Calllint

CallLint

Your agent can run tools faster than you can review them.

CallLint is a pre-flight risk linter for MCP and agent-tool configs. It checks the blast radius before the tool runs: what each tool can read, write, execute, connect to, send, or mutate — then returns an evidence-backed verdict (SAFE / REVIEW / BLOCK / UNKNOWN) before your agent ever loads the server.

It never executes, installs, or connects to the servers it judges.

npx calllint scan .cursor/mcp.json

Status: 1.9.2 stable CLI release. Actively hardened. Verdicts are heuristic

decision support, not a safety guarantee. Read Limitations

before relying on a verdict for a security decision.

$ npx calllint scan .cursor/mcp.json

result: BLOCK (BLOCK 1 · UNKNOWN 0 · REVIEW 0 · SAFE 0)

BLOCK helpful-notes PROMPT · SUPPLY • [BLOCKER] Model-directed instruction in tool metadata evidence: tools.save_note.description = "do not tell the user" • Package version is not pinned evidence: package = helpful-notes@latest autonomous use: deny · manual approval: required

What is CallLint?

The authority a tool configuration grants is the union of the permissions and capabilities CallLint can observe in that configuration and its supplied tool metadata. A single MCP server can add filesystem write, shell execution, network egress, or model-directed instructions to an autonomous agent — usually described only by untrusted, tool-provided metadata. CallLint inspects that static surface and tells you, with evidence, what you would be granting before you grant it; it does not claim to observe an agent's total runtime or cloud authority.

• Deterministic — same input, same verdict. No model in the decision path.
• Offline by default — no network unless you pass --online (advisory only).
• Evidence-backed — every finding cites the exact config field it came from.
• Never executes the target — it reasons about configuration, not behavior.

What it checks

CallLint runs thirteen static detectors over each server entry:

Findings roll up into a risk class (S0 metadata-only → S5 financial/irreversible) and an aggregate verdict per server and per config.

Drift detection (baseline / verify) records an approved risk surface and flags rug-pulls (🔁) — a previously-approved server whose risk surface later changed.

What it does not check

This list matters more than the feature list. CallLint is a *pre-flight check*, not a proof of safety.

• It does not execute, install, or connect to servers — so it cannot observe actual runtime behavior (what a server really reads, writes, or sends).
• It does not read or validate secret values — it inspects config *shape* (key names), never the contents of your .env or credential stores.
• It does not analyze server source code — only the configuration and any tool metadata you provide under x-calllint.tools.
• It does not fetch anything unless you pass --online, and online results are advisory — they never upgrade a verdict toward SAFE.
• It does not certify third-party tools, replace human security review, or guarantee an agent is safe.
• A clean run is necessary, not sufficient. Pair it with code review, least-privilege tokens, and runtime controls.

UNKNOWN is a real verdict: when CallLint cannot verify what a server will do, it says so and never silently upgrades UNKNOWN to SAFE.

What CallLint is — and is not

Install

# run without installing (recommended):

npx calllint scan ./mcp.json

or install globally:

npm install -g calllint

Requires Node.js ≥ 20. The published package is a single self-contained bundle with zero runtime dependencies. calllint on the latest tag is the current stable CLI release; @next carries release candidates and @preview older previews.

Quick start

Zero-config scanning — discover and scan all your agent configs:

# Auto-discover and scan all agents (Cursor, Claude Code, Claude Desktop, VS Code, Windsurf)

calllint scan --auto

List all discovered agent configs

calllint inventory

Scan a specific agent type

calllint scan --agent cursor calllint scan --agent vscode

Manual path scanning — scan a specific config file:

# scan a config file (auto-detects common locations if no path given)

calllint scan ./mcp.json

scan from stdin, machine-readable JSON out

cat .cursor/mcp.json | calllint scan --stdin --json

CI gate: non-zero exit per policy (BLOCK=30, UNKNOWN=20, REVIEW=10 if enabled)

calllint scan ./mcp.json --ci --no-emoji

synthesize a config for an npm package (offline) or a GitHub repo (--online)

calllint scan npm:mcp-weather@1.0.0 calllint scan github:owner/repo --online

record an approved baseline, then detect drift / rug-pulls later

calllint baseline ./mcp.json calllint verify ./mcp.json --ci

explain one server's verdict from the last scan

calllint explain filesystem

structured diagnostics for editor / agent-host integration

calllint diagnostics ./mcp.json --json

Output formats: default terminal, --compact, --json (stable schema), --sarif (GitHub Code Scanning), --markdown (PR comments / GitHub Step Summary), --html (self-contained report). The diagnostics command emits a separate editor/agent-host JSON (calllint.diagnostics.v0).

See CallLint running in CI on a deliberately risky config — calllint-demo-risky-mcp publishes one Code Scanning alert per finding on every push.

Beyond config scanning

The same engine and verdict semantics extend past MCP-config scanning to other points where an agent grants authority:

# Preflight a planned external action before the agent runs it

calllint action inspect payment.json # calllint.action.v0 descriptor calllint action inspect email-reply.json --json

Preflight a normalized agent inbox event (delegates to the action analyzer)

calllint inbox inspect gmail-reply.normalized.json

Record a scan as a local, verifiable receipt, then validate it later

calllint scan ./mcp.json --receipt # writes calllint-receipt.json calllint receipt verify calllint-receipt.json

Attach an external content-scanner report as evidence (joint Trust Packet)

calllint scan ./mcp.json --evidence skillspector-report.json

Receipts (calllint.receipt.v0) are a reporting layer derived from a scan — they prove which CallLint version produced which verdict over which input under which policy. They are not a second scanner and never re-judge a verdict. A receipt can carry an optional ed25519 signature; receipt keygen / receipt sign generate and sign one locally for development, and receipt verify checks the signature when present (offline, with --public-key). A signature proves provenance and integrity — never safety.

Trust Gateway — prepare, approve, apply, verify

Scanning tells you the blast radius; the Trust Gateway acts on it, safely. It resolves an agent-tool target to an immutable, digest-pinned identity, judges it deterministically, and emits a reversible install plan. Applying that plan is the only thing that ever writes live config: it re-validates every digest, writes atomically, verifies the result, and rolls back on failure. The gateway never executes, installs, or connects to the target it judges.

# read-only: resolve + judge a target and emit a reversible plan (touches no live config)

calllint trust prepare github:owner/repo --host claude-code --write-plan calllint trust show .calllint/plans/ .json calllint trust explain .calllint/plans/ .json

the only writer of live config — applies an approved plan, atomically and reversibly

calllint trust apply --plan .calllint/plans/ .json --approve --receipt

validate a decision receipt later (read-only; never re-judges or executes)

calllint trust verify calllint-decision-receipt.json --public-key key.pub

The gateway is a deterministic, fail-closed pipeline over six sealed digests (artifact → evidence → authority → decision/policy → install-plan → receipt). An approval binds all six at once; if any digest changes between prepare and apply, the approval is void and nothing is written. UNKNOWN never becomes SAFE, and external evidence can tighten a verdict but never set it alone. Five Tier-A hosts ship the audited apply surface — Claude Code, Cursor, Windsurf, Claude Desktop, and VS Code. See the CHANGELOG (Trust Gateway Core) and ADRs 0035–0039.

Continuous Guard — catch a rug-pull after approval

A tool you approved once can change later. calllint guard records the approved authority surface and re-decides it — silent when nothing changed, and loud the moment a previously-approved server's risk surface shifts (a rug-pull, 🔁). It adds no new verdict engine: it reuses the same deterministic drift check as baseline / verify and the same stable exit codes.

# re-assess the current authority surface vs the approved baseline (silent when unchanged)

calllint guard

install a guard hook into a host — a declarative shim that only shells out to calllint guard

calllint guard install --host git # git pre-commit hook calllint guard install --host github # GitHub Actions drift-gate workflow calllint guard status # baseline / disable / installed-hook state calllint guard disable # writes .calllint/guard.json { enabled: false }

Guard installs on seven hosts: git (pre-commit), git-pre-push, github (Actions), claude-code, copilot, gemini, and vscode. Every hook binds only to a commit / push / CI / session-start event —