mcp-app-lint

SARIF findings about what an MCP App declares (CSP domain lists, permissions, tool visibility) and what its HTML does (innerHTML sinks, postMessage to '*', external hosts, data sinks), read from a package, saved results or a live server over HTTP or stdio

Installation

MCP client config (paste into mcp.json)

{
  "mcpServers": {
    "npm-mcp-app-lint": {
      "command": "npx",
      "args": [
        "mcp-app-lint"
      ]
    }
  }
}

Agent install prompt

Copy and paste into Cursor / Claude / other agents to install this MCP for you

Please read this MCP repository and install it into my current environment:
https://www.npmjs.com/package/mcp-app-lint

Known working client config (can write into mcp.json):
{
  "mcpServers": {
    "npm-mcp-app-lint": {
      "command": "npx",
      "args": [
        "mcp-app-lint"
      ]
    }
  }
}

Please: 1) check README for deps and env vars; 2) write config for my client; 3) if secrets are missing, tell me what to fill — do not invent values.

GitHub

Related servers