Security model
What Signalint treats as untrusted, which filesystem boundary it enforces, and what remains outside that boundary.
MCP tool arguments are untrusted. A coding model can be prompt-injected by repository content, generated text, or another tool response.
Argument boundary
- Every tool input is parsed by strict runtime Zod schemas.
- Unknown properties, wrong container types, non-string paths, malformed issue references, and arrays above 512 paths are rejected.
- Absolute, leading-dash, and NUL-containing paths are refused.
- Relative paths are checked against the project root before and after symlink or junction canonicalization.
check_files,check_project, and tsc project selection share the same containment module.
Process boundary
Adapters spawn resolved engine entry points directly without a shell. Oxlint and Biome receive an explicit end-of-options separator. TypeScript receives only a contained, canonical configuration path. Engine output is byte-bounded and process trees are terminated on timeout, cancellation, or server shutdown on Windows and POSIX systems.
Filesystem reach
After validation, Signalint directly reads selected project files and recognized config files inside the project root. Its own persistent writes stay under .signalint/. This is a tool-argument containment boundary, not an operating-system sandbox.
Trusted TypeScript or linter configuration can still ask an engine to resolve imports, extends entries, plugins, or packages using that engine's normal filesystem behavior. Run Signalint only on projects and engine configuration you are willing to execute with the current operating-system account.
Transport
The published server constructs only the SDK's local StdioServerTransport. It opens no HTTP listener and serves no static filesystem path. Adding an HTTP transport or dashboard server would require a new security review before release.
Dependency advisory
The repository documents a moderate @hono/node-server static-file advisory in the MCP SDK's transitive dependency graph. The affected HTTP serveStatic path is not imported or exercised by Signalint's stdio-only entry point. This reachability assessment must be rechecked when the dependency updates or if an HTTP surface is added.
For the complete analysis and vulnerability reporting instructions, read SECURITY.md on GitHub.