777genius

Lintai — Security skill for Claude Code

Security community

Offline-first, precision-first security linter for SKILLS, MCP, plugins, configs and other AI infrastructure.

How to install Lintai

This entry records only its repository, not the path inside it, so there is no exact command to give. Open 777genius/lintai and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Lintai does

Offline-first, precision-first security linter for SKILLS, MCP, plugins, configs and other AI infrastructure.

Alternatives in Security

Mcp-scan (Invariant Labs) — MCP security scanner with proxy mode for real-time scanning without infrastructure changes 1.9k ★
Trail Of Bits Claude-code-config — Opinionated production defaults from a top security firm: sandboxing, permissions, hooks, skills, MCP server c 1.6k ★
Claude Bootstrap — Opinionated project initialization with security-first guardrails, spec-driven atomic todos, LLM testing patte 536 ★

README

lintai

[![coverage](https://img.shields.io/endpoint?url=https%3A%2F%2F777genius.github.io%2Flintai%2Fcoverage%2Fcoverage-badge.json)](https://777genius.github.io/lintai/coverage/)

Make AI agent policy reviewable.

`lintai` checks the files that quietly decide what coding agents can run, access, and inherit before merge. It helps you review MCP configs, hooks, permissions, skills, and agent instructions before risky defaults spread through local workflows or CI. It can also run an opt-in advisory lane for committed npm lockfiles.

Current release: `v0.1.1`

Fast local and CI checks
Deterministic findings with evidence
Helps verify artifacts before use

`lintai` helps raise confidence and find risky patterns. It does not guarantee that an artifact is completely safe.

Why `lintai` exists

Skills, MCP configs, agent rules, hooks, and plugin manifests are not just docs or metadata. They are trust surfaces that can change agent behavior, launch tools, route network access, and carry risky auth or execution patterns.

`lintai` exists to make those artifacts easier to verify before use, before sharing, and before merge. It is built for fast local runs, repeatable CI checks, and private repositories where offline-first verification matters.

Think of it as a Ruff/Biome-style workflow for agent artifact review: fast, deterministic, and meant to run often.

Quick Start

curl -fsSL https://github.com/777genius/lintai/releases/latest/download/lintai-installer.sh | sh
"$HOME/.local/bin/lintai" scan .

After `~/.local/bin` is on `PATH`, use `lintai scan .` directly.

Exit codes:

0: no blocking findings
1: blocking findings were emitted
2: execution or configuration error

Interpretation:

Stable findings are the release-quality baseline behind the quiet recommended default.
Preview findings are useful deeper-review signals, but not the baseline trust bar.
explicit sidecar lanes such as threat-review, compat, governance, a