Odd Bits / Builder kits
Agent Lint
Paste what your MCP server returns for tools/list, a CLAUDE.md or agent prompt, or an MCP config. Agent Lint lists the problems it can see, and for each one says which rule fired, where that rule comes from, and what to change.
- What you get
- Findings on tool names, descriptions and annotations
- Each finding with a source link
- Secrets in your text are masked
- Works with
- MCP tool definitions (JSON)CLAUDE.mdAgent prompts
- Version
- v1.0, updated 2026-10-19
Paste what your MCP server returns for tools/list (or just the tools array), as JSON.
What it never does
- Send what you paste anywhere: the code that checks it makes no network calls, and the page tells the browser to block connections to other sites
- Store what you paste: it stays in this tab until you close it
- Connect to your server, run your tools, or open your files for you: it reads only the text you give it
- Say your setup is “clean”, “safe” or will pass a review. A quiet result means only that these rules found nothing
- Promise that an agent will follow your instructions: Claude Code’s own docs say CLAUDE.md is context, not enforcement
- Find all problems: the contradiction check catches only obvious wording and four known conflicts
- Promise anything about a listing or a review: Anthropic decides
Questions
What can I paste?
In the first tab, an MCP server’s tools/list result (or just its tools array) as JSON. In the second tab, a CLAUDE.md, an AGENTS.md or an agent prompt as text, or an MCP config such as .mcp.json or claude_desktop_config.json as JSON. If you paste into the wrong tab it tells you. Up to 1 MB.
Where do the rules come from?
Each finding names its source. Pages change, so check the link before you rely on a rule.
If it finds nothing, will my connector be accepted?
No. Anthropic decides, and reviewers run your server and read your tools as a person would. Agent Lint checks only what can be seen in the text.
What does it check in a CLAUDE.md?
Secret-looking strings, files longer than 200 lines (Claude Code’s docs advise staying under that), vague wording, lines that contradict each other, risky commands with no rule asking for approval, pasted-in instructions, leftovers and repeats, and “never” rules that only the client can enforce. It matches words, not meaning, and cannot see other files that are imported or loaded alongside.
What does it check in an MCP config?
Entries with a url but no type, the deprecated sse type, secrets written into env or headers instead of ${VAR}, secrets in a URL, plain http to a remote server, packages started without a pinned version, shell wrappers, and servers that share the whole disk. It cannot tell you whether a server is trustworthy.
Can I check that nothing is uploaded?
Yes. Open your browser’s network tab, let the page finish loading, clear the list, then press Check: nothing that carries your text appears. (The browser may load other pages of this store in the background; that is separate.) The links under each finding go to the source page only if you click them.
Not affiliated with or endorsed by Anthropic. Anthropic, Claude and MCP are named only to say which published pages the rules come from.