v0.1.0 — initial release

First public release.

13 rules mapped to OWASP MCP Top 10: hardcoded secrets, unpinned/typosquat packages, plain HTTP, unauthenticated remotes, filesystem overreach, shell servers, prompt-injection markers, hidden unicode, tool shadowing, lockfile drift, OSV CVEs.

Highlights

• static-only: never executes your MCP servers
• local-first: no telemetry; network only with --online
• .mcplint.lock.json pinning for rug-pull detection
• CycloneDX AIBOM export
• SARIF 2.1.0 + GitHub Action + pre-commit hook

Install: uvx mcplint-sec scan (command: mcplint)

PyPI: https://pypi.org/project/mcplint-sec/0.1.0/