CallLint
About
Static preflight safety gate for MCP servers — scan configs before you run them. Never executes.
Details
- Author
- calllint
- Categories
- Developer Tools
Jump to
Setup
Install CallLint in your MCP client (Claude Desktop, Cursor, Windsurf, and others).
Repository: https://github.com/calllint/calllint
Follow the installation instructions in the repository README, then restart your MCP client.
Run CallLint as an MCP server (calllint-mcp)
CallLint also ships as its own MCP server, so an agent can run the preflight check itself —beforeit installs or approves another MCP server. It is a thin wrapper over the same engine: every tool delegates tocalllint, it carries zero runtime dependencies, and it never executes the server it judges.
{ "mcpServers": { "calllint": { "command": "npx", "args": ](https://github.com/calllint/calllint/blob/HEAD/CHANGELOG.md)["-y", "calllint-mcp"] } } }
Tools exposed:scan_mcp_config_path,scan_mcp_config_json,verify_baseline,explain_finding,generate_agent_rule,generate_ci_gate_snippet. The server speaks stdio JSON-RPC and returns the same evidence-backed SAFE / REVIEW / BLOCK / UNKNOWN verdicts as the CLI. Seepackages/calllint-mcpfor details. Published on npm ascalllint-mcp.
CallLint scan config: ./mcp.json result: BLOCK (BLOCK 1 · UNKNOWN 0 · REVIEW 0 · SAFE 0) ──────────────────────────────────────────────────────────── BLOCK helpful-notes PROMPT S2 Sensitive read · reproducibility HIGH · confidence medium "helpful-notes" is blocked. Risk: Prompt (S2 Sensitive read). • [BLOCKER] Suspicious model-directed instruction in tool metadata (prompt.poisoning, observed, confidence medium) evidence: tools.save_note.description = do not tell the user impact: Tool metadata reaches the model directly and can hijack autonomous tool selection or coerce data disclosure. fix: Remove model-directed instructions from tool names, descriptions, schemas, and server instructions. autonomous use: deny · manual approval: required · sandbox: recommended
CallLint's verdicts are tested against a machine-checkable corpus. Each case pins an expected verdict, required evidence, and a "dangerous input never resolves to SAFE" policy. The corpus is enforced as a release gate:pnpm corpus:test.
- 60 calibrated cases
- 38 real or redacted snapshots
- 0 dangerous false-SAFE
- UNKNOWN ratio 10.0% (target ≤ 15%)
The corpus is a regression and calibration gate, not a claim of full MCP ecosystem coverage. Seeproject-facts.json(the single source of truth for these numbers). Website and README copy is kept in sync bypnpm check:public-copy.
Each rule has a detector and a human-readable doc underpackages/risk-engine/rules/:
- prompt.poisoning— model-directed instructions in tool metadata (blocker)
- prompt.hidden-instructions— hidden/obfuscated content (zero-width, bidi, tag-char, HTML comments) in model-visible metadata (R4 prompt surface, ADR 0014)
- prompt.surface-instructions— model-directed or hidden content in a project document read via--surface-dir(README.md / SKILL.md / AGENTS.md /package.jsondescription); non-blocker, ADR 0015
- exec.dangerous-command— shell-out / interpreter / package-runner commands
- exec.unverified-local-source— runs a local script/binary that is not a recognized package, pinned image, or remote (ADR 0011)
- files.broad-path— over-broad filesystem grants, incl. docker bind-mount host paths (--mount type=bind,src=…,-v host:container; ADR 0012)
- supply.unpinned-package— unpinned package specs (rug-pull surface)
- plussecretEnvKeys,unknownRemote,externalMutation,financialActiondetectors (seeWhat it checks)
Verdicts are governed bypolicy as code(calllint.policy.json); runcalllint policy initto write the defaults andcalllint policy explainto see the effective policy.
calllint scan <config> --badgeemits ashields.io endpointJSON object so an MCP author can show a truthful CallLint verdict in a README. It is built for transparency: the badge shows whatever the verdict is, andonlySAFEis green—REVIEW,UNKNOWN, andBLOCKeach carry a distinct non-green colour. It is a projection of the aggregate verdict (no schema change), andSAFEmeans no blockers observed, not a proof of runtime safety. Seebadge.mdfor the wiring and the verdict→colour map.
CallLint is a security tool, so its own boundaries are explicit and auditable.
- No host execution.It parses and reasons about configuration only; it never runs the server it judges. (See ADR 0003.)
- Treats all config as attacker-controlled.Tool names, descriptions, and schemas are untrusted input; report rendering escapes them.
- Offline by default.--onlineadds advisory registry lookups only and can never make a verdictmorepermissive.
- Deterministic and reproducible.No model, clock, or network in the decision path; the JSON output schema is stable (calllint.report.v0).
Full statement:SECURITY.md· trust boundaries:LIMITATIONS.md. Report issues tosecurity@calllint.com.
CallLint sees configuration, not behavior. It can miss risks a server only reveals at runtime, and can flag surface that turns out benign. It depends on the tool metadata you provide being accurate, and a server can change after you approve it (usebaseline/verifyto catch that). It is heuristic: expect both false positives and false negatives, and treatREVIEW/BLOCKas the start of a review, not a complete threat assessment. SeeLIMITATIONS.mdfor the full trust-boundary document.
- Broaden config-format coverage (more agent/host config dialects)
- Richer online supply-chain signals (still advisory, never auto-SAFE)
- More detectors and tunable policy packs
- Editor/CI integrations beyond SARIF
CallLint stays focused on pre-run risk linting for agent-tool configurations. Hosted registries, gateways, and runtime enforcement are outside the current release scope.
CallLint is the official Apache-2.0 open-source project published atcalllint.com,github.com/calllint/calllint, and npm packagescalllint(CLI) andcalllint-mcp(MCP server). It is maintainer-led — seeGOVERNANCE.mdandCONTRIBUTING.md.
Apache-2.0 — seeLICENSEandNOTICE. The CallLint name and logo are not licensed with the code; seeTRADEMARKS.md.
This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.
Create crafted UI components inspired by the best 21st.dev design engineers.
Bring agent evaluations, observability, and synthetic test set generation directly into your IDE for free with Galileo's new MCP server
An MCP server to help AI assistants to answer questions and generate AccelByte Extend SDK code more effectively .
MCP server for AI Diagram Maker — generate beautiful software engineering diagrams directly inside Cursor, Claude Desktop, Claude Code, or any MCP-compatible AI agent
ALAPI MCP Tools,Call hundreds of API interfaces via MCP
AI-powered SVG animation generator that transforms static files into animated SVG components using the Allyson platform
MCP server that gives AI assistants on-demand access to 1,500+ amCharts docs, ~300 code examples, and 1000+ class API references.
APIMatic MCP Server is used to validate OpenAPI specifications using APIMatic. The server processes OpenAPI files and returns validation summaries by leveraging APIMatic’s API.
One shared context layer for AI agents and humans — live API specs, DB schemas, and versioned contracts across repos so every agent and teammate works from the same source of truth.
Build and deploy full-stack Next.js apps with 98 tools for React, AWS, and MongoDB
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
