v0.2.1

Docs / packaging release — no behavior change. Republished so the refreshed README reaches the npm package page.

npm i -g mcpconform or npx mcpconform, or use the Action: uses: cejor6/mcpconform@v1.

What's new

• README curb-appeal for public visibility — status badges (npm version, CI, license, Node), a copy-pasteable "Lint your MCP server in 30 seconds" quickstart at the top, a real example-output block, a clean-run example, and a prominent npm link.
• CI self-lint (dogfood) job — the linter now runs against the examples/ fixtures on every push/PR, asserting the bad fixtures surface a known seeded finding (not merely a non-zero exit) and the good fixtures pass clean.
• Bug-report issue form + config.yml routing (security → policy, questions → README).

No rules, profiles, or CLI behavior changed since v0.2.0. Full notes in CHANGELOG.md.

v0.2.0

Provider- and language-agnostic static linter for MCP. npm i -g mcpconform or npx mcpconform, or use the Action: uses: cejor6/mcpconform@v1.

Highlights

New rules

• provider/total-size — flags a serialized tool set over a profile's tools.maxTotalBytes budget.
• client-config/known-keys — catches typo'd server-entry keys (arg → args, …).
• client-config/env-refs-declared — flags malformed ${...} interpolations (empty, unterminated, invalid name).

CI ergonomics

• --min-severity <error|warn|info> — reporting floor (human + SARIF). Display-only; the exit code stays error-only. Also minSeverity in config.
• --min-tools <n> (inspect) — exits 2 when the live server surfaces fewer than n tools, catching the "boots but registers nothing" false green. Also minTools in config.
• Default-on aggregation — an info finding from an opt-in rule (tool/meta-namespacing, provider/schema-unenforced-keyword) that repeats on 3+ tools collapses to one line with a count (e.g. (on all 28 tools)), in the report and SARIF. Targets framework-injected noise (FastMCP's non-reverse-DNS _meta key); per-tool-actionable findings stay itemized. --expand lists every occurrence.

Fixes

• SARIF driver.version now tracks package.json (no more drift).

Full notes in CHANGELOG.md.

mcpconform v0.1.0

First public release — a provider- and language-agnostic static linter for MCP setup correctness: tool definitions, server.json registry manifests, and client configs. Spec baseline: MCP 2025-11-25.

What it checks

• MCP-spec + JSON-Schema correctness for tool definitions, server.json, and client configs (.mcp.json / claude_desktop_config.json), auto-detected by shape.
• Provider portability against declarative profiles — anthropic, openai, gemini, and generic-strict, each verified from the consumer's own docs (plus a mistral stub showing the extension pattern). Catches "legal per MCP but rejected by the provider" bugs like a dotted tool name.
• Three severity tiers: error (spec MUST / would 400), warn (spec SHOULD), info (portability + quality).

Usage

# CLI (also on npm: mcpconform@0.1.0)
npx mcpconform server.json .mcp.json --target anthropic,openai

# live server, any language, via the MCP stdio handshake
mcpconform inspect --target anthropic,openai -- python server.py

GitHub Action

- uses: cejor6/mcpconform@v1
  id: mcpconform
  with:
    files: server.json .mcp.json
    targets: anthropic,openai
- uses: github/codeql-action/upload-sarif@v4
  with:
    sarif_file: ${{ steps.mcpconform.outputs.sarif }}

Emits SARIF for GitHub code scanning. Engine stays vendor-agnostic — a new provider or host is a profiles/*.json file, never a code change.