@yawlabs/ctxlint 0.9.14 → 0.9.16

package/README.md

@@ -260,7 +260,7 @@ Options:
   --mcp-global         Also scan user/global MCP config files (implies --mcp)
   --session            Enable session audit checks (cross-project consistency)
   --session-only       Run only session checks, skip context and MCP checks
-  --mcp-server         Start the MCP server (for IDE/agent integration)
+  --mcp-server         Start the MCP server (alias: `serve` subcommand)
   --watch              Re-lint on context file changes
   -V, --version        Output the version number
   -h, --help           Display help
@@ -405,10 +405,16 @@ CLI flags override config file settings. Use `--config <path>` to load a config
 
 ctxlint ships with an MCP server that exposes six tools (`ctxlint_audit`, `ctxlint_mcp_audit`, `ctxlint_session_audit`, `ctxlint_validate_path`, `ctxlint_token_report`, `ctxlint_fix`). All read-only tools declare annotations so MCP clients can skip confirmation dialogs.
 
+Launch it with the `serve` subcommand (or the equivalent `--mcp-server` flag, kept for back-compat):
+
+```bash
+npx -y @yawlabs/ctxlint serve
+```
+
 ### With Claude Code
 
 ```bash
-claude mcp add ctxlint -- npx -y @yawlabs/ctxlint --mcp-server
+claude mcp add ctxlint -- npx -y @yawlabs/ctxlint serve
 ```
 
 ### With `.mcp.json` (Claude Code project config, Cursor, Windsurf)
@@ -422,7 +428,7 @@ macOS / Linux / WSL:
   "mcpServers": {
     "ctxlint": {
       "command": "npx",
-      "args": ["-y", "@yawlabs/ctxlint", "--mcp-server"]
+      "args": ["-y", "@yawlabs/ctxlint", "serve"]
     }
   }
 }
@@ -435,7 +441,7 @@ Windows:
   "mcpServers": {
     "ctxlint": {
       "command": "cmd",
-      "args": ["/c", "npx", "-y", "@yawlabs/ctxlint", "--mcp-server"]
+      "args": ["/c", "npx", "-y", "@yawlabs/ctxlint", "serve"]
     }
   }
 }
@@ -452,7 +458,7 @@ Add to `.vscode/mcp.json`:
   "servers": {
     "ctxlint": {
       "command": "npx",
-      "args": ["-y", "@yawlabs/ctxlint", "--mcp-server"]
+      "args": ["-y", "@yawlabs/ctxlint", "serve"]
     }
   }
 }
@@ -467,7 +473,7 @@ Add to your Claude Desktop config (`claude_desktop_config.json`):
   "mcpServers": {
     "ctxlint": {
       "command": "npx",
-      "args": ["-y", "@yawlabs/ctxlint", "--mcp-server"]
+      "args": ["-y", "@yawlabs/ctxlint", "serve"]
     }
   }
 }

package/dist/index.js

@@ -578,24 +578,24 @@ function processCreateParams(params) {
   };
   return { errorMap: customMap, description };
 }
-function timeRegexSource(args) {
+function timeRegexSource(args2) {
   let secondsRegexSource = `[0-5]\\d`;
-  if (args.precision) {
-    secondsRegexSource = `${secondsRegexSource}\\.\\d{${args.precision}}`;
-  } else if (args.precision == null) {
+  if (args2.precision) {
+    secondsRegexSource = `${secondsRegexSource}\\.\\d{${args2.precision}}`;
+  } else if (args2.precision == null) {
     secondsRegexSource = `${secondsRegexSource}(\\.\\d+)?`;
   }
-  const secondsQuantifier = args.precision ? "+" : "?";
+  const secondsQuantifier = args2.precision ? "+" : "?";
   return `([01]\\d|2[0-3]):[0-5]\\d(:${secondsRegexSource})${secondsQuantifier}`;
 }
-function timeRegex(args) {
-  return new RegExp(`^${timeRegexSource(args)}$`);
+function timeRegex(args2) {
+  return new RegExp(`^${timeRegexSource(args2)}$`);
 }
-function datetimeRegex(args) {
-  let regex2 = `${dateRegexSource}T${timeRegexSource(args)}`;
+function datetimeRegex(args2) {
+  let regex2 = `${dateRegexSource}T${timeRegexSource(args2)}`;
   const opts = [];
-  opts.push(args.local ? `Z?` : `Z`);
-  if (args.offset)
+  opts.push(args2.local ? `Z?` : `Z`);
+  if (args2.offset)
     opts.push(`([+-]\\d{2}:?\\d{2})`);
   regex2 = `${regex2}(${opts.join("|")})`;
   return new RegExp(`^${regex2}$`);
@@ -3256,9 +3256,9 @@ var init_types = __esm({
           });
           return INVALID;
         }
-        function makeArgsIssue(args, error49) {
+        function makeArgsIssue(args2, error49) {
           return makeIssue({
-            data: args,
+            data: args2,
             path: ctx.path,
             errorMaps: [ctx.common.contextualErrorMap, ctx.schemaErrorMap, getErrorMap(), en_default].filter((x3) => !!x3),
             issueData: {
@@ -3282,10 +3282,10 @@ var init_types = __esm({
         const fn = ctx.data;
         if (this._def.returns instanceof ZodPromise) {
           const me2 = this;
-          return OK(async function(...args) {
+          return OK(async function(...args2) {
             const error49 = new ZodError([]);
-            const parsedArgs = await me2._def.args.parseAsync(args, params).catch((e) => {
-              error49.addIssue(makeArgsIssue(args, e));
+            const parsedArgs = await me2._def.args.parseAsync(args2, params).catch((e) => {
+              error49.addIssue(makeArgsIssue(args2, e));
               throw error49;
             });
             const result = await Reflect.apply(fn, this, parsedArgs);
@@ -3297,10 +3297,10 @@ var init_types = __esm({
           });
         } else {
           const me2 = this;
-          return OK(function(...args) {
-            const parsedArgs = me2._def.args.safeParse(args, params);
+          return OK(function(...args2) {
+            const parsedArgs = me2._def.args.safeParse(args2, params);
             if (!parsedArgs.success) {
-              throw new ZodError([makeArgsIssue(args, parsedArgs.error)]);
+              throw new ZodError([makeArgsIssue(args2, parsedArgs.error)]);
             }
             const result = Reflect.apply(fn, this, parsedArgs.data);
             const parsedReturns = me2._def.returns.safeParse(result, params);
@@ -3337,9 +3337,9 @@ var init_types = __esm({
         const validatedFunc = this.parse(func);
         return validatedFunc;
       }
-      static create(args, returns, params) {
+      static create(args2, returns, params) {
         return new _ZodFunction({
-          args: args ? args : ZodTuple.create([]).rest(ZodUnknown.create()),
+          args: args2 ? args2 : ZodTuple.create([]).rest(ZodUnknown.create()),
           returns: returns || ZodUnknown.create(),
           typeName: ZodFirstPartyTypeKind.ZodFunction,
           ...processCreateParams(params)
@@ -4613,8 +4613,8 @@ function parsedType(data) {
   }
   return t2;
 }
-function issue(...args) {
-  const [iss, input, inst] = args;
+function issue(...args2) {
+  const [iss, input, inst] = args2;
   if (typeof iss === "string") {
     return {
       message: iss,
@@ -5053,20 +5053,20 @@ __export(regexes_exports, {
 function emoji() {
   return new RegExp(_emoji, "u");
 }
-function timeSource(args) {
+function timeSource(args2) {
   const hhmm = `(?:[01]\\d|2[0-3]):[0-5]\\d`;
-  const regex2 = typeof args.precision === "number" ? args.precision === -1 ? `${hhmm}` : args.precision === 0 ? `${hhmm}:[0-5]\\d` : `${hhmm}:[0-5]\\d\\.\\d{${args.precision}}` : `${hhmm}(?::[0-5]\\d(?:\\.\\d+)?)?`;
+  const regex2 = typeof args2.precision === "number" ? args2.precision === -1 ? `${hhmm}` : args2.precision === 0 ? `${hhmm}:[0-5]\\d` : `${hhmm}:[0-5]\\d\\.\\d{${args2.precision}}` : `${hhmm}(?::[0-5]\\d(?:\\.\\d+)?)?`;
   return regex2;
 }
-function time(args) {
-  return new RegExp(`^${timeSource(args)}$`);
+function time(args2) {
+  return new RegExp(`^${timeSource(args2)}$`);
 }
-function datetime(args) {
-  const time3 = timeSource({ precision: args.precision });
+function datetime(args2) {
+  const time3 = timeSource({ precision: args2.precision });
   const opts = ["Z"];
-  if (args.local)
+  if (args2.local)
     opts.push("");
-  if (args.offset)
+  if (args2.offset)
     opts.push(`([+-](?:[01]\\d|2[0-3]):[0-5]\\d)`);
   const timeRegex2 = `${time3}(?:${opts.join("|")})`;
   return new RegExp(`^${dateSource}T(?:${timeRegex2})$`);
@@ -5712,11 +5712,11 @@ var Doc;
 var init_doc = __esm({
   "node_modules/.pnpm/zod@4.3.6/node_modules/zod/v4/core/doc.js"() {
     Doc = class {
-      constructor(args = []) {
+      constructor(args2 = []) {
         this.content = [];
         this.indent = 0;
         if (this)
-          this.args = args;
+          this.args = args2;
       }
       indented(fn) {
         this.indent += 1;
@@ -5739,10 +5739,10 @@ var init_doc = __esm({
       }
       compile() {
         const F3 = Function;
-        const args = this?.args;
+        const args2 = this?.args;
         const content = this?.content ?? [``];
         const lines = [...content.map((x3) => `  ${x3}`)];
-        return new F3(...args, lines.join("\n"));
+        return new F3(...args2, lines.join("\n"));
       }
     };
   }
@@ -7638,8 +7638,8 @@ var init_schemas = __esm({
         if (typeof func !== "function") {
           throw new Error("implement() must be called with a function");
         }
-        return function(...args) {
-          const parsedArgs = inst._def.input ? parse(inst._def.input, args) : args;
+        return function(...args2) {
+          const parsedArgs = inst._def.input ? parse(inst._def.input, args2) : args2;
           const result = Reflect.apply(func, this, parsedArgs);
           if (inst._def.output) {
             return parse(inst._def.output, result);
@@ -7651,8 +7651,8 @@ var init_schemas = __esm({
         if (typeof func !== "function") {
           throw new Error("implementAsync() must be called with a function");
         }
-        return async function(...args) {
-          const parsedArgs = inst._def.input ? await parseAsync(inst._def.input, args) : args;
+        return async function(...args2) {
+          const parsedArgs = inst._def.input ? await parseAsync(inst._def.input, args2) : args2;
           const result = await Reflect.apply(func, this, parsedArgs);
           if (inst._def.output) {
             return await parseAsync(inst._def.output, result);
@@ -7678,22 +7678,22 @@ var init_schemas = __esm({
         }
         return payload;
       };
-      inst.input = (...args) => {
+      inst.input = (...args2) => {
         const F3 = inst.constructor;
-        if (Array.isArray(args[0])) {
+        if (Array.isArray(args2[0])) {
           return new F3({
             type: "function",
             input: new $ZodTuple({
               type: "tuple",
-              items: args[0],
-              rest: args[1]
+              items: args2[0],
+              rest: args2[1]
             }),
             output: inst._def.output
           });
         }
         return new F3({
           type: "function",
-          input: args[0],
+          input: args2[0],
           output: inst._def.output
         });
       };
@@ -17185,12 +17185,12 @@ var init_schemas3 = __esm({
         },
         configurable: true
       });
-      inst.meta = (...args) => {
-        if (args.length === 0) {
+      inst.meta = (...args2) => {
+        if (args2.length === 0) {
           return globalRegistry.get(inst);
         }
         const cl = inst.clone();
-        globalRegistry.add(cl, args[0]);
+        globalRegistry.add(cl, args2[0]);
         return cl;
       };
       inst.isOptional = () => inst.safeParse(void 0).success;
@@ -17206,18 +17206,18 @@ var init_schemas3 = __esm({
       inst.format = bag.format ?? null;
       inst.minLength = bag.minimum ?? null;
       inst.maxLength = bag.maximum ?? null;
-      inst.regex = (...args) => inst.check(_regex(...args));
-      inst.includes = (...args) => inst.check(_includes(...args));
-      inst.startsWith = (...args) => inst.check(_startsWith(...args));
-      inst.endsWith = (...args) => inst.check(_endsWith(...args));
-      inst.min = (...args) => inst.check(_minLength(...args));
-      inst.max = (...args) => inst.check(_maxLength(...args));
-      inst.length = (...args) => inst.check(_length(...args));
-      inst.nonempty = (...args) => inst.check(_minLength(1, ...args));
+      inst.regex = (...args2) => inst.check(_regex(...args2));
+      inst.includes = (...args2) => inst.check(_includes(...args2));
+      inst.startsWith = (...args2) => inst.check(_startsWith(...args2));
+      inst.endsWith = (...args2) => inst.check(_endsWith(...args2));
+      inst.min = (...args2) => inst.check(_minLength(...args2));
+      inst.max = (...args2) => inst.check(_maxLength(...args2));
+      inst.length = (...args2) => inst.check(_length(...args2));
+      inst.nonempty = (...args2) => inst.check(_minLength(1, ...args2));
       inst.lowercase = (params) => inst.check(_lowercase(params));
       inst.uppercase = (params) => inst.check(_uppercase(params));
       inst.trim = () => inst.check(_trim());
-      inst.normalize = (...args) => inst.check(_normalize(...args));
+      inst.normalize = (...args2) => inst.check(_normalize(...args2));
       inst.toLowerCase = () => inst.check(_toLowerCase());
       inst.toUpperCase = () => inst.check(_toUpperCase());
       inst.slugify = () => inst.check(_slugify());
@@ -17480,8 +17480,8 @@ var init_schemas3 = __esm({
       inst.merge = (other) => util_exports.merge(inst, other);
       inst.pick = (mask) => util_exports.pick(inst, mask);
       inst.omit = (mask) => util_exports.omit(inst, mask);
-      inst.partial = (...args) => util_exports.partial(ZodOptional2, inst, args[0]);
-      inst.required = (...args) => util_exports.required(ZodNonOptional, inst, args[0]);
+      inst.partial = (...args2) => util_exports.partial(ZodOptional2, inst, args2[0]);
+      inst.required = (...args2) => util_exports.required(ZodNonOptional, inst, args2[0]);
     });
     ZodUnion2 = /* @__PURE__ */ $constructor("ZodUnion", (inst, def) => {
       $ZodUnion.init(inst, def);
@@ -17526,19 +17526,19 @@ var init_schemas3 = __esm({
       inst._zod.processJSONSchema = (ctx, json2, params) => mapProcessor(inst, ctx, json2, params);
       inst.keyType = def.keyType;
       inst.valueType = def.valueType;
-      inst.min = (...args) => inst.check(_minSize(...args));
+      inst.min = (...args2) => inst.check(_minSize(...args2));
       inst.nonempty = (params) => inst.check(_minSize(1, params));
-      inst.max = (...args) => inst.check(_maxSize(...args));
-      inst.size = (...args) => inst.check(_size(...args));
+      inst.max = (...args2) => inst.check(_maxSize(...args2));
+      inst.size = (...args2) => inst.check(_size(...args2));
     });
     ZodSet2 = /* @__PURE__ */ $constructor("ZodSet", (inst, def) => {
       $ZodSet.init(inst, def);
       ZodType2.init(inst, def);
       inst._zod.processJSONSchema = (ctx, json2, params) => setProcessor(inst, ctx, json2, params);
-      inst.min = (...args) => inst.check(_minSize(...args));
+      inst.min = (...args2) => inst.check(_minSize(...args2));
       inst.nonempty = (params) => inst.check(_minSize(1, params));
-      inst.max = (...args) => inst.check(_maxSize(...args));
-      inst.size = (...args) => inst.check(_size(...args));
+      inst.max = (...args2) => inst.check(_maxSize(...args2));
+      inst.size = (...args2) => inst.check(_size(...args2));
     });
     ZodEnum2 = /* @__PURE__ */ $constructor("ZodEnum", (inst, def) => {
       $ZodEnum.init(inst, def);
@@ -17733,11 +17733,11 @@ var init_schemas3 = __esm({
     });
     describe2 = describe;
     meta2 = meta;
-    stringbool = (...args) => _stringbool({
+    stringbool = (...args2) => _stringbool({
       Codec: ZodCodec,
       Boolean: ZodBoolean2,
       String: ZodString2
-    }, ...args);
+    }, ...args2);
   }
 });
 
@@ -22751,23 +22751,23 @@ var require_code = __commonJS({
     };
     exports._Code = _Code;
     exports.nil = new _Code("");
-    function _3(strs, ...args) {
+    function _3(strs, ...args2) {
       const code = [strs[0]];
       let i2 = 0;
-      while (i2 < args.length) {
-        addCodeArg(code, args[i2]);
+      while (i2 < args2.length) {
+        addCodeArg(code, args2[i2]);
         code.push(strs[++i2]);
       }
       return new _Code(code);
     }
     exports._ = _3;
     var plus = new _Code("+");
-    function str(strs, ...args) {
+    function str(strs, ...args2) {
       const expr = [safeStringify(strs[0])];
       let i2 = 0;
-      while (i2 < args.length) {
+      while (i2 < args2.length) {
         expr.push(plus);
-        addCodeArg(expr, args[i2]);
+        addCodeArg(expr, args2[i2]);
         expr.push(plus, safeStringify(strs[++i2]));
       }
       optimize(expr);
@@ -23322,10 +23322,10 @@ var require_codegen = __commonJS({
       }
     };
     var Func = class extends BlockNode {
-      constructor(name, args, async) {
+      constructor(name, args2, async) {
         super();
         this.name = name;
-        this.args = args;
+        this.args = args2;
         this.async = async;
       }
       render(opts) {
@@ -23600,8 +23600,8 @@ var require_codegen = __commonJS({
         return this;
       }
       // `function` heading (or definition if funcBody is passed)
-      func(name, args = code_1.nil, async, funcBody) {
-        this._blockNode(new Func(name, args, async));
+      func(name, args2 = code_1.nil, async, funcBody) {
+        this._blockNode(new Func(name, args2, async));
         if (funcBody)
           this.code(funcBody).endFunc();
         return this;
@@ -23695,13 +23695,13 @@ var require_codegen = __commonJS({
     }
     exports.not = not;
     var andCode = mappend(exports.operators.AND);
-    function and(...args) {
-      return args.reduce(andCode);
+    function and(...args2) {
+      return args2.reduce(andCode);
     }
     exports.and = and;
     var orCode = mappend(exports.operators.OR);
-    function or(...args) {
-      return args.reduce(orCode);
+    function or(...args2) {
+      return args2.reduce(orCode);
     }
     exports.or = or;
     function mappend(op) {
@@ -24434,8 +24434,8 @@ var require_code2 = __commonJS({
       ];
       if (it2.opts.dynamicRef)
         valCxt.push([names_1.default.dynamicAnchors, names_1.default.dynamicAnchors]);
-      const args = (0, codegen_1._)`${dataAndSchema}, ${gen.object(...valCxt)}`;
-      return context !== codegen_1.nil ? (0, codegen_1._)`${func}.call(${context}, ${args})` : (0, codegen_1._)`${func}(${args})`;
+      const args2 = (0, codegen_1._)`${dataAndSchema}, ${gen.object(...valCxt)}`;
+      return context !== codegen_1.nil ? (0, codegen_1._)`${func}.call(${context}, ${args2})` : (0, codegen_1._)`${func}(${args2})`;
     }
     exports.callValidateCode = callValidateCode;
     var newRegExp = (0, codegen_1._)`new RegExp`;
@@ -30480,8 +30480,8 @@ var init_mcp = __esm({
             if (taskSupport === "optional" && !isTaskRequest && isTaskHandler) {
               return await this.handleAutomaticTaskPolling(tool, request, extra);
             }
-            const args = await this.validateToolInput(tool, request.params.arguments, request.params.name);
-            const result = await this.executeToolHandler(tool, args, extra);
+            const args2 = await this.validateToolInput(tool, request.params.arguments, request.params.name);
+            const result = await this.executeToolHandler(tool, args2, extra);
             if (isTaskRequest) {
               return result;
             }
@@ -30518,13 +30518,13 @@ var init_mcp = __esm({
       /**
        * Validates tool input arguments against the tool's input schema.
        */
-      async validateToolInput(tool, args, toolName) {
+      async validateToolInput(tool, args2, toolName) {
         if (!tool.inputSchema) {
           return void 0;
         }
         const inputObj = normalizeObjectSchema(tool.inputSchema);
         const schemaToParse = inputObj ?? tool.inputSchema;
-        const parseResult = await safeParseAsync2(schemaToParse, args);
+        const parseResult = await safeParseAsync2(schemaToParse, args2);
         if (!parseResult.success) {
           const error49 = "error" in parseResult ? parseResult.error : "Unknown error";
           const errorMessage = getParseErrorMessage(error49);
@@ -30559,7 +30559,7 @@ var init_mcp = __esm({
       /**
        * Executes a tool handler (either regular or task-based).
        */
-      async executeToolHandler(tool, args, extra) {
+      async executeToolHandler(tool, args2, extra) {
         const handler = tool.handler;
         const isTaskHandler = "createTask" in handler;
         if (isTaskHandler) {
@@ -30569,7 +30569,7 @@ var init_mcp = __esm({
           const taskExtra = { ...extra, taskStore: extra.taskStore };
           if (tool.inputSchema) {
             const typedHandler = handler;
-            return await Promise.resolve(typedHandler.createTask(args, taskExtra));
+            return await Promise.resolve(typedHandler.createTask(args2, taskExtra));
           } else {
             const typedHandler = handler;
             return await Promise.resolve(typedHandler.createTask(taskExtra));
@@ -30577,7 +30577,7 @@ var init_mcp = __esm({
         }
         if (tool.inputSchema) {
           const typedHandler = handler;
-          return await Promise.resolve(typedHandler(args, extra));
+          return await Promise.resolve(typedHandler(args2, extra));
         } else {
           const typedHandler = handler;
           return await Promise.resolve(typedHandler(extra));
@@ -30590,10 +30590,10 @@ var init_mcp = __esm({
         if (!extra.taskStore) {
           throw new Error("No task store provided for task-capable tool.");
         }
-        const args = await this.validateToolInput(tool, request.params.arguments, request.params.name);
+        const args2 = await this.validateToolInput(tool, request.params.arguments, request.params.name);
         const handler = tool.handler;
         const taskExtra = { ...extra, taskStore: extra.taskStore };
-        const createTaskResult = args ? await Promise.resolve(handler.createTask(args, taskExtra)) : (
+        const createTaskResult = args2 ? await Promise.resolve(handler.createTask(args2, taskExtra)) : (
           // eslint-disable-next-line @typescript-eslint/no-explicit-any
           await Promise.resolve(handler.createTask(taskExtra))
         );
@@ -30768,9 +30768,9 @@ var init_mcp = __esm({
               const errorMessage = getParseErrorMessage(error49);
               throw new McpError(ErrorCode.InvalidParams, `Invalid arguments for prompt ${request.params.name}: ${errorMessage}`);
             }
-            const args = parseResult.data;
+            const args2 = parseResult.data;
             const cb = prompt.callback;
-            return await Promise.resolve(cb(args, extra));
+            return await Promise.resolve(cb(args2, extra));
           } else {
             const cb = prompt.callback;
             return await Promise.resolve(cb(extra));
@@ -34885,7 +34885,7 @@ var require_common = __commonJS({
         let enableOverride = null;
         let namespacesCache;
         let enabledCache;
-        function debug2(...args) {
+        function debug2(...args2) {
           if (!debug2.enabled) {
             return;
           }
@@ -34896,28 +34896,28 @@ var require_common = __commonJS({
           self2.prev = prevTime;
           self2.curr = curr;
           prevTime = curr;
-          args[0] = createDebug.coerce(args[0]);
-          if (typeof args[0] !== "string") {
-            args.unshift("%O");
+          args2[0] = createDebug.coerce(args2[0]);
+          if (typeof args2[0] !== "string") {
+            args2.unshift("%O");
           }
           let index = 0;
-          args[0] = args[0].replace(/%([a-zA-Z%])/g, (match, format2) => {
+          args2[0] = args2[0].replace(/%([a-zA-Z%])/g, (match, format2) => {
             if (match === "%%") {
               return "%";
             }
             index++;
             const formatter = createDebug.formatters[format2];
             if (typeof formatter === "function") {
-              const val = args[index];
+              const val = args2[index];
               match = formatter.call(self2, val);
-              args.splice(index, 1);
+              args2.splice(index, 1);
               index--;
             }
             return match;
           });
-          createDebug.formatArgs.call(self2, args);
+          createDebug.formatArgs.call(self2, args2);
           const logFn = self2.log || createDebug.log;
-          logFn.apply(self2, args);
+          logFn.apply(self2, args2);
         }
         debug2.namespace = namespace;
         debug2.useColors = createDebug.useColors();
@@ -35139,16 +35139,16 @@ var require_browser = __commonJS({
       typeof navigator !== "undefined" && navigator.userAgent && (m = navigator.userAgent.toLowerCase().match(/firefox\/(\d+)/)) && parseInt(m[1], 10) >= 31 || // Double check webkit in userAgent just in case we are in a worker
       typeof navigator !== "undefined" && navigator.userAgent && navigator.userAgent.toLowerCase().match(/applewebkit\/(\d+)/);
     }
-    function formatArgs(args) {
-      args[0] = (this.useColors ? "%c" : "") + this.namespace + (this.useColors ? " %c" : " ") + args[0] + (this.useColors ? "%c " : " ") + "+" + module.exports.humanize(this.diff);
+    function formatArgs(args2) {
+      args2[0] = (this.useColors ? "%c" : "") + this.namespace + (this.useColors ? " %c" : " ") + args2[0] + (this.useColors ? "%c " : " ") + "+" + module.exports.humanize(this.diff);
       if (!this.useColors) {
         return;
       }
       const c3 = "color: " + this.color;
-      args.splice(1, 0, c3, "color: inherit");
+      args2.splice(1, 0, c3, "color: inherit");
       let index = 0;
       let lastC = 0;
-      args[0].replace(/%[a-zA-Z%]/g, (match) => {
+      args2[0].replace(/%[a-zA-Z%]/g, (match) => {
         if (match === "%%") {
           return;
         }
@@ -35157,7 +35157,7 @@ var require_browser = __commonJS({
           lastC = index;
         }
       });
-      args.splice(lastC, 0, c3);
+      args2.splice(lastC, 0, c3);
     }
     exports.log = console.debug || console.log || (() => {
     });
@@ -35438,16 +35438,16 @@ var require_node = __commonJS({
     function useColors() {
       return "colors" in exports.inspectOpts ? Boolean(exports.inspectOpts.colors) : tty3.isatty(process.stderr.fd);
     }
-    function formatArgs(args) {
+    function formatArgs(args2) {
       const { namespace: name, useColors: useColors2 } = this;
       if (useColors2) {
         const c3 = this.color;
         const colorCode = "\x1B[3" + (c3 < 8 ? c3 : "8;5;" + c3);
         const prefix = `  ${colorCode};1m${name} \x1B[0m`;
-        args[0] = prefix + args[0].split("\n").join("\n" + prefix);
-        args.push(colorCode + "m+" + module.exports.humanize(this.diff) + "\x1B[0m");
+        args2[0] = prefix + args2[0].split("\n").join("\n" + prefix);
+        args2.push(colorCode + "m+" + module.exports.humanize(this.diff) + "\x1B[0m");
       } else {
-        args[0] = getDate() + name + " " + args[0];
+        args2[0] = getDate() + name + " " + args2[0];
       }
     }
     function getDate() {
@@ -35456,8 +35456,8 @@ var require_node = __commonJS({
       }
       return (/* @__PURE__ */ new Date()).toISOString() + " ";
     }
-    function log(...args) {
-      return process.stderr.write(util2.formatWithOptions(exports.inspectOpts, ...args) + "\n");
+    function log(...args2) {
+      return process.stderr.write(util2.formatWithOptions(exports.inspectOpts, ...args2) + "\n");
     }
     function save(namespaces) {
       if (namespaces) {
@@ -36253,29 +36253,29 @@ function appendTaskOptions(options, commands = []) {
     return commands2;
   }, commands);
 }
-function getTrailingOptions(args, initialPrimitive = 0, objectOnly = false) {
+function getTrailingOptions(args2, initialPrimitive = 0, objectOnly = false) {
   const command = [];
-  for (let i2 = 0, max = initialPrimitive < 0 ? args.length : initialPrimitive; i2 < max; i2++) {
-    if ("string|number".includes(typeof args[i2])) {
-      command.push(String(args[i2]));
+  for (let i2 = 0, max = initialPrimitive < 0 ? args2.length : initialPrimitive; i2 < max; i2++) {
+    if ("string|number".includes(typeof args2[i2])) {
+      command.push(String(args2[i2]));
     }
   }
-  appendTaskOptions(trailingOptionsArgument(args), command);
+  appendTaskOptions(trailingOptionsArgument(args2), command);
   if (!objectOnly) {
-    command.push(...trailingArrayArgument(args));
+    command.push(...trailingArrayArgument(args2));
   }
   return command;
 }
-function trailingArrayArgument(args) {
-  const hasTrailingCallback = typeof last(args) === "function";
-  return asStringArray(filterType(last(args, hasTrailingCallback ? 1 : 0), filterArray, []));
+function trailingArrayArgument(args2) {
+  const hasTrailingCallback = typeof last(args2) === "function";
+  return asStringArray(filterType(last(args2, hasTrailingCallback ? 1 : 0), filterArray, []));
 }
-function trailingOptionsArgument(args) {
-  const hasTrailingCallback = filterFunction(last(args));
-  return filterType(last(args, hasTrailingCallback ? 1 : 0), filterPlainObject);
+function trailingOptionsArgument(args2) {
+  const hasTrailingCallback = filterFunction(last(args2));
+  return filterType(last(args2, hasTrailingCallback ? 1 : 0), filterPlainObject);
 }
-function trailingFunctionArgument(args, includeNoop = true) {
-  const callback = asFunction(last(args));
+function trailingFunctionArgument(args2, includeNoop = true) {
+  const callback = asFunction(last(args2));
   return includeNoop || isUserFunction(callback) ? callback : void 0;
 }
 function callTaskParser(parser4, streams) {
@@ -36643,15 +36643,15 @@ function createLog() {
 }
 function prefixedLogger(to, prefix, forward) {
   if (!prefix || !String(prefix).replace(/\s*/, "")) {
-    return !forward ? to : (message, ...args) => {
-      to(message, ...args);
-      forward(message, ...args);
+    return !forward ? to : (message, ...args2) => {
+      to(message, ...args2);
+      forward(message, ...args2);
     };
   }
-  return (message, ...args) => {
-    to(`%s ${message}`, prefix, ...args);
+  return (message, ...args2) => {
+    to(`%s ${message}`, prefix, ...args2);
     if (forward) {
-      forward(message, ...args);
+      forward(message, ...args2);
     }
   };
 }
@@ -36753,8 +36753,8 @@ function changeWorkingDirectoryTask(directory, root) {
     return (root || instance).cwd = directory;
   });
 }
-function checkoutTask(args) {
-  const commands = ["checkout", ...args];
+function checkoutTask(args2) {
+  const commands = ["checkout", ...args2];
   if (commands[1] === "-b" && commands.includes("-B")) {
     commands[1] = remove(commands, "-B");
   }
@@ -37258,11 +37258,11 @@ function versionParser(stdOut) {
   }
   return parseStringResponse(versionResponse(0, 0, 0, stdOut), parsers7, stdOut);
 }
-function createCloneTask(api, task, repoPath, ...args) {
+function createCloneTask(api, task, repoPath, ...args2) {
   if (!filterString(repoPath)) {
     return configurationErrorTask(`git.${api}() requires a string 'repoPath'`);
   }
-  return task(repoPath, filterType(args[0], filterString), getTrailingOptions(arguments));
+  return task(repoPath, filterType(args2[0], filterString), getTrailingOptions(arguments));
 }
 function clone_default() {
   return {
@@ -37610,13 +37610,13 @@ function abortPlugin(signal) {
 function blockUnsafeOperationsPlugin(options = {}) {
   return {
     type: "spawn.args",
-    action(args, { env: env2 }) {
-      for (const vulnerability of te2(args, env2)) {
+    action(args2, { env: env2 }) {
+      for (const vulnerability of te2(args2, env2)) {
         if (options[vulnerability.category] !== true) {
           throw new GitPluginError(void 0, "unsafe", vulnerability.message);
         }
       }
-      return args;
+      return args2;
     }
   };
 }
@@ -37782,11 +37782,11 @@ function progressMonitorPlugin(progress) {
   };
   const onArgs = {
     type: "spawn.args",
-    action(args, context) {
+    action(args2, context) {
       if (!progressMethods.includes(context.method)) {
-        return args;
+        return args2;
       }
-      return including(args, progressCommand);
+      return including(args2, progressCommand);
     }
   };
   return [onArgs, onProgress];
@@ -37843,8 +37843,8 @@ function suffixPathsPlugin() {
     action(data) {
       const prefix = [];
       let suffix;
-      function append2(args) {
-        (suffix = suffix || []).push(...args);
+      function append2(args2) {
+        (suffix = suffix || []).push(...args2);
       }
       for (let i2 = 0; i2 < data.length; i2++) {
         const param = data[i2];
@@ -38509,18 +38509,18 @@ var init_esm2 = __esm({
           }
           async attemptRemoteTask(task, logger) {
             const binary = this._plugins.exec("spawn.binary", "", pluginContext(task, task.commands));
-            const args = this._plugins.exec("spawn.args", [...task.commands], {
+            const args2 = this._plugins.exec("spawn.args", [...task.commands], {
               ...pluginContext(task, task.commands),
               env: { ...this.env }
             });
             const raw = await this.gitResponse(
               task,
               binary,
-              args,
+              args2,
               this.outputHandler,
               logger.step("SPAWN")
             );
-            const outputStreams = await this.handleTaskData(task, args, raw, logger.step("HANDLE"));
+            const outputStreams = await this.handleTaskData(task, args2, raw, logger.step("HANDLE"));
             logger(`passing response to task's parser as a %s`, task.format);
             if (isBufferTask(task)) {
               return callTaskParser(task.parser, outputStreams);
@@ -38531,7 +38531,7 @@ var init_esm2 = __esm({
             logger(`empty task bypassing child process to call to task's parser`);
             return task.parser(this);
           }
-          handleTaskData(task, args, result, logger) {
+          handleTaskData(task, args2, result, logger) {
             const { exitCode, rejection, stdOut, stdErr } = result;
             return new Promise((done, fail) => {
               logger(`Preparing to handle process response exitCode=%d stdOut=`, exitCode);
@@ -38539,7 +38539,7 @@ var init_esm2 = __esm({
                 "task.error",
                 { error: rejection },
                 {
-                  ...pluginContext(task, args),
+                  ...pluginContext(task, args2),
                   ...result
                 }
               );
@@ -38574,7 +38574,7 @@ var init_esm2 = __esm({
               done(new GitOutputStreams(Buffer.concat(stdOut), Buffer.concat(stdErr)));
             });
           }
-          async gitResponse(task, command, args, outputHandler, logger) {
+          async gitResponse(task, command, args2, outputHandler, logger) {
             const outputLogger = logger.sibling("output");
             const spawnOptions = this._plugins.exec(
               "spawn.options",
@@ -38588,9 +38588,9 @@ var init_esm2 = __esm({
             return new Promise((done) => {
               const stdOut = [];
               const stdErr = [];
-              logger.info(`%s %o`, command, args);
+              logger.info(`%s %o`, command, args2);
               logger("%O", spawnOptions);
-              let rejection = this._beforeSpawn(task, args);
+              let rejection = this._beforeSpawn(task, args2);
               if (rejection) {
                 return done({
                   stdOut,
@@ -38600,12 +38600,12 @@ var init_esm2 = __esm({
                 });
               }
               this._plugins.exec("spawn.before", void 0, {
-                ...pluginContext(task, args),
+                ...pluginContext(task, args2),
                 kill(reason) {
                   rejection = reason || rejection;
                 }
               });
-              const spawned = spawn(command, args, spawnOptions);
+              const spawned = spawn(command, args2, spawnOptions);
               spawned.stdout.on(
                 "data",
                 onDataReceived(stdOut, "stdOut", logger, outputLogger.step("stdOut"))
@@ -38617,10 +38617,10 @@ var init_esm2 = __esm({
               spawned.on("error", onErrorReceived(stdErr, logger));
               if (outputHandler) {
                 logger(`Passing child process stdOut/stdErr to custom outputHandler`);
-                outputHandler(command, spawned.stdout, spawned.stderr, [...args]);
+                outputHandler(command, spawned.stdout, spawned.stderr, [...args2]);
               }
               this._plugins.exec("spawn.after", void 0, {
-                ...pluginContext(task, args),
+                ...pluginContext(task, args2),
                 spawned,
                 close(exitCode, reason) {
                   done({
@@ -38640,10 +38640,10 @@ var init_esm2 = __esm({
               });
             });
           }
-          _beforeSpawn(task, args) {
+          _beforeSpawn(task, args2) {
             let rejection;
             this._plugins.exec("spawn.before", void 0, {
-              ...pluginContext(task, args),
+              ...pluginContext(task, args2),
               kill(reason) {
                 rejection = reason || rejection;
               }
@@ -40226,13 +40226,13 @@ var init_esm2 = __esm({
         Git2.prototype.submoduleAdd = function(repo, path12, then) {
           return this._runTask(addSubModuleTask2(repo, path12), trailingFunctionArgument2(arguments));
         };
-        Git2.prototype.submoduleUpdate = function(args, then) {
+        Git2.prototype.submoduleUpdate = function(args2, then) {
           return this._runTask(
             updateSubModuleTask2(getTrailingOptions2(arguments, true)),
             trailingFunctionArgument2(arguments)
           );
         };
-        Git2.prototype.submoduleInit = function(args, then) {
+        Git2.prototype.submoduleInit = function(args2, then) {
           return this._runTask(
             initSubModuleTask2(getTrailingOptions2(arguments, true)),
             trailingFunctionArgument2(arguments)
@@ -40306,10 +40306,10 @@ var init_esm2 = __esm({
         Git2.prototype.binaryCatFile = function() {
           return this._catFile("buffer", arguments);
         };
-        Git2.prototype._catFile = function(format2, args) {
-          var handler = trailingFunctionArgument2(args);
+        Git2.prototype._catFile = function(format2, args2) {
+          var handler = trailingFunctionArgument2(args2);
           var command = ["cat-file"];
-          var options = args[0];
+          var options = args2[0];
           if (typeof options === "string") {
             return this._runTask(
               configurationErrorTask2("Git.catFile: options must be supplied as an array of strings"),
@@ -43854,7 +43854,7 @@ import { readFileSync as readFileSync4 } from "node:fs";
 import { resolve as resolve8, dirname as dirname3 } from "node:path";
 import { fileURLToPath } from "node:url";
 function loadVersion() {
-  if (true) return "0.9.14";
+  if (true) return "0.9.16";
   const __dir = dirname3(fileURLToPath(import.meta.url));
   const pkgPath = resolve8(__dir, "../package.json");
   const pkg = JSON.parse(readFileSync4(pkgPath, "utf-8"));
@@ -44771,7 +44771,23 @@ var init_fixer = __esm({
 // src/mcp/server.ts
 var server_exports = {};
 import * as path9 from "node:path";
-var contextCheckEnum, mcpCheckEnum, sessionCheckEnum, server, transport;
+function validateProjectPath(rawPath) {
+  if (!rawPath) return process.cwd();
+  if (PATH_DISALLOWED.test(rawPath)) {
+    throw new Error("projectPath contains disallowed characters");
+  }
+  const resolved = path9.resolve(rawPath);
+  if (!isDirectory(resolved)) {
+    throw new Error("projectPath is not an existing directory");
+  }
+  return resolved;
+}
+function validateFilePathInput(rawPath) {
+  if (PATH_DISALLOWED.test(rawPath)) {
+    throw new Error("path contains disallowed characters");
+  }
+}
+var contextCheckEnum, mcpCheckEnum, sessionCheckEnum, PATH_DISALLOWED, server, transport;
 var init_server3 = __esm({
   async "src/mcp/server.ts"() {
     "use strict";
@@ -44791,13 +44807,14 @@ var init_server3 = __esm({
     contextCheckEnum = external_exports3.enum(ALL_CHECKS);
     mcpCheckEnum = external_exports3.enum(ALL_MCP_CHECKS);
     sessionCheckEnum = external_exports3.enum(ALL_SESSION_CHECKS);
+    PATH_DISALLOWED = /[\n\r\t;`|]|\$\(|\$\{/;
     server = new McpServer({
       name: "ctxlint",
       version: VERSION
     });
     server.tool(
       "ctxlint_audit",
-      "Audit AI agent context files (CLAUDE.md, AGENTS.md, etc.) in the project. Checks for stale references, invalid commands, redundant content, contradictions, frontmatter issues, and token waste. Use ctxlint_mcp_audit for MCP configs or ctxlint_session_audit for session checks.",
+      "Audit AI agent context files (CLAUDE.md, AGENTS.md, etc.) in the project. Checks for stale references, invalid commands, redundant content, contradictions, frontmatter issues, and token waste. Scoped to context-file checks only; MCP-config and session-level checks are exposed as separate tools.",
       {
         projectPath: external_exports3.string().optional().describe("Path to the project root. Defaults to current working directory."),
         checks: external_exports3.array(contextCheckEnum).optional().describe("Which context-file checks to run. Defaults to all.")
@@ -44809,9 +44826,9 @@ var init_server3 = __esm({
         openWorldHint: false
       },
       async ({ projectPath, checks }) => {
-        const root = path9.resolve(projectPath || process.cwd());
-        const activeChecks = checks?.length ? checks : ALL_CHECKS;
         try {
+          const root = validateProjectPath(projectPath);
+          const activeChecks = checks?.length ? checks : ALL_CHECKS;
           const result = await runAudit(root, activeChecks);
           return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
         } catch (err) {
@@ -44843,7 +44860,8 @@ var init_server3 = __esm({
       },
       async ({ path: filePath, projectPath }) => {
         try {
-          const root = path9.resolve(projectPath || process.cwd());
+          validateFilePathInput(filePath);
+          const root = validateProjectPath(projectPath);
           const resolved = path9.resolve(root, filePath);
           const result = {
             path: filePath,
@@ -44885,8 +44903,8 @@ var init_server3 = __esm({
         openWorldHint: false
       },
       async ({ projectPath }) => {
-        const root = path9.resolve(projectPath || process.cwd());
         try {
+          const root = validateProjectPath(projectPath);
           const discovered = await scanForContextFiles(root);
           const parsed = discovered.map((f) => parseContextFile(f));
           const files = parsed.map((f) => ({
@@ -44936,9 +44954,9 @@ var init_server3 = __esm({
         openWorldHint: false
       },
       async ({ projectPath, checks }) => {
-        const root = path9.resolve(projectPath || process.cwd());
-        const activeChecks = checks?.length ? checks : ALL_CHECKS;
         try {
+          const root = validateProjectPath(projectPath);
+          const activeChecks = checks?.length ? checks : ALL_CHECKS;
           const result = await runAudit(root, activeChecks);
           const fixSummary = applyFixes(result, { quiet: true });
           return {
@@ -44986,9 +45004,9 @@ var init_server3 = __esm({
         openWorldHint: false
       },
       async ({ projectPath, checks, includeGlobal }) => {
-        const root = path9.resolve(projectPath || process.cwd());
-        const activeChecks = checks?.length ? checks : ALL_MCP_CHECKS;
         try {
+          const root = validateProjectPath(projectPath);
+          const activeChecks = checks?.length ? checks : ALL_MCP_CHECKS;
           const result = await runAudit(root, activeChecks, {
             mcp: true,
             mcpOnly: true,
@@ -45023,9 +45041,9 @@ var init_server3 = __esm({
         openWorldHint: true
       },
       async ({ projectPath, checks }) => {
-        const root = path9.resolve(projectPath || process.cwd());
-        const activeChecks = checks?.length ? checks : ALL_SESSION_CHECKS;
         try {
+          const root = validateProjectPath(projectPath);
+          const activeChecks = checks?.length ? checks : ALL_SESSION_CHECKS;
           const result = await runAudit(root, activeChecks, {
             session: true,
             sessionOnly: true
@@ -45342,9 +45360,9 @@ var require_help = __commonJS({
        * @returns {string}
        */
       subcommandTerm(cmd) {
-        const args = cmd.registeredArguments.map((arg) => humanReadableArgName(arg)).join(" ");
+        const args2 = cmd.registeredArguments.map((arg) => humanReadableArgName(arg)).join(" ");
         return cmd._name + (cmd._aliases[0] ? "|" + cmd._aliases[0] : "") + (cmd.options.length ? " [options]" : "") + // simplistic check for non-help option
-        (args ? " " + args : "");
+        (args2 ? " " + args2 : "");
       }
       /**
        * Get the option term to show in the list of options.
@@ -46346,7 +46364,7 @@ var require_command = __commonJS({
           desc = null;
         }
         opts = opts || {};
-        const [, name, args] = nameAndArgs.match(/([^ ]+) *(.*)/);
+        const [, name, args2] = nameAndArgs.match(/([^ ]+) *(.*)/);
         const cmd = this.createCommand(name);
         if (desc) {
           cmd.description(desc);
@@ -46355,7 +46373,7 @@ var require_command = __commonJS({
         if (opts.isDefault) this._defaultCommandName = cmd._name;
         cmd._hidden = !!(opts.noHelp || opts.hidden);
         cmd._executableFile = opts.executableFile || null;
-        if (args) cmd.arguments(args);
+        if (args2) cmd.arguments(args2);
         this._registerCommand(cmd);
         cmd.parent = this;
         cmd.copyInheritedSettings(this);
@@ -46680,9 +46698,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command} `this` command for chaining
        */
       action(fn) {
-        const listener = (args) => {
+        const listener = (args2) => {
           const expectedArgsCount = this.registeredArguments.length;
-          const actionArgs = args.slice(0, expectedArgsCount);
+          const actionArgs = args2.slice(0, expectedArgsCount);
           if (this._storeOptionsAsProperties) {
             actionArgs[expectedArgsCount] = this;
           } else {
@@ -47222,8 +47240,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
        *
        * @private
        */
-      _executeSubCommand(subcommand, args) {
-        args = args.slice();
+      _executeSubCommand(subcommand, args2) {
+        args2 = args2.slice();
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
@@ -47272,11 +47290,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let proc;
         if (process11.platform !== "win32") {
           if (launchWithNode) {
-            args.unshift(executableFile);
-            args = incrementNodeInspectorPort(process11.execArgv).concat(args);
-            proc = childProcess.spawn(process11.argv[0], args, { stdio: "inherit" });
+            args2.unshift(executableFile);
+            args2 = incrementNodeInspectorPort(process11.execArgv).concat(args2);
+            proc = childProcess.spawn(process11.argv[0], args2, { stdio: "inherit" });
           } else {
-            proc = childProcess.spawn(executableFile, args, { stdio: "inherit" });
+            proc = childProcess.spawn(executableFile, args2, { stdio: "inherit" });
           }
         } else {
           this._checkForMissingExecutable(
@@ -47284,9 +47302,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
             executableDir,
             subcommand._name
           );
-          args.unshift(executableFile);
-          args = incrementNodeInspectorPort(process11.execArgv).concat(args);
-          proc = childProcess.spawn(process11.execPath, args, { stdio: "inherit" });
+          args2.unshift(executableFile);
+          args2 = incrementNodeInspectorPort(process11.execArgv).concat(args2);
+          proc = childProcess.spawn(process11.execPath, args2, { stdio: "inherit" });
         }
         if (!proc.killed) {
           const signals2 = ["SIGUSR1", "SIGUSR2", "SIGTERM", "SIGINT", "SIGHUP"];
@@ -47669,7 +47687,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string[]} args
        * @return {{operands: string[], unknown: string[]}}
        */
-      parseOptions(args) {
+      parseOptions(args2) {
         const operands = [];
         const unknown2 = [];
         let dest = operands;
@@ -47685,12 +47703,12 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let activeVariadicOption = null;
         let activeGroup = null;
         let i2 = 0;
-        while (i2 < args.length || activeGroup) {
-          const arg = activeGroup ?? args[i2++];
+        while (i2 < args2.length || activeGroup) {
+          const arg = activeGroup ?? args2[i2++];
           activeGroup = null;
           if (arg === "--") {
             if (dest === unknown2) dest.push(arg);
-            dest.push(...args.slice(i2));
+            dest.push(...args2.slice(i2));
             break;
           }
           if (activeVariadicOption && (!maybeOption(arg) || negativeNumberArg(arg))) {
@@ -47702,13 +47720,13 @@ Expecting one of '${allowedValues.join("', '")}'`);
             const option = this._findOption(arg);
             if (option) {
               if (option.required) {
-                const value = args[i2++];
+                const value = args2[i2++];
                 if (value === void 0) this.optionMissingArgument(option);
                 this.emit(`option:${option.name()}`, value);
               } else if (option.optional) {
                 let value = null;
-                if (i2 < args.length && (!maybeOption(args[i2]) || negativeNumberArg(args[i2]))) {
-                  value = args[i2++];
+                if (i2 < args2.length && (!maybeOption(args2[i2]) || negativeNumberArg(args2[i2]))) {
+                  value = args2[i2++];
                 }
                 this.emit(`option:${option.name()}`, value);
               } else {
@@ -47744,18 +47762,18 @@ Expecting one of '${allowedValues.join("', '")}'`);
           if ((this._enablePositionalOptions || this._passThroughOptions) && operands.length === 0 && unknown2.length === 0) {
             if (this._findCommand(arg)) {
               operands.push(arg);
-              unknown2.push(...args.slice(i2));
+              unknown2.push(...args2.slice(i2));
               break;
             } else if (this._getHelpCommand() && arg === this._getHelpCommand().name()) {
-              operands.push(arg, ...args.slice(i2));
+              operands.push(arg, ...args2.slice(i2));
               break;
             } else if (this._defaultCommandName) {
-              unknown2.push(arg, ...args.slice(i2));
+              unknown2.push(arg, ...args2.slice(i2));
               break;
             }
           }
           if (this._passThroughOptions) {
-            dest.push(arg, ...args.slice(i2));
+            dest.push(arg, ...args2.slice(i2));
             break;
           }
           dest.push(arg);
@@ -48084,13 +48102,13 @@ Expecting one of '${allowedValues.join("', '")}'`);
       usage(str) {
         if (str === void 0) {
           if (this._usage) return this._usage;
-          const args = this.registeredArguments.map((arg) => {
+          const args2 = this.registeredArguments.map((arg) => {
             return humanReadableArgName(arg);
           });
           return [].concat(
             this.options.length || this._helpOption !== null ? "[options]" : [],
             this.commands.length ? "[command]" : [],
-            this.registeredArguments.length ? args : []
+            this.registeredArguments.length ? args2 : []
           ).join(" ");
         }
         this._usage = str;
@@ -48405,17 +48423,17 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {Array} args - array of options to search for help flags
        * @private
        */
-      _outputHelpIfRequested(args) {
+      _outputHelpIfRequested(args2) {
         const helpOption = this._getHelpOption();
-        const helpRequested = helpOption && args.find((arg) => helpOption.is(arg));
+        const helpRequested = helpOption && args2.find((arg) => helpOption.is(arg));
         if (helpRequested) {
           this.outputHelp();
           this._exit(0, "commander.helpDisplayed", "(outputHelp)");
         }
       }
     };
-    function incrementNodeInspectorPort(args) {
-      return args.map((arg) => {
+    function incrementNodeInspectorPort(args2) {
+      return args2.map((arg) => {
         if (!arg.startsWith("--inspect")) {
           return arg;
         }
@@ -48805,17 +48823,17 @@ var init_mjs = __esm({
         this.#emitter.emit("exit", this.#process.exitCode, null);
         return this.#originalProcessReallyExit.call(this.#process, this.#process.exitCode);
       }
-      #processEmit(ev, ...args) {
+      #processEmit(ev, ...args2) {
         const og = this.#originalProcessEmit;
         if (ev === "exit" && processOk(this.#process)) {
-          if (typeof args[0] === "number") {
-            this.#process.exitCode = args[0];
+          if (typeof args2[0] === "number") {
+            this.#process.exitCode = args2[0];
           }
-          const ret = og.call(this.#process, ev, ...args);
+          const ret = og.call(this.#process, ev, ...args2);
           this.#emitter.emit("exit", this.#process.exitCode, null);
           return ret;
         } else {
-          return og.call(this.#process, ev, ...args);
+          return og.call(this.#process, ev, ...args2);
         }
       }
     };
@@ -52001,7 +52019,7 @@ async function runCli() {
     "Lint your AI agent context files and MCP server configs against your actual codebase"
   ).version(VERSION).argument("[path]", "Project directory to scan", ".").option("--strict", "Exit code 1 on any warning or error (for CI)", false).option("--checks <checks>", "Comma-separated list of checks to run", "").addOption(
     new Option("--format <format>", "Output format: text, json, or sarif").choices(["text", "json", "sarif"]).default("text")
-  ).option("--tokens", "Show token breakdown per file", false).option("--verbose", "Show passing checks too", false).option("--fix", "Auto-fix broken paths using git history and fuzzy matching", false).option("--fix-dry-run", "Preview --fix changes without writing", false).option("--yes", "Skip interactive confirmation prompts (required for --fix in TTY)", false).option("--follow-symlinks", "Allow --fix to write through symlinks (default: skip)", false).option("--ignore <checks>", "Comma-separated list of checks to ignore", "").option("--quiet", "Suppress all output except errors (exit code only)", false).option("--config <path>", "Path to config file (default: .ctxlintrc in project root)").option("--depth <n>", "Max subdirectory depth to scan (default: 2)", "2").option("--mcp", "Enable MCP config linting alongside context file checks", false).option("--mcp-only", "Run only MCP config checks, skip context file checks", false).option("--mcp-global", "Also scan user/global MCP config files (implies --mcp)", false).option("--mcp-server", "Start the MCP server (for IDE/agent integration)").option("--session", "Run session audit checks (cross-project consistency)", false).option("--session-only", "Run only session checks, skip context and MCP checks", false).option("--watch", "Re-lint on context file changes", false).action(async (projectPath, opts) => {
+  ).option("--tokens", "Show token breakdown per file", false).option("--verbose", "Show passing checks too", false).option("--fix", "Auto-fix broken paths using git history and fuzzy matching", false).option("--fix-dry-run", "Preview --fix changes without writing", false).option("--yes", "Skip interactive confirmation prompts (required for --fix in TTY)", false).option("--follow-symlinks", "Allow --fix to write through symlinks (default: skip)", false).option("--ignore <checks>", "Comma-separated list of checks to ignore", "").option("--quiet", "Suppress all output except errors (exit code only)", false).option("--config <path>", "Path to config file (default: .ctxlintrc in project root)").option("--depth <n>", "Max subdirectory depth to scan (default: 2)", "2").option("--mcp", "Enable MCP config linting alongside context file checks", false).option("--mcp-only", "Run only MCP config checks, skip context file checks", false).option("--mcp-global", "Also scan user/global MCP config files (implies --mcp)", false).option("--mcp-server", "Start the MCP server (alias: `ctxlint serve`)").option("--session", "Run session audit checks (cross-project consistency)", false).option("--session-only", "Run only session checks, skip context and MCP checks", false).option("--watch", "Re-lint on context file changes", false).action(async (projectPath, opts) => {
     const resolvedPath = path11.resolve(projectPath);
     const configPath = opts.config ? path11.resolve(opts.config) : void 0;
     const config2 = configPath ? loadConfigFromPath(configPath) : loadConfig(resolvedPath);
@@ -52341,7 +52359,8 @@ var init_cli = __esm({
 });
 
 // src/index.ts
-if (process.argv.includes("--mcp-server")) {
+var args = process.argv.slice(2);
+if (args[0] === "serve" || args.includes("--mcp-server")) {
   await init_server3().then(() => server_exports);
 } else {
   const { runCli: runCli2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/ctxlint",
-  "version": "0.9.14",
+  "version": "0.9.16",
   "description": "Lint your AI agent context files, MCP server configs, and session data against your actual codebase",
   "bin": {
     "ctxlint": "dist/index.js"