mcp-app-lint 0.1.5 → 0.1.6

package/README.md

@@ -9,6 +9,7 @@ npx mcp-app-lint --package @scope/name                # an npm package: download
 npx mcp-app-lint --read read.json --list list.json --tools tools.json
                                                       # results of resources/read, resources/list, tools/list
 npx mcp-app-lint --html app.html                      # one UI document
+npx mcp-app-lint --a2ui stream.jsonl                  # A2UI v0.9 messages: one, a JSON array, { messages } or JSONL
 ```
 
 Options: `--out file.sarif`, `--format sarif|text`, `--fail-on error|warning|note|none` (default
@@ -41,7 +42,8 @@ Inputs: `directory` (default `.`), `fail-on` (default `error`), `upload-sarif` (
 `sarif-file` (default `mcp-app-lint.sarif`), `version` (npm dist-tag or version, default `latest`),
 `args` (passed through), `node-version` (default `22`, empty to use the runner's Node). The SARIF
 is written even when findings fail the job, so it still uploads; paths are repo-relative so code
-scanning maps them to the source.
+scanning maps them to the source. Recorded A2UI streams go through `args`, for example
+`args: --a2ui test/fixtures/surface.jsonl`.
 
 Any CI can run the CLI directly and read the exit code (`0` clean, `1` findings at or above
 `--fail-on`, `2` usage error):
@@ -74,6 +76,29 @@ npx mcp-app-lint --dir . --format sarif --out mcp-app-lint.sarif --fail-on error
 | MCPAPP018 | meta-read-wider-than-list | error | both declare a CSP and the read-time one adds an entry (domain or wildcard) the listing did not declare under the same key |
 | MCPAPP019 | csp-sink-tenant-host | note | one bucket, worker or app on a storage or serverless service from the denylist (`acct.blob.core.windows.net`, `pub-<id>.r2.dev`); fine while the owner keeps the name |
 
+### A2UI rules
+
+`--a2ui` reads A2UI v0.9 server-to-client messages (`createSurface`, `updateComponents`,
+`updateDataModel`, `deleteSurface`). A2UI sends no HTML; what matters is where the agent's data may
+flow. Absolute `{ "path": … }` bindings and `formatString` interpolations are resolved against the
+`updateDataModel` messages of the same stream after every message, so a value swapped after the
+first render is checked too, at the line of the update that brought it. Relative paths in list
+templates and client function calls are left to the runtime check
+([`@render-policy/a2ui`](../a2ui)); this scan is a CI aid, not a substitute for it.
+
+| Id | Name | Level | What it means |
+| --- | --- | --- | --- |
+| A2UI001 | a2ui-openurl-scheme | error | `openUrl` target that does not resolve to http or https (`javascript:`, `data:`, `mailto:`), as the basic catalog requires |
+| A2UI002 | a2ui-sink-host | error | `Image`, `Video` or `AudioPlayer` url, `theme.iconUrl` or an `openUrl` target on a sink host anyone can use |
+| A2UI003 | a2ui-url-encoded-payload | warning | media or icon URL, fetched without a click, that is too long or carries a long high-entropy token |
+| A2UI004 | a2ui-url-template-host | warning | `formatString` takes the scheme or host of a media URL or `openUrl` target from data |
+| A2UI005 | a2ui-url-template-data | note | `formatString` puts data into the path or query of a media URL |
+| A2UI006 | a2ui-text-markup | warning | `Text` contains raw HTML, a Markdown image or a link (bare URLs count; code spans and fences do not), which the basic catalog excludes |
+| A2UI007 | a2ui-remote-media-hosts | note | the hosts media and icons load from, for the client's allowlist |
+
+On the 44 examples of the v0.9 basic catalog the scan reports A2UI007 notes and one A2UI006: the
+Markdown example puts a link in `Text`.
+
 Hand-written means an inline script with short lines and not too many of them; bundles carry
 framework internals and the SDK bridge (which posts to `'*'` by design) and are not reported
 for MCPAPP010, MCPAPP011 and MCPAPP013.
@@ -86,10 +111,10 @@ Apps MIME type or `ui://` (hosts, renderers, SDKs) are not treated as serving a
 looked for in the package's HTML documents only: a `fetch` in server code is not bound by the CSP,
 so it does not count.
 
-The rules come out of the [MCP Apps UI census](../../census) in this repository; the analyzer is
+The MCP Apps rules come out of the [MCP Apps UI census](../../census) in this repository; the analyzer is
 shared. The HTML sink detection is `eslint-plugin-render-policy`'s `no-unsafe-innerhtml`. The sink
 denylist is `@render-policy/core`'s. The package also exports the analysis functions (`analyzeHtml`,
-`analyzeUiMeta`, `compareListRead`, `scanPackageDir`, …) and `categorizeDomain`, the heuristic host
+`analyzeUiMeta`, `compareListRead`, `scanPackageDir`, `lintA2uiMessages`, `parseA2uiMessages`, …) and `categorizeDomain`, the heuristic host
 category (fonts, analytics, maps, storage, media, cdn, api, …) the census report tabulates; it is
 data for aggregates, not a rule.
 

package/dist/a2ui.d.mts

@@ -0,0 +1,28 @@
+import type { Finding } from './lint.mjs';
+export type A2uiEntry = {
+    message: unknown;
+    line?: number;
+};
+export type UrlUse = 'fetched' | 'openUrl';
+export type Place = {
+    surfaceId: string;
+    componentId?: string;
+    property: string;
+    dataPath?: string;
+    line?: number;
+};
+/**
+ * Messages from the text of a file: one message, an array of them, an object with `messages` (the
+ * list wrapper and the specification's samples), or JSONL. Throws on a line that does not parse.
+ * @param {string} text
+ * @returns {A2uiEntry[]}
+ */
+export declare function parseA2uiMessages(text: string): A2uiEntry[];
+/**
+ * Findings over a stream of A2UI v0.9 messages. `uri` is the file the messages came from.
+ * @param {readonly (A2uiEntry | unknown)[]} input messages, or entries with their line
+ * @param {string} uri
+ * @returns {Finding[]}
+ */
+export declare function lintA2uiMessages(input: readonly (A2uiEntry | unknown)[], uri: string): Finding[];
+//# sourceMappingURL=a2ui.d.mts.map

package/dist/a2ui.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a2ui.d.mts","sourceRoot":"","sources":["../src/a2ui.mjs"],"names":[],"mappings":"AAiBG,OAAQ,KAAA,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAIrC,YAA+C,SAAS,GAA9C;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAW;AAEvD,YAAiC,MAAM,GAA7B,SAAS,GAAG,SAAS,CAAQ;AAGxC,YAA2G,KAAK,GAAtG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAO;AAmBnH;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAH3B,MAG2B,GAFzB,SAAS,EAAE,CA4BvB;AA4GD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAJ3B,SAAS,CAAC,SAAS,GAAG,OAAO,CAAC,EAIH,EAAE,GAAG,EAHhC,MAGgC,GAF9B,OAAO,EAAE,CA0KrB"}

package/dist/cli.d.mts

@@ -8,6 +8,7 @@ export type CliOptions = {
     list?: string;
     tools?: string;
     html?: string;
+    a2ui?: string;
     out?: string;
     help?: boolean;
 };

package/dist/cli.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.mts","sourceRoot":"","sources":["../src/cli.mjs"],"names":[],"mappings":"AAmBG,OAAQ,KAAA,EAAE,QAAQ,EAAE,MAAM,aAAa,CACvC;AAGA,YAAkB,UAAU,GAC5B;IAAmB,MAAM,EAAd,MAAM,CACjB;IAAmB,MAAM,EAAd,MAAM,CACjB;IAAoB,GAAG,AAAvB,CACA,EADW,MAAM,CACjB;IAAoB,OAAO,AAA3B,CACA,EADW,MAAM,CACjB;IAAoB,IAAI,AAAxB,CACA,EADW,MAAM,CACjB;IAAoB,IAAI,AAAxB,CACA,EADW,MAAM,CACjB;IAAoB,KAAK,AAAzB,CACA,EADW,MAAM,CACjB;IAAoB,IAAI,AAAxB,CACA,EADW,MAAM,CACjB;IAAoB,GAAG,AAAvB,CACA,EADW,MAAM,CACjB;IAAqB,IAAI,AAAzB,CAA0B,EAAf,OAAO,CAAQ;CAAA,CAAA;AA+C7B;;;;;;GAMG;AACH,wBAAsB,GAAG,CAAC,IAAI,EAJnB,SAAS,MAAM,EAII,EAAE,EAAE,MAAuB,EAAE,MAAuB,EAAE,AAHjF,CACA,EADQ;IAAE,MAAM,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;CAGU,GAF5E,OAAO,CAAC,MAAM,CAAC,CAwD3B"}
+{"version":3,"file":"cli.d.mts","sourceRoot":"","sources":["../src/cli.mjs"],"names":[],"mappings":"AAqBG,OAAQ,KAAA,EAAE,QAAQ,EAAE,MAAM,aAAa,CACvC;AAGA,YAAkB,UAAU,GAC5B;IAAmB,MAAM,EAAd,MAAM,CACjB;IAAmB,MAAM,EAAd,MAAM,CACjB;IAAoB,GAAG,AAAvB,CACA,EADW,MAAM,CACjB;IAAoB,OAAO,AAA3B,CACA,EADW,MAAM,CACjB;IAAoB,IAAI,AAAxB,CACA,EADW,MAAM,CACjB;IAAoB,IAAI,AAAxB,CACA,EADW,MAAM,CACjB;IAAoB,KAAK,AAAzB,CACA,EADW,MAAM,CACjB;IAAoB,IAAI,AAAxB,CACA,EADW,MAAM,CACjB;IAAoB,IAAI,AAAxB,CACA,EADW,MAAM,CACjB;IAAoB,GAAG,AAAvB,CACA,EADW,MAAM,CACjB;IAAqB,IAAI,AAAzB,CAA0B,EAAf,OAAO,CAAQ;CAAA,CAAA;AAgD7B;;;;;;GAMG;AACH,wBAAsB,GAAG,CAAC,IAAI,EAJnB,SAAS,MAAM,EAII,EAAE,EAAE,MAAuB,EAAE,MAAuB,EAAE,AAHjF,CACA,EADQ;IAAE,MAAM,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;CAGU,GAF5E,OAAO,CAAC,MAAM,CAAC,CA2D3B"}

package/dist/index.d.mts

@@ -1,3 +1,4 @@
+export { lintA2uiMessages, parseA2uiMessages } from './a2ui.mjs';
 export { analyzeHtml, analyzeTools, analyzeUiMeta, compareListRead, ESCAPE_FUNCTIONS, isHandwritten, postMessageStarCalls, UI_MIME, uiMetaOf, withSinkHosts } from './analyze.mjs';
 export { categorizeDomain, categorizeHost, classifyDomains, DOMAIN_CATEGORIES, parseDomainPattern, sinkFor, sinkScope } from './domains.mjs';
 export { levelOf, lintHtml, lintPackageScan, lintResource, lintTools, lintUiMeta } from './lint.mjs';
@@ -5,6 +6,7 @@ export { downloadTarball, extractTarball, packageMeta, scanPackage, scanPackageD
 export { RULES, RULE_INDEX, ruleByName } from './rules.mjs';
 export { toSarif, toText, TOOL_VERSION } from './sarif.mjs';
 export { run } from './cli.mjs';
+export type A2uiEntry = import('./a2ui.mjs').A2uiEntry;
 export type UiMeta = import('./analyze.mjs').UiMeta;
 export type CspKey = import('./analyze.mjs').CspKey;
 export type HtmlAnalysis = import('./analyze.mjs').HtmlAnalysis;
@@ -23,6 +25,7 @@ export type DomainSite = import('./npm.mjs').DomainSite;
 export type Rule = import('./rules.mjs').Rule;
 export type Level = import('./rules.mjs').Level;
 /**
+ * @typedef {import('./a2ui.mjs').A2uiEntry} A2uiEntry
  * @typedef {import('./analyze.mjs').UiMeta} UiMeta
  * @typedef {import('./analyze.mjs').CspKey} CspKey
  * @typedef {import('./analyze.mjs').HtmlAnalysis} HtmlAnalysis

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mjs"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnL,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC7I,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC/H,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAG7B,YAA0C,MAAM,GAAtC,OAAO,eAAe,EAAE,MAAM,CAAQ;AAChD,YAA0C,MAAM,GAAtC,OAAO,eAAe,EAAE,MAAM,CAAQ;AAChD,YAAgD,YAAY,GAAlD,OAAO,eAAe,EAAE,YAAY,CAAc;AAC5D,YAA4C,QAAQ,GAA1C,OAAO,eAAe,EAAE,QAAQ,CAAU;AACpD,YAAmD,eAAe,GAAxD,OAAO,eAAe,EAAE,eAAe,CAAiB;AAClE,YAAiD,aAAa,GAApD,OAAO,eAAe,EAAE,aAAa,CAAe;AAC9D,YAAkD,cAAc,GAAtD,OAAO,eAAe,EAAE,cAAc,CAAgB;AAChE,YAAqD,iBAAiB,GAA5D,OAAO,eAAe,EAAE,iBAAiB,CAAmB;AACtE,YAA6C,SAAS,GAA5C,OAAO,eAAe,EAAE,SAAS,CAAW;AACtD,YAAwC,OAAO,GAArC,OAAO,YAAY,EAAE,OAAO,CAAS;AAC/C,YAA8C,aAAa,GAAjD,OAAO,YAAY,EAAE,aAAa,CAAe;AAC3D,YAA2C,WAAW,GAA5C,OAAO,WAAW,EAAE,WAAW,CAAa;AACtD,YAA2C,WAAW,GAA5C,OAAO,WAAW,EAAE,WAAW,CAAa;AACtD,YAA2C,WAAW,GAA5C,OAAO,WAAW,EAAE,WAAW,CAAa;AACtD,YAA0C,UAAU,GAA1C,OAAO,WAAW,EAAE,UAAU,CAAY;AACpD,YAAsC,IAAI,GAAhC,OAAO,aAAa,EAAE,IAAI,CAAM;AAC1C,YAAuC,KAAK,GAAlC,OAAO,aAAa,EAAE,KAAK,CAAO;AAjB/C;;;;;;;;;;;;;;;;;;GAkBG"}
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mjs"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnL,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC7I,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACrG,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC/H,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAG7B,YAA0C,SAAS,GAAzC,OAAO,YAAY,EAAE,SAAS,CAAW;AACnD,YAA0C,MAAM,GAAtC,OAAO,eAAe,EAAE,MAAM,CAAQ;AAChD,YAA0C,MAAM,GAAtC,OAAO,eAAe,EAAE,MAAM,CAAQ;AAChD,YAAgD,YAAY,GAAlD,OAAO,eAAe,EAAE,YAAY,CAAc;AAC5D,YAA4C,QAAQ,GAA1C,OAAO,eAAe,EAAE,QAAQ,CAAU;AACpD,YAAmD,eAAe,GAAxD,OAAO,eAAe,EAAE,eAAe,CAAiB;AAClE,YAAiD,aAAa,GAApD,OAAO,eAAe,EAAE,aAAa,CAAe;AAC9D,YAAkD,cAAc,GAAtD,OAAO,eAAe,EAAE,cAAc,CAAgB;AAChE,YAAqD,iBAAiB,GAA5D,OAAO,eAAe,EAAE,iBAAiB,CAAmB;AACtE,YAA6C,SAAS,GAA5C,OAAO,eAAe,EAAE,SAAS,CAAW;AACtD,YAAwC,OAAO,GAArC,OAAO,YAAY,EAAE,OAAO,CAAS;AAC/C,YAA8C,aAAa,GAAjD,OAAO,YAAY,EAAE,aAAa,CAAe;AAC3D,YAA2C,WAAW,GAA5C,OAAO,WAAW,EAAE,WAAW,CAAa;AACtD,YAA2C,WAAW,GAA5C,OAAO,WAAW,EAAE,WAAW,CAAa;AACtD,YAA2C,WAAW,GAA5C,OAAO,WAAW,EAAE,WAAW,CAAa;AACtD,YAA0C,UAAU,GAA1C,OAAO,WAAW,EAAE,UAAU,CAAY;AACpD,YAAsC,IAAI,GAAhC,OAAO,aAAa,EAAE,IAAI,CAAM;AAC1C,YAAuC,KAAK,GAAlC,OAAO,aAAa,EAAE,KAAK,CAAO;AAlB/C;;;;;;;;;;;;;;;;;;;GAmBG"}

package/dist/rules.d.mts

@@ -1,7 +1,8 @@
 /** @typedef {'error' | 'warning' | 'note'} Level */
 /**
- * A rule in SARIF terms: `short` and `full` become its short and full description.
- * @typedef {{ id: string, name: string, level: Level, short: string, full: string }} Rule
+ * A rule in SARIF terms: `short` and `full` become its short and full description; `tags` default to
+ * security and mcp-apps.
+ * @typedef {{ id: string, name: string, level: Level, short: string, full: string, tags?: readonly string[] }} Rule
  */
 export type Level = 'error' | 'warning' | 'note';
 export type Rule = {
@@ -10,6 +11,7 @@ export type Rule = {
     level: Level;
     short: string;
     full: string;
+    tags?: readonly string[];
 };
 /**
  * The rules, in SARIF terms. Ids are stable; names are what a scanner shows.

package/dist/rules.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.mts","sourceRoot":"","sources":["../src/rules.mjs"],"names":[],"mappings":"AAAA,oDAAoD;AACpD;;;GAGG;AAJC,YAAwC,KAAK,GAAnC,OAAO,GAAG,SAAS,GAAG,MAAM,CAAO;AAG9C,YAAmF,IAAI,GAA7E;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAM;AAG1F;;;GAGG;AACH,eAAO,MAAM,KAAK,EAFR,SAAS,IAAI,EAsBtB,CAAC;AAEF,eAAO,MAAM,UAAU,qBAAwD,CAAC;AAChF,2BAA2B;AAC3B,eAAO,MAAM,UAAU,SADX,MAAM,qBACoD,CAAC"}
+{"version":3,"file":"rules.d.mts","sourceRoot":"","sources":["../src/rules.mjs"],"names":[],"mappings":"AAAA,oDAAoD;AACpD;;;;GAIG;AALC,YAAwC,KAAK,GAAnC,OAAO,GAAG,SAAS,GAAG,MAAM,CAAO;AAI9C,YAA6G,IAAI,GAAvG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAM;AAKpH;;;GAGG;AACH,eAAO,MAAM,KAAK,EAFR,SAAS,IAAI,EA6BtB,CAAC;AAEF,eAAO,MAAM,UAAU,qBAAwD,CAAC;AAChF,2BAA2B;AAC3B,eAAO,MAAM,UAAU,SADX,MAAM,qBACoD,CAAC"}

package/dist/sarif.d.mts

@@ -38,7 +38,7 @@ export declare function toSarif(findings: readonly Finding[], { invocation }?: {
                         level: import("./rules.mjs").Level;
                     };
                     properties: {
-                        tags: string[];
+                        tags: readonly string[];
                     };
                 }[];
             };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mcp-app-lint",
-  "version": "0.1.5",
-  "description": "SARIF findings about what an MCP App declares (CSP domain lists, permissions, tool visibility) and what its HTML does (innerHTML sinks, postMessage to '*', external hosts, data sinks).",
+  "version": "0.1.6",
+  "description": "SARIF findings about what an MCP App declares (CSP domain lists, permissions, tool visibility) and what its HTML does (innerHTML sinks, postMessage to '*', external hosts, data sinks); A2UI message streams (openUrl schemes, sink hosts, data in URLs, markup in Text).",
   "license": "MIT",
   "type": "module",
   "bin": {
@@ -39,6 +39,7 @@
   "keywords": [
     "mcp",
     "mcp-apps",
+    "a2ui",
     "sarif",
     "security",
     "csp",

package/src/a2ui.mjs

@@ -0,0 +1,360 @@
+/**
+ * Static checks over A2UI v0.9 server-to-client messages (createSurface, updateComponents,
+ * updateDataModel, deleteSurface). A2UI sends no HTML; the hazards are URLs the client fetches
+ * without a click (Image, Video, AudioPlayer, theme.iconUrl), URLs it navigates to (openUrl), and
+ * Markdown in Text that breaks the basic catalog's "no HTML, images or links".
+ *
+ * Most values are bound to the data model, so the effective value exists only at render time. This
+ * scan resolves absolute `{ "path": … }` bindings and `formatString` interpolations against the
+ * `updateDataModel` messages of the same stream, after every message, so a value swapped after the
+ * first render is seen too. What it cannot resolve (relative paths in list templates, client
+ * functions, data from a later stream) it leaves to the runtime check, `@render-policy/a2ui`.
+ */
+import { checkUrl, DEFAULT_URL_HEURISTICS } from '@render-policy/core';
+import { checkUrlHeuristics } from '@render-policy/core/internal';
+import { parseDomainPattern, sinkScope } from './domains.mjs';
+
+/**
+ * @import { Finding } from './lint.mjs'
+ */
+/**
+ * One message and the line it starts on, when the input had lines (JSONL).
+ * @typedef {{ message: unknown, line?: number }} A2uiEntry
+ */
+/** @typedef {'fetched' | 'openUrl'} UrlUse */
+/**
+ * Where a value sits: surface, component and property, plus the data-model path it came from.
+ * @typedef {{ surfaceId: string, componentId?: string, property: string, dataPath?: string, line?: number }} Place
+ */
+
+/** Basic-catalog properties the client fetches without a click. */
+const FETCHED_PROPERTIES = /** @type {Record<string, string>} */ ({ Image: 'url', Video: 'url', AudioPlayer: 'url' });
+/** The catalog: openUrl must resolve to http or https. */
+const OPEN_URL_POLICY = { allowedSchemes: ['http', 'https'], allowRelativeUrls: true };
+const MAX_SHOWN = 120;
+
+/** @param {unknown} value */
+const isObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+/** @param {string} value */
+const shown = (value) => (value.length > MAX_SHOWN ? `${value.slice(0, MAX_SHOWN)}…` : value);
+/** @param {Place} p */
+const placeName = (p) => `${p.surfaceId}/${p.componentId ?? 'theme'}.${p.property}${p.dataPath ? ` <- ${p.dataPath}` : ''}`;
+/** @param {Place} p */
+const placeText = (p) =>
+  `${p.componentId ? `component "${p.componentId}"` : 'the surface theme'} (surface "${p.surfaceId}") ${p.property}${p.dataPath ? `, bound to ${p.dataPath}` : ''}`;
+
+/**
+ * Messages from the text of a file: one message, an array of them, an object with `messages` (the
+ * list wrapper and the specification's samples), or JSONL. Throws on a line that does not parse.
+ * @param {string} text
+ * @returns {A2uiEntry[]}
+ */
+export function parseA2uiMessages(text) {
+  /** @type {unknown} */
+  let whole;
+  try {
+    whole = JSON.parse(text);
+  } catch {
+    whole = undefined;
+  }
+  if (whole !== undefined) {
+    if (Array.isArray(whole)) return whole.map((message) => ({ message }));
+    if (isObject(whole) && Array.isArray(/** @type {any} */ (whole).messages)) return /** @type {any} */ (whole).messages.map((/** @type {unknown} */ message) => ({ message }));
+    return [{ message: whole }];
+  }
+  /** @type {A2uiEntry[]} */
+  const entries = [];
+  const lines = text.split('\n');
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = (lines[i] ?? '').trim();
+    if (line === '') continue;
+    try {
+      entries.push({ message: JSON.parse(line), line: i + 1 });
+    } catch (error) {
+      throw new Error(`line ${i + 1}: not a JSON message (${error instanceof Error ? error.message : String(error)})`);
+    }
+  }
+  return entries;
+}
+
+/**
+ * JSON Pointer segments; `/` and `` are the whole model.
+ * @param {string} path
+ */
+const segments = (path) => (path === '' || path === '/' ? [] : path.split('/').slice(1).map((s) => s.replace(/~1/g, '/').replace(/~0/g, '~')));
+
+/**
+ * @param {unknown} model
+ * @param {string} path
+ */
+function readPath(model, path) {
+  /** @type {any} */
+  let node = model;
+  for (const key of segments(path)) {
+    if (node === null || typeof node !== 'object') return undefined;
+    node = node[key];
+  }
+  return node;
+}
+
+/**
+ * The model after one updateDataModel: `value` replaces what is at `path`; no `value` removes it.
+ * @param {unknown} model
+ * @param {string} path
+ * @param {unknown} value
+ * @param {boolean} remove
+ */
+function writePath(model, path, value, remove) {
+  const keys = segments(path);
+  if (keys.length === 0) return remove ? {} : structuredClone(value);
+  /** @type {any} */
+  const root = isObject(model) || Array.isArray(model) ? model : {};
+  let node = root;
+  for (const key of keys.slice(0, -1)) {
+    if (node[key] === null || typeof node[key] !== 'object') node[key] = {};
+    node = node[key];
+  }
+  const last = /** @type {string} */ (keys.at(-1));
+  if (remove) delete node[last];
+  else node[last] = structuredClone(value);
+  return root;
+}
+
+/**
+ * `formatString` with only `${/absolute/path}` interpolations, resolved; null when it calls a
+ * function or uses a relative path, which only the client can resolve.
+ * @param {string} template
+ * @param {unknown} model
+ */
+function interpolate(template, model) {
+  let resolvable = true;
+  const out = template.replace(/(\\?)\$\{([^}]*)\}/g, (match, escape, expression) => {
+    if (escape) return match.slice(1);
+    const path = String(expression).trim();
+    if (!/^\/[^\s(),:'"]*$/.test(path)) {
+      resolvable = false;
+      return '';
+    }
+    const value = readPath(model, path);
+    return value === undefined || value === null ? '' : String(value);
+  });
+  return resolvable ? out : null;
+}
+
+/** Interpolations that are not escaped with a backslash. */
+const INTERPOLATION_RE = /(?<!\\)\$\{/;
+/** Scheme and authority of an absolute URL template. */
+const AUTHORITY_RE = /^[a-z][a-z0-9+.-]*:\/\/[^/?#]*/i;
+
+/**
+ * Markup the basic catalog keeps out of Text. Code spans and fences are left out first: `<b>` in
+ * code is shown as code.
+ * @param {string} text
+ */
+function textMarkup(text) {
+  const prose = text.replace(/```[\s\S]*?(```|$)/g, ' ').replace(/`[^`\n]*`/g, ' ');
+  /** @type {string[]} */
+  const kinds = [];
+  const TAG_RE = /<\/?[a-z][a-z0-9-]*(\s[^<>]*)?\/?>|<!--[\s\S]*?(-->|$)/gi;
+  if (TAG_RE.test(prose)) kinds.push('raw HTML');
+  // A URL inside a tag is part of the HTML, not a link of its own.
+  const withoutTags = prose.replace(TAG_RE, ' ');
+  if (/!\[[^\]]*\](\([^)]*\)|\[[^\]]*\])/.test(withoutTags)) kinds.push('an image');
+  const withoutImages = withoutTags.replace(/!\[[^\]]*\](\([^)]*\)|\[[^\]]*\])/g, ' ');
+  if (/\[[^\]]+\]\([^)]*\)|\[[^\]]+\]\[[^\]]*\]|<[a-z][a-z0-9+.-]*:[^\s>]+>|\bhttps?:\/\/\S|\bwww\.[a-z0-9-]+\.[a-z]/i.test(withoutImages)) kinds.push('a link');
+  return kinds;
+}
+
+/**
+ * Every `{ call: 'openUrl' }` inside a component, with the property path that leads to it.
+ * @param {unknown} node
+ * @param {string} at
+ * @param {Array<{ args: any, at: string }>} out
+ */
+function findOpenUrlCalls(node, at, out) {
+  if (Array.isArray(node)) {
+    node.forEach((item, i) => findOpenUrlCalls(item, `${at}[${i}]`, out));
+    return out;
+  }
+  if (!isObject(node)) return out;
+  const object = /** @type {Record<string, unknown>} */ (node);
+  if (object.call === 'openUrl') out.push({ args: object.args, at });
+  for (const [key, value] of Object.entries(object)) findOpenUrlCalls(value, at ? `${at}.${key}` : key, out);
+  return out;
+}
+
+/**
+ * Findings over a stream of A2UI v0.9 messages. `uri` is the file the messages came from.
+ * @param {readonly (A2uiEntry | unknown)[]} input messages, or entries with their line
+ * @param {string} uri
+ * @returns {Finding[]}
+ */
+export function lintA2uiMessages(input, uri) {
+  /** @type {A2uiEntry[]} */
+  const entries = input.map((item) => (isObject(item) && 'message' in /** @type {object} */ (item) ? /** @type {A2uiEntry} */ (item) : { message: item }));
+  /** @type {Finding[]} */
+  const findings = [];
+  const reported = new Set();
+  /** @type {Set<string>} */
+  const remoteHosts = new Set();
+
+  /**
+   * @param {string} ruleId
+   * @param {string} message
+   * @param {Place} place
+   * @param {Record<string, unknown>} [properties]
+   */
+  const report = (ruleId, message, place, properties = {}) => {
+    const key = `${ruleId}|${placeName(place)}|${String(properties.value ?? '')}`;
+    if (reported.has(key)) return;
+    reported.add(key);
+    findings.push({
+      ruleId,
+      message,
+      uri,
+      ...(place.line ? { region: { startLine: place.line } } : {}),
+      logical: { name: placeName(place), kind: 'member' },
+      properties: { surfaceId: place.surfaceId, ...(place.componentId ? { componentId: place.componentId } : {}), property: place.property, ...(place.dataPath ? { dataPath: place.dataPath } : {}), ...properties },
+    });
+  };
+
+  /**
+   * One URL value, literal or resolved.
+   * @param {unknown} raw
+   * @param {UrlUse} use
+   * @param {Place} place
+   */
+  const checkUrlValue = (raw, use, place) => {
+    if (typeof raw !== 'string' || raw.trim() === '') return;
+    const verdict = checkUrl(raw, OPEN_URL_POLICY);
+    if (!verdict.ok) {
+      // A fetched URL with another scheme (data:, blob:) makes no network request; only navigation is the catalog's concern.
+      if (use === 'openUrl') report('A2UI001', `openUrl in ${placeText(place)} opens "${shown(raw)}": ${verdict.reason}; the basic catalog allows http and https only.`, place, { value: raw });
+      return;
+    }
+    if (verdict.parsed.relative) return;
+    const { url } = verdict.parsed;
+    const sink = sinkScope(parseDomainPattern(url.host));
+    if (sink?.scope === 'shared') {
+      report('A2UI002', `${placeText(place)} ${use === 'openUrl' ? 'navigates to' : 'loads'} ${url.host}, which is on the sink denylist (${sink.entry.category}: ${sink.entry.pattern}).`, place, { value: raw, host: url.host });
+    }
+    if (use === 'fetched') {
+      remoteHosts.add(url.host);
+      const problem = checkUrlHeuristics(url, DEFAULT_URL_HEURISTICS);
+      if (problem) report('A2UI003', `${placeText(place)} is fetched without a click and ${problem.reason.replace(/^URL /, '')}: "${shown(raw)}".`, place, { value: raw, code: problem.code });
+    }
+  };
+
+  /**
+   * @param {unknown} raw
+   * @param {Place} place
+   */
+  const checkTextValue = (raw, place) => {
+    if (typeof raw !== 'string') return;
+    const kinds = textMarkup(raw);
+    if (kinds.length > 0) report('A2UI006', `Text in ${placeText(place)} contains ${kinds.join(', ')}; the basic catalog allows Markdown without HTML, images or links.`, place, { value: raw, kinds });
+  };
+
+  /**
+   * @param {string} template
+   * @param {UrlUse} use
+   * @param {Place} place
+   */
+  const checkTemplate = (template, use, place) => {
+    const at = template.search(INTERPOLATION_RE);
+    if (at === -1) return;
+    const authority = AUTHORITY_RE.exec(template)?.[0] ?? '';
+    if (at < authority.length || authority === '') {
+      report('A2UI004', `formatString in ${placeText(place)} takes the ${authority === '' ? 'scheme and host' : 'host'} from data: "${shown(template)}". No host allowlist can be checked before render.`, place, { value: template });
+    } else if (use === 'fetched') {
+      report('A2UI005', `formatString in ${placeText(place)} puts data into a URL fetched without a click: "${shown(template)}". The client must check the resolved URL.`, place, { value: template });
+    }
+  };
+
+  /**
+   * Bindings per surface, resolved against the model after every message.
+   * @type {Map<string, { model: unknown, bindings: Array<{ kind: 'path' | 'template', source: string, check: 'url' | 'text', use: UrlUse, place: Place }> }>}
+   */
+  const surfaces = new Map();
+  /** @param {string} id */
+  const surface = (id) => {
+    let s = surfaces.get(id);
+    if (!s) {
+      s = { model: {}, bindings: [] };
+      surfaces.set(id, s);
+    }
+    return s;
+  };
+
+  /**
+   * A property value: a literal is checked now, a binding or template is remembered.
+   * @param {unknown} value
+   * @param {'url' | 'text'} check
+   * @param {UrlUse} use
+   * @param {Place} place
+   */
+  const property = (value, check, use, place) => {
+    if (typeof value === 'string') {
+      if (check === 'url') checkUrlValue(value, use, place);
+      else checkTextValue(value, place);
+      return;
+    }
+    if (!isObject(value)) return;
+    const v = /** @type {any} */ (value);
+    const bindings = surface(place.surfaceId).bindings;
+    if (typeof v.path === 'string' && v.path.startsWith('/')) bindings.push({ kind: 'path', source: v.path, check, use, place });
+    else if (v.call === 'formatString' && typeof v.args?.value === 'string') {
+      if (check === 'url') checkTemplate(v.args.value, use, place);
+      bindings.push({ kind: 'template', source: v.args.value, check, use, place });
+    }
+  };
+
+  /** @param {string} id */
+  const resolveBindings = (id, line = /** @type {number | undefined} */ (undefined)) => {
+    const s = surface(id);
+    for (const b of s.bindings) {
+      const value = b.kind === 'path' ? readPath(s.model, b.source) : interpolate(b.source, s.model);
+      if (value === undefined || value === null) continue;
+      const place = { ...b.place, dataPath: b.kind === 'path' ? b.source : `formatString "${shown(b.source)}"`, line: line ?? b.place.line };
+      if (b.check === 'url') checkUrlValue(value, b.use, place);
+      else checkTextValue(value, place);
+    }
+  };
+
+  for (const { message, line } of entries) {
+    if (!isObject(message)) continue;
+    const m = /** @type {any} */ (message);
+    if (isObject(m.createSurface)) {
+      const id = String(m.createSurface.surfaceId ?? '?');
+      surface(id);
+      if (m.createSurface.theme?.iconUrl !== undefined) checkUrlValue(m.createSurface.theme.iconUrl, 'fetched', { surfaceId: id, property: 'theme.iconUrl', line });
+    } else if (isObject(m.updateComponents)) {
+      const id = String(m.updateComponents.surfaceId ?? '?');
+      for (const c of Array.isArray(m.updateComponents.components) ? m.updateComponents.components : []) {
+        if (!isObject(c)) continue;
+        const componentId = String(c.id ?? '?');
+        const fetched = FETCHED_PROPERTIES[String(c.component)];
+        if (fetched) property(c[fetched], 'url', 'fetched', { surfaceId: id, componentId, property: fetched, line });
+        if (c.component === 'Text') property(c.text, 'text', 'fetched', { surfaceId: id, componentId, property: 'text', line });
+        for (const call of findOpenUrlCalls(c, '', [])) {
+          property(call.args?.url, 'url', 'openUrl', { surfaceId: id, componentId, property: `${call.at}.args.url`, line });
+        }
+      }
+      resolveBindings(id);
+    } else if (isObject(m.updateDataModel)) {
+      const id = String(m.updateDataModel.surfaceId ?? '?');
+      const s = surface(id);
+      const update = m.updateDataModel;
+      s.model = writePath(s.model, typeof update.path === 'string' ? update.path : '/', update.value, !('value' in update));
+      resolveBindings(id, line);
+    } else if (isObject(m.deleteSurface)) {
+      surfaces.delete(String(m.deleteSurface.surfaceId ?? '?'));
+    }
+  }
+
+  if (remoteHosts.size > 0) {
+    const hosts = [...remoteHosts].sort();
+    findings.push({ ruleId: 'A2UI007', message: `Surfaces load media from ${hosts.join(', ')}; a client policy must allow these hosts (for example images.hosts in @render-policy/a2ui).`, uri, properties: { hosts } });
+  }
+  return findings;
+}

package/src/cli.mjs

@@ -6,11 +6,13 @@
  *   mcp-app-lint --read read.json [--list list.json] [--tools tools.json]
  *                                                  # results of resources/read, resources/list, tools/list
  *   mcp-app-lint --html app.html                   # one UI document
+ *   mcp-app-lint --a2ui stream.jsonl               # A2UI v0.9 messages (JSON, JSON array, { messages } or JSONL)
  * Options: --out file.sarif, --format sarif|text (default sarif), --fail-on error|warning|note|none (default error)
  */
 import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
+import { lintA2uiMessages, parseA2uiMessages } from './a2ui.mjs';
 import { UI_MIME } from './analyze.mjs';
 import { lintHtml, lintPackageScan, lintResource, lintTools, levelOf } from './lint.mjs';
 import { packageMeta, scanPackage, scanPackageDir } from './npm.mjs';
@@ -30,6 +32,7 @@ import { toSarif, toText } from './sarif.mjs';
  * @property {string} [list]
  * @property {string} [tools]
  * @property {string} [html]
+ * @property {string} [a2ui]
  * @property {string} [out]
  * @property {boolean} [help]
  */
@@ -54,6 +57,7 @@ function parseArgs(argv) {
     else if (arg === '--list') options.list = next();
     else if (arg === '--tools') options.tools = next();
     else if (arg === '--html') options.html = next();
+    else if (arg === '--a2ui') options.a2ui = next();
     else if (arg === '--out') options.out = next();
     else if (arg === '--format') options.format = next();
     else if (arg === '--fail-on') options.failOn = next();
@@ -87,8 +91,8 @@ function relativeUri(uri) {
  */
 export async function run(argv, { stdout = process.stdout, stderr = process.stderr } = {}) {
   const options = parseArgs(argv);
-  if (options.help || (!options.dir && !options.package && !options.read && !options.html && !options.tools)) {
-    stderr.write('usage: mcp-app-lint (--dir <path> | --package <name> | --read <read.json> [--list <list.json>] | --html <file>) [--tools <tools.json>] [--out file] [--format sarif|text] [--fail-on error|warning|note|none]\n');
+  if (options.help || (!options.dir && !options.package && !options.read && !options.html && !options.tools && !options.a2ui)) {
+    stderr.write('usage: mcp-app-lint (--dir <path> | --package <name> | --read <read.json> [--list <list.json>] | --html <file> | --a2ui <messages>) [--tools <tools.json>] [--out file] [--format sarif|text] [--fail-on error|warning|note|none]\n');
     return 2;
   }
   /** @type {Finding[]} */
@@ -123,6 +127,9 @@ export async function run(argv, { stdout = process.stdout, stderr = process.stde
   if (options.html) {
     findings.push(...lintHtml(await readFile(options.html, 'utf8'), options.html));
   }
+  if (options.a2ui) {
+    findings.push(...lintA2uiMessages(parseA2uiMessages(await readFile(options.a2ui, 'utf8')), options.a2ui));
+  }
   if (options.tools) {
     const tools = await readJson(options.tools);
     findings.push(...lintTools(Array.isArray(tools?.tools) ? tools.tools : tools, options.tools));

package/src/index.mjs

@@ -1,3 +1,4 @@
+export { lintA2uiMessages, parseA2uiMessages } from './a2ui.mjs';
 export { analyzeHtml, analyzeTools, analyzeUiMeta, compareListRead, ESCAPE_FUNCTIONS, isHandwritten, postMessageStarCalls, UI_MIME, uiMetaOf, withSinkHosts } from './analyze.mjs';
 export { categorizeDomain, categorizeHost, classifyDomains, DOMAIN_CATEGORIES, parseDomainPattern, sinkFor, sinkScope } from './domains.mjs';
 export { levelOf, lintHtml, lintPackageScan, lintResource, lintTools, lintUiMeta } from './lint.mjs';
@@ -7,6 +8,7 @@ export { toSarif, toText, TOOL_VERSION } from './sarif.mjs';
 export { run } from './cli.mjs';
 
 /**
+ * @typedef {import('./a2ui.mjs').A2uiEntry} A2uiEntry
  * @typedef {import('./analyze.mjs').UiMeta} UiMeta
  * @typedef {import('./analyze.mjs').CspKey} CspKey
  * @typedef {import('./analyze.mjs').HtmlAnalysis} HtmlAnalysis

package/src/rules.mjs

@@ -1,9 +1,12 @@
 /** @typedef {'error' | 'warning' | 'note'} Level */
 /**
- * A rule in SARIF terms: `short` and `full` become its short and full description.
- * @typedef {{ id: string, name: string, level: Level, short: string, full: string }} Rule
+ * A rule in SARIF terms: `short` and `full` become its short and full description; `tags` default to
+ * security and mcp-apps.
+ * @typedef {{ id: string, name: string, level: Level, short: string, full: string, tags?: readonly string[] }} Rule
  */
 
+const A2UI_TAGS = ['security', 'a2ui'];
+
 /**
  * The rules, in SARIF terms. Ids are stable; names are what a scanner shows.
  * @type {readonly Rule[]}
@@ -28,6 +31,13 @@ export const RULES = [
   { id: 'MCPAPP017', name: 'meta-list-read-mismatch', level: 'warning', short: 'resources/read declares a different policy than resources/list', full: 'Hosts must prefer the read-time policy. Reported when both sides declare the same field (csp, permissions or domain) with different values and the read-time CSP adds nothing (that is MCPAPP018). A listing that declares no CSP is not a mismatch: the MCP Apps SDK puts the CSP in the read result only.' },
   { id: 'MCPAPP018', name: 'meta-read-wider-than-list', level: 'error', short: 'resources/read widens the policy seen at resources/list', full: 'Both sides declare a CSP and the read-time one has an entry the listing does not have under the same key (a new domain, a replaced one, or a wildcard). This is the pattern a host that reviews at connection time cannot see.' },
   { id: 'MCPAPP019', name: 'csp-sink-tenant-host', level: 'note', short: 'CSP entry names one account on a multi-tenant service', full: 'The host is a single bucket, worker or app on a storage or serverless service from the sink denylist (acct.blob.core.windows.net, pub-<id>.r2.dev). It reaches only that account, which is fine while the owner keeps it; a deleted bucket or app name can be registered by someone else.' },
+  { id: 'A2UI001', name: 'a2ui-openurl-scheme', level: 'error', tags: A2UI_TAGS, short: 'openUrl target is not http or https', full: "The basic catalog requires openUrl to resolve to http: or https: and to abort otherwise. javascript:, data: and other schemes are script or content the agent chose; a client that opens them runs it. Checked on literals and on values bound from the data model in the same stream." },
+  { id: 'A2UI002', name: 'a2ui-sink-host', level: 'error', tags: A2UI_TAGS, short: 'A URL in the surface points at a data sink', full: 'An Image, Video or AudioPlayer url, the theme icon, or an openUrl target names a host on the sink denylist (request catchers, tunnels, anonymous serverless endpoints, form builders, public object storage) where anyone can open an account. Media is fetched as soon as it renders, without a click.' },
+  { id: 'A2UI003', name: 'a2ui-url-encoded-payload', level: 'warning', tags: A2UI_TAGS, short: 'A URL fetched without a click carries an encoded payload', full: 'A media or icon URL is longer than 2048 characters or has a long high-entropy path segment or query value, the shape of data encoded into a request. The client fetches it as soon as it renders. Checked on literals, bound values and formatString results the stream lets the scanner resolve.' },
+  { id: 'A2UI004', name: 'a2ui-url-template-host', level: 'warning', tags: A2UI_TAGS, short: 'formatString takes a URL host from data', full: 'A formatString builds a media URL or openUrl target whose scheme or host comes from the data model, so the host is decided at render time and no allowlist can be reviewed before. Fix the host in the template, or check the resolved URL on the client (@render-policy/a2ui).' },
+  { id: 'A2UI005', name: 'a2ui-url-template-data', level: 'note', tags: A2UI_TAGS, short: 'formatString puts data into a URL fetched without a click', full: 'A media URL is assembled from data model values. Whatever the data holds reaches the host in the request as soon as the component renders. The client should check the resolved URL (length, entropy, host), which is what @render-policy/a2ui does.' },
+  { id: 'A2UI006', name: 'a2ui-text-markup', level: 'warning', tags: A2UI_TAGS, short: 'Text contains HTML, an image or a link', full: 'The basic catalog allows simple Markdown in Text "without HTML, images, or links". The contract binds the agent, not the renderer: a client that renders Text with a general Markdown renderer fetches the image or shows the link. Code spans and fences are not reported. Bare URLs count, because GFM renderers turn them into links.' },
+  { id: 'A2UI007', name: 'a2ui-remote-media-hosts', level: 'note', tags: A2UI_TAGS, short: 'Surfaces load media from remote hosts', full: 'The hosts that media and icon URLs in the stream point at, literal or resolved. A client policy has to allow them, or the images stay blocked.' },
 ];
 
 export const RULE_INDEX = new Map(RULES.map((rule, index) => [rule.id, index]));

package/src/sarif.mjs

@@ -50,7 +50,7 @@ export function toSarif(findings, { invocation = {} } = {}) {
               fullDescription: { text: rule.full },
               help: { text: rule.full },
               defaultConfiguration: { level: rule.level },
-              properties: { tags: ['security', 'mcp-apps'] },
+              properties: { tags: rule.tags ?? ['security', 'mcp-apps'] },
             })),
           },
         },