Add CallLint to the Copilot plugins marketplace - #80
Open
saintl1022 wants to merge 1 commit into
Open
Conversation
CallLint is a preflight risk linter for MCP servers and agent tools. It reports SAFE / REVIEW / BLOCK / UNKNOWN with evidence for every finding, and never executes the server it judges. The entry mirrors the existing `workiq` shape field for field and points at plugins/calllint in calllint/calllint, which carries the plugin manifest and .mcp.json. Append-only: one entry, 24 lines, no existing entry altered and the .claude-plugin/marketplace.json symlink untouched.
saintl1022
added a commit
to calllint/calllint
that referenced
this pull request
Aug 27, 2026
Version bump: 1.8.0 -> 1.9.0. Closes a nine-day gap in which 35 commits sat on `main` while npm still served 1.8.0, so no user had any of them. Most consequentially, the telemetry delivery path now actually ships, which means `no telemetry ingested yet` stops being a correct description of the world and starts being a finding (O-1). Three fields move together because a gate requires it: apps/cli/package.json, project-facts.json stableVersion, and CLI_VERSION (derived from stableVersion in renderPage.ts). The Trust Index bake follows, and re-baking also advanced 99 pages FRESH -> AGING — time-derived and accurate, not caused by the bump. Distribution: - copilot-cli/github-copilot-plugin READY_NOT_SUBMITTED -> PENDING_UPSTREAM. Opened github/copilot-plugins#80 on the user's behalf: one entry appended to `.github/plugin/marketplace.json`, +24/-0. That repo's `.claude-plugin/marketplace.json` is a *symlink* to it (mode 120000), which the contents API hides by resolving — only the tree mode shows it. §89's quota of 3 external submissions is now spent. - openclaw/openclaw-clawhub: DECIDED, declined. Publishing needs one command and no new artifact, but ClawHub releases every skill under MIT-0 against this repo's Apache-2.0. The alternative was checked before recording: their skill format documents no `license` field and states it "does not support per-skill license overrides". Recorded as settled rather than pending. - Dropped a `READY_NOT_SUBMITTED` non-emptiness assertion added earlier the same day. It failed within the hour when the copilot row moved, and it was the original mistake wearing the opposite sign: requiring the state to be populated is no more a rule than requiring it empty. Arm 4's ability to fail rests on three negative fixtures, not on live data. - CHANGELOG: added the `.mcp.json` and O-2 entries that landed after #343, then closed [Unreleased] into [1.9.0]. Removed a stale "see ADR 0008" citation for the rename — no ADR 0008 records it in either series. Verification: pnpm test 4978 passed / 1 skipped (266 files), typecheck clean, build clean, all 4 distribution/copy gates PASS.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this adds
One entry for CallLint, a preflight risk linter for MCP servers and agent tools.
Before an agent adds or edits a tool config, CallLint scans the blast radius and returns
SAFE/REVIEW/BLOCK/UNKNOWN— with evidence attached to every finding, and arecorded distinction between what was observed and what was inferred. It is advisory and
non-blocking, and it never executes the server it is judging.
calllint,calllint-mcpThe diff
Append-only,
.github/plugin/marketplace.json, 24 lines added / 0 removed, one hunk. Noexisting entry is altered, and
.claude-plugin/marketplace.json— the symlink added in #24 —is deliberately untouched.
The entry mirrors the live
workiqentry field for field and in order. Every value is onealready published in
plugins/calllint/.claude-plugin/plugin.json; nothing was invented forthis submission.
Verified before opening
plugins/calllint/.mcp.jsonis oncalllint/calllint@main— so following this entryyields a plugin whose MCP server actually registers. It resolves to
npx -y calllint-mcp./mcplists the server asconnected. An earlier revision shipped only
mcp.json(Cursor's filename), which loadedthe plugin while leaving the MCP server silently absent;
.mcp.jsonwas added to fixexactly that, and it landed before this PR was opened.
Happy to adjust the description, keywords, or field set to match whatever convention you'd
prefer for third-party entries.