Calllint MCP server

CallLint

Your agent can run tools faster than you can review them.

CallLint is a pre-flight risk linter for MCP and agent-tool configs. It checks the blast radius before the tool runs: what each tool can read, write, execute, connect to, send, or mutate — then returns an evidence-backed verdict (SAFE / REVIEW / BLOCK / UNKNOWN) before your agent ever loads the server.

It never executes, installs, or connects to the servers it judges.

npx calllint scan .cursor/mcp.json

Status: 1.9.1 stable CLI release. Actively hardened. Verdicts are heuristic

decision support, not a safety guarantee. Read Limitations

before relying on a verdict for a security decision.

$ npx calllint scan .cursor/mcp.json
result: BLOCK   (BLOCK 1 · UNKNOWN 0 · REVIEW 0 · SAFE 0)

BLOCK  helpful-notes    PROMPT · SUPPLY
  • [BLOCKER] Model-directed instruction in tool metadata
      evidence: tools.save_note.description = "do not tell the user"
  • Package version is not pinned
      evidence: package = helpful-notes@latest
  autonomous use: deny · manual approval: required

What is CallLint?

The authority a tool configuration grants is the union of the permissions and capabilities CallLint can observe in that configuration and its supplied tool metadata. A single MCP server can add filesystem write, shell execution, network egress, or model-directed instructions to an autonomous agent — usually described only by untrusted, tool-provided metadata. CallLint inspects that static surface and tells you, with evidence, what you would be granting before you grant it; it does not claim to observe an agent's total runtime or cloud authority.

• Deterministic — same input, same verdict. No model in the decision path.
• Offline by default — no network unless you pass --online (advisory only).
• Evidence-backed — every finding cites the exact config field it came from.
• Never executes the target — it reasons about configuration, not behavior.

What it checks

CallLint runs thirteen static detectors over each server entry:

Findings roll up into a risk class (S0 metadata-only → S5 financial/irreversible) and an aggregate verdict per server and per config.

Shortened. The full README is on GitHub.