v0.2.0

Provider- and language-agnostic static linter for MCP. npm i -g mcpconform or npx mcpconform, or use the Action: uses: cejor6/mcpconform@v1.

Highlights

New rules

• provider/total-size — flags a serialized tool set over a profile's tools.maxTotalBytes budget.
• client-config/known-keys — catches typo'd server-entry keys (arg → args, …).
• client-config/env-refs-declared — flags malformed ${...} interpolations (empty, unterminated, invalid name).

CI ergonomics

• --min-severity <error|warn|info> — reporting floor (human + SARIF). Display-only; the exit code stays error-only. Also minSeverity in config.
• --min-tools <n> (inspect) — exits 2 when the live server surfaces fewer than n tools, catching the "boots but registers nothing" false green. Also minTools in config.
• Default-on aggregation — an info finding from an opt-in rule (tool/meta-namespacing, provider/schema-unenforced-keyword) that repeats on 3+ tools collapses to one line with a count (e.g. (on all 28 tools)), in the report and SARIF. Targets framework-injected noise (FastMCP's non-reverse-DNS _meta key); per-tool-actionable findings stay itemized. --expand lists every occurrence.

Fixes

• SARIF driver.version now tracks package.json (no more drift).

Full notes in CHANGELOG.md.