cross-review

MCP server orchestrating API-first cross-review between Claude, ChatGPT Codex, Gemini, DeepSeek, Grok, and Perplexity with unanimous convergence gates.

Upgrade from the published registry.

npm upgrade -g @lcv-ideas-software/cross-review --ignore-scripts --allow-git=none --allow-remote=none
# or using the GitHub Packages mirror:
npm upgrade -g @lcv-ideas-software/cross-review --@lcv-ideas-software:registry=https://npm.pkg.github.com --ignore-scripts --allow-git=none --allow-remote=none

npm 12 global operations evaluate the whole global dependency tree, not this package's project policy in isolation. The command therefore disables every install-time script and keeps Git and remote-URL dependencies blocked. The published package has no install lifecycle and is tested in this mode. Never add --dangerously-allow-all-scripts, and do not install a locally built source tree or tarball as a substitute for the published registry release.

Status. Stable. The current source/release target is v09.02.02 (package 9.2.2). Use the npm badge or npm view @lcv-ideas-software/cross-review version for registry state and server_info for the version actually loaded by an MCP window. See CHANGELOG.md for the full release history.

Project renamed 15/05/2026. This project was previously published as @lcv-ideas-software/cross-review-v2 (versions 0.x through 3.7.5). v4.0.0 is the first release under the shorter canonical name @lcv-ideas-software/cross-review after the companion cross-review-v1 project was discontinued and archived. Historical CHANGELOG entries below v4.0.0 reference the prior name verbatim.

The version history at a glance:

v09.02.02 (23/09/2026): The xAI peer now defaults to Grok 4.7 and reads assistant text from typed Responses output, ignoring encrypted reasoning items.

| Release | Scope | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | v09.02.01 | Perplexity requests no longer ask perplexity/kimi-k3 for a reasoning effort it rejects. Every bare invalid request failure of the peer since 14/09/2026 had one mechanism: the adapter sent reasoning.effort: "max" and the pinned model rejects xhigh and max — HTTP 400 synchronously, a failed background run at the first retrieval — while minimal | low | medium | highcomplete, other models on the same API still acceptmax, and the API reference still lists the full enum. The default effort for the peer is high, clampEffortForPerplexitylandsxhigh, maxandultraonhigh, and a regression pins the clamp table and the wire value on both the reviewer and the relator path (CROSREV-51, #327). | | v09.02.00 | One re-creation after a bare asynchronous Perplexity failure: a background run the provider accepted and then reported failed at the first retrieval with the bare invalid request body — no param, no HTTP status, no usage, within PERPLEXITY_BARE_FAILURE_RECREATE_WINDOW_MS of the create — is created once more through withRetry; every other failure keeps its verdict, and a second bare failure persists. Also: the Windows token-file ACL probe in scripts/smoke.ts runs Windows PowerShell 5.1 with its own PSModulePath so the suite passes under a pwsh 7 ancestor, and three pre-existing biome useOptionalChain warnings are cleared (CROSREV-48, #324). | | v09.01.00 | A provider failure preserves the provider's own error object instead of discarding it: the optional provider_error_detail keeps the HTTP status, type, code, param and the body — redacted as structure, capped at a declared ceiling and flagged when truncated — so a 400 rejecting our request body and an asynchronous failure of an already-created background job can be told apart afterwards; an empty serialization is not recorded (CROSREV-50, #322). | | v09.00.00 | Major: a circular session is refused when the output-ceiling screen would drop ANY rotator, instead of quietly continuing with the rest. The initial screen ran once and a dropped peer never returned, so a session could finalize converged while a peer that would fit the final artifact never saw it. The refusal costs zero provider calls and names the excluded peers with their ceilings and what continuing would have narrowed the rotation to; the two levers stay the same — shrink the artifact or raise the ceilings in the central configuration (CROSREV-49, #319). | | v08.00.00 | Major: review mode evaluates a fixed artifact, and the lead never revises it. Three surfaces disagreed about the relator's role in mode: "review", a seat died on max_output_tokens after the round's votes had been paid, and a short lead verdict silently replaced draft. In review the lead now generates only in round zero, when the caller brought no artifact; from there the peers vote on a fixed artifact, and the output-ceiling screen applies to ship and circular only. Callers that relied on the lead re-emitting the artifact in review no longer get that behaviour. Also updates the CodeQL SARIF upload Action to v4.38.0 and zizmor-action to v0.6.4, SHA-pinned (CROSREV-46, #318). | | v07.00.00 | Major: the operator identity is retired from the protocol. caller is now REQUIRED on every tool that accepts it and "operator" is no longer an admissible value, so a host that omitted it and relied on the old default fails schema validation — set it explicitly before upgrading. The nine read-only tools that never accepted caller (session_list, session_read, session_poll, session_metrics, session_peer_reliability_report, session_events, session_report, session_check_convergence, session_judgment_precision_report) are unaffected. escalate_to_operator, session_evidence_checklist_update and regenerate_caller_tokens are removed; session_finalize accepts only outcome=aborted and is petitioner-scoped; server_info drops operator_capability_loaded and operator_capability_required; the operator_verified provenance tier is no longer produced, and host-tokens.json holds six capabilities instead of seven. The pins move to gpt-6-astra and claude-fable-5-1, with no second supported model per provider — re-key any model_cost_rates card accordingly or the financial preflight blocks. The relator draw now screens the seat's output ceiling against the draft before dispatching a round. Every cross-review-authored surface is English. Also: a Perplexity poll failure no longer re-creates the run it just abandoned — the rethrow carries safe_to_repeat: false, read only by the retry loop (issue #298). | | v06.00.00 | Major: the five legacy Sonar rate-card keys (request_fee_low_per_1000, request_fee_medium_per_1000, request_fee_high_per_1000, citation_tokens_per_million, deep_research_reasoning_tokens_per_million) are rejected by the strict central-config schema again — remove any Sonar card or key from config.json before upgrading, or the whole file is ignored and paid calls stay blocked with CROSS_REVIEW_CONFIG_FILE_INVALID. TokenUsage.citation_tokens, the three CostEstimate line items and the five legacy CostRateConfig keys leave the shipped declarations, so a consumer referencing them stops compiling; server_info.config_load.deprecated_keys_ignored and the citation_tokens clause of the provider-work predicate are gone with them. Also: the Perplexity reviewer and relator run in Agent API background mode (background: true plus GET /v1/agent/{id}) because the provider severs a synchronous request at ~300 s; those two long requests now send store: true, so Perplexity retains them (issue #296). | | v05.00.00 | Major: legacy Sonar dimensions removed. estimateCost no longer prices them; the five Sonar-only rate-card keys stay accepted by the schema as deprecated no-ops named at boot; a central config the schema rejects is now announced at boot. | | v04.06.08 | Evidence custody fixes. A provider-escaped GitHub URL quoted from the attachment no longer downgrades a READY vote; a relator may name a file the admitted unified diff materializes. | | v04.06.07 | No manual gesture. A push to main that changes the version publishes to npmjs.com and GitHub Packages and then records the Release with the run's own token. | | v04.06.06 | Native release path. The repository-owned tagging, dispatch and policy machinery leaves; publishing runs on a published GitHub Release with npm Trusted Publishing and provenance. | | v04.06.05 | Native organization governance. Actions lockfile, advanced CodeQL workflow, merge-queue triggers and the v04.05.26 recovery workflow leave; the canonical Dependabot auto-merge and the organization workflows enter; the release gates read the CodeQL default-setup analyses. | | v04.06.04 | Makes evidence conflict correlation linear and argv-exact, and makes future/current model parsing clause-aware through finite English/Portuguese frames, including replace … with, update … to, Portuguese present qualifiers, and semicolon isolation. | | v04.06.03 | Restores fail-closed anti-deception semantics for conflicting executions of the same command, additive not only/não só model claims, and current-state claims beside planning language, while preserving independent RED/GREEN records and genuine future targets. | | v04.06.02 | Republish of v04.06.01 with a self-contained pin-validator action (bundled parser, clean-runner proven), reference-resolved local action manifests and a location-scoped Scorecard allowance. | | v04.06.01 | Republish of v04.06.00 with the supply-chain gate fix: minimal per-job GITHUB_TOKEN permissions across all workflows, TokenPermissionsID back under Scorecard watch, and a real pinning revalidation in the Publish gate covering the immutable $/ same-repo references. | | v04.06.00 | Migrates the Perplexity peer to the Agent API (perplexity/kimi-k3) before the Sonar sunset of 27/09/2026, moves Grok to grok-4.6 with xhigh effort, refreshes provider rate documentation, and makes the relator lottery smoke deterministic with an explicit chi-square bound. | | v04.05.39 | Prevents repeated caller-token permission recovery in one boot, regenerates only after a confirmed disappearance, and makes the trusted-console Windows recipe replace only a protected-empty DACL before verifying the exact result. | | v04.05.38 | Locks the T2#10 source-regex debt at its current smoke=129, source-contract=29, total 158 baseline so a new broad source-style regex pin cannot consume the two-pin allowance left by the older v4.4.6 budget. | | v04.05.37 | Makes Windows caller-token ACL hardening interruption-tolerant, repairs one protected-empty-DACL denial without looping or rotating tokens, binds path/SID data outside the PowerShell command parser, and adds a dedicated Windows regression gate. | | v04.05.36 | Repairs byte-exact JSON citation grounding, preserves active caller evidence during full decision retry, accepts documented terminal Perplexity aggregate content, and refreshes the signed immutable central automation pins. | | v04.05.35 | Hardens the public-package boundary, moves administrative release checks into the protected non-deployment environment, updates TypeScript ESLint to 8.66.0, and makes Windows parent-process forensics tests deterministic without changing the 500 ms best-effort runtime cap. | | v04.05.34 | Removes two redundant control-flow expressions reported by GitHub Code Quality while preserving the budget-preflight behavior and the lazy evidence-attachment fallback used when truthfulness preflight is disabled. | | v04.05.33 | Supersedes the unpublished 4.5.32 tag by recognizing npm's documented 404 identity concealment only in the negative OIDC probe, matching npm's scoped-package escaping, retaining an exact-201 positive gate, and resolving OpenAI 7.3.0. | | v04.05.32 | Bootstraps checksum-verified npm 12.0.2, proves both npm OIDC environment boundaries before source execution, splits privileged publication from verification, and remediates the current Hono, brace-expansion, fast-uri and ip-address advisories. | | v04.05.31 | Supersedes the unpublished 4.5.30 tag by making the clean-consumer license gate follow the exact bundled MCP SDK version instead of a stale hard-coded version. | | v04.05.30 | Updates the OpenAI runtime to 7.0.0 and bundled MCP SDK to 1.30.0; completely removes Socket Security and StepSecurity; prevents redundant immutable-tag publication; fails closed on ambiguous GitHub API status; and runs direct Zizmor through checksum-verified uv. | | v04.05.29 | Supersedes the unpublished 4.5.28 tag and locks brace-expansion 5.0.8 after its newly disclosed high-severity DoS advisory blocked publication; also retains the descriptor-based caller-token TOCTOU fix verified by CodeQL. | | v04.05.28 | Adds opt-in Claude Opus 5 support; bounds Evidence Broker amplification without weakening blockers; repairs interrupted-session lifecycle, checklist provenance and truthfulness diagnostics; hardens caller-token ACLs; and makes event polling compact. | | v04.05.27 | Updates the Anthropic and OpenAI SDKs, makes manifests and lockfiles the dependency source of truth, and ships hardened dependency automation with verified release recovery. | | v04.05.26 | Bundles the MCP runtime and hardens exact-SHA automation, immutable releases, and current provider dependencies. | | v04.05.25 | Resolves the three registry advisories in the lockfile: body-parser 2.3.0, nested protobufjs 7.6.5, and brace-expansion 5.0.7; updates the one reviewed install-script approval to [email protected]. Scorecard and Auto-tag remain fail-closed; no alert was suppressed. | | v04.05.23 | Accepts npm 12's one-item npm view --json response only when it contains one metadata object; empty, multiple, and malformed responses fail closed before the integrity-bound audit lock and mandatory npm audit signatures gate. | | v04.05.22 | Decodes npm's Sigstore DSSE envelope before binding the SLSA provenance to the protected tag, publication workflow, and immutable source commit; the later cryptographic npm audit signatures gate remains mandatory. | | v04.05.21 | Aligns the durable effective-config regression with JSON semantics: unset optional properties are omitted consistently from persisted snapshots and their SHA-256 canonical form. | | v04.05.20 | Restores a deterministic CI fixture for the pre-publish budget/cache contract: Gemini has an explicit test rate and a manually known settlement cannot retain a stale unknown-spend marker. The production financial gate remains fail-closed. | | v04.05.19 | Hardens the npm publication gate without weakening artifact verification: an integrity-bound temporary lock drives npm ci and npm audit signatures, while visibility no longer pipes downloaded data into Node. | | v04.05.18 | Closes the 4.5.16–4.5.17 session-audit findings: symmetric grounding for blocking verdicts, per-peer write-through durability, terminal preflight audit trails, bounded evidence judges, complete cache/config telemetry and action-oriented compact reports. | | v04.05.17 | Publishes the accumulated provider/toolchain maintenance, raises the Anthropic SDK range and keeps npm 12 dependency scripts fail-closed with an exact, reviewed Google Gen AI 2.12.0 no-op lifecycle permission. | | v04.05.16 | Makes background observation compact and race-safe: summary polling by default, explicit forensic detail, real HTML-neutralized Markdown, durable cross-host job status and idempotent late-cancellation results with final state.