GoGuard

GoGuard MCP is a dual-tool MCP server that performs traditional Go code quality checks with golangci-lint and intelligent runtime risk detection. It focuses on change-aware analysis to ensure your current development work is assessed without being clouded by historical code, and it outputs structured risk data you can use to drive AI-assisted reviews.

How to use

You use GoGuard MCP with an MCP client to run two complementary checks on your Go projects. The code_lint tool evaluates static quality based on golangci-lint, while the code_review tool focuses on runtime risk and security issues. The system automatically detects the scope of changes across branches and workspaces, groups multi-project changes, and returns structured results that you can feed into Cursor Rule or your CI/CD pipelines.

To get started, configure an MCP client to connect to the GoGuard MCP server as described in the installation and configuration steps. Then trigger checks for your project changes. You will receive two sets of results: one for code quality at the package and file level, and another for runtime risk points with detailed context and suggested mitigations.

How to install

Prerequisites you need before installing GoGuard MCP are Node.js, Git, and Go, plus golangci-lint installed and in your PATH.

# Prerequisites
node -v
git --version
go version
golangci-lint --version

# Quick verification (recommend using npx for the latest release)
npx go-guard --help 2>/dev/null || echo "go-guard 运行正常"

Install GoGuard MCP via npm (recommended approach): you can run it without installing locally by using npx, or install globally or locally for repeated use.

# Direct use without installation
npx go-guard

# Global installation
npm install -g go-guard

# Local installation
npm install go-guard

Configuration and usage notes

GoGuard MCP provides two MCP connection options. Use the stdio (local) mode for direct development workflows or an HTTP remote server configuration if you have a centralized MCP endpoint.

{
  "mcpServers": {
    "go_guard": {
      "command": "npx",
      "args": [
        "-y",
        "go-guard@latest"
      ]
    }
  }
}

If you prefer a local runtime without npx, you can run the runtime directly if you have a built package available in your environment.

{
  "mcpServers": {
    "go_guard": {
      "command": "go-guard",
      "args": []
    }
  }
}

Security and integration notes

The MCP server uses a standardized JSON-based communication format and provides structured results for both code quality and runtime risk analyses. It supports zero-config startup by automatically detecting necessary parameters and project scope, and it works best when you specify the project root path to maximize performance.

For CI/CD integration, you can invoke the MCP endpoints from your pipeline and consume the structured outputs to gate changes or generate risk dashboards. When paired with Cursor Rule, you gain precise, data-driven guidance for reviewer prompts and AI-assisted analysis.

Troubleshooting and best practices

If you encounter issues with golangci-lint versions, ensure the binary in your PATH is compatible (v1.52.2+ or v2.4.0+). Resolve multiple versions if necessary by cleaning older binaries and re-installing the recommended version.

For best performance, enable incremental checking by focusing on changed files and use the projectPath parameter to avoid unnecessary inferring work. In multi-project scenarios, GoGuard automatically groups changes per project and merges results.

Versioning and roadmap

Current version is v1.2.0. It introduces the dual tool architecture (code_lint and code_review), improved output token efficiency, and robust change-aware detection across multiple strategies. Future plans include enhanced configuration, richer reporting, and performance improvements such as caching and parallel multi-project checks.

Integration with clients and tooling

Cursor IDE integration automatically detects and uses the MCP server for real-time feedback. For AI-assisted review, pair code_review outputs with Cursor Rule to generate targeted prompts that reflect actual risk points rather than generic advice.

CI/CD workflows can call the MCP command line interface to run checks and emit structured JSON outputs that your automation scripts can parse for reporting and gate decisions.

Notes

The server is designed to detect change scope automatically, grouping and processing changes per project without requiring you to specify exact paths for every run. If you see any unusual behavior in a multi-project setup, verify that the projectRoot boundaries are correctly identified and that each project contains valid Go modules.

Available tools

code_lint

Traditional code quality checks based on golangci-lint, with automatic change detection, package-level precision, multi-project support, and multi-strategy analysis.

code_review

Smart runtime risk detection focusing on concurrency, transactions, resources, and panic safety; outputs structured risk data to support AI-assisted review.