The mcp-linter utility has been released to address security and architectural issues in Model Context Protocol (MCP) servers. The tool is built using pure Node.js without external dependencies, ensuring a secure supply chain. It performs a non-destructive audit by running the server in an isolated process to check for compliance with 34 rules, including JSON-RPC framing and security annotations.
The linter evaluates servers on a health scale from 0 to 100, assigning grades from A+ to F. It supports SARIF v2.1.0 for GitHub Security integration and includes an auto-fix feature to generate JSON patches for missing schemas or incorrect annotations. The tool is available via npx, allowing developers to audit their servers locally or within CI/CD pipelines.
Benchmarking of official Anthropic reference servers revealed various issues. The server-everything package received a score of 90/100 (Grade B), while server-memory scored 66/100 (Grade C) due to missing instructions and parameter descriptions. The server-filesystem package scored 38/100 (Grade D) because of 18 parameters lacking descriptions, which can lead to model hallucinations.
The project is open-source under the MIT license. Future development plans include adding support for remote transports such as Server-Sent Events (SSE) and WebSockets, implementing context budget audits for token usage, and integrating LLM-based schema auto-correction.
