Guide

agentlint lints and security-checks AI coding-agent configuration — Claude Code (CLAUDE.md, .claude/agents, .claude/commands, .claude/skills/**/SKILL.md, settings.json) and MCP (.mcp.json). It catches real misconfigurations and security problems (hardcoded secrets, dangerous hooks, curl | sh, over-broad permissions, prompt-injection) before they bite.

Open the Validator, choose a File kind (or leave auto-detect on), paste or upload your config, and press Validate. Each finding shows line:col, the rule id (links to Rules), and a fixable badge where a safe autofix exists. Nothing is stored — it lints in memory and returns JSON.

From the command line, in your project:

npx agentlint          # lint the whole project
npx agentlint --fix    # apply safe autofixes

The Catalog has 198 vetted building blocks — 104 skills, 24 MCP servers, and 70 tools. Search, filter by kind, and click Preview to read any item.

A) CLI (easiest) — installs to the right path; MCP servers merge into your .mcp.json instead of overwriting it:

npx agentlint add --list           # browse every id
npx agentlint add code-reviewer    # a subagent
npx agentlint add ship-feature     # a workflow skill
npx agentlint add mcp-github       # merges into .mcp.json
npx agentlint add mcp-github --dry-run   # preview, write nothing

B) Download .zip — on the Catalog, click Download .zip, then unzip into your project root. Files land in the correct structure (with a merged .mcp.json and a README):

unzip agentlint-catalog.zip -d your-project

C) Copy & paste — open Preview on a card, copy, and paste into the file at the path shown.

• skill → .claude/skills/<name>/SKILL.md
• subagent → .claude/agents/<name>.md
• slash command → .claude/commands/<name>.md
• MCP server → .mcp.json

Then restart Claude Code so it discovers them, and set any 🔑 env vars a server needs (each MCP card lists them).

Every catalog item carries a ✓ agentlint badge — it passed agentlint with zero errors: no hardcoded secrets, no remote-code-execution patterns, no over-broad tool/permission grants. Credentials are always ${ENV_VAR} references — you set them yourself; nothing secret is shipped. Re-check anything you add with npx agentlint.

agentlint ships an MCP server so an agent can lint its own config. Run it with agentlint mcp (or the agentlint-mcp bin), and point your .mcp.json at it:

// .mcp.json
{ "mcpServers": { "agentlint": { "command": "agentlint", "args": ["mcp"] } } }