mcp-app-lint 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 render-policy contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,85 @@
-# Temporary Holding Version
+# mcp-app-lint
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+SARIF findings about what an MCP App declares and what its HTML does. Meant to be run by MCP
+scanners and CI, or by hand on a package, a directory, or the JSON a server returned.
+
+```
+npx mcp-app-lint --dir ./my-server                    # a package directory, built or source
+npx mcp-app-lint --package @scope/name                # an npm package: downloaded, scanned, deleted
+npx mcp-app-lint --read read.json --list list.json --tools tools.json
+                                                      # results of resources/read, resources/list, tools/list
+npx mcp-app-lint --html app.html                      # one UI document
+```
+
+Options: `--out file.sarif`, `--format sarif|text`, `--fail-on error|warning|note|none` (default
+`error`; the exit code is 1 when a finding reaches the threshold, 2 on usage errors).
+
+## Use in CI (GitHub code scanning)
+
+This repository ships a composite action that runs the scanner and uploads the SARIF to code
+scanning, so findings appear in the Security tab and on pull requests:
+
+```yaml
+# .github/workflows/mcp-app-lint.yml
+name: mcp-app-lint
+on: [push, pull_request]
+permissions:
+  contents: read
+  security-events: write   # required for the SARIF upload
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: shteynu/render-policy@v1
+        with:
+          directory: .
+          fail-on: error     # error | warning | note | none
+```
+
+Inputs: `directory` (default `.`), `fail-on` (default `error`), `upload-sarif` (default `true`),
+`sarif-file` (default `mcp-app-lint.sarif`), `version` (npm dist-tag or version, default `latest`),
+`args` (passed through), `node-version` (default `22`, empty to use the runner's Node). The SARIF
+is written even when findings fail the job, so it still uploads; paths are repo-relative so code
+scanning maps them to the source.
+
+Any CI can run the CLI directly and read the exit code (`0` clean, `1` findings at or above
+`--fail-on`, `2` usage error):
+
+```
+npx mcp-app-lint --dir . --format sarif --out mcp-app-lint.sarif --fail-on error
+```
+
+## Rules
+
+| Id | Name | Level | What it means |
+| --- | --- | --- | --- |
+| MCPAPP001 | csp-missing | warning | no `ui.csp`; a compliant host applies `default-src 'none'`, `connect-src 'none'` |
+| MCPAPP002 | csp-allows-every-host | error | `*` or a scheme-only entry (`https:`) expands to every host |
+| MCPAPP003 | csp-wildcard-host | warning | `*.example.com` allows every subdomain |
+| MCPAPP004 | csp-insecure-scheme | warning | `http:` origin |
+| MCPAPP005 | csp-sink-host | error | host on the sink denylist (request catchers, tunnels, form builders, public buckets) |
+| MCPAPP006 | csp-development-origin | note | localhost, 127.0.0.1, `blob:` in published metadata |
+| MCPAPP007 | permissions-sensitive | note | camera, microphone or geolocation requested |
+| MCPAPP008 | tool-side-effects-app-visible | warning | tool without `readOnlyHint` callable by the app |
+| MCPAPP009 | tool-visibility-implicit | note | tool with UI metadata relies on the default `["model", "app"]` |
+| MCPAPP010 | html-dynamic-innerhtml | warning | hand-written inline script assigns dynamic content to an HTML sink (with line and column) |
+| MCPAPP011 | html-postmessage-wildcard | warning | hand-written `postMessage(…, '*')` |
+| MCPAPP012 | html-inline-handlers | note | `on*` attributes |
+| MCPAPP013 | html-eval | warning | `eval` or `new Function` in hand-written script |
+| MCPAPP014 | html-form-action | note | a form that posts somewhere |
+| MCPAPP015 | html-external-host | note | scripts, styles, images or media from external hosts |
+| MCPAPP016 | html-sink-host | error | a URL in the document points at a sink host |
+| MCPAPP017 | meta-list-read-mismatch | warning | `resources/read` declares a different policy than `resources/list` |
+| MCPAPP018 | meta-read-wider-than-list | error | the read-time policy adds domains or wildcards the listing did not declare |
+
+Hand-written means an inline script with short lines and not too many of them; bundles carry
+framework internals and the SDK bridge (which posts to `'*'` by design) and are not reported
+for MCPAPP010, MCPAPP011 and MCPAPP013.
+
+The rules come out of the [MCP Apps UI census](../../census) in this repository; the analyzer is
+shared. The HTML sink detection is `eslint-plugin-render-policy`'s `no-unsafe-innerhtml`. The sink
+denylist is `@render-policy/core`'s. The package also exports the analysis functions (`analyzeHtml`,
+`analyzeUiMeta`, `compareListRead`, `scanPackageDir`, …) and `categorizeDomain`, the heuristic host
+category (fonts, analytics, maps, storage, media, cdn, api, …) the census report tabulates; it is
+data for aggregates, not a rule.

package/bin/mcp-app-lint.mjs

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { run } from '../src/cli.mjs';
+
+run(process.argv.slice(2)).then(
+  (code) => process.exit(code),
+  (error) => {
+    process.stderr.write(`mcp-app-lint: ${error.message}\n`);
+    process.exit(2);
+  },
+);

package/package.json

@@ -1,6 +1,45 @@
 {
   "name": "mcp-app-lint",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "SARIF findings about what an MCP App declares (CSP domain lists, permissions, tool visibility) and what its HTML does (innerHTML sinks, postMessage to '*', external hosts, data sinks).",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "mcp-app-lint": "./bin/mcp-app-lint.mjs"
+  },
+  "exports": {
+    ".": "./src/index.mjs"
+  },
+  "files": [
+    "bin",
+    "src",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "node --test test/*.test.mjs"
+  },
+  "engines": {
+    "node": ">=22.12"
+  },
+  "dependencies": {
+    "@render-policy/core": "^0.1.0",
+    "eslint": "^10.11.0",
+    "eslint-plugin-render-policy": "^0.1.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "mcp",
+    "mcp-apps",
+    "sarif",
+    "security",
+    "csp",
+    "lint"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/shteynu/render-policy.git",
+    "directory": "packages/mcp-app-lint"
+  }
+}

package/src/analyze.mjs

@@ -0,0 +1,195 @@
+/**
+ * Pure analysis over what a server or package declares: the `_meta.ui` of its UI resources,
+ * its tools, and the HTML of the resources themselves. No network here.
+ */
+import { createRequire } from 'node:module';
+import { classifyDomains } from './domains.mjs';
+
+const require = createRequire(import.meta.url);
+
+const CSP_KEYS = ['connectDomains', 'resourceDomains', 'frameDomains', 'baseUriDomains'];
+const PERMISSION_KEYS = ['camera', 'microphone', 'geolocation', 'clipboardWrite'];
+export const UI_MIME = 'text/html;profile=mcp-app';
+
+/** `_meta.ui` in the modern shape, or the legacy flat `ui/...` keys folded into one object. */
+export function uiMetaOf(meta) {
+  if (!meta || typeof meta !== 'object') return null;
+  const modern = meta.ui && typeof meta.ui === 'object' ? { ...meta.ui } : {};
+  for (const [key, value] of Object.entries(meta)) {
+    if (key.startsWith('ui/')) modern[key.slice(3)] = value;
+  }
+  return Object.keys(modern).length > 0 ? modern : null;
+}
+
+export function analyzeUiMeta(meta) {
+  const ui = uiMetaOf(meta);
+  const csp = ui?.csp && typeof ui.csp === 'object' ? ui.csp : null;
+  const domains = {};
+  for (const key of CSP_KEYS) domains[key] = classifyDomains(csp?.[key]);
+  const permissions = ui?.permissions && typeof ui.permissions === 'object' ? PERMISSION_KEYS.filter((k) => k in ui.permissions) : [];
+  return {
+    hasUiMeta: ui !== null,
+    cspDeclared: csp !== null,
+    cspEmpty: csp !== null && CSP_KEYS.every((k) => !Array.isArray(csp[k]) || csp[k].length === 0),
+    domains,
+    anyWildcard: CSP_KEYS.some((k) => domains[k].wildcards > 0),
+    anyFullWildcard: CSP_KEYS.some((k) => domains[k].fullWildcards > 0),
+    anyInsecure: CSP_KEYS.some((k) => domains[k].insecure > 0),
+    sinks: CSP_KEYS.flatMap((k) => domains[k].sinks),
+    permissions,
+    domain: typeof ui?.domain === 'string' ? ui.domain : null,
+    prefersBorder: ui?.prefersBorder === true,
+  };
+}
+
+function canonical(value) {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(Object.keys(value).sort().map((k) => [k, canonical(value[k])]));
+  }
+  return value;
+}
+
+/** Does `resources/read` declare a different policy than `resources/list`? The host that checked list is then wrong. */
+export function compareListRead(listMeta, readMeta) {
+  const a = uiMetaOf(listMeta);
+  const b = uiMetaOf(readMeta);
+  if (!a && !b) return { comparable: false, mismatch: false };
+  const pick = (m) => (m ? { csp: m.csp ?? null, permissions: m.permissions ?? null, domain: m.domain ?? null } : null);
+  const left = JSON.stringify(canonical(pick(a)));
+  const right = JSON.stringify(canonical(pick(b)));
+  const readWider = (() => {
+    if (!a?.csp || !b?.csp) return false;
+    return CSP_KEYS.some((k) => (b.csp[k]?.length ?? 0) > (a.csp[k]?.length ?? 0) || (b.csp[k] ?? []).some((d) => String(d).includes('*') && !(a.csp[k] ?? []).includes(d)));
+  })();
+  return { comparable: true, mismatch: left !== right, readWider, listOnly: !!a && !b, readOnly: !a && !!b };
+}
+
+export function analyzeTools(tools) {
+  const list = Array.isArray(tools) ? tools : [];
+  let withUi = 0;
+  let visibleToApp = 0;
+  let sideEffectsVisibleToApp = 0;
+  let appOnly = 0;
+  for (const tool of list) {
+    const ui = uiMetaOf(tool?._meta);
+    if (!ui) continue;
+    if (ui.resourceUri) withUi += 1;
+    const visibility = Array.isArray(ui.visibility) ? ui.visibility : ['model', 'app'];
+    const app = visibility.includes('app');
+    if (app) visibleToApp += 1;
+    if (app && !visibility.includes('model')) appOnly += 1;
+    const readOnly = tool?.annotations?.readOnlyHint === true;
+    if (app && !readOnly) sideEffectsVisibleToApp += 1;
+  }
+  return { total: list.length, withUi, visibleToApp, appOnly, sideEffectsVisibleToApp };
+}
+
+let linter = null;
+function lintInlineScript(code) {
+  if (!linter) {
+    const { Linter } = require('eslint');
+    const plugin = require('eslint-plugin-render-policy').default;
+    const instance = new Linter({ configType: 'flat' });
+    const config = [
+      {
+        files: ['**/*.js'],
+        plugins: { 'render-policy': plugin },
+        rules: { 'render-policy/no-unsafe-innerhtml': 'error' },
+        languageOptions: { ecmaVersion: 2024, sourceType: 'module', parserOptions: { ecmaFeatures: { jsx: true } } },
+      },
+    ];
+    linter = (source) => instance.verify(source, config, { filename: 'inline.js' });
+  }
+  return linter(code);
+}
+
+const SCRIPT_RE = /<script\b([^>]*)>([\s\S]*?)<\/script>/gi;
+const URL_ATTR_RE = /\b(?:src|href|action|poster|data)\s*=\s*["']([^"']+)["']/gi;
+
+/** Static signals in a UI resource's HTML. Heuristic by design; the report says so. */
+export function analyzeHtml(html) {
+  const text = String(html ?? '');
+  const result = {
+    bytes: text.length,
+    inlineScripts: 0,
+    handwrittenScripts: 0,
+    externalScripts: [],
+    unsafeInnerHtml: 0,
+    unsafeInnerHtmlHandwritten: 0,
+    evalLikeHandwritten: 0,
+    postMessageStarHandwritten: 0,
+    lintErrors: 0,
+    unparsedScripts: 0,
+    inlineHandlers: (text.match(/\son[a-z]+\s*=/gi) ?? []).length,
+    sinks: [],
+    evalLike: (text.match(/\beval\s*\(|new\s+Function\s*\(/g) ?? []).length,
+    postMessageStar: (text.match(/postMessage\s*\([^)]*['"]\*['"]/g) ?? []).length,
+    forms: (text.match(/<form\b/gi) ?? []).length,
+    formsWithAction: (text.match(/<form\b[^>]*\baction\s*=/gi) ?? []).length,
+    metaCsp: /<meta\b[^>]*http-equiv\s*=\s*["']content-security-policy["']/i.test(text),
+    externalHosts: [],
+    sinkHosts: [],
+  };
+  const hosts = new Set();
+  for (const match of text.matchAll(URL_ATTR_RE)) {
+    const value = match[1];
+    if (!/^(https?:)?\/\//i.test(value)) continue;
+    try {
+      hosts.add(new URL(value.startsWith('//') ? `https:${value}` : value).hostname.toLowerCase());
+    } catch {
+      /* ignore */
+    }
+  }
+  result.externalHosts = [...hosts].sort();
+  for (const match of text.matchAll(SCRIPT_RE)) {
+    const attrs = match[1] ?? '';
+    const body = match[2] ?? '';
+    const src = /\bsrc\s*=\s*["']([^"']+)["']/i.exec(attrs)?.[1];
+    if (src) {
+      result.externalScripts.push(src);
+      continue;
+    }
+    const type = /\btype\s*=\s*["']([^"']+)["']/i.exec(attrs)?.[1]?.toLowerCase();
+    if (type && !/javascript|module|ecmascript/.test(type)) continue;
+    result.inlineScripts += 1;
+    // A bundled or minified script mostly carries framework internals; "handwritten" scripts
+    // (short lines, few of them) are what the app author wrote and can change.
+    const handwritten = isHandwritten(body);
+    if (handwritten) {
+      result.handwrittenScripts += 1;
+      result.evalLikeHandwritten += (body.match(/\beval\s*\(|new\s+Function\s*\(/g) ?? []).length;
+      result.postMessageStarHandwritten += (body.match(/postMessage\s*\([^)]*['"]\*['"]/g) ?? []).length;
+    }
+    try {
+      const messages = lintInlineScript(body);
+      const fatal = messages.filter((m) => m.fatal);
+      if (fatal.length > 0) {
+        result.unparsedScripts += 1;
+        continue;
+      }
+      const hits = messages.filter((m) => m.ruleId === 'render-policy/no-unsafe-innerhtml');
+      result.unsafeInnerHtml += hits.length;
+      if (handwritten) result.unsafeInnerHtmlHandwritten += hits.length;
+      const scriptLine = text.slice(0, match.index).split('\n').length + (match[0].slice(0, match[0].indexOf('>') + 1).split('\n').length - 1);
+      for (const hit of hits) result.sinks.push({ line: scriptLine + hit.line - 1, column: hit.column, handwritten, message: hit.message });
+    } catch {
+      result.unparsedScripts += 1;
+    }
+  }
+  return result;
+}
+
+/** Short lines and not too many of them: written by a person, not emitted by a bundler. */
+export function isHandwritten(code) {
+  const lines = code.split('\n');
+  const longest = Math.max(0, ...lines.map((l) => l.length));
+  const average = code.length / Math.max(1, lines.length);
+  return longest < 2000 && average < 200 && lines.length < 3000;
+}
+
+/** Everything the HTML analysis reports about hosts, joined with the sink denylist. */
+export function withSinkHosts(analysis) {
+  const { sinkFor } = require('./domains.mjs');
+  return { ...analysis, sinkHosts: analysis.externalHosts.filter((h) => sinkFor(h) !== null) };
+}

package/src/cli.mjs

@@ -0,0 +1,105 @@
+/**
+ * mcp-app-lint: SARIF findings about what an MCP App declares and what its HTML does.
+ *
+ *   mcp-app-lint --dir ./my-server                 # a package directory (built or source)
+ *   mcp-app-lint --package @scope/name             # an npm package (downloaded, scanned, deleted)
+ *   mcp-app-lint --read read.json [--list list.json] [--tools tools.json]
+ *                                                  # results of resources/read, resources/list, tools/list
+ *   mcp-app-lint --html app.html                   # one UI document
+ * Options: --out file.sarif, --format sarif|text (default sarif), --fail-on error|warning|note|none (default error)
+ */
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { UI_MIME } from './analyze.mjs';
+import { lintHtml, lintPackageScan, lintResource, lintTools, levelOf } from './lint.mjs';
+import { packageMeta, scanPackage, scanPackageDir } from './npm.mjs';
+import { toSarif, toText } from './sarif.mjs';
+
+const LEVEL_RANK = { error: 3, warning: 2, note: 1, none: 0 };
+
+function parseArgs(argv) {
+  const options = { format: 'sarif', failOn: 'error' };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    const next = () => argv[++i];
+    if (arg === '--dir') options.dir = next();
+    else if (arg === '--package') options.package = next();
+    else if (arg === '--read') options.read = next();
+    else if (arg === '--list') options.list = next();
+    else if (arg === '--tools') options.tools = next();
+    else if (arg === '--html') options.html = next();
+    else if (arg === '--out') options.out = next();
+    else if (arg === '--format') options.format = next();
+    else if (arg === '--fail-on') options.failOn = next();
+    else if (arg === '--help' || arg === '-h') options.help = true;
+    else throw new Error(`unknown argument ${arg}`);
+  }
+  return options;
+}
+
+const readJson = async (file) => JSON.parse(await readFile(file, 'utf8'));
+const isUiResource = (r) => (r?.mimeType ?? '').startsWith('text/html') || String(r?.uri ?? '').startsWith('ui://');
+
+/** A filesystem path under the working directory becomes a forward-slash repo-relative uri; anything else is unchanged. */
+function relativeUri(uri) {
+  if (typeof uri !== 'string' || !path.isAbsolute(uri)) return uri;
+  const rel = path.relative(process.cwd(), uri);
+  return rel && !rel.startsWith('..') ? rel.split(path.sep).join('/') : uri;
+}
+
+export async function run(argv, { stdout = process.stdout, stderr = process.stderr } = {}) {
+  const options = parseArgs(argv);
+  if (options.help || (!options.dir && !options.package && !options.read && !options.html && !options.tools)) {
+    stderr.write('usage: mcp-app-lint (--dir <path> | --package <name> | --read <read.json> [--list <list.json>] | --html <file>) [--tools <tools.json>] [--out file] [--format sarif|text] [--fail-on error|warning|note|none]\n');
+    return 2;
+  }
+  const findings = [];
+
+  if (options.dir) {
+    const scan = await scanPackageDir(path.resolve(options.dir));
+    findings.push(...lintPackageScan(scan, options.dir));
+  }
+  if (options.package) {
+    const meta = await packageMeta(options.package);
+    if (!meta.tarball) throw new Error(`${options.package}: no tarball`);
+    const work = path.join(os.tmpdir(), 'mcp-app-lint');
+    await mkdir(work, { recursive: true });
+    try {
+      const scan = await scanPackage(meta, work);
+      findings.push(...lintPackageScan(scan, `npm:${meta.name}@${meta.version}`));
+    } finally {
+      await rm(work, { recursive: true, force: true });
+    }
+  }
+  if (options.read) {
+    const read = await readJson(options.read);
+    const contents = Array.isArray(read?.contents) ? read.contents : Array.isArray(read) ? read : [read];
+    const listing = options.list ? await readJson(options.list) : null;
+    const listEntries = Array.isArray(listing?.resources) ? listing.resources : Array.isArray(listing) ? listing : listing ? [listing] : [];
+    for (const item of contents) {
+      if (!isUiResource(item) && item.mimeType !== UI_MIME) continue;
+      const entry = listEntries.find((r) => r.uri === item.uri) ?? null;
+      findings.push(...lintResource({ uri: item.uri ?? options.read, listMeta: entry?._meta ?? null, readMeta: item._meta ?? null, html: typeof item.text === 'string' ? item.text : null }));
+    }
+  }
+  if (options.html) {
+    findings.push(...lintHtml(await readFile(options.html, 'utf8'), options.html));
+  }
+  if (options.tools) {
+    const tools = await readJson(options.tools);
+    findings.push(...lintTools(Array.isArray(tools?.tools) ? tools.tools : tools, options.tools));
+  }
+
+  // Code scanning maps a SARIF location by a repo-relative path. A filesystem uri under the
+  // working directory is made relative; ui://, npm: and tools/list locations are left as they are.
+  const located = findings.map((f) => ({ ...f, uri: relativeUri(f.uri) }));
+
+  const output = options.format === 'text' ? toText(located) : `${JSON.stringify(toSarif(located, { invocation: { commandLine: `mcp-app-lint ${argv.join(' ')}` } }), null, 2)}\n`;
+  if (options.out) await writeFile(options.out, output);
+  else stdout.write(output);
+
+  const threshold = LEVEL_RANK[options.failOn] ?? 3;
+  const worst = Math.max(0, ...located.map((f) => LEVEL_RANK[f.level ?? levelOf(f.ruleId)] ?? 0));
+  return threshold > 0 && worst >= threshold ? 1 : 0;
+}

package/src/domains.mjs

@@ -0,0 +1,101 @@
+/**
+ * Classification of the domain patterns MCP Apps declare in `_meta.ui.csp`
+ * (connectDomains, resourceDomains, frameDomains, baseUriDomains). A pattern may be a bare
+ * host, a host with a scheme, a scheme alone, or carry a wildcard. Sink hosts come from the
+ * render-policy denylist: services that exist to receive whatever is sent to them.
+ */
+import { SINK_DENYLIST } from '@render-policy/core';
+
+/** Schemes that never name a network host; alone they widen nothing. */
+const LOCAL_SCHEMES = new Set(['blob', 'data', 'filesystem', 'mediastream', 'about']);
+/** Schemes whose transport is cleartext. */
+const INSECURE_SCHEMES = new Set(['http', 'ws']);
+
+const SCHEME_ONLY_RE = /^([a-z][a-z0-9+.-]*):$/i;
+const SCHEME_HOST_RE = /^([a-z][a-z0-9+.-]*):\/\//i;
+const DEV_HOST_RE = /^(localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]|.*\.localhost)$/i;
+
+export function parseDomainPattern(raw) {
+  const value = String(raw ?? '').trim();
+  const schemeOnly = SCHEME_ONLY_RE.exec(value);
+  const schemeHost = schemeOnly ? null : SCHEME_HOST_RE.exec(value);
+  const scheme = (schemeOnly ?? schemeHost)?.[1]?.toLowerCase() ?? null;
+  const withoutScheme = schemeOnly ? '' : value.slice(schemeHost?.[0].length ?? 0);
+  const hostPort = withoutScheme.split('/')[0] ?? '';
+  const host = (hostPort.startsWith('[') ? hostPort.slice(0, hostPort.indexOf(']') + 1) : hostPort.split(':')[0]).toLowerCase();
+  const localScheme = scheme !== null && LOCAL_SCHEMES.has(scheme);
+  const wildcard = host.includes('*');
+  // A bare '*' or a scheme-source such as 'https:' expands to a CSP source matching every host.
+  const full = host === '*' || (schemeOnly !== null && !localScheme);
+  const leadingWildcard = host.startsWith('*.');
+  const bareHost = leadingWildcard ? host.slice(2) : host.replace(/\*/g, '');
+  return {
+    raw: value,
+    scheme,
+    schemeOnly: schemeOnly !== null,
+    localScheme,
+    development: localScheme || DEV_HOST_RE.test(host),
+    host,
+    wildcard,
+    full,
+    leadingWildcard,
+    bareHost,
+    insecureScheme: scheme !== null && INSECURE_SCHEMES.has(scheme),
+  };
+}
+
+/** The sink denylist entry a host pattern falls under, or null. */
+export function sinkFor(host) {
+  const candidate = String(host ?? '').toLowerCase().replace(/^\*\./, '');
+  if (!candidate) return null;
+  for (const entry of SINK_DENYLIST.entries) {
+    const hostPattern = entry.pattern.split('/')[0].toLowerCase();
+    if (candidate === hostPattern || candidate.endsWith(`.${hostPattern}`)) return entry;
+  }
+  return null;
+}
+
+/**
+ * Coarse categories for the hosts apps declare or load from. Heuristic, by well-known hosts
+ * and naming conventions; a host that fits several falls into the first one listed. Used for
+ * aggregates only, so a misfiled host moves a count by one and names nothing.
+ */
+export const DOMAIN_CATEGORIES = ['every-host', 'development', 'sink', 'fonts', 'analytics', 'maps', 'storage', 'media', 'cdn', 'api', 'other'];
+
+const HOST_RULES = [
+  ['fonts', /^(fonts\.googleapis\.com|fonts\.gstatic\.com|(use|p)\.typekit\.net|fonts\.bunny\.net|rsms\.me|(use|kit|ka-f)\.fontawesome\.com|fonts\.cdnfonts\.com)$/],
+  ['analytics', /(^|\.)(google-analytics\.com|googletagmanager\.com|analytics\.google\.com|doubleclick\.net|segment\.(io|com)|mixpanel\.com|amplitude\.com|plausible\.io|posthog\.com|sentry\.io|hotjar\.com|clarity\.ms|newrelic\.com|nr-data\.net|datadoghq-browser-agent\.com|browser-intake-datadoghq\.com|events\.mapbox\.com|fullstory\.com|heap\.io|intercom\.io|launchdarkly\.com)$/],
+  ['maps', /(^|\.)(mapbox\.com|openstreetmap\.org|maptiler\.com|arcgis\.com|here\.com|tomtom\.com|geojson\.io|cartocdn\.com|stadiamaps\.com|maps\.googleapis\.com|maps\.gstatic\.com|places\.googleapis\.com)$/],
+  ['storage', /(^|\.)(storage\.googleapis\.com|firebasestorage\.googleapis\.com|amazonaws\.com|blob\.core\.windows\.net|myqcloud\.com|aliyuncs\.com|r2\.dev|r2\.cloudflarestorage\.com|digitaloceanspaces\.com|backblazeb2\.com|supabase\.co|storage\.yandexcloud\.net)$|^(s3|storage|bucket|blob|files|uploads)\./],
+  ['media', /(^|\.)(googleusercontent\.com|scdn\.co|spotifycdn\.com|licdn\.com|cdninstagram\.com|fbcdn\.net|tiktokcdn(-[a-z]+)?\.com|media-amazon\.com|ssl-images-amazon\.com|ytimg\.com|imgur\.com|giphy\.com|unsplash\.com|pexels\.com|gravatar\.com|ui-avatars\.com|replicate\.delivery|fal\.media|twimg\.com|wp\.com|slack-edge\.com)$|^(img|imgs|image|images|media|avatars?|photos?|pics?|icons?|thumbs?)(-[a-z0-9]+)?\./],
+  ['cdn', /(^|\.)(unpkg\.com|jsdelivr\.net|cdnjs\.cloudflare\.com|esm\.sh|esm\.run|skypack\.dev|jspm\.io|githubusercontent\.com|github\.io|gitlab\.io|cdn\.tailwindcss\.com|code\.jquery\.com|bootstrapcdn\.com|ajax\.googleapis\.com|gstatic\.com|cloudfront\.net|akamaihd\.net|akamaized\.net|fastly\.net|azureedge\.net|cdn\.socket\.io|polyfill\.io|vercel\.app|netlify\.app|pages\.dev)$|^(cdn|static|assets|s)\d*(-[a-z0-9]+)?\.|cdn/],
+  ['api', /^(api|apis|rest|graphql|gateway)(-[a-z0-9]+)?\d*\.|\.api\.|(^|\.)googleapis\.com$/],
+];
+
+/** Category of a parsed domain pattern (see parseDomainPattern). */
+export function categorizeDomain(pattern) {
+  const p = typeof pattern === 'string' ? parseDomainPattern(pattern) : pattern;
+  if (p.full) return 'every-host';
+  if (p.development) return 'development';
+  if (sinkFor(p.bareHost)) return 'sink';
+  for (const [category, re] of HOST_RULES) if (re.test(p.bareHost)) return category;
+  return 'other';
+}
+
+/** Category of a bare host (as found in HTML: script src, img src, …). */
+export function categorizeHost(host) {
+  return categorizeDomain(parseDomainPattern(String(host ?? '').includes('://') ? host : `https://${host}`));
+}
+
+export function classifyDomains(list) {
+  const patterns = (Array.isArray(list) ? list : []).map(parseDomainPattern);
+  return {
+    count: patterns.length,
+    wildcards: patterns.filter((p) => p.wildcard).length,
+    fullWildcards: patterns.filter((p) => p.full).length,
+    insecure: patterns.filter((p) => p.insecureScheme).length,
+    sinks: patterns.map((p) => sinkFor(p.bareHost)).filter(Boolean).map((e) => e.category),
+    hosts: patterns.map((p) => p.host),
+    categories: patterns.map(categorizeDomain),
+  };
+}

package/src/index.mjs

@@ -0,0 +1,7 @@
+export { analyzeHtml, analyzeTools, analyzeUiMeta, compareListRead, isHandwritten, UI_MIME, uiMetaOf, withSinkHosts } from './analyze.mjs';
+export { categorizeDomain, categorizeHost, classifyDomains, DOMAIN_CATEGORIES, parseDomainPattern, sinkFor } from './domains.mjs';
+export { levelOf, lintHtml, lintPackageScan, lintResource, lintTools, lintUiMeta } from './lint.mjs';
+export { downloadTarball, extractTarball, packageMeta, scanPackage, scanPackageDir, searchPackages, UI_SDKS } from './npm.mjs';
+export { RULES, RULE_INDEX, ruleByName } from './rules.mjs';
+export { toSarif, toText, TOOL_VERSION } from './sarif.mjs';
+export { run } from './cli.mjs';

package/src/lint.mjs

@@ -0,0 +1,112 @@
+/**
+ * From analysis to findings. A finding is { ruleId, level?, message, uri, region?, logical?, properties? }.
+ */
+import { analyzeHtml, analyzeTools, analyzeUiMeta, compareListRead, uiMetaOf, withSinkHosts } from './analyze.mjs';
+import { parseDomainPattern, sinkFor } from './domains.mjs';
+import { RULES } from './rules.mjs';
+
+const DEV_HOST_RE = /^(localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])$/i;
+const CSP_KEYS = ['connectDomains', 'resourceDomains', 'frameDomains', 'baseUriDomains'];
+
+const finding = (ruleId, message, uri, extra = {}) => ({ ruleId, message, uri, ...extra });
+
+/** Findings about one `_meta.ui` object (the resolved one: read, falling back to list). */
+export function lintUiMeta(meta, uri) {
+  const findings = [];
+  const ui = uiMetaOf(meta);
+  const analysis = analyzeUiMeta(meta);
+  if (!analysis.cspDeclared) {
+    findings.push(finding('MCPAPP001', 'No ui.csp declared; a compliant host applies default-src \'none\'.', uri));
+  } else {
+    for (const key of CSP_KEYS) {
+      for (const raw of ui?.csp?.[key] ?? []) {
+        const pattern = parseDomainPattern(raw);
+        const logical = { name: `csp.${key}`, kind: 'member' };
+        if (pattern.full) findings.push(finding('MCPAPP002', `${key} entry "${raw}" allows every host.`, uri, { logical }));
+        else if (pattern.wildcard) findings.push(finding('MCPAPP003', `${key} entry "${raw}" allows every subdomain.`, uri, { logical }));
+        if (pattern.insecureScheme) findings.push(finding('MCPAPP004', `${key} entry "${raw}" uses ${pattern.scheme}:.`, uri, { logical }));
+        const sink = sinkFor(pattern.bareHost);
+        if (sink) findings.push(finding('MCPAPP005', `${key} entry "${raw}" is on the sink denylist (${sink.category}: ${sink.pattern}).`, uri, { logical }));
+        if (DEV_HOST_RE.test(pattern.host) || pattern.scheme === 'blob') findings.push(finding('MCPAPP006', `${key} entry "${raw}" is a development origin.`, uri, { logical }));
+      }
+    }
+  }
+  for (const permission of analysis.permissions) {
+    if (permission !== 'clipboardWrite') findings.push(finding('MCPAPP007', `Requests the ${permission} permission.`, uri, { logical: { name: `permissions.${permission}`, kind: 'member' } }));
+  }
+  return findings;
+}
+
+/** Findings about a UI resource as served: listing entry, read result content item, HTML. */
+export function lintResource({ uri, listMeta = null, readMeta = null, html = null }) {
+  const findings = [];
+  const effective = readMeta ?? listMeta;
+  findings.push(...lintUiMeta(effective, uri));
+  if (listMeta && readMeta) {
+    const compared = compareListRead(listMeta, readMeta);
+    if (compared.readWider) findings.push(finding('MCPAPP018', 'resources/read declares a wider policy than resources/list.', uri));
+    else if (compared.mismatch) findings.push(finding('MCPAPP017', 'resources/read and resources/list declare different policies.', uri));
+  }
+  if (typeof html === 'string') findings.push(...lintHtml(html, uri));
+  return findings;
+}
+
+/** Findings about the HTML of a UI resource. */
+export function lintHtml(html, uri) {
+  return htmlFindings(withSinkHosts(analyzeHtml(html)), uri);
+}
+
+/** The HTML rules over one analysis, from a live document or a stored scan. */
+function htmlFindings(a, uri) {
+  const findings = [];
+  if (Array.isArray(a.sinks)) {
+    for (const sink of a.sinks.filter((s) => s.handwritten)) findings.push(finding('MCPAPP010', sink.message, uri, { region: { startLine: sink.line, startColumn: sink.column } }));
+  } else if ((a.unsafeInnerHtmlHandwritten ?? 0) > 0) {
+    // A scan from before sinks carried positions: one finding per document.
+    findings.push(finding('MCPAPP010', `${a.unsafeInnerHtmlHandwritten} dynamic HTML sink(s) in hand-written script.`, uri));
+  }
+  if ((a.postMessageStarHandwritten ?? 0) > 0) findings.push(finding('MCPAPP011', `${a.postMessageStarHandwritten} hand-written postMessage(…, '*') call(s).`, uri));
+  if ((a.inlineHandlers ?? 0) > 0) findings.push(finding('MCPAPP012', `${a.inlineHandlers} inline event handler attribute(s).`, uri));
+  if ((a.evalLikeHandwritten ?? 0) > 0) findings.push(finding('MCPAPP013', `${a.evalLikeHandwritten} eval/new Function use(s) in hand-written script.`, uri));
+  if ((a.formsWithAction ?? 0) > 0) findings.push(finding('MCPAPP014', `${a.formsWithAction} form(s) with an action.`, uri));
+  if ((a.externalHosts?.length ?? 0) > 0) findings.push(finding('MCPAPP015', `References external hosts: ${a.externalHosts.join(', ')}.`, uri, { properties: { hosts: a.externalHosts } }));
+  for (const host of a.sinkHosts ?? []) findings.push(finding('MCPAPP016', `References sink host ${host}.`, uri));
+  return findings;
+}
+
+/** Findings about a tools/list result. */
+export function lintTools(tools, uri = 'tools/list') {
+  const findings = [];
+  for (const tool of Array.isArray(tools) ? tools : []) {
+    const ui = uiMetaOf(tool?._meta);
+    if (!ui) continue;
+    const explicit = Array.isArray(ui.visibility);
+    const visibility = explicit ? ui.visibility : ['model', 'app'];
+    const logical = { name: tool.name ?? '?', kind: 'function' };
+    if (!explicit && ui.resourceUri) findings.push(finding('MCPAPP009', `Tool "${tool.name}" relies on the default visibility ["model", "app"].`, uri, { logical }));
+    if (visibility.includes('app') && tool?.annotations?.readOnlyHint !== true) {
+      findings.push(finding('MCPAPP008', `Tool "${tool.name}" has no readOnlyHint and is callable by the app.`, uri, { logical }));
+    }
+  }
+  return findings;
+}
+
+/** Findings about a scanned package directory (see scanPackageDir). */
+export function lintPackageScan(scan, root = '.') {
+  const findings = [];
+  if (scan.declaresUi) {
+    const fake = { ui: { csp: scan.cspDeclared ? Object.fromEntries(Object.entries(scan.domains).filter(([, v]) => v.length > 0)) : undefined, permissions: Object.fromEntries(scan.permissions.map((p) => [p, {}])) } };
+    if (!scan.cspDeclared) delete fake.ui.csp;
+    findings.push(...lintUiMeta(fake, root));
+  }
+  for (const doc of scan.html ?? []) {
+    findings.push(...htmlFindings(doc, `${root}/${doc.file}`.replace(/^\.\//, '')));
+  }
+  return findings;
+}
+
+export function levelOf(ruleId) {
+  return RULES.find((r) => r.id === ruleId)?.level ?? 'warning';
+}
+
+export { analyzeTools };

package/src/npm.mjs

@@ -0,0 +1,187 @@
+/**
+ * npm as a source: keyword search, package metadata, tarballs downloaded with a size cap and
+ * scanned for what the package declares about its UI resources. Public data only.
+ */
+import { execFile } from 'node:child_process';
+import { createWriteStream } from 'node:fs';
+import { mkdir, readdir, readFile, rm, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { promisify } from 'node:util';
+import { analyzeHtml, withSinkHosts } from './analyze.mjs';
+import { classifyDomains } from './domains.mjs';
+
+const execFileAsync = promisify(execFile);
+const REGISTRY = 'https://registry.npmjs.org';
+const UA = 'mcp-ui-census/0.1 (+https://github.com/shteynu/render-policy)';
+export const UI_SDKS = ['@modelcontextprotocol/ext-apps', '@mcp-ui/server', '@mcp-ui/client'];
+
+async function getJson(url, timeoutMs = 30000) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(url, { headers: { accept: 'application/json', 'user-agent': UA }, signal: controller.signal });
+    if (!response.ok) throw Object.assign(new Error(`HTTP ${response.status}`), { status: response.status });
+    return await response.json();
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/** All packages a search query returns (the API pages by `from`, 250 per page). */
+export async function searchPackages(text, { max = 2000 } = {}) {
+  const names = [];
+  for (let from = 0; from < max; from += 250) {
+    const data = await getJson(`${REGISTRY}/-/v1/search?text=${encodeURIComponent(text)}&size=250&from=${from}`);
+    const objects = Array.isArray(data.objects) ? data.objects : [];
+    for (const object of objects) names.push(object.package?.name);
+    if (objects.length < 250) break;
+  }
+  return names.filter(Boolean);
+}
+
+/** Latest version manifest (small): dependencies, tarball, size. */
+export async function packageMeta(name) {
+  const manifest = await getJson(`${REGISTRY}/${encodeURIComponent(name).replace('%40', '@')}/latest`);
+  if (!manifest?.version) throw new Error(`${name}: no latest version`);
+  const deps = { ...(manifest.dependencies ?? {}), ...(manifest.peerDependencies ?? {}), ...(manifest.optionalDependencies ?? {}) };
+  return {
+    name,
+    version: manifest.version,
+    description: manifest.description ?? '',
+    repository: manifest.repository?.url ?? null,
+    tarball: manifest.dist?.tarball ?? null,
+    unpackedSize: manifest.dist?.unpackedSize ?? null,
+    uiSdks: UI_SDKS.filter((sdk) => sdk in deps),
+    dependsOnMcpSdk: '@modelcontextprotocol/sdk' in deps,
+  };
+}
+
+export async function downloadTarball(url, dest, { maxBytes = 25 * 1024 * 1024, timeoutMs = 60000 } = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(url, { headers: { 'user-agent': UA }, signal: controller.signal });
+    if (!response.ok || !response.body) throw new Error(`HTTP ${response.status}`);
+    const length = Number(response.headers.get('content-length') ?? 0);
+    if (length > maxBytes) throw Object.assign(new Error(`tarball is ${length} bytes, over the cap`), { kind: 'too-large' });
+    let received = 0;
+    const capped = Readable.fromWeb(response.body);
+    capped.on('data', (chunk) => {
+      received += chunk.length;
+      if (received > maxBytes) capped.destroy(Object.assign(new Error('tarball exceeded the cap while streaming'), { kind: 'too-large' }));
+    });
+    await pipeline(capped, createWriteStream(dest));
+    return received;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export async function extractTarball(file, dir) {
+  await mkdir(dir, { recursive: true });
+  await execFileAsync('tar', ['-xzf', file, '-C', dir], { maxBuffer: 1024 * 1024 });
+}
+
+const SOURCE_EXT = new Set(['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.mts', '.cts']);
+const CSP_ARRAY_RE = /\b(connectDomains|resourceDomains|frameDomains|baseUriDomains)\s*:\s*\[([^\]]*)\]/g;
+const PERMISSIONS_RE = /\bpermissions\s*:\s*\{([^}]*)\}/g;
+const VISIBILITY_RE = /\bvisibility\s*:\s*\[([^\]]*)\]/g;
+const EMBEDDED_HTML_RE = /<!doctype html>[\s\S]*?<\/html>/gi;
+
+async function* walk(dir, depth = 0) {
+  if (depth > 12) return;
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.name === 'node_modules' || entry.name.startsWith('.')) continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) yield* walk(full, depth + 1);
+    else if (entry.isFile()) yield full;
+  }
+}
+
+const stringLiterals = (text) => [...text.matchAll(/["'`]([^"'`]*)["'`]/g)].map((m) => m[1]).filter(Boolean);
+
+/** What an unpacked package says about its UI resources. Regex-based on purpose: a census, not a compiler. */
+export async function scanPackageDir(dir, { maxFiles = 4000, maxFileBytes = 2 * 1024 * 1024 } = {}) {
+  const result = {
+    files: 0,
+    sourceFiles: 0,
+    appResourceRegistrations: 0,
+    uiMimeMentions: 0,
+    uiUriMentions: 0,
+    cspArrays: 0,
+    domains: { connectDomains: [], resourceDomains: [], frameDomains: [], baseUriDomains: [] },
+    permissions: new Set(),
+    toolVisibility: { app: 0, model: 0 },
+    readOnlyHints: 0,
+    html: [],
+    embeddedHtml: 0,
+  };
+  for await (const file of walk(dir)) {
+    result.files += 1;
+    if (result.files > maxFiles) break;
+    const ext = path.extname(file).toLowerCase();
+    const isSource = SOURCE_EXT.has(ext);
+    const isHtml = ext === '.html' || ext === '.htm';
+    if (!isSource && !isHtml) continue;
+    const info = await stat(file);
+    if (info.size > maxFileBytes) continue;
+    const text = await readFile(file, 'utf8').catch(() => '');
+    if (isHtml) {
+      result.html.push({ file: path.relative(dir, file), ...withSinkHosts(analyzeHtml(text)) });
+      continue;
+    }
+    result.sourceFiles += 1;
+    result.appResourceRegistrations += (text.match(/\bregisterAppResource\s*\(/g) ?? []).length;
+    result.uiMimeMentions += (text.match(/text\/html;profile=mcp-app/g) ?? []).length;
+    result.uiUriMentions += (text.match(/["'`]ui:\/\//g) ?? []).length;
+    for (const match of text.matchAll(CSP_ARRAY_RE)) {
+      result.cspArrays += 1;
+      result.domains[match[1]].push(...stringLiterals(match[2]));
+    }
+    for (const match of text.matchAll(PERMISSIONS_RE)) {
+      for (const key of ['camera', 'microphone', 'geolocation', 'clipboardWrite']) if (new RegExp(`\\b${key}\\b`).test(match[1])) result.permissions.add(key);
+    }
+    for (const match of text.matchAll(VISIBILITY_RE)) {
+      if (/['"]app['"]/.test(match[1])) result.toolVisibility.app += 1;
+      if (/['"]model['"]/.test(match[1])) result.toolVisibility.model += 1;
+    }
+    result.readOnlyHints += (text.match(/readOnlyHint\s*:\s*true/g) ?? []).length;
+    for (const match of text.matchAll(EMBEDDED_HTML_RE)) {
+      result.embeddedHtml += 1;
+      if (result.html.length < 40) result.html.push({ file: `${path.relative(dir, file)}#embedded`, ...withSinkHosts(analyzeHtml(match[0])) });
+    }
+  }
+  const classified = {};
+  for (const key of Object.keys(result.domains)) classified[key] = classifyDomains(result.domains[key]);
+  return {
+    ...result,
+    permissions: [...result.permissions],
+    domainsClassified: classified,
+    declaresUi: result.appResourceRegistrations + result.uiMimeMentions + result.uiUriMentions > 0,
+    cspDeclared: result.cspArrays > 0,
+  };
+}
+
+/** Download, extract, scan, clean up. */
+export async function scanPackage(meta, workDir, options = {}) {
+  const safe = meta.name.replace(/[^a-z0-9]+/gi, '_');
+  const tgz = path.join(workDir, `${safe}.tgz`);
+  const dir = path.join(workDir, safe);
+  try {
+    const bytes = await downloadTarball(meta.tarball, tgz, options);
+    await extractTarball(tgz, dir);
+    const scan = await scanPackageDir(dir, options);
+    return { ok: true, bytes, ...scan };
+  } finally {
+    await rm(tgz, { force: true });
+    await rm(dir, { recursive: true, force: true });
+  }
+}

package/src/rules.mjs

@@ -0,0 +1,24 @@
+/** The rules, in SARIF terms. Ids are stable; names are what a scanner shows. */
+export const RULES = [
+  { id: 'MCPAPP001', name: 'csp-missing', level: 'warning', short: 'UI resource declares no CSP domain list', full: "A compliant host applies default-src 'none' and connect-src 'none' to a resource without ui.csp. Declare the domains the app uses, or confirm it needs none." },
+  { id: 'MCPAPP002', name: 'csp-allows-every-host', level: 'error', short: 'CSP entry allows every host', full: "A bare '*' or a scheme-only entry such as 'https:' is expanded by hosts into a CSP source that allows every host, including request catchers and tunnels. Name the hosts." },
+  { id: 'MCPAPP003', name: 'csp-wildcard-host', level: 'warning', short: 'CSP entry allows every subdomain', full: 'A *.example.com entry allows every subdomain, including user-controlled ones on multi-tenant services. Prefer exact hosts.' },
+  { id: 'MCPAPP004', name: 'csp-insecure-scheme', level: 'warning', short: 'CSP entry uses http:', full: 'An http: origin can be read and modified in transit. Use https:.' },
+  { id: 'MCPAPP005', name: 'csp-sink-host', level: 'error', short: 'CSP entry names a data sink', full: 'The host is on a denylist of services that exist to receive data: request catchers, tunnels, anonymous serverless endpoints, form builders, public object storage. An app allowed to reach it can carry tool results out.' },
+  { id: 'MCPAPP006', name: 'csp-development-origin', level: 'note', short: 'CSP entry is a development origin', full: 'localhost, 127.0.0.1, 0.0.0.0 or blob: in published metadata is usually a leftover from development.' },
+  { id: 'MCPAPP007', name: 'permissions-sensitive', level: 'note', short: 'UI resource requests a sensitive permission', full: 'camera, microphone or geolocation is requested for the sandbox. Hosts should ask the user.' },
+  { id: 'MCPAPP008', name: 'tool-side-effects-app-visible', level: 'warning', short: 'Side-effecting tool callable by the app', full: 'A tool without readOnlyHint is visible to the app (visibility includes "app", the default). A compromised or injected app can call it with the user\'s session; hosts should require consent.' },
+  { id: 'MCPAPP009', name: 'tool-visibility-implicit', level: 'note', short: 'Tool with UI metadata relies on the default visibility', full: 'visibility defaults to ["model", "app"]. Declare it explicitly so the app-callable surface is a decision, not a default.' },
+  { id: 'MCPAPP010', name: 'html-dynamic-innerhtml', level: 'warning', short: 'Inline script assigns dynamic content to an HTML sink', full: "innerHTML, outerHTML, insertAdjacentHTML, setHTMLUnsafe, createContextualFragment or document.write receives a non-static value. With the default script-src 'unsafe-inline', an injected tool result becomes script inside the sandbox. Render through a policy or use textContent." },
+  { id: 'MCPAPP011', name: 'html-postmessage-wildcard', level: 'warning', short: "Inline script posts a message to '*'", full: "postMessage(…, '*') delivers the message to whatever embeds the document. The SDK bridge does this by design; hand-written calls may leak data to a different embedder." },
+  { id: 'MCPAPP012', name: 'html-inline-handlers', level: 'note', short: 'Inline event handlers in the document', full: 'on* attributes are script; they are also what an injection uses. Attach handlers from a script instead.' },
+  { id: 'MCPAPP013', name: 'html-eval', level: 'warning', short: 'Inline script uses eval or new Function', full: 'String evaluation turns any injected value into script.' },
+  { id: 'MCPAPP014', name: 'html-form-action', level: 'note', short: 'Form posts to a URL', full: "The specification's CSP has no form-action directive; a form is a way out of the sandbox for data. Check the destination." },
+  { id: 'MCPAPP015', name: 'html-external-host', level: 'note', short: 'Document references external hosts', full: 'Scripts, styles, images or media are loaded from hosts outside the document. They must be declared in resourceDomains or the host blocks them.' },
+  { id: 'MCPAPP016', name: 'html-sink-host', level: 'error', short: 'Document references a data sink', full: 'A URL in the document points at a service on the sink denylist.' },
+  { id: 'MCPAPP017', name: 'meta-list-read-mismatch', level: 'warning', short: 'resources/read declares a different policy than resources/list', full: 'Hosts must prefer the read-time policy. A wider policy at read time means the policy reviewed at connection time is not the one enforced.' },
+  { id: 'MCPAPP018', name: 'meta-read-wider-than-list', level: 'error', short: 'resources/read widens the policy seen at resources/list', full: 'The read-time policy adds domains or wildcards the listing did not declare. This is the pattern a host that reviews at connection time cannot see.' },
+];
+
+export const RULE_INDEX = new Map(RULES.map((rule, index) => [rule.id, index]));
+export const ruleByName = (name) => RULES.find((r) => r.name === name);

package/src/sarif.mjs

@@ -0,0 +1,57 @@
+import { RULES, RULE_INDEX } from './rules.mjs';
+import { levelOf } from './lint.mjs';
+
+export const TOOL_VERSION = '0.1.0';
+
+/** A SARIF 2.1.0 log with one run. */
+export function toSarif(findings, { invocation = {} } = {}) {
+  const results = findings.map((f) => ({
+    ruleId: f.ruleId,
+    ruleIndex: RULE_INDEX.get(f.ruleId),
+    level: f.level ?? levelOf(f.ruleId),
+    message: { text: f.message },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: { uri: f.uri },
+          ...(f.region ? { region: f.region } : {}),
+        },
+        ...(f.logical ? { logicalLocations: [f.logical] } : {}),
+      },
+    ],
+    ...(f.properties ? { properties: f.properties } : {}),
+  }));
+  return {
+    $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+    version: '2.1.0',
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: 'mcp-app-lint',
+            version: TOOL_VERSION,
+            informationUri: 'https://github.com/shteynu/render-policy/tree/main/packages/mcp-app-lint',
+            rules: RULES.map((rule) => ({
+              id: rule.id,
+              name: rule.name,
+              shortDescription: { text: rule.short },
+              fullDescription: { text: rule.full },
+              help: { text: rule.full },
+              defaultConfiguration: { level: rule.level },
+              properties: { tags: ['security', 'mcp-apps'] },
+            })),
+          },
+        },
+        invocations: [{ executionSuccessful: true, ...invocation }],
+        results,
+      },
+    ],
+  };
+}
+
+export function toText(findings) {
+  if (findings.length === 0) return 'no findings\n';
+  return `${findings
+    .map((f) => `${(f.level ?? levelOf(f.ruleId)).padEnd(7)} ${f.ruleId} ${f.uri}${f.region ? `:${f.region.startLine}:${f.region.startColumn}` : ''}  ${f.message}`)
+    .join('\n')}\n`;
+}