CI and code scanning

Add it to a workflow

Audit the saved payload, write a SARIF log, then hand the log to code scanning. The two steps are independent, so the audit still fails the job on its own.

name: mcplint
on: [push, pull_request]

jobs:
  mcplint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.x

      - name: Audit MCP tools
        run: bunx github:srivtx/mcplint#main --tools tools.json --client claude --fail-on warning --sarif mcplint.sarif

      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: mcplint.sarif

What a SARIF result contains

Each finding becomes one SARIF result:

• ruleId is the rule code, such as MCP-008.
• level is mapped from severity: error becomes error, warning becomes warning, and info becomes note.
• The physical location points at the payload file, so the annotation lands on the pull request.
• properties.severity and the issue location carry the original values.

Failing the build

Without --sarif, the exit code is the gate. mcplint --tools tools.json exits 1 on any error-severity finding. Add --fail-on warning to fail on warnings too. The flag changes only the exit code; the report is the same either way.

$ mcplint --tools tools.json --client claude --fail-on warning --sarif mcplint.sariftools.json  errors:3  warnings:6  info:1  tools:3  tokens:~147ERROR  MCP-001  read file:name  Tool name "read file" is not valid for claude (use letters, digits, "_" and "-", 1-64 characters).ERROR  MCP-008  search_docs:inputSchema.required  "required" lists "page", which is not declared in "properties"; strict clients reject the tool.WARNING  MCP-022  read file:inputSchema.properties.path  Property "path" looks like a path sink but is an unconstrained string; validate it in the server (pattern, enum, or maxLength).wrote mcplint.sarif · exit 1