lintai docs

Appearance

Preset Reference

membership175 direct rules

mcp

Rules for MCP, tool, and server JSON configs, including preview-only coverage.

Membership preset: directly activates this rule set.

Coverage

Covered Rules

SEC301MCP config: shell trampolineMCP configuration shells out through sh -c or bash -cstablejson
SEC302Config: insecure HTTP endpointConfiguration contains an insecure http:// endpointstablejson
SEC303MCP config: credential env passthroughMCP configuration passes through credential environment variablesstablejson
SEC304Config: TLS verification disabledConfiguration disables TLS or certificate verificationstablejson
SEC305Config: hardcoded auth materialConfiguration embeds static authentication material in a connection or auth valuestablejson
SEC306JSON config: hidden override instructionsJSON configuration description contains override-style hidden instructionspreviewjson
SEC307Config: sensitive env forwardingConfiguration forwards sensitive environment variable referencespreviewjson
SEC308Config: suspicious remote endpointConfiguration points at a suspicious remote endpointpreviewjson
SEC309Config: literal secrets in configConfiguration commits literal secret material in env, auth, or header valuesstablejson
SEC310Config: metadata or private-network hostConfiguration endpoint targets a metadata or private-network host literalstablejson
SEC311Cursor plugin: unsafe path traversalCursor plugin manifest contains an unsafe absolute or parent-traversing pathstablejson
SEC314Tool descriptor: missing machine fieldsMCP-style tool descriptor is missing required machine fieldsstabletool_json
SEC315Tool descriptors: duplicate tool namesMCP-style tool descriptor collection contains duplicate tool namesstabletool_json
SEC316OpenAI strict schema: missing additionalProperties falseOpenAI strict tool schema omits recursive additionalProperties: falsestabletool_json
SEC317OpenAI strict schema: properties not all requiredOpenAI strict tool schema does not require every declared propertystabletool_json
SEC318Anthropic strict schema: missing additionalProperties falseAnthropic strict tool input schema omits additionalProperties: falsestabletool_json
SEC319server.json remotes: insecure or private URLserver.json remotes entry uses an insecure or non-public remote URLstableserver_json
SEC320server.json remotes: undefined template variableserver.json remotes URL references an undefined template variablestableserver_json
SEC321server.json remotes: literal auth headerserver.json remotes header commits literal authentication materialstableserver_json
SEC322server.json remotes: undefined header variableserver.json remotes header value references an undefined template variablestableserver_json
SEC323server.json auth: missing explicit secret flagserver.json auth header carries material without an explicit secret flagpreviewserver_json
SEC329MCP config: mutable package runnerMCP configuration launches tooling through a mutable package runnerstablejson
SEC330MCP config: remote content piped to shellMCP configuration command downloads remote content and pipes it into a shellstablejson
SEC331MCP config: TLS verification disabledMCP configuration command disables TLS verification in a network-capable execution pathstablejson
SEC336MCP client config: broad envFileRepo-local MCP client config loads a broad dotenv-style envFilepreviewjson
SEC337MCP config: Docker image not digest-pinnedMCP configuration launches Docker with an image reference that is not digest-pinnedstablejson
SEC338MCP config: sensitive host bind mountMCP configuration launches Docker with a bind mount of sensitive host materialstablejson
SEC339MCP config: privileged Docker flagsMCP configuration launches Docker with a host-escape or privileged runtime flagstablejson
SEC343Plugin hook: mutable package launcherPlugin hook command uses a mutable package launcherstablejson
SEC344Plugin hook: remote content piped to shellPlugin hook command downloads remote content and pipes it into a shellstablejson
SEC345Plugin hook: TLS verification disabledPlugin hook command disables TLS verification in a network-capable execution pathstablejson
SEC346MCP config: mutable registry refreshMCP configuration forces Docker to refresh from a mutable registry sourcestablejson
SEC394MCP config: wildcard auto-approveMCP configuration auto-approves all tools with `autoApprove: ["*"]`stablejson
SEC395MCP config: autoApproveTools trueMCP configuration auto-approves all tools with `autoApproveTools: true`stablejson
SEC396MCP config: trustTools trueMCP configuration fully trusts tools with `trustTools: true`stablejson
SEC397MCP config: sandbox disabledMCP configuration disables sandboxing with `sandbox: false` or `disableSandbox: true`stablejson
SEC398MCP config: wildcard capabilitiesMCP configuration grants all capabilities with `capabilities: ["*"]` or `capabilities: "*"`stablejson
SEC422MCP config: sudo commandMCP configuration launches the server through `sudo`stablejson
SEC446MCP config: sudo first argumentMCP configuration passes `sudo` as the first launch argumentstablejson
SEC546MCP config: Bash(*) auto-approveMCP configuration auto-approves blanket shell execution with `autoApprove: ["Bash(*)"]`stablejson
SEC547MCP config: curl auto-approveMCP configuration auto-approves `Bash(curl:*)` through `autoApprove`stablejson
SEC548MCP config: wget auto-approveMCP configuration auto-approves `Bash(wget:*)` through `autoApprove`stablejson
SEC549MCP config: sudo auto-approveMCP configuration auto-approves `Bash(sudo:*)` through `autoApprove`stablejson
SEC550MCP config: rm auto-approveMCP configuration auto-approves `Bash(rm:*)` through `autoApprove`stablejson
SEC551MCP config: git push auto-approveMCP configuration auto-approves `Bash(git push)` through `autoApprove`stablejson
SEC552MCP config: gh api POST auto-approveMCP configuration auto-approves `Bash(gh api --method POST:*)` through `autoApprove`stablejson
SEC553MCP config: git checkout auto-approveMCP configuration auto-approves `Bash(git checkout:*)` through `autoApprove`stablejson
SEC554MCP config: git commit auto-approveMCP configuration auto-approves `Bash(git commit:*)` through `autoApprove`stablejson
SEC555MCP config: git reset auto-approveMCP configuration auto-approves `Bash(git reset:*)` through `autoApprove`stablejson
SEC556MCP config: git clean auto-approveMCP configuration auto-approves `Bash(git clean:*)` through `autoApprove`stablejson
SEC557MCP config: gh api DELETE auto-approveMCP configuration auto-approves `Bash(gh api --method DELETE:*)` through `autoApprove`stablejson
SEC558MCP config: gh api PATCH auto-approveMCP configuration auto-approves `Bash(gh api --method PATCH:*)` through `autoApprove`stablejson
SEC559MCP config: gh api PUT auto-approveMCP configuration auto-approves `Bash(gh api --method PUT:*)` through `autoApprove`stablejson
SEC560MCP config: gh issue create auto-approveMCP configuration auto-approves `Bash(gh issue create:*)` through `autoApprove`stablejson
SEC561MCP config: gh repo create auto-approveMCP configuration auto-approves `Bash(gh repo create:*)` through `autoApprove`stablejson
SEC562MCP config: gh repo delete auto-approveMCP configuration auto-approves `Bash(gh repo delete:*)` through `autoApprove`stablejson
SEC563MCP config: gh repo edit auto-approveMCP configuration auto-approves `Bash(gh repo edit:*)` through `autoApprove`stablejson
SEC564MCP config: gh secret set auto-approveMCP configuration auto-approves `Bash(gh secret set:*)` through `autoApprove`stablejson
SEC565MCP config: gh variable set auto-approveMCP configuration auto-approves `Bash(gh variable set:*)` through `autoApprove`stablejson
SEC566MCP config: gh workflow run auto-approveMCP configuration auto-approves `Bash(gh workflow run:*)` through `autoApprove`stablejson
SEC567MCP config: Read wildcard auto-approveMCP configuration auto-approves `Read(*)` through `autoApprove`stablejson
SEC568MCP config: Write wildcard auto-approveMCP configuration auto-approves `Write(*)` through `autoApprove`stablejson
SEC569MCP config: Edit wildcard auto-approveMCP configuration auto-approves `Edit(*)` through `autoApprove`stablejson
SEC570MCP config: Glob wildcard auto-approveMCP configuration auto-approves `Glob(*)` through `autoApprove`stablejson
SEC571MCP config: Grep wildcard auto-approveMCP configuration auto-approves `Grep(*)` through `autoApprove`stablejson
SEC572MCP config: WebFetch wildcard auto-approveMCP configuration auto-approves `WebFetch(*)` through `autoApprove`stablejson
SEC573MCP config: WebSearch wildcard auto-approveMCP configuration auto-approves `WebSearch(*)` through `autoApprove`stablejson
SEC574MCP config: Read unsafe path auto-approveMCP configuration auto-approves `Read(...)` over an unsafe path through `autoApprove`stablejson
SEC575MCP config: Write unsafe path auto-approveMCP configuration auto-approves `Write(...)` over an unsafe path through `autoApprove`stablejson
SEC576MCP config: Edit unsafe path auto-approveMCP configuration auto-approves `Edit(...)` over an unsafe path through `autoApprove`stablejson
SEC577MCP config: Glob unsafe path auto-approveMCP configuration auto-approves `Glob(...)` over an unsafe path through `autoApprove`stablejson
SEC578MCP config: Grep unsafe path auto-approveMCP configuration auto-approves `Grep(...)` over an unsafe path through `autoApprove`stablejson
SEC579MCP config: gh secret delete auto-approveMCP configuration auto-approves `Bash(gh secret delete:*)` through `autoApprove`stablejson
SEC580MCP config: gh variable delete auto-approveMCP configuration auto-approves `Bash(gh variable delete:*)` through `autoApprove`stablejson
SEC581MCP config: gh workflow disable auto-approveMCP configuration auto-approves `Bash(gh workflow disable:*)` through `autoApprove`stablejson
SEC582MCP config: gh repo transfer auto-approveMCP configuration auto-approves `Bash(gh repo transfer:*)` through `autoApprove`stablejson
SEC583MCP config: gh release create auto-approveMCP configuration auto-approves `Bash(gh release create:*)` through `autoApprove`stablejson
SEC584MCP config: gh release delete auto-approveMCP configuration auto-approves `Bash(gh release delete:*)` through `autoApprove`stablejson
SEC585MCP config: gh release upload auto-approveMCP configuration auto-approves `Bash(gh release upload:*)` through `autoApprove`stablejson
SEC586MCP config: npx auto-approveMCP configuration auto-approves `Bash(npx ...)` through `autoApprove`stablejson
SEC587MCP config: uvx auto-approveMCP configuration auto-approves `Bash(uvx ...)` through `autoApprove`stablejson
SEC588MCP config: npm exec auto-approveMCP configuration auto-approves `Bash(npm exec ...)` through `autoApprove`stablejson
SEC589MCP config: bunx auto-approveMCP configuration auto-approves `Bash(bunx ...)` through `autoApprove`stablejson
SEC590MCP config: pnpm dlx auto-approveMCP configuration auto-approves `Bash(pnpm dlx ...)` through `autoApprove`stablejson
SEC591MCP config: yarn dlx auto-approveMCP configuration auto-approves `Bash(yarn dlx ...)` through `autoApprove`stablejson
SEC592MCP config: pipx run auto-approveMCP configuration auto-approves `Bash(pipx run ...)` through `autoApprove`stablejson
SEC593MCP config: package install auto-approveMCP configuration auto-approves package installation commands through `autoApprove`stablejson
SEC594MCP config: git clone auto-approveMCP configuration auto-approves `Bash(git clone:*)` through `autoApprove`stablejson
SEC595MCP config: git fetch auto-approveMCP configuration auto-approves `Bash(git fetch:*)` through `autoApprove`stablejson
SEC596MCP config: git ls-remote auto-approveMCP configuration auto-approves `Bash(git ls-remote:*)` through `autoApprove`stablejson
SEC597MCP config: git add auto-approveMCP configuration auto-approves `Bash(git add:*)` through `autoApprove`stablejson
SEC598MCP config: git config auto-approveMCP configuration auto-approves `Bash(git config:*)` through `autoApprove`stablejson
SEC599MCP config: git tag auto-approveMCP configuration auto-approves `Bash(git tag:*)` through `autoApprove`stablejson
SEC600MCP config: git branch auto-approveMCP configuration auto-approves `Bash(git branch:*)` through `autoApprove`stablejson
SEC601MCP config: gh pr auto-approveMCP configuration auto-approves `Bash(gh pr:*)` through `autoApprove`stablejson
SEC602MCP config: git stash auto-approveMCP configuration auto-approves `Bash(git stash:*)` through `autoApprove`stablejson
SEC603MCP config: git restore auto-approveMCP configuration auto-approves `Bash(git restore:*)` through `autoApprove`stablejson
SEC604MCP config: git rebase auto-approveMCP configuration auto-approves `Bash(git rebase:*)` through `autoApprove`stablejson
SEC605MCP config: git merge auto-approveMCP configuration auto-approves `Bash(git merge:*)` through `autoApprove`stablejson
SEC606MCP config: git cherry-pick auto-approveMCP configuration auto-approves `Bash(git cherry-pick:*)` through `autoApprove`stablejson
SEC607MCP config: git apply auto-approveMCP configuration auto-approves `Bash(git apply:*)` through `autoApprove`stablejson
SEC608MCP config: git am auto-approveMCP configuration auto-approves `Bash(git am:*)` through `autoApprove`stablejson
SEC609MCP config: crontab auto-approveMCP configuration auto-approves `Bash(crontab:*)` through `autoApprove`stablejson
SEC610MCP config: systemctl enable auto-approveMCP configuration auto-approves `Bash(systemctl enable:*)` through `autoApprove`stablejson
SEC611MCP config: launchctl load auto-approveMCP configuration auto-approves `Bash(launchctl load:*)` through `autoApprove`stablejson
SEC612MCP config: launchctl bootstrap auto-approveMCP configuration auto-approves `Bash(launchctl bootstrap:*)` through `autoApprove`stablejson
SEC613MCP config: chmod auto-approveMCP configuration auto-approves `Bash(chmod:*)` through `autoApprove`stablejson
SEC614MCP config: chown auto-approveMCP configuration auto-approves `Bash(chown:*)` through `autoApprove`stablejson
SEC615MCP config: chgrp auto-approveMCP configuration auto-approves `Bash(chgrp:*)` through `autoApprove`stablejson
SEC616MCP config: su auto-approveMCP configuration auto-approves `Bash(su:*)` through `autoApprove`stablejson
SEC617MCP config: raw.githubusercontent.com WebFetch auto-approveMCP configuration auto-approves `WebFetch(domain:raw.githubusercontent.com)` through `autoApprove`stablejson
SEC618MCP config: bare Read auto-approveMCP configuration auto-approves bare `Read` through `autoApprove`stablejson
SEC619MCP config: bare Write auto-approveMCP configuration auto-approves bare `Write` through `autoApprove`stablejson
SEC620MCP config: bare Edit auto-approveMCP configuration auto-approves bare `Edit` through `autoApprove`stablejson
SEC621MCP config: bare Glob auto-approveMCP configuration auto-approves bare `Glob` through `autoApprove`stablejson
SEC622MCP config: bare Grep auto-approveMCP configuration auto-approves bare `Grep` through `autoApprove`stablejson
SEC623MCP config: bare WebFetch auto-approveMCP configuration auto-approves bare `WebFetch` through `autoApprove`stablejson
SEC624MCP config: bare WebSearch auto-approveMCP configuration auto-approves bare `WebSearch` through `autoApprove`stablejson
SEC625MCP config: bare Bash auto-approveMCP configuration auto-approves bare `Bash` through `autoApprove`stablejson
SEC637MCP config: destructive root deletionMCP configuration command attempts destructive root deletionstablejson
SEC638MCP config: password file accessMCP configuration command accesses a sensitive system password filestablejson
SEC639MCP config: shell profile writeMCP configuration command writes to a shell profile startup filestablejson
SEC640MCP config: authorized_keys writeMCP configuration command writes to SSH authorized_keysstablejson
SEC645Plugin hook: destructive root deletionPlugin hook command attempts destructive root deletionstablejson
SEC646Plugin hook: password file accessPlugin hook command accesses a sensitive system password filestablejson
SEC647Plugin hook: shell profile writePlugin hook command writes to a shell profile startup filestablejson
SEC648Plugin hook: authorized_keys writePlugin hook command writes to SSH authorized_keysstablejson
SEC652MCP config: cron persistenceMCP configuration command manipulates cron persistencestablejson
SEC653MCP config: systemd persistenceMCP configuration command registers a systemd service or unit for persistencestablejson
SEC654MCP config: launchd persistenceMCP configuration command registers a launchd plist for persistencestablejson
SEC658Plugin hook: cron persistencePlugin hook command manipulates cron persistencestablejson
SEC659Plugin hook: systemd persistencePlugin hook command registers a systemd service or unit for persistencestablejson
SEC660Plugin hook: launchd persistencePlugin hook command registers a launchd plist for persistencestablejson
SEC664MCP config: insecure chmodMCP configuration command performs an insecure permission changestablejson
SEC665MCP config: setuid or setgid manipulationMCP configuration command manipulates setuid or setgid permissionsstablejson
SEC666MCP config: Linux capability manipulationMCP configuration command manipulates Linux capabilitiesstablejson
SEC670Plugin hook: insecure chmodPlugin hook command performs an insecure permission changestablejson
SEC671Plugin hook: setuid or setgid manipulationPlugin hook command manipulates setuid or setgid permissionsstablejson
SEC672Plugin hook: Linux capability manipulationPlugin hook command manipulates Linux capabilitiesstablejson
SEC674MCP config: secret exfiltrationMCP configuration command appears to send secret material over the networkstablejson
SEC675MCP config: insecure HTTP secret sendMCP configuration command sends secret material to an insecure http:// endpointstablejson
SEC676MCP config: webhook secret exfiltrationMCP configuration command posts secret material to a webhook endpointstablejson
SEC680Plugin hook: secret exfiltrationPlugin hook command appears to send secret material over the networkstablejson
SEC681Plugin hook: insecure HTTP secret sendPlugin hook command sends secret material to an insecure http:// endpointstablejson
SEC682Plugin hook: webhook secret exfiltrationPlugin hook command posts secret material to a webhook endpointstablejson
SEC684MCP config: sensitive file exfiltrationMCP configuration command transfers a sensitive credential file to a remote destinationstablejson
SEC686Plugin hook: sensitive file exfiltrationPlugin hook command transfers a sensitive credential file to a remote destinationstablejson
SEC689MCP config: clipboard readMCP configuration command reads local clipboard contentsstablejson
SEC690MCP config: browser credential store accessMCP configuration command accesses browser credential or cookie storesstablejson
SEC693Plugin hook: clipboard readPlugin hook command reads local clipboard contentsstablejson
SEC694Plugin hook: browser credential store accessPlugin hook command accesses browser credential or cookie storesstablejson
SEC697MCP config: clipboard exfiltrationMCP configuration command exfiltrates clipboard contents over the networkstablejson
SEC698MCP config: browser credential store exfiltrationMCP configuration command exfiltrates browser credential or cookie store datastablejson
SEC701Plugin hook: clipboard exfiltrationPlugin hook command exfiltrates clipboard contents over the networkstablejson
SEC702Plugin hook: browser credential store exfiltrationPlugin hook command exfiltrates browser credential or cookie store datastablejson
SEC705MCP config: screen captureMCP configuration command captures a screenshot or desktop imagestablejson
SEC706MCP config: screen capture exfiltrationMCP configuration command captures and exfiltrates a screenshot or desktop imagestablejson
SEC709Plugin hook: screen capturePlugin hook command captures a screenshot or desktop imagestablejson
SEC710Plugin hook: screen capture exfiltrationPlugin hook command captures and exfiltrates a screenshot or desktop imagestablejson
SEC715MCP config: camera captureMCP configuration command captures a webcam or camera imagestablejson
SEC716MCP config: microphone captureMCP configuration command captures microphone audiostablejson
SEC717MCP config: camera capture exfiltrationMCP configuration command captures and exfiltrates webcam or camera datastablejson
SEC718MCP config: microphone capture exfiltrationMCP configuration command captures and exfiltrates microphone audiostablejson
SEC723Plugin hook: camera capturePlugin hook command captures a webcam or camera imagestablejson
SEC724Plugin hook: microphone capturePlugin hook command captures microphone audiostablejson
SEC725Plugin hook: camera capture exfiltrationPlugin hook command captures and exfiltrates webcam or camera datastablejson
SEC726Plugin hook: microphone capture exfiltrationPlugin hook command captures and exfiltrates microphone audiostablejson
SEC729MCP config: keylogger captureMCP configuration command captures keystrokes or keyboard inputstablejson
SEC730MCP config: keylogger exfiltrationMCP configuration command captures and exfiltrates keystrokes or keyboard inputstablejson
SEC733Plugin hook: keylogger capturePlugin hook command captures keystrokes or keyboard inputstablejson
SEC734Plugin hook: keylogger exfiltrationPlugin hook command captures and exfiltrates keystrokes or keyboard inputstablejson
SEC737MCP config: environment dumpMCP configuration command dumps environment variables or shell statestablejson
SEC738MCP config: environment dump exfiltrationMCP configuration command dumps and exfiltrates environment variables or shell statestablejson
SEC741Plugin hook: environment dumpPlugin hook command dumps environment variables or shell statestablejson
SEC742Plugin hook: environment dump exfiltrationPlugin hook command dumps and exfiltrates environment variables or shell statestablejson

What This Preset Enables ​

The mcp preset scopes coverage to JSON, tool descriptor, and server registry surfaces.

When To Use It ​

Use it when MCP configs and tool/server descriptors are your main attack surface.

Tradeoffs ​

This preset is precise for config-heavy repos, but it does not cover markdown-only instruction risks.