Calllint MCP Server

Calllint MCP server is a hosted integration for AI assistants that speak the Model Context Protocol. Static preflight safety gate for MCP servers — scan configs before you run them. Never executes.

What you get

CallLint is a pre-flight risk linter for MCP and agent-tool configs. It checks the blast radius before the tool runs: what each tool can read, write, execute, connect to, send, or mutate — then returns an evidence-backed verdict (SAFE / REVIEW / BLOCK / UNKNOWN) before your agent ever loads the server.

An agent's power is the union of its tools' permissions. A single MCP server can add filesystem write, shell execution, network egress, or model-directed instructions to an autonomous agent — usually described only by untrusted, tool-provided metadata. CallLint inspects that surface statically and tells you, with evidence, what you would be granting before you grant it.

• It does not execute, install, or connect to servers — so it cannot observe
• It does not read or validate secret values — it inspects config shape
• It does not analyze server source code — only the configuration and any
• It does not fetch anything unless you pass --online, and online results
• It does not certify third-party tools, replace human security review, or
• A clean run is necessary, not sufficient. Pair it with code review,

Setting it up

Being a remote server, there is no local install. You register the endpoint with your client, authorise it once, and the tools appear.

What the assistant can call

Once Calllint is connected, these are the calls the assistant has available:

• Deterministic — same input, same verdict. No model in the decision path
• Evidence-backed — every finding cites the exact config field it came from
• prompt.poisoning — model-directed instructions in tool metadata (blocker)
• prompt.hidden-instructions — hidden/obfuscated content (zero-width, bidi,
• prompt.surface-instructions — model-directed or hidden content in a project
• exec.dangerous-command — shell-out / interpreter / package-runner commands
• exec.unverified-local-source — runs a local script/binary that is not a
• files.broad-path — over-broad filesystem grants, incl. docker bind-mount host
• supply.unpinned-package — unpinned package specs (rug-pull surface)
• Detector — Risk symbol
• secretEnvKeys — 🔐 Secrets
• broadFilesystemPath — 📁 Files

Before you rely on it

• Your data travels to the provider's service, so the usual questions apply about what you send and what they retain.
• With 14 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Calllint.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the calllint mcp server does with a few real requests.

Choosing this one

Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Calllint's toolset — Deterministic, Evidence-backed, prompt.poisoning and 11 more — is a fair guide to whether it matches your workflow. It is maintained by calllint; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.