scrub-mcp

# S.C.R.U.B. **Source Code Review, Uplift, and Baselining** A 22-tool MCP server and CI-ready CLI that cuts cloud LLM token usage on code quality tasks. Deterministic tools handle what they can. A local LLM (via DSPy) handles the rest. Cloud models plan and review. Nothing else. ``` Cloud LLM (plan) ──> S.C.R.U.B. MCP Server ──> Cloud LLM (review) │ ┌───────────┼───────────┐ ▼ ▼ ▼ Deterministic DSPy + Security + (Ruff, AST, Local LLM Supply Chain pyright) (Qwen Coder) (Bandit, OSV) ┌───────────┴───────────┐ ▼ ▼ CLI (scrub) GitHub Actions check│fix│diff│audit .pre-commit-hooks SARIF 2.1.0 output ``` ## Why: From Code Generation to Code Governance The AI industry is obsessed with Day 1: writing code faster. But for any team responsible for enterprise infrastructure, the real cost of software isn't writing it—it's Day 2: maintaining, securing, and auditing that code for the next five years. AI makes it dangerously easy to generate massive amounts of technical debt, complex spaghetti logic, and unvetted supply chain risks. It writes code, but it doesn't own systems. S.C.R.U.B. is the adult in the room. It is not a coding tool; it is a **best practices tool**. It acts as a deterministic governance engine that sits between the AI and your codebase, strictly enforcing sanity, security thresholds, and architectural standards. It allows teams to safely adopt autonomous coding agents because the output is systematically proven to be compliant, legible, and secure *before* it ever hits a pull request. The fact that S.C.R.U.B. forces CycloneDX SBOMs, Bandit security scans, and strict cyclomatic complexity limits isn't just a side feature—it's the product. The conversation shifts from "How fast can the AI code?" to "How safe is the code the AI just wrote?" This determ…