calllint/calllint

**Your agent can run tools faster than you can review them.**
CallLint is a pre-flight risk linter for MCP and agent-tool configs. It checks
the blast radius before the tool runs: what each tool can read, write, execute,
connect to, send, or mutate — then returns an evidence-backed verdict
(**SAFE / REVIEW / BLOCK / UNKNOWN**) before your agent ever loads the server.
It never executes, installs, or connects to the servers it judges.
> Status: 1.9.1 stable CLI release. Actively hardened. Verdicts are heuristic
> decision support, not a safety guarantee. Read Limitations
> before relying on a verdict for a security decision.
What is CallLint?
The authority a tool configuration grants is the union of the permissions and
capabilities CallLint can observe in that configuration and its supplied tool
metadata. A single MCP server can add filesystem write, shell execution, network
egress, or model-directed instructions to an autonomous agent — usually described
only by untrusted, tool-provided metadata. CallLint inspects that static surface
and tells you, with evidence, what you would be granting **before** you grant it;
it does not claim to observe an agent's total runtime or cloud authority.
- **Deterministic** — same input, same verdict. No model in the decision path.
- **Offline by default** — no network unless you pass --online (advisory only).
- **Evidence-backed** — every finding cites the exact config field it came from.
- **Never executes the target** — it reasons about configuration, not behavior.
What it checks
CallLint runs thirteen static detectors over each server entry:
| Detector | Risk symbol | What it flags |
|---|---|---|
| secretEnvKeys | 🔐 Secrets | Env keys whose names imply credentials (tokens, keys, passwords), incl. docker inline -e KEY |
| broadFilesystemPath | 📁 Files | Filesystem roots that grant broad read/write (/, ~, home, drive roots), incl. docker bind-mount host paths |
| unknownRemote | 🌐 Network | Remote/HTTP transports to unrecognized or unpinned hosts |
| promptPoisoning | 🧠 Prompt | Model-directed instructions hidden in tool names, descriptions, or schemas |
| hiddenInstructions | 🧠 Prompt | Hidden/obfuscated content (zero-width, bidi, tag-char, HTML comments) in model-visible metadata |
| dangerousCommand | ⚙️ Exec | Shell-out / interpreter / package-runner commands (bash -c, npx, …) |
| unverifiedLocalSource | ⚙️ Exec | Local script/binary that is not a recognized package, pinned image, or remote |
| externalMutation | ✉️ Action | Tools that send or mutate external state (email, messages, posts) |
| messagingSend | ✉️ Action | Tools that send messages/email on your behalf (Slack, Twilio, SMTP, …) |
| oauthScope | ✉️ Action | OAuth scopes that are undeclared, broad, or expansive (admin, *, repo, …) |
| gatewayRuntime | ✉️ Action | Long-running gateway runtimes that proxy many downstream tools under one auth |
| financialAction | 💸 Money | Payment / transfer / irreversible financial actions |
| unpinnedPackage | 🧩 Supply | Unpinned package specs (@latest, no version) — rug-pull surface |
Findings roll up into a **risk class** (S0 metadata-only → S5
financial/irreversible) and an aggregate **verdict** per server and per config.
Drift detection (baseline / verify) records an approved risk surface and
flags **rug-pulls** (🔁) — a previously-approved server whose risk surface later
changed.
What it does not check
This list matters more than the feature list. CallLint is a *pre-flight check*,
not a proof of safety.
- It **does not execute, install, or connect** to servers — so it cannot observe
actual runtime behavior (what a server really reads, writes, or sends).
- It **does not read or validate secret values** — it inspects config *shape*
(key names), never the contents of your .env or credential stores.
- It **does not analyze server source code** — only the configuration and any
tool metadata you provide under x-calllint.tools.
- It **does not fetch anything** unless you pass --online, and online results
are advisory — they never upgrade a verdict toward SAFE.
- It **does not certify** third-party tools, replace human security review, or