mcp-app-lint 0.1.0 → 0.1.2

package/dist/sarif.d.mts

@@ -0,0 +1,80 @@
+import type { Finding } from './lint.mjs';
+/** @import { Finding } from './lint.mjs' */
+/**
+ * The version of this package, as the SARIF driver reports it. Read from package.json, which every
+ * install ships, so it cannot fall behind a release.
+ * @type {string}
+ */
+export declare const TOOL_VERSION: string;
+/**
+ * A SARIF 2.1.0 log with one run.
+ * @param {readonly Finding[]} findings
+ * @param {{ invocation?: Record<string, unknown> }} [options] extra fields for the run's invocation, such as `commandLine`
+ */
+export declare function toSarif(findings: readonly Finding[], { invocation }?: {
+    invocation?: Record<string, unknown>;
+}): {
+    $schema: string;
+    version: string;
+    runs: {
+        tool: {
+            driver: {
+                name: string;
+                version: string;
+                informationUri: string;
+                rules: {
+                    id: string;
+                    name: string;
+                    shortDescription: {
+                        text: string;
+                    };
+                    fullDescription: {
+                        text: string;
+                    };
+                    help: {
+                        text: string;
+                    };
+                    defaultConfiguration: {
+                        level: import("./rules.mjs").Level;
+                    };
+                    properties: {
+                        tags: string[];
+                    };
+                }[];
+            };
+        };
+        invocations: {
+            executionSuccessful: boolean;
+        }[];
+        results: {
+            ruleId: string;
+            ruleIndex: number | undefined;
+            level: import("./rules.mjs").Level;
+            message: {
+                text: string;
+            };
+            locations: {
+                physicalLocation: {
+                    artifactLocation: {
+                        uri: string;
+                    };
+                    region?: {
+                        startLine: number;
+                        startColumn?: number;
+                    } | undefined;
+                };
+                logicalLocations?: {
+                    name: string;
+                    kind: string;
+                }[] | undefined;
+            }[];
+            properties?: Record<string, unknown> | undefined;
+        }[];
+    }[];
+};
+/**
+ * One line per finding: level, rule, location, message.
+ * @param {readonly Finding[]} findings
+ */
+export declare function toText(findings: readonly Finding[]): string;
+//# sourceMappingURL=sarif.d.mts.map

package/dist/sarif.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.d.mts","sourceRoot":"","sources":["../src/sarif.mjs"],"names":[],"mappings":"AAII,OAAQ,KAAA,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAAzC,4CAA4C;AAE5C;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAFf,MAEuG,CAAC;AAElH;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAHrB,SAAS,OAAO,EAGK,EAAE,EAAE,UAAe,EAAE,AAFlD,CACF,EADU;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAES;;;;;YAuBhD,MAAM;gBACJ,IAAI;gBACJ,OAAO;gBACP,cAAc;gBACd,KAAK;;;;wBAGiB,IAAI;;;wBACL,IAAI;;;wBACf,IAAI;;;wBACY,KAAK;;;wBACf,IAAI;;;;;;;;;;;;;gBA7BjB,IAAI;;;;;wBAIW,GAAG;;;;;;;;;;;;;;;EAkChC;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,QAAQ,EAFpB,SAAS,OAAO,EAEI,UAK9B"}

package/package.json

@@ -1,30 +1,37 @@
 {
   "name": "mcp-app-lint",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "SARIF findings about what an MCP App declares (CSP domain lists, permissions, tool visibility) and what its HTML does (innerHTML sinks, postMessage to '*', external hosts, data sinks).",
   "license": "MIT",
   "type": "module",
   "bin": {
     "mcp-app-lint": "./bin/mcp-app-lint.mjs"
   },
+  "types": "./dist/index.d.mts",
   "exports": {
-    ".": "./src/index.mjs"
+    ".": {
+      "types": "./dist/index.d.mts",
+      "default": "./src/index.mjs"
+    }
   },
   "files": [
     "bin",
     "src",
+    "dist",
     "README.md"
   ],
   "scripts": {
+    "build": "tsc -p tsconfig.build.json && tsc -p test/types/tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json",
     "test": "node --test test/*.test.mjs"
   },
   "engines": {
     "node": ">=22.12"
   },
   "dependencies": {
-    "@render-policy/core": "^0.1.0",
+    "@render-policy/core": "^0.1.1",
     "eslint": "^10.11.0",
-    "eslint-plugin-render-policy": "^0.1.0"
+    "eslint-plugin-render-policy": "^0.1.2"
   },
   "publishConfig": {
     "access": "public"

package/src/analyze.mjs

@@ -3,28 +3,50 @@
  * its tools, and the HTML of the resources themselves. No network here.
  */
 import { createRequire } from 'node:module';
-import { classifyDomains } from './domains.mjs';
+import { classifyDomains, sinkFor } from './domains.mjs';
+
+/**
+ * @import { Linter } from 'eslint'
+ * @import { ClassifiedDomains } from './domains.mjs'
+ */
 
 const require = createRequire(import.meta.url);
 
+/**
+ * `_meta.ui` as a server sent it: JSON from the wire or from source, so every field is checked where it is read.
+ * @typedef {Record<string, any>} UiMeta
+ */
+/** @typedef {'connectDomains' | 'resourceDomains' | 'frameDomains' | 'baseUriDomains'} CspKey */
+
+/** @type {readonly CspKey[]} */
 const CSP_KEYS = ['connectDomains', 'resourceDomains', 'frameDomains', 'baseUriDomains'];
 const PERMISSION_KEYS = ['camera', 'microphone', 'geolocation', 'clipboardWrite'];
 export const UI_MIME = 'text/html;profile=mcp-app';
 
-/** `_meta.ui` in the modern shape, or the legacy flat `ui/...` keys folded into one object. */
+/**
+ * `_meta.ui` in the modern shape, or the legacy flat `ui/...` keys folded into one object.
+ * @param {unknown} meta a `_meta` object
+ * @returns {UiMeta | null}
+ */
 export function uiMetaOf(meta) {
   if (!meta || typeof meta !== 'object') return null;
-  const modern = meta.ui && typeof meta.ui === 'object' ? { ...meta.ui } : {};
+  const ui = /** @type {{ ui?: unknown }} */ (meta).ui;
+  /** @type {UiMeta} */
+  const modern = ui && typeof ui === 'object' ? { ...ui } : {};
   for (const [key, value] of Object.entries(meta)) {
     if (key.startsWith('ui/')) modern[key.slice(3)] = value;
   }
   return Object.keys(modern).length > 0 ? modern : null;
 }
 
+/**
+ * What one `_meta` object declares: the CSP domain lists classified, permissions, domain.
+ * @param {unknown} meta a `_meta` object
+ */
 export function analyzeUiMeta(meta) {
   const ui = uiMetaOf(meta);
   const csp = ui?.csp && typeof ui.csp === 'object' ? ui.csp : null;
-  const domains = {};
+  const domains = /** @type {Record<CspKey, ClassifiedDomains>} */ ({});
   for (const key of CSP_KEYS) domains[key] = classifyDomains(csp?.[key]);
   const permissions = ui?.permissions && typeof ui.permissions === 'object' ? PERMISSION_KEYS.filter((k) => k in ui.permissions) : [];
   return {
@@ -36,35 +58,50 @@ export function analyzeUiMeta(meta) {
     anyFullWildcard: CSP_KEYS.some((k) => domains[k].fullWildcards > 0),
     anyInsecure: CSP_KEYS.some((k) => domains[k].insecure > 0),
     sinks: CSP_KEYS.flatMap((k) => domains[k].sinks),
+    tenantSinks: CSP_KEYS.flatMap((k) => domains[k].tenantSinks),
     permissions,
     domain: typeof ui?.domain === 'string' ? ui.domain : null,
     prefersBorder: ui?.prefersBorder === true,
   };
 }
 
+/**
+ * @param {unknown} value
+ * @returns {unknown}
+ */
 function canonical(value) {
   if (Array.isArray(value)) return value.map(canonical);
   if (value && typeof value === 'object') {
-    return Object.fromEntries(Object.keys(value).sort().map((k) => [k, canonical(value[k])]));
+    const object = /** @type {Record<string, unknown>} */ (value);
+    return Object.fromEntries(Object.keys(object).sort().map((k) => [k, canonical(object[k])]));
   }
   return value;
 }
 
-/** Does `resources/read` declare a different policy than `resources/list`? The host that checked list is then wrong. */
+/**
+ * Does `resources/read` declare a different policy than `resources/list`? The host that checked list is then wrong.
+ * @param {unknown} listMeta `_meta` of the listing entry
+ * @param {unknown} readMeta `_meta` of the read result's content item
+ */
 export function compareListRead(listMeta, readMeta) {
   const a = uiMetaOf(listMeta);
   const b = uiMetaOf(readMeta);
   if (!a && !b) return { comparable: false, mismatch: false };
+  /** @param {UiMeta | null} m */
   const pick = (m) => (m ? { csp: m.csp ?? null, permissions: m.permissions ?? null, domain: m.domain ?? null } : null);
   const left = JSON.stringify(canonical(pick(a)));
   const right = JSON.stringify(canonical(pick(b)));
   const readWider = (() => {
     if (!a?.csp || !b?.csp) return false;
-    return CSP_KEYS.some((k) => (b.csp[k]?.length ?? 0) > (a.csp[k]?.length ?? 0) || (b.csp[k] ?? []).some((d) => String(d).includes('*') && !(a.csp[k] ?? []).includes(d)));
+    return CSP_KEYS.some((k) => (b.csp[k]?.length ?? 0) > (a.csp[k]?.length ?? 0) || (b.csp[k] ?? []).some((/** @type {unknown} */ d) => String(d).includes('*') && !(a.csp[k] ?? []).includes(d)));
   })();
   return { comparable: true, mismatch: left !== right, readWider, listOnly: !!a && !b, readOnly: !a && !!b };
 }
 
+/**
+ * Counts over the tools of a tools/list result: with a UI, visible to the app, app-only, side-effecting and app-visible.
+ * @param {unknown} tools
+ */
 export function analyzeTools(tools) {
   const list = Array.isArray(tools) ? tools : [];
   let withUi = 0;
@@ -85,17 +122,25 @@ export function analyzeTools(tools) {
   return { total: list.length, withUi, visibleToApp, appOnly, sideEffectsVisibleToApp };
 }
 
+/** Escaping helpers whose result the census treats as text: by name, not by implementation. */
+export const ESCAPE_FUNCTIONS = ['esc', 'escapeHtml', 'escapeHTML', 'htmlEscape', 'escapeAttr', 'escapeHtmlAttr', 'DOMPurify.sanitize'];
+
+/** @type {((source: string) => Linter.LintMessage[]) | null} */
 let linter = null;
+// The rule runs twice over each script: strict, and with ESCAPE_FUNCTIONS. A sink only the strict
+// run reports gets every dynamic part through an escaping helper.
+/** @param {string} code */
 function lintInlineScript(code) {
   if (!linter) {
     const { Linter } = require('eslint');
     const plugin = require('eslint-plugin-render-policy').default;
     const instance = new Linter({ configType: 'flat' });
+    /** @type {Linter.Config[]} */
     const config = [
       {
         files: ['**/*.js'],
-        plugins: { 'render-policy': plugin },
-        rules: { 'render-policy/no-unsafe-innerhtml': 'error' },
+        plugins: { 'render-policy': plugin, escaped: plugin },
+        rules: { 'render-policy/no-unsafe-innerhtml': 'error', 'escaped/no-unsafe-innerhtml': ['error', { escapeFunctions: ESCAPE_FUNCTIONS }] },
         languageOptions: { ecmaVersion: 2024, sourceType: 'module', parserOptions: { ecmaFeatures: { jsx: true } } },
       },
     ];
@@ -105,35 +150,101 @@ function lintInlineScript(code) {
 }
 
 const SCRIPT_RE = /<script\b([^>]*)>([\s\S]*?)<\/script>/gi;
+const POST_MESSAGE_RE = /([\w$.]*)\s*\.\s*postMessage\s*\(/g;
+const PROTOCOL_TARGET_RE = /(^|\.)(parent|top)$/;
+// MCP Apps JSON-RPC, and the message types of the mcp-ui protocol.
+const PROTOCOL_MESSAGE_RE = /\bjsonrpc\s*:|\bmethod\s*:\s*['"`]ui\/|\btype\s*:\s*['"`](ui-[a-z-]+|prompt|link|tool|intent|notify)['"`]/;
+
+/**
+ * The argument text of a call whose opening parenthesis ends at `start`, or null if unbalanced.
+ * @param {string} code
+ * @param {number} start
+ */
+function callArguments(code, start) {
+  let depth = 1;
+  let quote = null;
+  for (let i = start; i < code.length && i < start + 20000; i += 1) {
+    const c = code[i];
+    if (quote) {
+      if (c === '\\') i += 1;
+      else if (c === quote) quote = null;
+    } else if (c === '"' || c === "'" || c === '`') quote = c;
+    else if (c === '(' || c === '{' || c === '[') depth += 1;
+    else if (c === ')' || c === '}' || c === ']') {
+      depth -= 1;
+      if (depth === 0) return code.slice(start, i);
+    }
+  }
+  return null;
+}
+
+/**
+ * A `postMessage(…, '*')` call: 1-based position, and whether it carries the app protocol to the host.
+ * @typedef {{ line: number, column: number, protocol: boolean }} PostMessageCall
+ */
+/**
+ * A dynamic HTML sink the lint rule reported, positioned in the document.
+ * @typedef {object} HtmlSink
+ * @property {number} line
+ * @property {number} column
+ * @property {boolean} handwritten the script it is in is hand-written, not a bundle
+ * @property {boolean} escaped every dynamic part of the value goes through an escaping helper
+ * @property {string} message
+ */
+
+/**
+ * postMessage calls whose target origin is '*', with position and whether they carry the app protocol to the host.
+ * @param {string} code
+ * @returns {PostMessageCall[]}
+ */
+export function postMessageStarCalls(code) {
+  /** @type {PostMessageCall[]} */
+  const calls = [];
+  for (const match of code.matchAll(POST_MESSAGE_RE)) {
+    const args = callArguments(code, match.index + match[0].length);
+    if (args === null || !/,\s*['"`]\*['"`]\s*(,[^,]*)?,?\s*$/.test(args)) continue;
+    const before = code.slice(0, match.index);
+    const line = before.split('\n').length;
+    const column = match.index - before.lastIndexOf('\n');
+    calls.push({ line, column, protocol: PROTOCOL_TARGET_RE.test(match[1] ?? '') && PROTOCOL_MESSAGE_RE.test(args) });
+  }
+  return calls;
+}
 const URL_ATTR_RE = /\b(?:src|href|action|poster|data)\s*=\s*["']([^"']+)["']/gi;
 
-/** Static signals in a UI resource's HTML. Heuristic by design; the report says so. */
+/**
+ * Static signals in a UI resource's HTML. Heuristic by design; the report says so.
+ * @param {unknown} html
+ */
 export function analyzeHtml(html) {
   const text = String(html ?? '');
   const result = {
     bytes: text.length,
     inlineScripts: 0,
     handwrittenScripts: 0,
-    externalScripts: [],
+    externalScripts: /** @type {string[]} */ ([]),
     unsafeInnerHtml: 0,
     unsafeInnerHtmlHandwritten: 0,
     evalLikeHandwritten: 0,
     postMessageStarHandwritten: 0,
+    postMessageStarHandwrittenNonProtocol: 0,
+    unsafeInnerHtmlHandwrittenUnescaped: 0,
+    postMessages: /** @type {Array<PostMessageCall & { handwritten: boolean }>} */ ([]),
     lintErrors: 0,
     unparsedScripts: 0,
     inlineHandlers: (text.match(/\son[a-z]+\s*=/gi) ?? []).length,
-    sinks: [],
+    sinks: /** @type {HtmlSink[]} */ ([]),
     evalLike: (text.match(/\beval\s*\(|new\s+Function\s*\(/g) ?? []).length,
     postMessageStar: (text.match(/postMessage\s*\([^)]*['"]\*['"]/g) ?? []).length,
     forms: (text.match(/<form\b/gi) ?? []).length,
     formsWithAction: (text.match(/<form\b[^>]*\baction\s*=/gi) ?? []).length,
     metaCsp: /<meta\b[^>]*http-equiv\s*=\s*["']content-security-policy["']/i.test(text),
-    externalHosts: [],
-    sinkHosts: [],
+    externalHosts: /** @type {string[]} */ ([]),
+    sinkHosts: /** @type {string[]} */ ([]),
   };
   const hosts = new Set();
   for (const match of text.matchAll(URL_ATTR_RE)) {
-    const value = match[1];
+    const value = match[1] ?? '';
     if (!/^(https?:)?\/\//i.test(value)) continue;
     try {
       hosts.add(new URL(value.startsWith('//') ? `https:${value}` : value).hostname.toLowerCase());
@@ -161,6 +272,11 @@ export function analyzeHtml(html) {
       result.evalLikeHandwritten += (body.match(/\beval\s*\(|new\s+Function\s*\(/g) ?? []).length;
       result.postMessageStarHandwritten += (body.match(/postMessage\s*\([^)]*['"]\*['"]/g) ?? []).length;
     }
+    const scriptLine = text.slice(0, match.index).split('\n').length + (match[0].slice(0, match[0].indexOf('>') + 1).split('\n').length - 1);
+    for (const call of postMessageStarCalls(body)) {
+      result.postMessages.push({ ...call, line: scriptLine + call.line - 1, handwritten });
+      if (handwritten && !call.protocol) result.postMessageStarHandwrittenNonProtocol += 1;
+    }
     try {
       const messages = lintInlineScript(body);
       const fatal = messages.filter((m) => m.fatal);
@@ -169,10 +285,14 @@ export function analyzeHtml(html) {
         continue;
       }
       const hits = messages.filter((m) => m.ruleId === 'render-policy/no-unsafe-innerhtml');
+      const unescaped = new Set(messages.filter((m) => m.ruleId === 'escaped/no-unsafe-innerhtml').map((m) => `${m.line}:${m.column}`));
       result.unsafeInnerHtml += hits.length;
-      if (handwritten) result.unsafeInnerHtmlHandwritten += hits.length;
-      const scriptLine = text.slice(0, match.index).split('\n').length + (match[0].slice(0, match[0].indexOf('>') + 1).split('\n').length - 1);
-      for (const hit of hits) result.sinks.push({ line: scriptLine + hit.line - 1, column: hit.column, handwritten, message: hit.message });
+      for (const hit of hits) {
+        const escaped = !unescaped.has(`${hit.line}:${hit.column}`);
+        if (handwritten) result.unsafeInnerHtmlHandwritten += 1;
+        if (handwritten && !escaped) result.unsafeInnerHtmlHandwrittenUnescaped += 1;
+        result.sinks.push({ line: scriptLine + hit.line - 1, column: hit.column, handwritten, escaped, message: hit.message });
+      }
     } catch {
       result.unparsedScripts += 1;
     }
@@ -180,7 +300,10 @@ export function analyzeHtml(html) {
   return result;
 }
 
-/** Short lines and not too many of them: written by a person, not emitted by a bundler. */
+/**
+ * Short lines and not too many of them: written by a person, not emitted by a bundler.
+ * @param {string} code
+ */
 export function isHandwritten(code) {
   const lines = code.split('\n');
   const longest = Math.max(0, ...lines.map((l) => l.length));
@@ -188,8 +311,14 @@ export function isHandwritten(code) {
   return longest < 2000 && average < 200 && lines.length < 3000;
 }
 
-/** Everything the HTML analysis reports about hosts, joined with the sink denylist. */
+/** @typedef {ReturnType<typeof analyzeHtml>} HtmlAnalysis */
+
+/**
+ * Everything the HTML analysis reports about hosts, joined with the sink denylist.
+ * @template {{ externalHosts: string[] }} T
+ * @param {T} analysis
+ * @returns {T & { sinkHosts: string[] }}
+ */
 export function withSinkHosts(analysis) {
-  const { sinkFor } = require('./domains.mjs');
   return { ...analysis, sinkHosts: analysis.externalHosts.filter((h) => sinkFor(h) !== null) };
 }

package/src/cli.mjs

@@ -8,7 +8,7 @@
  *   mcp-app-lint --html app.html                   # one UI document
  * Options: --out file.sarif, --format sarif|text (default sarif), --fail-on error|warning|note|none (default error)
  */
-import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { UI_MIME } from './analyze.mjs';
@@ -16,13 +16,38 @@ import { lintHtml, lintPackageScan, lintResource, lintTools, levelOf } from './l
 import { packageMeta, scanPackage, scanPackageDir } from './npm.mjs';
 import { toSarif, toText } from './sarif.mjs';
 
+/**
+ * @import { Writable } from 'node:stream'
+ * @import { Finding } from './lint.mjs'
+ */
+/**
+ * @typedef {object} CliOptions
+ * @property {string} format
+ * @property {string} failOn
+ * @property {string} [dir]
+ * @property {string} [package]
+ * @property {string} [read]
+ * @property {string} [list]
+ * @property {string} [tools]
+ * @property {string} [html]
+ * @property {string} [out]
+ * @property {boolean} [help]
+ */
+
+/** @type {Record<string, number>} */
 const LEVEL_RANK = { error: 3, warning: 2, note: 1, none: 0 };
 
+/** @param {readonly string[]} argv */
 function parseArgs(argv) {
+  /** @type {CliOptions} */
   const options = { format: 'sarif', failOn: 'error' };
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
-    const next = () => argv[++i];
+    const next = () => {
+      const value = argv[++i];
+      if (value === undefined) throw new Error(`${arg} needs a value`);
+      return value;
+    };
     if (arg === '--dir') options.dir = next();
     else if (arg === '--package') options.package = next();
     else if (arg === '--read') options.read = next();
@@ -38,22 +63,35 @@ function parseArgs(argv) {
   return options;
 }
 
+/** @type {(file: string) => Promise<any>} */
 const readJson = async (file) => JSON.parse(await readFile(file, 'utf8'));
+/** @type {(r: any) => boolean} */
 const isUiResource = (r) => (r?.mimeType ?? '').startsWith('text/html') || String(r?.uri ?? '').startsWith('ui://');
 
-/** A filesystem path under the working directory becomes a forward-slash repo-relative uri; anything else is unchanged. */
+/**
+ * A filesystem path under the working directory becomes a forward-slash repo-relative uri; anything else is unchanged.
+ * @param {string} uri
+ */
 function relativeUri(uri) {
   if (typeof uri !== 'string' || !path.isAbsolute(uri)) return uri;
   const rel = path.relative(process.cwd(), uri);
   return rel && !rel.startsWith('..') ? rel.split(path.sep).join('/') : uri;
 }
 
+/**
+ * The command line, without the process exit: resolves to the exit code (0 clean, 1 findings at or
+ * above --fail-on, 2 usage error). Throws on unreadable input or a failed download.
+ * @param {readonly string[]} argv arguments after the program name
+ * @param {{ stdout?: Pick<Writable, 'write'>, stderr?: Pick<Writable, 'write'> }} [io]
+ * @returns {Promise<number>}
+ */
 export async function run(argv, { stdout = process.stdout, stderr = process.stderr } = {}) {
   const options = parseArgs(argv);
   if (options.help || (!options.dir && !options.package && !options.read && !options.html && !options.tools)) {
     stderr.write('usage: mcp-app-lint (--dir <path> | --package <name> | --read <read.json> [--list <list.json>] | --html <file>) [--tools <tools.json>] [--out file] [--format sarif|text] [--fail-on error|warning|note|none]\n');
     return 2;
   }
+  /** @type {Finding[]} */
   const findings = [];
 
   if (options.dir) {
@@ -63,8 +101,7 @@ export async function run(argv, { stdout = process.stdout, stderr = process.stde
   if (options.package) {
     const meta = await packageMeta(options.package);
     if (!meta.tarball) throw new Error(`${options.package}: no tarball`);
-    const work = path.join(os.tmpdir(), 'mcp-app-lint');
-    await mkdir(work, { recursive: true });
+    const work = await mkdtemp(path.join(os.tmpdir(), 'mcp-app-lint-'));
     try {
       const scan = await scanPackage(meta, work);
       findings.push(...lintPackageScan(scan, `npm:${meta.name}@${meta.version}`));
@@ -79,7 +116,7 @@ export async function run(argv, { stdout = process.stdout, stderr = process.stde
     const listEntries = Array.isArray(listing?.resources) ? listing.resources : Array.isArray(listing) ? listing : listing ? [listing] : [];
     for (const item of contents) {
       if (!isUiResource(item) && item.mimeType !== UI_MIME) continue;
-      const entry = listEntries.find((r) => r.uri === item.uri) ?? null;
+      const entry = listEntries.find((/** @type {any} */ r) => r.uri === item.uri) ?? null;
       findings.push(...lintResource({ uri: item.uri ?? options.read, listMeta: entry?._meta ?? null, readMeta: item._meta ?? null, html: typeof item.text === 'string' ? item.text : null }));
     }
   }