MIT License
Use, copy, modify, and distribute Signalint under the repository's MIT terms.
Public record / MIT
Inspect the code that shapes your diagnostics.
Signalint is free software under the MIT License. The server, tests, architecture, security model, and original build record are all available in the public repository.
LicenseMIT
Use, modify, and distribute under the repository license.
Published0.2.0
Current latest dist-tag on the public npm registry.
CI matrix4
Windows, macOS, Ubuntu Node 22, and Ubuntu Node 20.19.
Transportstdio
Local MCP surface with no hosted runtime dependency.
Repository / evidence
Designed to be checked, not taken on trust.
The current implementation and its test history supersede the archived build plan when they differ.
Contribution workflow
Development setup, verification gates, commit style, and required cross-platform CI checks.
Threat model
MCP arguments are untrusted; filesystem reach, process controls, and the dependency advisory are documented.
Architecture
Current module boundaries, engine strategy, cache identity, and check data flow.
Tests and CI
The suite runs on Windows, Ubuntu, and macOS, including the supported Node 20.19 line.
Project history
The archived build plan retains acceptance criteria, amendments, risks, and pre-launch review findings.
Repository / map
Know where each guarantee lives.
The public repository separates process execution, validation, caching, clustering, and session state so each boundary can be reviewed independently.
| Path | What it owns | What to verify there |
|---|---|---|
src/adapters/ | Oxlint, TypeScript, and Biome invocation | Arguments, output parsing, engine-specific behavior |
src/projectPaths.tssrc/toolArguments.ts | Untrusted MCP input boundary | Schema enforcement, canonical containment, hostile-path rejection |
src/cache/src/cluster/ | Reuse and response reduction | Version-aware keys, LRU bounds, rule-first grouping, priority |
src/memory/src/sessionLog.ts | Loop history and metrics | Bounded replay, rotation, malformed-line tolerance |
test/.github/workflows/ci.yml | Regression and platform evidence | Windows, macOS, Ubuntu, Node 20.19, and Node 22 checks |
Contribution / workflow
Contribute against the same evidence gate.
Changes land through protected pull requests. The repository documents the commands, commit format, trust boundaries, and cross-platform checks expected before merge.
- 01
Install the locked toolchain
Use Node 20.19+ or 22.12+, pnpm 11.9.0, and
pnpm install --frozen-lockfile. - 02
Run the full local gate
Run lint, typecheck, test, and build. A change is complete only when its behavior is covered and the commands pass.
- 03
Open a focused pull request
Use
type(scope): message. Main blocks direct and force pushes, including for administrators. - 04
Pass every supported platform
Required checks cover Windows, macOS, Ubuntu on Node 22, and Ubuntu on Node 20.19.
Scope / v1
Understand the boundary before adopting it.
Signalint is deliberately narrow: local JavaScript and TypeScript diagnostics for coding agents, with explicit limits rather than implied coverage.
Included
The current contract
- Local stdio MCP and direct CLI checks.
- Oxlint, TypeScript, and optional Biome adapters.
- Bounded cache, clustered schema 1.1 responses, and loop warnings.
- Strict tool schemas and project-root path containment.
Not included
Deliberate v1 limits
- No arbitrary custom engines, autofix application, SAST, or IDE extension.
- Monorepos need a root TypeScript Project References config.
check_filescannot infer an omitted changed TypeScript dependency.- The containment boundary is not an operating-system sandbox.
Security
Report privately before publishing exploit details.
The current reporting policy asks researchers to contact the repository owner through GitHub and request a private channel.
Read the security policy