping it
• mcp: add an absolute 5-minute timeout to the scan and score tools. A stuck subprocess now returns a clear error instead of hanging the agent session.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.2...v0.1.3

0.1.2Patch

Patch Changes

• npm: remove the bin field from the five @rust-doctor/* platform packages. It conflicted with the main package's bin symlink at install time; the main package's install.js postinstall resolves the platform binary itself.

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.1...v0.1.2

0.1.1Patch

Patch Changes

• npm: fix the publish pipeline: publish.sh now creates each platform package's bin/ directory before extracting the binary (git does not track empty directories), so the @rust-doctor/* platform packages actually ship their binaries
• npm: pin the main package's optionalDependencies to the matching platform-package version

Full Changelog: https://github.com/arthjean/rust-doctor/compare/v0.1.0...v0.1.1

0.1.0Feature

Initial public release of rust-doctor: scan, score, and fix your Rust codebase with one command.

What's in the box

• Unified scanning: 700+ clippy lints with severity overrides and category mapping, plus 18 custom AST rules (via syn) covering error handling, performance, security, async anti-patterns, and framework-specific issues (tokio, axum, actix-web)
• Dependency auditing: CVE detection via cargo-audit, supply-chain policy via cargo-deny, unused dependencies via cargo-machete, unsafe-code metrics via cargo-geiger, API breakage via cargo-semver-checks
• Health score: 0-100 with per-dimension breakdown and the ASCII doctor face
• MCP server: plug into Claude Code, Cursor, or any MCP-compatible agent with npx rust-doctor --mcp
• Diff mode: scan only changed files for fast CI feedback
• Workspace support: scan all crates or select specific members
• Inline suppression: // rust-doctor-disable-next-line <rule>
• Output modes: terminal, --json, --score, NO_COLOR respected
• Library crate: drive rust-doctor programmatically via lib.rs

Install

• npm: npm install -g rust-doctor (prebuilt native binary, no Rust toolchain required)
• crates.io: cargo install rust-doctor or cargo binstall rust-doctor
• Shell installer (Linux/macOS) and PowerShell installer (Windows) attached below

Full Changelog: https://github.com/arthjean/rust-doctor/commits/v0.1.0