io.github.calllint/calllint

Apply an install plan you already prepared and explicitly approved, writing the pinned MCP server into a host's config. This is a WRITE — it is the only CallLint tool that changes a file, and it refuses unless you name a supported host AND pass approvalDigest equal to the exact planDigest calllint_prepare_safe_install returned. Before writing it re-runs the full local gateway from scratch and recomputes the plan: if the host config or the pinned target changed since you prepared, the digest differs and the apply aborts with nothing written. A public BLOCK/UNKNOWN/unsupported route, a local BLOCK/UNKNOWN decision, or an exact-target mismatch all refuse before the write. The write itself is delegated to CallLint's shipped apply engine, which backs up the current config, writes atomically under a lock, re-reads to verify, and rolls back on any failure — so a failed apply leaves the original config in place. Outcomes: APPLIED_AND_VERIFIED (written and verified, with a decision receipt returned inline for later verification), ABORTED_ON_MISMATCH, BLOCKED, LOCAL_PREFLIGHT_REQUIRED, or UNSUPPORTED. This is a one-time protected setup: it installs no CallLint components, leaves no persistent CallLint files, and never starts, connects to, authenticates to, or tests the server it installed.

List exactly what CallLint's continuous protection would install, so a person can decide whether to enable it. Continuous protection is persistent: unlike a one-time install it adds CallLint components to the project (a session-start hook, a git hook, or a CI workflow, depending on host) that re-decide the approved agent-tool authority surface, detect drift, and re-check upgrades. Because it is persistent it is always a separate decision, never bundled into an install: this tool writes nothing, enables nothing, and installs nothing even if you pass approvalDigest. It returns every component with the file it creates, the command that enables it, and the command that removes it, plus a disclosureDigest over that set and a disableCommand. Report the components and both choices — enable, or not now — and let the person run the enable command themselves in a terminal. Declining changes nothing about an install already completed.

Fetch the committed CallLint Agent Adoption Contract for a published MCP server / agent tool, by its canonical name (the same canonicalName/slug calllint_search_agent_tools returns). Returns the exact machine contract CallLint already published: the pinned subject (package, version, artifact digest), the public observation (verdict + boundary-safe label), the authority delta, and the recommendedNextAction telling you how to proceed (usually calllint_prepare_safe_install with the exact version/artifact/contract digests to assert). The contract is served verbatim from a committed bundle — no network, no execution, no new verdict. Optionally pass version to require an exact pinned version (a mismatch returns not-found rather than a different version). A resource with no committed contract is not served; absence is not a verdict. Use this to obtain the exact target to assert, then calllint_prepare_safe_install to re-decide locally before any install.

CallLint is present in this session as a static, deterministic preflight gate for MCP servers and agent tools (a pure delegator, ADR 0025). It reads an MCP or agent-tool config and returns an evidence-backed verdict — SAFE means no blockers observed, REVIEW means human judgment required, BLOCK means a dangerous surface, UNKNOWN means it cannot verify statically; UNKNOWN is never SAFE. Verdicts come from deterministic rules, never an LLM, and CallLint never executes the server or tool it judges. Its tools: scan_mcp_config_json and scan_mcp_config_path (a verdict for a config), explain_finding (the evidence behind a verdict), verify_baseline (drift versus an approved baseline), generate_agent_rule and generate_ci_gate_snippet (wire it into a host or CI). This tool only reports that CallLint is available; it changes no verdict and performs no action of its own.

Locally and statically PREPARE a safe install of a published MCP server, re-deciding its trust verdict on THIS machine before anything is written. Give the canonical name (and ideally the exact version/artifact/contract digests from calllint_get_adoption_contract to assert you got the target you meant). This never executes the server and never writes any config — it synthesizes the exact pinned launch, re-runs the full CallLint gateway locally (resolve → authority manifest → toxic-flow fold → policy decision), and, when you name a host, computes the inert install plan you would later apply. The local decision can only be STRICTER than the public one: a public BLOCK/UNKNOWN/unsupported target is refused before the local re-decode, an exact-target mismatch aborts with no plan, and only a pinned npm subject is auto-preparable in this version (anything else returns LOCAL_PREFLIGHT_REQUIRED — run `calllint trust prepare`). Outcomes: PREPARED (a plan is ready for a separate, explicitly-approved apply — never auto-applied), BLOCKED, LOCAL_PREFLIGHT_REQUIRED, ABORTED_ON_MISMATCH, or UNSUPPORTED. The returned plan authorizes nothing on its own; applying it is a separate human-gated step.

Search already-published CallLint Trust Pages for MCP servers and agent tools by name, and get each match's existing verdict. Deterministic name match only (exact, then prefix, then substring; alphabetical within a tier) over a committed index — no LLM, no fuzzy or semantic ranking, and no new score. Each result carries the page's shipped verdict verbatim — SAFE (no blockers observed), REVIEW (human judgment required), BLOCK (a dangerous surface), or UNKNOWN (could not verify statically; UNKNOWN is never SAFE) — plus its boundary-safe label, artifact digest, observed-at time, and Trust Page URL. When the resource also has a CallLint acquisition page, the result includes installUrl (the human Install page), contractUrl (the machine Agent Adoption Contract), and installability (the route: PREPARE_AVAILABLE, REVIEW_REQUIRED, BLOCKED, LOCAL_PREFLIGHT_REQUIRED, or UNSUPPORTED); these link existing pages and authorize nothing — installing always re-decides locally. A match reports an existing observation at a specific digest and time; it is not a certification, an endorsement, or a guarantee of safety, and this tool never executes a server and changes no verdict. A resource with no CallLint Trust Page simply does not appear; absence is not a verdict. To scan a config that has no page yet, use scan_mcp_config_json.

Verify that an MCP server install is actually in place and unchanged, by reading the host's config and comparing it against the published contract's exact pinned target. Read-only: it writes nothing, runs no scan, applies no policy, decides no verdict, and never starts or connects to the installed server. It reports whether the config exists and parses, whether the expected server entry is present, and whether that entry still pins the exact package@version the contract names (drift is reported, never accepted). Optionally pass the decision receipt from calllint_apply_prepared_install to also confirm its structure and approval binding are intact (an expired receipt is reported as a true record of a past approval, not a current authorization). A passing check means this exact entry is present right now — it is not a safety verdict.

Return the full evidence-backed explanation for the servers in an MCP config JSON (why each verdict was reached).

Generate the CallLint agent-safety rule text for a host (e.g. claude, cursor, copilot, agents). Paste into the host's rules file.

Generate a GitHub Actions workflow (.github/workflows/calllint.yml) that gates a repo on its agent-tool surface. mode=drift fails on approved-state drift; mode=scan-all is report-only.

Scan MCP config JSON text and return compact decisions (one per server: verdict, fingerprint hash, reason codes). Static; never executes the server.

Scan an MCP config file on disk and return the full ScanReport (verdict + evidence). Static; never executes the server.

Compare a fresh scan of MCP config JSON against a recorded baseline and report drift / rug-pull signals. Static; never executes the server.