lintai docs

Appearance

Preset Reference

surface presetdirect activation168 direct rules

mcp

Rules for MCP, tool, and server JSON configs, including preview-only coverage.

Focus review on MCP configs, descriptors, and server registries.

Explicitly turns on this rule set.

Coverage

Covered Rules

SEC301MCP config: shell trampolineMCP configuration shells out through sh -c or bash -cthreat-reviewsecurityjson
SEC303MCP config: credential env passthroughMCP configuration passes through credential environment variablesgovernancehardeningjson
SEC305Config: hardcoded auth materialConfiguration embeds static authentication material in a connection or auth valuethreat-reviewsecurityjson
SEC306JSON config: hidden override instructionsJSON configuration description contains override-style hidden instructionsthreat-reviewauditjson
SEC307Config: sensitive env forwardingConfiguration forwards sensitive environment variable referencesgovernancehardeningjson
SEC308Config: suspicious remote endpointConfiguration points at a suspicious remote endpointpreviewauditjson
SEC309Config: literal secrets in configConfiguration commits literal secret material in env, auth, or header valuesthreat-reviewsecurityjson
SEC310Config: metadata or private-network hostConfiguration endpoint targets a metadata or private-network host literalthreat-reviewsecurityjson
SEC311Cursor plugin: unsafe path traversalCursor plugin manifest contains an unsafe absolute or parent-traversing pathcompatqualityjson
SEC314Tool descriptor: missing machine fieldsMCP-style tool descriptor is missing required machine fieldscompatqualitytool_json
SEC315Tool descriptors: duplicate tool namesMCP-style tool descriptor collection contains duplicate tool namescompatqualitytool_json
SEC316OpenAI strict schema: missing additionalProperties falseOpenAI strict tool schema omits recursive additionalProperties: falsecompatqualitytool_json
SEC317OpenAI strict schema: properties not all requiredOpenAI strict tool schema does not require every declared propertycompatqualitytool_json
SEC318Anthropic strict schema: missing additionalProperties falseAnthropic strict tool input schema omits additionalProperties: falsecompatqualitytool_json
SEC319server.json remotes: insecure or private URLserver.json remotes entry uses an insecure or non-public remote URLsupply-chainhardeningserver_json
SEC320server.json remotes: undefined template variableserver.json remotes URL references an undefined template variablecompatqualityserver_json
SEC321server.json remotes: literal auth headerserver.json remotes header commits literal authentication materialthreat-reviewsecurityserver_json
SEC322server.json remotes: undefined header variableserver.json remotes header value references an undefined template variablecompatqualityserver_json
SEC323server.json auth: missing explicit secret flagserver.json auth header carries material without an explicit secret flagcompatqualityserver_json
SEC329MCP config: dynamic package launchMCP config launches an external package dynamically at runtimerecommendedsecurityjson
SEC330MCP config: remote content piped to shellMCP configuration command downloads remote content and pipes it into a shellsupply-chainsecurityjson
SEC336MCP client config: broad envFileRepo-local MCP client config loads a broad dotenv-style envFilegovernancehardeningjson
SEC338MCP config: sensitive host bind mountMCP configuration launches Docker with a bind mount of sensitive host materialthreat-reviewsecurityjson
SEC339MCP config: privileged Docker flagsMCP configuration launches Docker with a host-escape or privileged runtime flagthreat-reviewsecurityjson
SEC344Plugin hook: remote content piped to shellPlugin hook command downloads remote content and pipes it into a shellsupply-chainsecurityjson
SEC394MCP config: wildcard auto-approveMCP configuration auto-approves all tools with `autoApprove: ["*"]`governancehardeningjson
SEC395MCP config: autoApproveTools trueMCP configuration auto-approves all tools with `autoApproveTools: true`governancehardeningjson
SEC396MCP config: trustTools trueMCP configuration fully trusts tools with `trustTools: true`governancehardeningjson
SEC397MCP config: sandbox disabledMCP configuration disables sandboxing with `sandbox: false` or `disableSandbox: true`governancehardeningjson
SEC398MCP config: wildcard capabilitiesMCP configuration grants all capabilities with `capabilities: ["*"]` or `capabilities: "*"`governancehardeningjson
SEC422MCP config: sudo commandMCP configuration launches the server through `sudo`threat-reviewsecurityjson
SEC446MCP config: sudo first argumentMCP configuration passes `sudo` as the first launch argumentthreat-reviewsecurityjson
SEC546MCP config: Bash(*) auto-approveMCP configuration auto-approves blanket shell execution with `autoApprove: ["Bash(*)"]`governancehardeningjson
SEC547MCP config: curl auto-approveMCP configuration auto-approves `Bash(curl:*)` through `autoApprove`governancehardeningjson
SEC548MCP config: wget auto-approveMCP configuration auto-approves `Bash(wget:*)` through `autoApprove`governancehardeningjson
SEC549MCP config: sudo auto-approveMCP configuration auto-approves `Bash(sudo:*)` through `autoApprove`governancehardeningjson
SEC550MCP config: rm auto-approveMCP configuration auto-approves `Bash(rm:*)` through `autoApprove`governancehardeningjson
SEC551MCP config: git push auto-approveMCP configuration auto-approves `Bash(git push)` through `autoApprove`governancehardeningjson
SEC552MCP config: gh api POST auto-approveMCP configuration auto-approves `Bash(gh api --method POST:*)` through `autoApprove`governancehardeningjson
SEC553MCP config: git checkout auto-approveMCP configuration auto-approves `Bash(git checkout:*)` through `autoApprove`governancehardeningjson
SEC554MCP config: git commit auto-approveMCP configuration auto-approves `Bash(git commit:*)` through `autoApprove`governancehardeningjson
SEC555MCP config: git reset auto-approveMCP configuration auto-approves `Bash(git reset:*)` through `autoApprove`governancehardeningjson
SEC556MCP config: git clean auto-approveMCP configuration auto-approves `Bash(git clean:*)` through `autoApprove`governancehardeningjson
SEC557MCP config: gh api DELETE auto-approveMCP configuration auto-approves `Bash(gh api --method DELETE:*)` through `autoApprove`governancehardeningjson
SEC558MCP config: gh api PATCH auto-approveMCP configuration auto-approves `Bash(gh api --method PATCH:*)` through `autoApprove`governancehardeningjson
SEC559MCP config: gh api PUT auto-approveMCP configuration auto-approves `Bash(gh api --method PUT:*)` through `autoApprove`governancehardeningjson
SEC560MCP config: gh issue create auto-approveMCP configuration auto-approves `Bash(gh issue create:*)` through `autoApprove`governancehardeningjson
SEC561MCP config: gh repo create auto-approveMCP configuration auto-approves `Bash(gh repo create:*)` through `autoApprove`governancehardeningjson
SEC562MCP config: gh repo delete auto-approveMCP configuration auto-approves `Bash(gh repo delete:*)` through `autoApprove`governancehardeningjson
SEC563MCP config: gh repo edit auto-approveMCP configuration auto-approves `Bash(gh repo edit:*)` through `autoApprove`governancehardeningjson
SEC564MCP config: gh secret set auto-approveMCP configuration auto-approves `Bash(gh secret set:*)` through `autoApprove`governancehardeningjson
SEC565MCP config: gh variable set auto-approveMCP configuration auto-approves `Bash(gh variable set:*)` through `autoApprove`governancehardeningjson
SEC566MCP config: gh workflow run auto-approveMCP configuration auto-approves `Bash(gh workflow run:*)` through `autoApprove`governancehardeningjson
SEC567MCP config: Read wildcard auto-approveMCP configuration auto-approves `Read(*)` through `autoApprove`governancehardeningjson
SEC568MCP config: Write wildcard auto-approveMCP configuration auto-approves `Write(*)` through `autoApprove`governancehardeningjson
SEC569MCP config: Edit wildcard auto-approveMCP configuration auto-approves `Edit(*)` through `autoApprove`governancehardeningjson
SEC570MCP config: Glob wildcard auto-approveMCP configuration auto-approves `Glob(*)` through `autoApprove`governancehardeningjson
SEC571MCP config: Grep wildcard auto-approveMCP configuration auto-approves `Grep(*)` through `autoApprove`governancehardeningjson
SEC572MCP config: WebFetch wildcard auto-approveMCP configuration auto-approves `WebFetch(*)` through `autoApprove`governancehardeningjson
SEC573MCP config: WebSearch wildcard auto-approveMCP configuration auto-approves `WebSearch(*)` through `autoApprove`governancehardeningjson
SEC574MCP config: Read unsafe path auto-approveMCP configuration auto-approves `Read(...)` over an unsafe path through `autoApprove`governancehardeningjson
SEC575MCP config: Write unsafe path auto-approveMCP configuration auto-approves `Write(...)` over an unsafe path through `autoApprove`governancehardeningjson
SEC576MCP config: Edit unsafe path auto-approveMCP configuration auto-approves `Edit(...)` over an unsafe path through `autoApprove`governancehardeningjson
SEC577MCP config: Glob unsafe path auto-approveMCP configuration auto-approves `Glob(...)` over an unsafe path through `autoApprove`governancehardeningjson
SEC578MCP config: Grep unsafe path auto-approveMCP configuration auto-approves `Grep(...)` over an unsafe path through `autoApprove`governancehardeningjson
SEC579MCP config: gh secret delete auto-approveMCP configuration auto-approves `Bash(gh secret delete:*)` through `autoApprove`governancehardeningjson
SEC580MCP config: gh variable delete auto-approveMCP configuration auto-approves `Bash(gh variable delete:*)` through `autoApprove`governancehardeningjson
SEC581MCP config: gh workflow disable auto-approveMCP configuration auto-approves `Bash(gh workflow disable:*)` through `autoApprove`governancehardeningjson
SEC582MCP config: gh repo transfer auto-approveMCP configuration auto-approves `Bash(gh repo transfer:*)` through `autoApprove`governancehardeningjson
SEC583MCP config: gh release create auto-approveMCP configuration auto-approves `Bash(gh release create:*)` through `autoApprove`governancehardeningjson
SEC584MCP config: gh release delete auto-approveMCP configuration auto-approves `Bash(gh release delete:*)` through `autoApprove`governancehardeningjson
SEC585MCP config: gh release upload auto-approveMCP configuration auto-approves `Bash(gh release upload:*)` through `autoApprove`governancehardeningjson
SEC586MCP config: npx auto-approveMCP configuration auto-approves `Bash(npx ...)` through `autoApprove`governancehardeningjson
SEC587MCP config: uvx auto-approveMCP configuration auto-approves `Bash(uvx ...)` through `autoApprove`governancehardeningjson
SEC588MCP config: npm exec auto-approveMCP configuration auto-approves `Bash(npm exec ...)` through `autoApprove`governancehardeningjson
SEC589MCP config: bunx auto-approveMCP configuration auto-approves `Bash(bunx ...)` through `autoApprove`governancehardeningjson
SEC590MCP config: pnpm dlx auto-approveMCP configuration auto-approves `Bash(pnpm dlx ...)` through `autoApprove`governancehardeningjson
SEC591MCP config: yarn dlx auto-approveMCP configuration auto-approves `Bash(yarn dlx ...)` through `autoApprove`governancehardeningjson
SEC592MCP config: pipx run auto-approveMCP configuration auto-approves `Bash(pipx run ...)` through `autoApprove`governancehardeningjson
SEC593MCP config: package install auto-approveMCP configuration auto-approves package installation commands through `autoApprove`governancehardeningjson
SEC594MCP config: git clone auto-approveMCP configuration auto-approves `Bash(git clone:*)` through `autoApprove`governancehardeningjson
SEC595MCP config: git fetch auto-approveMCP configuration auto-approves `Bash(git fetch:*)` through `autoApprove`governancehardeningjson
SEC596MCP config: git ls-remote auto-approveMCP configuration auto-approves `Bash(git ls-remote:*)` through `autoApprove`governancehardeningjson
SEC597MCP config: git add auto-approveMCP configuration auto-approves `Bash(git add:*)` through `autoApprove`governancehardeningjson
SEC598MCP config: git config auto-approveMCP configuration auto-approves `Bash(git config:*)` through `autoApprove`governancehardeningjson
SEC599MCP config: git tag auto-approveMCP configuration auto-approves `Bash(git tag:*)` through `autoApprove`governancehardeningjson
SEC600MCP config: git branch auto-approveMCP configuration auto-approves `Bash(git branch:*)` through `autoApprove`governancehardeningjson
SEC601MCP config: gh pr auto-approveMCP configuration auto-approves `Bash(gh pr:*)` through `autoApprove`governancehardeningjson
SEC602MCP config: git stash auto-approveMCP configuration auto-approves `Bash(git stash:*)` through `autoApprove`governancehardeningjson
SEC603MCP config: git restore auto-approveMCP configuration auto-approves `Bash(git restore:*)` through `autoApprove`governancehardeningjson
SEC604MCP config: git rebase auto-approveMCP configuration auto-approves `Bash(git rebase:*)` through `autoApprove`governancehardeningjson
SEC605MCP config: git merge auto-approveMCP configuration auto-approves `Bash(git merge:*)` through `autoApprove`governancehardeningjson
SEC606MCP config: git cherry-pick auto-approveMCP configuration auto-approves `Bash(git cherry-pick:*)` through `autoApprove`governancehardeningjson
SEC607MCP config: git apply auto-approveMCP configuration auto-approves `Bash(git apply:*)` through `autoApprove`governancehardeningjson
SEC608MCP config: git am auto-approveMCP configuration auto-approves `Bash(git am:*)` through `autoApprove`governancehardeningjson
SEC609MCP config: crontab auto-approveMCP configuration auto-approves `Bash(crontab:*)` through `autoApprove`governancehardeningjson
SEC610MCP config: systemctl enable auto-approveMCP configuration auto-approves `Bash(systemctl enable:*)` through `autoApprove`governancehardeningjson
SEC611MCP config: launchctl load auto-approveMCP configuration auto-approves `Bash(launchctl load:*)` through `autoApprove`governancehardeningjson
SEC612MCP config: launchctl bootstrap auto-approveMCP configuration auto-approves `Bash(launchctl bootstrap:*)` through `autoApprove`governancehardeningjson
SEC613MCP config: chmod auto-approveMCP configuration auto-approves `Bash(chmod:*)` through `autoApprove`governancehardeningjson
SEC614MCP config: chown auto-approveMCP configuration auto-approves `Bash(chown:*)` through `autoApprove`governancehardeningjson
SEC615MCP config: chgrp auto-approveMCP configuration auto-approves `Bash(chgrp:*)` through `autoApprove`governancehardeningjson
SEC616MCP config: su auto-approveMCP configuration auto-approves `Bash(su:*)` through `autoApprove`governancehardeningjson
SEC617MCP config: raw.githubusercontent.com WebFetch auto-approveMCP configuration auto-approves `WebFetch(domain:raw.githubusercontent.com)` through `autoApprove`governancehardeningjson
SEC618MCP config: bare Read auto-approveMCP configuration auto-approves bare `Read` through `autoApprove`governancehardeningjson
SEC619MCP config: bare Write auto-approveMCP configuration auto-approves bare `Write` through `autoApprove`governancehardeningjson
SEC620MCP config: bare Edit auto-approveMCP configuration auto-approves bare `Edit` through `autoApprove`governancehardeningjson
SEC621MCP config: bare Glob auto-approveMCP configuration auto-approves bare `Glob` through `autoApprove`governancehardeningjson
SEC622MCP config: bare Grep auto-approveMCP configuration auto-approves bare `Grep` through `autoApprove`governancehardeningjson
SEC623MCP config: bare WebFetch auto-approveMCP configuration auto-approves bare `WebFetch` through `autoApprove`governancehardeningjson
SEC624MCP config: bare WebSearch auto-approveMCP configuration auto-approves bare `WebSearch` through `autoApprove`governancehardeningjson
SEC625MCP config: bare Bash auto-approveMCP configuration auto-approves bare `Bash` through `autoApprove`governancehardeningjson
SEC637MCP config: destructive root deletionMCP configuration command attempts destructive root deletionthreat-reviewsecurityjson
SEC638MCP config: password file accessMCP configuration command accesses a sensitive system password filethreat-reviewsecurityjson
SEC639MCP config: shell profile writeMCP configuration command writes to a shell profile startup filethreat-reviewsecurityjson
SEC640MCP config: authorized_keys writeMCP configuration command writes to SSH authorized_keysthreat-reviewsecurityjson
SEC645Plugin hook: destructive root deletionPlugin hook command attempts destructive root deletionthreat-reviewsecurityjson
SEC646Plugin hook: password file accessPlugin hook command accesses a sensitive system password filethreat-reviewsecurityjson
SEC647Plugin hook: shell profile writePlugin hook command writes to a shell profile startup filethreat-reviewsecurityjson
SEC648Plugin hook: authorized_keys writePlugin hook command writes to SSH authorized_keysthreat-reviewsecurityjson
SEC652MCP config: cron persistenceMCP configuration command manipulates cron persistencethreat-reviewsecurityjson
SEC653MCP config: systemd persistenceMCP configuration command registers a systemd service or unit for persistencethreat-reviewsecurityjson
SEC654MCP config: launchd persistenceMCP configuration command registers a launchd plist for persistencethreat-reviewsecurityjson
SEC658Plugin hook: cron persistencePlugin hook command manipulates cron persistencethreat-reviewsecurityjson
SEC659Plugin hook: systemd persistencePlugin hook command registers a systemd service or unit for persistencethreat-reviewsecurityjson
SEC660Plugin hook: launchd persistencePlugin hook command registers a launchd plist for persistencethreat-reviewsecurityjson
SEC664MCP config: insecure chmodMCP configuration command performs an insecure permission changethreat-reviewsecurityjson
SEC665MCP config: setuid or setgid manipulationMCP configuration command manipulates setuid or setgid permissionsthreat-reviewsecurityjson
SEC666MCP config: Linux capability manipulationMCP configuration command manipulates Linux capabilitiesthreat-reviewsecurityjson
SEC670Plugin hook: insecure chmodPlugin hook command performs an insecure permission changethreat-reviewsecurityjson
SEC671Plugin hook: setuid or setgid manipulationPlugin hook command manipulates setuid or setgid permissionsthreat-reviewsecurityjson
SEC672Plugin hook: Linux capability manipulationPlugin hook command manipulates Linux capabilitiesthreat-reviewsecurityjson
SEC674MCP config: secret exfiltrationMCP configuration command appears to send secret material over the networkthreat-reviewsecurityjson
SEC675MCP config: insecure HTTP secret sendMCP configuration command sends secret material to an insecure http:// endpointthreat-reviewsecurityjson
SEC676MCP config: webhook secret exfiltrationMCP configuration command posts secret material to a webhook endpointthreat-reviewsecurityjson
SEC680Plugin hook: secret exfiltrationPlugin hook command appears to send secret material over the networkthreat-reviewsecurityjson
SEC681Plugin hook: insecure HTTP secret sendPlugin hook command sends secret material to an insecure http:// endpointthreat-reviewsecurityjson
SEC682Plugin hook: webhook secret exfiltrationPlugin hook command posts secret material to a webhook endpointthreat-reviewsecurityjson
SEC684MCP config: sensitive file exfiltrationMCP configuration command transfers a sensitive credential file to a remote destinationthreat-reviewsecurityjson
SEC686Plugin hook: sensitive file exfiltrationPlugin hook command transfers a sensitive credential file to a remote destinationthreat-reviewsecurityjson
SEC689MCP config: clipboard readMCP configuration command reads local clipboard contentsthreat-reviewsecurityjson
SEC690MCP config: browser credential store accessMCP configuration command accesses browser credential or cookie storesthreat-reviewsecurityjson
SEC693Plugin hook: clipboard readPlugin hook command reads local clipboard contentsthreat-reviewsecurityjson
SEC694Plugin hook: browser credential store accessPlugin hook command accesses browser credential or cookie storesthreat-reviewsecurityjson
SEC697MCP config: clipboard exfiltrationMCP configuration command exfiltrates clipboard contents over the networkthreat-reviewsecurityjson
SEC698MCP config: browser credential store exfiltrationMCP configuration command exfiltrates browser credential or cookie store datathreat-reviewsecurityjson
SEC701Plugin hook: clipboard exfiltrationPlugin hook command exfiltrates clipboard contents over the networkthreat-reviewsecurityjson
SEC702Plugin hook: browser credential store exfiltrationPlugin hook command exfiltrates browser credential or cookie store datathreat-reviewsecurityjson
SEC705MCP config: screen captureMCP configuration command captures a screenshot or desktop imagethreat-reviewsecurityjson
SEC706MCP config: screen capture exfiltrationMCP configuration command captures and exfiltrates a screenshot or desktop imagethreat-reviewsecurityjson
SEC709Plugin hook: screen capturePlugin hook command captures a screenshot or desktop imagethreat-reviewsecurityjson
SEC710Plugin hook: screen capture exfiltrationPlugin hook command captures and exfiltrates a screenshot or desktop imagethreat-reviewsecurityjson
SEC715MCP config: camera captureMCP configuration command captures a webcam or camera imagethreat-reviewsecurityjson
SEC716MCP config: microphone captureMCP configuration command captures microphone audiothreat-reviewsecurityjson
SEC717MCP config: camera capture exfiltrationMCP configuration command captures and exfiltrates webcam or camera datathreat-reviewsecurityjson
SEC718MCP config: microphone capture exfiltrationMCP configuration command captures and exfiltrates microphone audiothreat-reviewsecurityjson
SEC723Plugin hook: camera capturePlugin hook command captures a webcam or camera imagethreat-reviewsecurityjson
SEC724Plugin hook: microphone capturePlugin hook command captures microphone audiothreat-reviewsecurityjson
SEC725Plugin hook: camera capture exfiltrationPlugin hook command captures and exfiltrates webcam or camera datathreat-reviewsecurityjson
SEC726Plugin hook: microphone capture exfiltrationPlugin hook command captures and exfiltrates microphone audiothreat-reviewsecurityjson
SEC729MCP config: keylogger captureMCP configuration command captures keystrokes or keyboard inputthreat-reviewsecurityjson
SEC730MCP config: keylogger exfiltrationMCP configuration command captures and exfiltrates keystrokes or keyboard inputthreat-reviewsecurityjson
SEC733Plugin hook: keylogger capturePlugin hook command captures keystrokes or keyboard inputthreat-reviewsecurityjson
SEC734Plugin hook: keylogger exfiltrationPlugin hook command captures and exfiltrates keystrokes or keyboard inputthreat-reviewsecurityjson
SEC737MCP config: environment dumpMCP configuration command dumps environment variables or shell statethreat-reviewsecurityjson
SEC738MCP config: environment dump exfiltrationMCP configuration command dumps and exfiltrates environment variables or shell statethreat-reviewsecurityjson
SEC741Plugin hook: environment dumpPlugin hook command dumps environment variables or shell statethreat-reviewsecurityjson
SEC742Plugin hook: environment dump exfiltrationPlugin hook command dumps and exfiltrates environment variables or shell statethreat-reviewsecurityjson

What This Preset Enables ​

The mcp preset scopes coverage to JSON, tool descriptor, and server registry surfaces.

When To Use It ​

Use it when MCP configs and tool/server descriptors are your main attack surface.

Tradeoffs ​

This preset is precise for config-heavy repos, but it does not cover markdown-only instruction risks.