Repository navigation
mcp-app-lint: lint live servers, suggest CSP, MCP server mode - #15
Merged
Merged
Conversation
mcp-app-lint: --url/--header and --stdio read what a running server publishes (initialize, resources/list, resources/read of UI resources, tools/list) and never call a tool, so a server owner can check the CSP and HTML a host actually gets with one command. --suggest-csp prints the _meta.ui.csp a document needs, following the host formula; MCPAPP001 now carries the same suggestion. New rules where the exact document is known: MCPAPP020 csp-unused-domain (note) and MCPAPP021 csp-host-undeclared (warning). --mcp serves six read-only tools to agents; none starts a process. The SARIF command line masks header values, URL credentials and query values, and env assignments in --stdio, since code scanning stores it. --dir path/ no longer gives path//file locations. census: the Streamable HTTP client moved into mcp-app-lint; the census subclasses it with its own user agent and client name. plugin: the mcp-app-csp skill covers --url, --stdio, --suggest-csp, the new rules, and the MCP tools when the user has registered the server; the plugin itself still ships no MCP server.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
mcp-app-lintcan now check a running server, suggest the CSP a UI needs, and serve its checks to agents over MCP.--url <endpoint>(Streamable HTTP,--header "Name: value"repeatable,--timeout) and--stdio "<command>"do what a host does:initialize,resources/list,resources/readfor every UI resource,tools/list. They never call a tool. A 401, a 404 or a timeout comes with a hint. The HTTP client moved here fromcensus/lib/mcp-client.mjs, and the census now subclasses it with its own user agent.--suggest-csp. Prints the_meta.ui.cspeach UI document needs (connectDomains,resourceDomains,frameDomains, following the host formula inconformance/host.mjs), as JSON or text. MCPAPP001 carries the same suggestion in its message and inproperties.suggestedCsp.csp-unused-domain(note): a declared host the document never mentions.csp-host-undeclared(warning): the document loads from or calls an origin the declared CSP does not allow, so the host blocks it.--mcp. Runs as an MCP server over stdio with six read-only tools:lint_ui_resource,suggest_csp,lint_tools,lint_a2ui,lint_directory,lint_server. No tool starts a process. The plugin still ships no MCP server; themcp-app-cspskill uses these tools when the user has registered the server.--dir path/gavepath//filelocations, which code scanning cannot map.commandLinenow masks header values, URL credentials and query values, andNAME=valueassignments in the--stdiocommand, so a token passed with--headerdoes not end up in code scanning.No new dependencies.
Verification
npm run checkis green: typecheck, unit tests, build, Chromium proofs, corpus 54/54 and 24/24.test/live.test.mjs: HTTP and stdio fixtures, server ping, non-JSON stdout, a server that exits, the MCP server loop, command-line redaction.test/csp.test.mjs: needs by key, coverage, MCPAPP020/021, the suggestion in MCPAPP001, the trailing-slash fix,--suggest-cspoutput.basic-server-vueexample, over--stdioand--url: MCPAPP008 and MCPAPP009, as expected. A wrong path gives the 404 hint and exit code 2.--dirover all ext-apps examples gives the same findings as before.claude plugin validate: passes, with the existingprivacyPolicyUrlwarning only.