calllint 0.6.0 → 0.7.0

package/dist/index.js

@@ -91,6 +91,7 @@ SCAN OPTIONS
   --sarif            Emit SARIF 2.1.0 (GitHub Code Scanning / CI)
   --markdown         Emit Markdown for PR comments / GitHub Step Summary
   --html             Emit a self-contained HTML report
+  --badge            Emit a shields.io endpoint badge JSON (SAFE/REVIEW/UNKNOWN/BLOCK)
   --policy <file>    Use a policy file (default: built-in defaults)
   --stdin            Read config JSON from stdin
   --ci               Exit non-zero per policy (BLOCK=30, UNKNOWN=20, REVIEW=10 if enabled)
@@ -110,6 +111,7 @@ EXAMPLES
   calllint scan-all --no-emoji
   calllint check ./mcp.json --json
   calllint scan .cursor/mcp.json --markdown
+  calllint scan .cursor/mcp.json --badge > calllint-badge.json
   calllint verify ./mcp.json --ci
   calllint approve && calllint verify --approved --ci
   calllint explain filesystem
@@ -767,6 +769,25 @@ function looksSecret(key) {
   const upper = key.toUpperCase();
   return SECRET_HINTS.some((h) => upper.includes(h));
 }
+function extractDockerEnvKeys(args) {
+  const keys = [];
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    let spec;
+    if (arg === "-e" || arg === "--env") {
+      spec = args[i + 1];
+      i += 1;
+    } else if (arg.startsWith("-e=")) {
+      spec = arg.slice("-e=".length);
+    } else if (arg.startsWith("--env=")) {
+      spec = arg.slice("--env=".length);
+    }
+    if (spec === void 0) continue;
+    const eq = spec.indexOf("=");
+    keys.push(eq === -1 ? spec : spec.slice(0, eq));
+  }
+  return keys;
+}
 function detectSecretEnvKeys(ctx) {
   const { server } = ctx;
   const evidence = [];
@@ -781,6 +802,21 @@ function detectSecretEnvKeys(ctx) {
       });
     }
   }
+  if ((server.command ?? "").toLowerCase() === "docker") {
+    const already = new Set(server.envKeys);
+    for (const key of extractDockerEnvKeys(server.args)) {
+      if (already.has(key)) continue;
+      already.add(key);
+      if (looksSecret(key)) {
+        evidence.push({
+          type: "config",
+          path: server.sourceConfigPath,
+          key: "args",
+          value: key
+        });
+      }
+    }
+  }
   if (evidence.length === 0) return [];
   return [
     {
@@ -3361,6 +3397,32 @@ function mdCell(s) {
   return s.replace(/\|/g, "\\|").replace(/\n/g, " ");
 }
 
+// ../../packages/report-renderer/src/renderBadge.ts
+var BADGE_COLOR = {
+  SAFE: "brightgreen",
+  REVIEW: "yellow",
+  UNKNOWN: "lightgrey",
+  BLOCK: "red"
+};
+var BADGE_MESSAGE = {
+  SAFE: "SAFE",
+  REVIEW: "REVIEW",
+  UNKNOWN: "UNKNOWN",
+  BLOCK: "BLOCK"
+};
+function renderBadge(summary) {
+  return JSON.stringify(badgeEndpoint(summary.verdict), null, 2);
+}
+function badgeEndpoint(verdict) {
+  return {
+    schemaVersion: 1,
+    label: "CallLint",
+    message: BADGE_MESSAGE[verdict],
+    color: BADGE_COLOR[verdict],
+    cacheSeconds: 3600
+  };
+}
+
 // ../../packages/report-renderer/src/renderDiagnostics.ts
 function verdictContributionFor(f) {
   if (f.blocker) return "blocker";
@@ -3736,6 +3798,7 @@ function renderSummary(summary, args) {
   if (flagBool(args.flags, "json")) return renderJson(summary);
   if (flagBool(args.flags, "sarif")) return renderSarif(summary);
   if (flagBool(args.flags, "markdown")) return renderMarkdown(summary);
+  if (flagBool(args.flags, "badge")) return renderBadge(summary);
   if (flagBool(args.flags, "html")) return renderHtml(summary);
   if (flagBool(args.flags, "compact")) return renderCompact(summary, style);
   return renderTerminal(summary, style);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "calllint",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Evidence-backed security verdicts for MCP servers and agent tools. Lint agent tool-call risk before tools run — SAFE / REVIEW / BLOCK / UNKNOWN, with evidence. Never executes the server it judges.",
   "keywords": [
     "mcp",