calllint 0.3.0-preview.1 → 0.3.0-rc.1

package/dist/index.js

@@ -621,6 +621,18 @@ function detectSecretEnvKeys(ctx) {
 
 // ../../packages/static-analyzer/src/detectors/dangerousCommand.ts
 var INLINE_EXEC_FLAGS = /* @__PURE__ */ new Set(["-c", "-e", "--eval", "--command"]);
+var INLINE_EVAL_INTERPRETERS = /* @__PURE__ */ new Set([
+  "node",
+  "nodejs",
+  "deno",
+  "bun",
+  "python",
+  "python2",
+  "python3",
+  "ruby",
+  "perl",
+  "php"
+]);
 function detectDangerousCommand(ctx) {
   const { server } = ctx;
   const command = server.command;
@@ -637,15 +649,17 @@ function detectDangerousCommand(ctx) {
       value: command
     });
   }
-  const inlineFlag = server.args.find((a) => INLINE_EXEC_FLAGS.has(a));
-  if (inlineFlag) {
-    reason = reason ?? `Server runs an inline command via ${inlineFlag}.`;
-    evidence.push({
-      type: "config",
-      path: server.sourceConfigPath,
-      key: "args",
-      value: inlineFlag
-    });
+  if (INLINE_EVAL_INTERPRETERS.has(cmd)) {
+    const inlineFlag = server.args.find((a) => INLINE_EXEC_FLAGS.has(a));
+    if (inlineFlag) {
+      reason = reason ?? `Server runs an inline command via ${command} ${inlineFlag}.`;
+      evidence.push({
+        type: "config",
+        path: server.sourceConfigPath,
+        key: "args",
+        value: inlineFlag
+      });
+    }
   }
   if (evidence.length === 0) return [];
   return [
@@ -1028,8 +1042,7 @@ function computeRiskClass(findings, binding) {
 // ../../packages/risk-engine/src/computeVerdict.ts
 function computeVerdict(findings, binding) {
   if (findings.some((f) => f.blocker)) return "BLOCK";
-  const unverifiable = !binding.sourceKnown && (Boolean(binding.remoteUrl) || binding.runtimeExecutable);
-  if (unverifiable) return "UNKNOWN";
+  if (!binding.sourceKnown) return "UNKNOWN";
   if (findings.some((f) => f.severity === "high" || f.severity === "critical")) {
     return "REVIEW";
   }
@@ -1394,7 +1407,7 @@ function parseConfigText(text, configPath = "<inline>") {
 function aggregate(configPath, reports, generatedAt) {
   const counts = { SAFE: 0, REVIEW: 0, BLOCK: 0, UNKNOWN: 0 };
   for (const r of reports) counts[r.verdict]++;
-  const verdict = mostSevereVerdict(reports.map((r) => r.verdict));
+  const verdict = reports.length === 0 ? "UNKNOWN" : mostSevereVerdict(reports.map((r) => r.verdict));
   return {
     schemaVersion: "calllint.report.v0",
     reportKind: "config-summary",
@@ -1860,7 +1873,7 @@ function renderSarif(summary) {
 }
 
 // ../../packages/report-renderer/src/logoBase64.ts
-var LOGO_REPORT_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAMAAABg3Am1AAADAFBMVEX+/v7+/v3VAADbChn+///9/f39+/v////+/f3+/Pz9/PzYAAraChn+/f7++/zWAADXAAfbDRzXAAraCxn9+vvbDBv9+vrZARHaDh3YAA7aCxvaDRz87O7bDhzZAQ/fKDXZBhTXAA3bEB/XAAX99vfcGCbaAxLaBhXYAAj9+fnnXmfZBQ/aCRb9/f7bChnZBBTaDRrfJTHZAA387u7eIC763+DcFiL519r41tjYAA3wnKLxqK3YAAvWAAbiPUjcEyD9+Pn76evZAxDZBRP3ys3pcXnnY2zkS1b//v776+zcGSbiO0biRE/ulJvqcnvXAALjQk39/v7tipHZCRj++vvaCRj+/P3qdn7pbXXcFCL75+noanPUAADkUlzxpqzoZ3D76Or409bYAAz2xsn53d/++vr3yczyrbH41NfnYmzfKjb52NrlVWD++PjmYGjWAAPyqq/dIy/86uzsgIfZCBbWAALaDhnkTVjiPUnyr7P89PXiQEzYAAPkRlL2xMjlU17hOUX1wcX2x8rtjJLjSVTpb3jcDh3lTFfgMT30trvsgorlUVzqe4Ppa3P0ub3siZDtjpTZAArth43ztLjre4P64eT75ebdJDHaExvvkZjeJDD98vPdHyz++frreIDtjJPvmaD5293qd3/vmqDnY23fMz/rfYbnYGraFiLmX2jdGyfaFh/gLTnkUVvnZW740dPhPUjpbnbumJ7reYL87u/hOUTiSVLlVmHbEB753N/fLzzcER/eLDbiQEr64OL88PH52dvnaHHXAAnbCRn0vcHzsrb+//7zsbbjUFfwpKnjTFLrdn71ur7lW2X++fr89fbqdH398/PztbndHivzrbP0trzuipHwnqT3ztH75ujwo6jgNUHyqq/52tzwoabtjpX2zND//f7vkpjqfYTeMz3vlZv1vMDdJjTdJzPnXWjzsrfdIi3tjJXzsrnqdHzhOEL1vMHkVWDZEB7ulZvVAALnbXXaFiTdGCbtkpnWAQr99fXZDBbshIv1wcblWGPhP0ryJPiiAAAACXBIWXMAAAsSAAALEgHS3X78AAAEpUlEQVRIx41WB1QUVxSdnf0798/u4hbqsouURYrAAQkR6bjUpYurBBQFg6DYIFgCBhRL7L1jj6iADdTYY0mvJ72YnPQeU000MYkxw4ZDwB0W35wz55+ZV+79/857wzA9TcaEdK8YRsLYsRHC1W0hzAgZZbqDRcw2lyXRTnZq84TDR3tgkTH9WLcDT05u2fEQ4Xs/p31X5HBFrZ4Mjt5Teoa64I8ZmXd+2w0nagd2dxDPIfpWwuWzLbHHwcnvzmbjT10csPbWX7cvljXM1q4B40QldjfVSQ5D86xDjdPOXfizoWXWt2bwTg72mIB+56laenl7u6sp89Le/ew3tRR9HoGMEt+KemNQjiXy8MCZwa6Vw+hjQXFZFa8SKutypN3grazkOBvsPa8U+6576drzooLdjmPSae+wYeBtklvXlJK6r88hea7WpPAs21SpMGnby8n+al8iE6fBJZISn0xfT6PGM6WIkJLXKvXGLYHtCZtJIifOOB3L2Y3m82ED18Mil3NYo3MvvPq5qgbp6XdroRMSX5U91dhm+HKds1dCKXieRBZ6eaz77GSb8ZfscYTa6IFhnshNqr8YmRGqdFM8gAEcFj+pcfQfNOX+eq8ZP4G3lTjJcjtGGiNM7k9JQyMMhBiaQh1HOSdVNyK58GHRgLk+6TlqL41SKpX6LQOednUUVhovdUpixuM2ATJrQOCcCR6mkXqlR0A+kB+ll2pG6dyi0uoGzRevcJ47bYxfaQr393BdBYyJOuM/wXTiTu483wzxgDwf7h/Verw8p9BP9SLB82OTbqatxt/sPN/OChImRCahXTslk1hJn+GO/G4mDMqeWTuOkJiFz5XhUzI8I833Zry1gqSHvCmlmONYl1oLjnNhAEGiwu1ZF4sctdMvXT/VG5L13DgcDDd0HAXHAwPMBobcZ5YDcidcuVHi3WrLQeaCA4+UZrNfwbLgpUVbXiGYHLGoYMFE/Mz+OomtAdf7y5R0VhinimlQDb66IlRhiksjKJ5hig1dUdKqul3FxnQGSHoIXJAvjymxq8xuGUMCpGFuusFAqtZHo1Q0tfkYxnuX2kJiKHE5fG3nEkWwcNRh2gJgpVavlDoHK5YEVlfyRKTNcDiRWx4T+6hSKagvGnhB5y6oxENRlazaCLEPgscxReu0piRnqaC5ZGCY80ip1NlvyLTWCe+JIOoEhSPasugAvdLddWmg0L/jB7pLNQHRe72LIbf1ttJuCJjqEK/ThymWg3PCQoVGr8scPVX9oEiA5L+uMV71RmTYTP+hZeBHY3OGv9SxdAM7XhyQFVPRm0OHv69z3YZAygRin1/4u+aWHUXos4tzeFudhwNxg8vBy/FJs3oXyVKvhqV3O6b/y1BmQT6bisXszI+BbEd2DI6O3Q3OzqijctLBpuBHtbZimc7YgQL2RheBviYqpfx0Ngc1xmueubsE/+kWGe1nztGJzQKqPUGKbbjCHtzJ0P4mI09pzthTEzdUORSzKTzlmX6N8vg+7sKmki9mvYPRlLkHE4boD1u3Hpr9VtcY7T9IGKMfzv9gCuwPq17Tl8Pr2+3tvyh1eZ8vHWz+PCRdnUTM/gUe0BB8YRiSMgAAAABJRU5ErkJggg==";
+var LOGO_REPORT_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAKdElEQVRo3u1aeXAT1xlf35cs2bJ8yJYtbGxjG+rgkJCjdaBMSYBAhstAhwSYZDJ105CGnBwNSUlKmibNJDR0GJrJQELb1C2kgQ6dtJwFAgFyTAB7tVpprdvyjW3Zkvb4+r2nAzVtZ/qHhO2ZLrOjZd/bx/f73u87Hwzz/+u/X8AwSeSezABSgJmVNikFJ7+m3PINnLq8NfbdpKAN+f1So8kTVAarNbfM9YWqpDB2bFJo36Iu32tP14EDb4umYh9510YpNYFBoHCp5JfTGTc5GA103vU9qbN5gWTHZ0tB1WYydhLnTDgQRKCTYeHZwurHhLRC4HVTZD/LKX7eqpiLqmQhTQfmgsofRUC8yDDJE0H2pFhacAVVzwtIGXNOsTxy6qwS7LRDwCLAyJlPFbNKL9sQBKub8sI3QY+jiwxp0W5o0Jq0Vb91JuUBX2CURk6eUZQxPwgzm8E64w6QfT4EcV7hdZWSMxnnaCvbWH2tLrxOctt4eiizvnYpn1NmcTLZ0Nl4t0hoIw8Ng+2ehWBKzgdTSj7Yvn0vSIPXwc/xSmfTd0Qy15xTKphLqlvGxR44pjqD05St4LJLT9iIsabrlK4nt0iKKIG/gwNhxl3A4m6YMouAyyqmQKwNs8HfzoIiy+B9drskZOgUG6MGNlt/ukNTtlJgjJkRWiZM8IjhsZqKSkd26ag7txycyx6Sxr6+KgNeA3v3AZdXAaaMQmBRONs9C8A+bwk+5wKXWQycphz697xHpsLYlQ7ZuWKd5FYZwJZTOnxFa6yPUCrhQepqwxwVarjdOWsukUUeu/g52Ocuhg4mh1KGRYpY62+HgLUTgjYHCA130HcsjpE5tuaFMPrZZUDUsvPO+fhOY/bMfzAnocGOGNpVhkmnQapyRjHL5PW65iwC0TeqWOtvQyHSwZxrAKHudvBu2gqixwsKoiO36O2G7mdeAKF+NnA4h8y11MwEyR9QXN8lwNU9jurZBqoc/DcSZtQR7VhLan9mYzLAu/WnstjTA3y+EThVKZiYPOh99ZeUIooogixJoRufydX72lu4E3k4twy9VRUEPV3g3fYyBroM6CyZ9mosTePOffQaq0xq/UY2u/SQBenAl9UqYm8fDOz+DQqeg9ovA1N6IQlW4L/aHgKBwtMbnwNo3GZdVWiOuhy/yYaBXXtA7OsHS9k0wDUVdAqHTGrDRlOO4ftxoVPsAi5V6YnBHAO4NBWSY/5SOSjYqMfh9bVgwgDFZeuRHuWU696Nz4Z34Yb2vU9uRqpkUZpxOaXApRcBX1ILAZaDINqK/d7lijvPKA2gUbtVZefiYtCxAFDIY47iGhj78usA0ajv9DmwVjZSo+VyysCcpUffrgdTqo6+l3B3ojaAWrZWN9ExKnxWCZiRRqbUArBMvQV8p85SkL4LlwLOiukITncm7gDY5PwTbkMDKIoieZ/ahtrMoO6SahS1b47eKGCKFoaP/h0i18jx0xgLtFR4c+xc/Jas0cFk4g5tQXc2JnVV34pz884lAID2hAcBoOeQnA+sQaqokMsGYDE1MKFGuQgQNaFRJvT94u0oAPJMYwHSw0xAkLn4DZusprGBjDnvXwXSyEgYgDb+ALhk7fGu8umE05Jr9cOotTSwNy+A7m0vI40QBBEQeW0mAiXlg/exp6MAPPhMhDRrKugcAp5NzYPuLTvAhq64A9Mq18p1IPl8CKApQQBStcc9BgQQDEquNY9AOw73hV2m728nwLVkDfCFU4FL09Ixx+LllP/kcixdDejf0QMVgLmwGsdWwcgnx0Ou9ZXX4RqORQFMRQApCQGgO+Ypa8AdCErOZWvBgh5E7OkNGaoSEpVE3uHDR6HvzXdg8Hd/jBrx4IcHoe+NXTD88VE6h16yEjLw7h7qyQgoaXRUclfeQmzoH3FLKyIg0IN87CmZBuLwsOR+5HEYOnQkJAcJWOQOBqNAIhf5+7+9wz90bjjQkWvooyPg2tAK4uCgRByFKa3gaNwARMK6Ob14X7fGCGJvr+h94nnwPPpEFIASFiTi+0mAE3v7QwCIlvv76Ts5Zh6N0MFQjPC0PgUejB3Brm7Jie4VM9j347kDtGrC7sIrXiwVx65cE/t/tZfy1nfsVEhoFGT0/EXoeW47OBauBB557Fr7aNQG3A8/DpYpjeBY1ALdOIfMVXAXqP0cO03X6seIPnrlmuQk9bOmfEes8uLSZbAXVa/txEg6+Ps/yaNnL1BD9az7AYjuLnAtexDQRsIZpwbHMsFxf0sUgHPFQ/guhXoelmSsGLnJN2JXN7jXt9K1fGc+xbUPSS70UILOuCZuvaTINrprmuo5JjtI0gQ0XgUbVmh800CovRWFyqL+ncN8KOTX1eBGcFE3ijbTQaqwPGM08NGUu3om5lR1YM4n1OxTvEgljCFjjsoZjXE34qstLel8Uv4XHqysJL9fdi1eTYXgsopionEJBUGEJVSJXCRWkDqAi43auZTrdA0X8UC4pnvGncAzmq/a2tpSEtKs6sw17PRgkPKdvyhdR9dI6MDjTtBELnKHE7rBd/dHAQwe+AO+09A0+l/SDnVo7lDbRzBy4RLSB8tTjWFn3Pj/TRo5jQ0zeSY74EHeYt6iWGuaaEJGEjMiUGyiNvrZ51EA/mtsKN3OihGegMFvrUhBspZ7XSuYmWy/raJuVkJKy2gxk1lyyIUC+M0WaeDd9yn/I9QgGiYFfGdTM8iBQDQOEJ9P0g5TeBdCFCqn3w7iGmMmXnJhEtiZrT+YsLIyohGLvr7ZwqhE16r1GJFkxd58HzVaCgK1TCjRu+O1G0Eu7OtJJCZj1F7wJt/Ysd0CkqQ4V64HsqZJX9Oc0MI+srCQa9jrRm0OHfmrGOgwoUBYTpKuQwYWKUVVtBt3oyKjDQsQnS7gS2swmSsM0U2Fu3ilHa4fPioS7pM1b1pXQjA2lAipOqvDUA+BLq98/YMPqUZNaOD9b+8JaZ9QCHtAhELkOdp2SSlAKqlg8L0DEPR2yzZcA9fi2yvq9DelBR9tnxfXLRYYteyYt4SoWOnZvpMGMOL/ScsksgOR9GH08lcYDzbS4qVn80ukpaLY5j2gWBm1xJfULEq49v9TfmTRVm4lkdOz4YeU6N4fb6ZpgQljQ9+bu6NeqP8dLPyx3CRjXeE6AYMbthixKNJWbhmXE5yoUedX/NqDgmCCR5Ob7md+QrVMAtfQwcMwgqUloRfpBXk3PgfhOUE3juPBx56EtVL+1xPItpaWFHSJBzwoEO5AkNLppZ+HmldV36IdOlJxEdqQMe/TRHgV8JryAyfnzCGJ4vidZEZAnGTmpPKaiv0ERJhOysDe/cCma7C8xP7PW9Swla7WTVTzGL0/uDyLnl6O/zEsEYBQABhI4jXGXU4U0HnfckkKBOThv3yCacKfMVzIsmvZWnSXGAfyp+wG3LUJdYYcFibUucazMIFRyY7GuxW/zS4FPF2S/ba5ikAMVjd1W8R+JuJhX1LEO+Hpy1ILo+l1ldaBGzsZPJPbz+qmrposJ5UhF1vaWMum6y5g5L0kGKfXT7bDbkonL54jcNWz1XFPj2/GRQz7xTDXYYIcqU7I/63yT1NyvbeodjVcAAAAAElFTkSuQmCC";
 
 // ../../packages/report-renderer/src/renderHtml.ts
 function esc(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "calllint",
-  "version": "0.3.0-preview.1",
+  "version": "0.3.0-rc.1",
   "description": "Evidence-backed security verdicts for MCP servers and agent tools. Lint agent tool-call risk before tools run — SAFE / REVIEW / BLOCK / UNKNOWN, with evidence. Never executes the server it judges.",
   "keywords": [
     "mcp",