0.3.0

0.3.0 takes AsItIs out of the chat window and into CI.

New

• An asitis command line tool. It outputs text, JSON, SARIF and GitHub annotations, uses exit codes 0 to 3 and supports --fail-on: npx -y -p @asitis/mcp@0.3.0 asitis lint
• A GitHub Action (Katta041/asitis-agent-tools@v0.3.0) and a pre-commit hook (asitis-lint). Setup for GitHub, pre-commit, lefthook, husky and GitLab is in docs/ci.md.
• .asitisrc.json config, inline <!-- asitis-disable-next-line rule -- reason --> comments and baselines, so you can adopt it on a big repo without fixing everything first.
• Drift checks:
  • flags an AGENTS.md that Claude Code never reads because a CLAUDE.md shadows it
  • flags mirrored files that have drifted apart, and rules that contradict each other across tools
  • checks the Codex 32 KiB budget, which is shared down the folder chain
• An opt-in security scan of skill folders (include: skills). It looks for downloaded code piped into a shell, encoded payloads, data sent off the machine, unscoped allowed-tools, binaries posing as text, and skill arguments that reach a shell.
• An opt-in audit of .claude/settings.json and .mcp.json (include: config). It looks for bypassPermissions, Bash(*), hooks that download and run code, unpinned npx -y servers, the vulnerable mcp-remote versions and inline secrets. It never reads ~/.claude.json.
• Fix suggestions as diffs, through the new suggest_fixes tool, /asitis:md-fix and --fix-preview. The server still never writes. You see each change and decide.
• A page for every rule, with bad and good examples and the vendor doc it rests on: docs/rules.

Default severities
Planted invisible or bidirectional characters, and hidden comments that tell the agent to ignore instructions, hide something, run a command or reach for secrets, are now errors. That means a default CI run fails on them. Comments that only address the agent stay warnings.

How it was tested

• Before release I ran it across 71 public repos and labelled every error and warning by hand. 98% were worth a contributor's time, up from 59% in the first release candidate. Every real finding is still caught.
• A security review checked that the tool doesn't print secrets, and that a repo's own config can't quietly hide security findings.
• The labelled set of 233 cases scores 100% on precision and recall.
• 1,722 tests run on macOS, Linux and Windows.

Known gaps for 0.3.x

• The skill scan doesn't yet catch some heavily disguised download-and-run commands, and it doesn't read Makefiles or YAML inside skill folders.
• A stray <!--> marker can give a false hidden-instruction warning.
• Fix diffs show the lines they change, so a secret already in that line appears in the diff.

Update

claude plugin marketplace update asitis
claude plugin update asitis@asitis

0.2.5

The big one: in Claude Code 2.1 the model was getting the JSON copy of each tool result instead of the text, so read_markdown handed it no file text and the "treat this as data" notice never arrived. Results are text only now. If a script of yours relies on the JSON, start the server with --structured (or set ASITIS_MCP_STRUCTURED=1).

Lint also caught two things it used to miss:

• short rules repeated under two headings, like "Run pnpm test before every commit"
• plain contradictions, like "Use named exports" a line above "Never use named exports"

On my labelled set of 233 cases, precision went from 94.1% to 99.5% and recall from 90.6% to 98.6%.

Other changes:

• context_budget follows what each tool actually loads. AGENTS.md only counts for Claude Code when there's no CLAUDE.md, or when CLAUDE.md imports it.
• Symlinks inside the project are followed.
• Big repos no longer overflow Claude Code's tool-result limit.
• Cursor's unquoted globs: *.ts is accepted.
• The guard hook gives better advice on CRLF files and catches whole-file reformats done through Edit.
• Two new checks: a frontmatter value cut off by an unquoted #, and near-miss keys ("did you mean user-invocable?").
• The asitis.app line in results is off by default (--footer turns it on).

Full list in CHANGELOG.md.

Update:

claude plugin marketplace update asitis
claude plugin update asitis@asitis

npm: npx -y @asitis/mcp@0.2.5

0.2.4: clearer output, working update steps

Install:

claude plugin marketplace add Katta041/asitis-agent-tools
claude plugin install asitis@asitis

Already installed:

claude plugin marketplace update asitis
claude plugin update asitis@asitis

Then restart Claude Code. Other MCP clients: npx -y @asitis/mcp@0.2.4 --root /absolute/path/to/project

Changed

• The bundled server's output is easier to read (see the @asitis/mcp changelog).
• /asitis:md-lint asks for a short report: totals first, hidden-content findings next, then errors and warnings as path:line rule: message, notes in one line. /asitis:md-budget asks for one line per tool, largest first, and stops early when nothing loads every session.
• Guard hook messages: correct plurals ("2 lines", not "2 line(s)"), no doubled parentheses, and for an Edit on a file with mixed line endings it says that Claude Code's Edit writes the whole file with one style, and advises asking the user instead of retrying.
• README: update and uninstall steps (claude plugin update asitis@asitis, claude plugin uninstall asitis@asitis), a first-run step, and absolute links that work on marketplace pages.

0.2.3: Windows project folders work again

Install or update:

claude plugin marketplace add Katta041/asitis-agent-tools
claude plugin install asitis@asitis
# already installed: refresh the marketplace, update the plugin, then restart Claude Code
claude plugin marketplace update asitis
claude plugin update asitis@asitis

Other MCP clients: npx -y @asitis/mcp@0.2.3 --root /absolute/path/to/project

Fixed

• Windows: the server could read nothing when Claude Code passed the project folder as an 8.3 short path (C:\Users\RUNNER~1\...) or in a different case than the one on disk. Every read failed with "is a symlink that resolves outside the allowed folder". The root and the files it contains are now compared in the same form. Links that resolve outside the project, .env files and .claude/settings*.json are still refused, and the project folder can still contain the plugin folder.

Changed

• The bundled server is @asitis/mcp 0.2.3.

0.2.2: MCP Registry metadata, guard answers before the hook timeout

Install or update:

claude plugin marketplace add Katta041/asitis-agent-tools
claude plugin install asitis@asitis
# already installed: refresh the marketplace, update the plugin, then restart Claude Code
claude plugin marketplace update asitis
claude plugin update asitis@asitis

Other MCP clients: npx -y @asitis/mcp@0.2.2 --root /absolute/path/to/project

Fixed

• The guard hook's own time budget is 6 s instead of 7 s and now counts from the moment the hook process starts. Node start-up and the work the budget cannot interrupt (reading and decoding a file of up to 16 MB) used to fall outside it, so on a slow machine the check could run into Claude Code's 10 s hook timeout, which lets the change through. The guard now always answers first: it asks, or blocks in deny mode.
• The guard's fail-closed test is deterministic: it lowers the budget through ASITIS_GUARD_BUDGET_MS (which can only lower it) instead of measuring wall-clock time.

Changed

• The bundled server is @asitis/mcp 0.2.2, which adds MCP Registry metadata and no behaviour changes.

0.2.1: fewer false positives, exact guard lines, quiet install

Install or update:

claude plugin marketplace add Katta041/asitis-agent-tools
claude plugin install asitis@asitis
# already installed: refresh the marketplace, update the plugin, then restart Claude Code
claude plugin marketplace update asitis
claude plugin update asitis@asitis

Fixed

• Installing the plugin no longer prints "2 userConfig options not yet set". Claude Code reports every plugin option the user has not saved, even one with a default, so the plugin now declares none and reads environment variables instead: ASITIS_GUARD_MODE (ask, deny or off) for the guard and ASITIS_MCP_FOOTER=0 to hide the footer. Set them in the env block of your Claude Code settings. If you set guard_mode or footer with /plugin configure, set the variable instead.
• The guard's trailing-whitespace check names the exact lines it would strip, and aligns the old and new text line by line first. Of two identical lines, only the one that loses its trailing spaces is reported, and deleting a line whose twin stays elsewhere is no longer reported as stripping. (#4)
• lint_steering no longer reports a hidden instruction for a comment that only names a product, such as Claude Code, or has "claude" in a URL. (#2)
• lint_steering compares whole list items and sentences for duplicate rules and skips markup-only lines such as </details>, so wrapped lines and closing tags are no longer reported as duplicates. (#3)

Changed

• The bundled server is @asitis/mcp 0.2.1.

0.2.0: works in nested folders, safer output, guard fails closed

Install or update:

claude plugin marketplace add Katta041/asitis-agent-tools
claude plugin install asitis@asitis
# already installed: refresh the marketplace, update the plugin, then restart Claude Code
claude plugin marketplace update asitis
claude plugin update asitis@asitis

No install? Try the same linter in the browser checker (nothing is uploaded).

Fixed

• The MCP server now starts when the plugin folder is inside the project folder (the "try it with --plugin-dir" layout and contributors working in the repository) and when a session starts in the home folder. Node's permission model denied the outer folder when a folder inside it was also allowed; the new launcher drops the redundant nested grant, and .mcp.json lists the project folder first.
• A root folder that Node will not let the server read is no longer reported as "Root folder not found". The message names the folders involved and how to fix the flags.
• outline finds the first heading of files that start with a BOM (UTF-8 and UTF-16).
• YAML errors in frontmatter are reported on the line where they are, not always on line 2.
• context_budget counts only the skills, commands and subagents Claude Code loads every session (.claude/skills/, .claude/commands/, .claude/agents/). Nested .claude/skills/ folders and other SKILL.md files are listed as not loaded.
• The guard hook simulates Edit and MultiEdit the way Claude Code writes them (one line-ending style for the whole file), so an edit that rewrites the line endings of a mixed-EOL file is caught.

Security

• lint_steering, outline, find_steering_files and context_budget quote and escape YAML keys, values, headings, link targets and file names, and say that quoted text comes from the files. A repository can no longer forge report lines with line breaks, bidi or zero-width characters. File names with such characters get an unsafe-path warning.
• Hidden-content checks also catch the [//]: # (...) comment idiom and the HTML hidden attribute.
• The guard hook fails closed on its own time budget (7 s, inside Claude Code's 10 s hook timeout) and on files over 16 MB: it asks, or blocks in deny mode, instead of letting the change through unchecked.
• An unknown guard_mode is treated as deny and the guard says so.

Added

• Lint rules from the Agent Skills spec and the Claude API skill rules: reserved words "anthropic" and "claude" in a skill name, XML tags in a name or description, and a warning for a SKILL.md body over about 5,000 tokens. A description over 1,024 characters is now an error.
• On Node older than 22.13 the plugin prints one line, "AsItIs needs Node 22.13 or later; you have X", instead of Node's "bad option: --permission".

Changed

• Less lint noise: repeated bold labels and short list items under different headings are not duplicate rules; an HTML comment inside inline code is not hidden; @scope/package names are not broken imports in AGENTS.md and only a note in CLAUDE.md.
• The plugin is shown as "AsItIs" in the Claude Code plugin list.