eslint-plugin-mcp-sdk-security

⭐ If this plugin caught a real bug for you, star the repo — it's the signal that keeps these rules maintained.

Description

Security rules for code built on @modelcontextprotocol/sdk.

Scope: this plugin lints the MCP SDK's API shapes — registerTool, transports, handler signatures. It does not inspect MCP wire traffic, which isn't visible from source. Every rule gates on the SDK actually being imported, so it stays silent in files that don't use MCP.

• Why — a linter nobody reads protects nothing. We would rather miss a finding than spend your attention on one that was never real.
• How — evidence, not names. A rule fires on what the code does, resolved through the AST and ESLint's own scope analysis.
• What — every finding carries its fix, in prose for a human and as structured JSON for an agent. Security rules add a CWE mapping and, where assigned, a CVSS score.

That trade costs recall, and we measure it: methodology · results · a false positive is a bug.

Getting Started

• To check out the guide, visit eslint.interlace.tools. 📚

npm install eslint-plugin-mcp-sdk-security --save-dev

⚙️ Configuration Presets

Usage

// eslint.config.js
import mcpSdkSecurity from 'eslint-plugin-mcp-sdk-security';

export default [
  mcpSdkSecurity.configs.recommended,
];

Or wire the rules yourself:

import mcpSdkSecurity from 'eslint-plugin-mcp-sdk-security';

export default [
  {
    plugins: { 'mcp-sdk-security': mcpSdkSecurity },
    rules: {
      'mcp-sdk-security/require-tool-input-schema': 'error',
    },
  },
];

oxlint

Every rule in this plugin runs on oxlint as well as ESLint:

{ "jsPlugins": ["eslint-plugin-mcp-sdk-security/oxlint"] }

📦 Compatibility

Package	Version
@modelcontextprotocol/sdk
ESLint
Node.js

See the ESLint Version Support Policy for the full matrix.

Rules

Legend

⭐ Support & follow

If this plugin caught a real bug for you, star the repo — stars are the signal that keeps the Interlace ESLint ecosystem maintained — and follow the writeups on Dev.to for the benchmarks and security research behind these rules.

🔗 Related ESLint Plugins

Part of the Interlace ESLint ecosystem — AI-native rules with LLM-optimized error messages:

Security

Plugin	Downloads	Description
eslint-plugin-anthropic-security		Anthropic SDK security.
eslint-plugin-browser-security		XSS, DOM security.
eslint-plugin-drizzle-security		Drizzle security.
eslint-plugin-express-security		Express middleware hardening.
eslint-plugin-gemini-security		Google Gemini SDK security.
eslint-plugin-jwt-security		Token security.
eslint-plugin-knex-security		Knex security.
eslint-plugin-lambda-security		AWS Lambda hardening.
eslint-plugin-mongodb-security		MongoDB injection.
eslint-plugin-mysql-security		MySQL security.
eslint-plugin-nestjs-security		NestJS framework hardening.
eslint-plugin-node-security		Server-side patterns.
eslint-plugin-openai-security		OpenAI SDK security.
eslint-plugin-postgresql-security		PostgreSQL security.
eslint-plugin-prisma-security		Prisma security.
eslint-plugin-secure-coding		Injection prevention.
eslint-plugin-sequelize-security		Sequelize ORM security.
eslint-plugin-sqlite-security		SQLite security.
eslint-plugin-supabase-security		Supabase security.
eslint-plugin-typeorm-security		TypeORM security.
eslint-plugin-vercel-ai-security		AI SDK security.

Code quality

Plugin	Downloads	Description
eslint-plugin-conventions		Team-specific habits and styles.
eslint-plugin-import-next		Fast cycle + import-graph analysis.
eslint-plugin-maintainability		Cognitive load and clean-code patterns.
eslint-plugin-modernization		ESNext migration + syntax evolution.
eslint-plugin-modularity		Structural integrity and DDD patterns.
eslint-plugin-operability		Production readiness and resource health.
eslint-plugin-react-a11y		React accessibility / WCAG.
eslint-plugin-react-features		React best practices and optimization.
eslint-plugin-reliability		Runtime stability and error safety.

📄 License

MIT © Ofri Peretz