MCP 2026-07-28

Lint tool definitions before clients consume them.

Static checks for current MCP tool metadata: names, uniqueness, input/output schemas, task support and risky exposure of sensitive parameters through x-mcp-header.

2026-07-28 tool modelJSON Schema awareNot a server inspector

MCP tools JSON

Tool, array or tools/list result

MCP lint report

Static metadata checks only

Ready to lint

This does not connect to an MCP server and does not replace protocol/runtime testing.

Current scope

Tool declarations, not transport probing

The current MCP specification uses JSON Schema for tool inputs and optional outputs. Tool names should use the documented restricted character set and be unique within a server. The linter also warns when a sensitive-looking parameter is annotated with x-mcp-header.

Security signals are lint, not guarantees

Authorization, SSRF, issuer validation, redirect handling and token audience validation require runtime architecture checks that cannot be proven from a tool definition alone.