JevLint-LE
NPM · JEVLINT-LE-MCP
Lint questions for TypeSafe's Jev and OpenAI's Luna offline, or ask the model itself with your key.
Available components
Last scanned (19 hours ago)
Scores higher than 39% of npm servers
Deprecated
This server is marked deprecated in the MCP registry.
The registry records this reason: Renamed to io.github.nolindnaidoo/decisionlint. Install decisionlint-mcp; jevlint-le-mcp 0.9.0 forwards to it.
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency65
- Repository check failed: the declared repository URL redirects; it must resolve directly. See how to fix → View diagnostics → Fail
- Cryptographically verified build provenance (signed, bound to nolindnaidoo/jevlint-le). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Maintenance check failed: the publisher has marked this version as deprecated on the registry, telling users to stop installing it. See how to fix → Fail
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability63
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1836 tokens (~229/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "probe_question" implies "send" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Fail
- An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 16 Oct 26 −1
- Maintenance: pass → fail ▼ functional
- 15 Oct 26 +21
- Source repository: pass → fail ▼ security
- Injection markers: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- MCP protocol: unverified → fail ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- First check of Schema quality: fail functional
- First check of Schema quality: excellent functional
- First check of Schema quality: fail functional
- First check of Destructive annotations: 0 functional
- First check of Tool coverage: 100 functional
- First check of Tool coverage: 100 functional
- 14 Oct 26 0
- Package version: 0.8.0 → 0.8.1 functional
- 13 Oct 26 0
- Package version: 0.7.0 → 0.8.0 functional
- 12 Oct 26 49
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 16 Oct 2026 · Analysed npm/jevlint-le-mcp@0.8.1
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | nolindnaidoo/jevlint-le |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/nolindnaidoo/jevlint-le/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 3251779585 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:0066c51e770e6279fc5d1ee81bedfd871f93c110912384b57e83e4a5d1efa32f064e0e55880d847bdbf8e9da2fd2a7b54898214e62b86bf07ba17a177 |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_with_jev Check with the model ~424
Ask the model itself, TypeSafe's Jev or OpenAI's Luna, to check the questions in the given text or paths after linting them: overlapping options, a question that needs counting, a label that does not match its description, and the other checks list_rules marks runsHere: false. This sends the questions to the vendor with the user's own API key and costs money, so call it only when the user asks for a check with Jev or Luna, never on every edit, and use plan_jev first when the cost matters. The key is read from TYPESAFE_API_KEY or OPENAI_API_KEY in the environment the server was started with, or from .env.local or .env in its working directory, and is never taken as an argument. Returns the lint report with the model's findings added, each with the probability the model gave, what was sent and answered, and why the check fell short when it did. Bounded by maxCalls.
| Name | Type | Req | Description |
|---|---|---|---|
| filename | string | – | A file name whose extension says what the text is: .json, .ts, .js, .py, .rs or .go. Defaults to request.jev.json. |
| maxCalls | integer | – | The most requests the call may send. Defaults to 25. Requests past it are counted and not sent. |
| model | string | – | The model to ask: a Jev version, or gpt-6-luna for OpenAI's Decisions API. Defaults to jev-1.13.0, which the checks were measured on. |
| paths | array | – | Files or directories on disk, relative to the directory the server was started in. |
| rules | object | – | Rule levels to override, such as { "JEV004": "off" }. Levels: off, hint, info, warning, error. |
| sendState | boolean | – | Also send the state written out in the text, to the checks that read it. Defaults to false. |
| text | string | – | The request JSON or the source code. |
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | yes | – |
| keySource | string | yes | Where the API key was found: the environment, .env.local or .env. Never the key. |
| shortfall | string|null | yes | Why the check covered less than it planned, or null when it covered everything: a failed request, a stop, or questions past maxCalls. |
| totals | object | yes | – |
No examples provided.
explain_rule Explain a rule ~84
A rule's own page, as Markdown: what it catches, an example that is flagged with the message the linter gives, one that is not, how to fix it and how to silence it. Use it before making a fix that fix_text leaves to you, or before silencing a finding.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | The rule, such as JEV004. |
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | – |
| default | string | yes | The level the rule runs at unless a setting changes it. |
| docs | string | yes | The vendor page behind the rule. |
| markdown | string | yes | The rule's page, as Markdown. |
| meaning | string | yes | What the rule catches, in one sentence. |
| name | string | yes | – |
| page | string | yes | The rule's own page. |
| runsHere | boolean | yes | False for a rule that asks the model itself, which only check_with_jev runs. |
No examples provided.
fix_text Fix text ~230
Apply the safe fixes to a request body or source code passed as text, and return the mended text with how many findings were mended and the report of what is left. A safe fix only mends what the API would refuse: a criteria key written yes where it takes true, a mistyped question type, criteria in the wrong shape. A fix that changes what a working request does, such as adding a fallback option or pinning a model, is never applied here. It stays in the report with its edit marked safe: false, for you to make or to leave. Nothing is written to disk and nothing is sent over the network.
| Name | Type | Req | Description |
|---|---|---|---|
| filename | string | – | A file name whose extension says what the text is: .json, .ts, .js, .py, .rs or .go. Defaults to request.jev.json. |
| rules | object | – | Rule levels to override, such as { "JEV004": "off" }. Levels: off, hint, info, warning, error. |
| text | string | yes | The request JSON or the source code. |
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | yes | – |
| fixed | integer | yes | Findings mended. |
| text | string | yes | The text with the safe fixes applied. |
| totals | object | yes | – |
No examples provided.
lint_paths Lint files ~115
Lint the Jev and OpenAI Decisions questions in files or directories on disk. A directory is searched for the file types the linter reads. Returns the same report as lint_text, one entry per file. It sends nothing over the network.
| Name | Type | Req | Description |
|---|---|---|---|
| paths | array | yes | Files or directories on disk, relative to the directory the server was started in. |
| rules | object | – | Rule levels to override, such as { "JEV004": "off" }. Levels: off, hint, info, warning, error. |
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | yes | – |
| totals | object | yes | – |
No examples provided.
lint_text Lint text ~237
Lint questions written for a decision model before they are sent: TypeSafe's Jev (System One, /v1/systemone) and OpenAI's Decisions API (gpt-6-luna, /v1/decisions), in either request shape, or the Vercel AI SDK's decide() for both. Pass a request body as JSON, or source code that builds one. Returns each finding with its rule, message, position and docs link, the edit that would mend it when there is one, plus how many questions were found and how many could not be read in full. Use it after writing or changing a question. It sends nothing over the network.
| Name | Type | Req | Description |
|---|---|---|---|
| filename | string | – | A file name whose extension says what the text is: .json, .ts, .js, .py, .rs or .go. Defaults to request.jev.json. |
| rules | object | – | Rule levels to override, such as { "JEV004": "off" }. Levels: off, hint, info, warning, error. |
| text | string | yes | The request JSON or the source code. |
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | yes | – |
| totals | object | yes | – |
No examples provided.
list_rules List rules ~54
List every rule with its code, name, what it catches, default level, its own page with an example, the vendor page behind it, and whether it runs offline here or only when check_with_jev asks the model.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| rules | array | yes | – |
No examples provided.
plan_jev Plan a check with the model ~305
Say what check_with_jev would send for the given text or paths, and send nothing: how many requests, to which model, about how many input tokens, how many questions are held back for having a part built at runtime, and how many fall past maxCalls. Needs no key. Call it first when the user wants to know the cost of a check before paying for it.
| Name | Type | Req | Description |
|---|---|---|---|
| filename | string | – | A file name whose extension says what the text is: .json, .ts, .js, .py, .rs or .go. Defaults to request.jev.json. |
| maxCalls | integer | – | The most requests the call may send. Defaults to 25. Requests past it are counted and not sent. |
| model | string | – | The model to ask: a Jev version, or gpt-6-luna for OpenAI's Decisions API. Defaults to jev-1.13.0, which the checks were measured on. |
| paths | array | – | Files or directories on disk, relative to the directory the server was started in. |
| rules | object | – | Rule levels to override, such as { "JEV004": "off" }. Levels: off, hint, info, warning, error. |
| sendState | boolean | – | Also send the state written out in the text, to the checks that read it. Defaults to false. |
| text | string | – | The request JSON or the source code. |
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | yes | – |
| totals | object | yes | – |
No examples provided.
probe_question Probe a question ~232
Send one question to Jev several times, as written and with its layout changed, options reversed, labels hidden, levels reversed, criteria removed, to see whether the answer holds. Returns a report as Markdown with a verdict and which variants moved the decision. The text must carry the state the question is asked against, and when it has more than one question, questionId names the one. Asks Jev only, about a dozen requests, with the user's TypeSafe key found the way check_with_jev finds it. It costs money, so call it only when the user asks to probe a question.
| Name | Type | Req | Description |
|---|---|---|---|
| filename | string | – | A file name whose extension says what the text is: .json, .ts, .js, .py, .rs or .go. Defaults to request.jev.json. |
| model | string | – | A Jev version. Defaults to jev-1.13.0. |
| questionId | string | – | The id of the question to probe. Needed when the text has more than one. |
| text | string | yes | The request JSON or the source code. |
| Name | Type | Req | Description |
|---|---|---|---|
| keySource | string | yes | Where the API key was found: the environment, .env.local or .env. Never the key. |
| markdown | string | yes | The full report, as Markdown. |
| model | string | yes | – |
| moved | array | yes | The variants that changed the decision. Empty when the answer held. |
| questionId | string | yes | – |
| requests | integer | yes | Requests sent: three as written, then one per layout change. |
| verdict | string | yes | The one sentence the report opens with. |
No examples provided.
How do I install the JevLint-LE MCP server?
JevLint-LE runs locally as an npm package, launched with npx -y jevlint-le-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · jevlint-le-mcp
claude mcp add nolindnaidoo-jevlint-le -- npx -y jevlint-le-mcp
What is the JevLint-LE MCP server?
JevLint-LE is an MCP server listed in the public MCP registry as io.github.nolindnaidoo/jevlint-le. Lint questions for TypeSafe's Jev and OpenAI's Luna offline, or ask the model itself with your key. This page covers its npm package (jevlint-le-mcp).
Is the JevLint-LE MCP server safe to use?
JevLint-LE scores 69 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 16 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the JevLint-LE MCP server expose?
JevLint-LE exposes 8 tools: lint_text, lint_paths, fix_text, list_rules, explain_rule, and 3 more. Their descriptions and schemas cost roughly 1,681 tokens of context every time the server is loaded.
Is the JevLint-LE MCP server still maintained?
JevLint-LE is marked deprecated in the MCP registry. We last reached this channel on 16 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the JevLint-LE MCP server under?
JevLint-LE declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.