
Security News
RubyGems Adds Cooldown Feature to Bundler for Newly Published Gems
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.
@felixgeelhaar/cclint
Advanced tools
Catch CLAUDE.md drift before Claude misbehaves. Lints CLAUDE.md, skills, subagents, and hooks for Claude Code projects.
Catch CLAUDE.md drift before Claude misbehaves. A fast linter for the configuration files Claude Code actually reads — CLAUDE.md, skills, subagents, and hooks — so silent context bugs stop costing you sessions.
claude-3-5-sonnet flagged as deprecated; claude-opus-4-7 recognized)@path imports and circular import chainsrm -rf /, curl | bash, fork bombs)--fix and interactive -i modes for common issuesnpm install -g @felixgeelhaar/cclint
npm install --save-dev @felixgeelhaar/cclint
npx @felixgeelhaar/cclint lint your-claude.md
# Lint a CLAUDE.md file
cclint lint CLAUDE.md
# Lint with JSON output
cclint lint CLAUDE.md --format json
# Set custom file size limit
cclint lint CLAUDE.md --max-size 5000
📝 Linting results for CLAUDE.md:
❌ error: Missing required section: "Development Commands" at 1:1 [structure]
⚠️ warning: File size (12,543 characters) exceeds maximum allowed size (10,000 characters) at 1:1 [file-size]
⚠️ warning: Missing required content: TypeScript usage (expected: "TypeScript") at 1:1 [content]
Summary: 1 errors, 2 warnings
import-syntax) 🆕Validates Anthropic's @path/to/file import syntax for CLAUDE.md files.
~/)content-organization) 🆕Validates content quality and structure following Anthropic best practices.
file-location) 🆕Validates file placement and naming conventions.
import-resolution) ⭐ v0.6.0Validates that imports resolve to existing files and detects circular dependencies.
content-appropriateness) ⭐ v0.6.0Ensures content is specific, actionable, and belongs in CLAUDE.md.
monorepo-hierarchy) ⭐ v0.6.0Validates CLAUDE.md file relationships in monorepos.
command-safety) ⭐ v0.6.0Validates bash command safety in code blocks.
rm -rf /, curl | bash, fork bombs)set -e, || exit 1)sudo usage warningsskill-structure) 🆕 v0.11.0Validates Claude Code skill files (.claude/skills/*.md).
subagent-structure) 🆕 v0.11.0Validates Claude Code subagent files (.claude/agents/*.md).
hook-configuration) 🆕 v0.11.0Validates Claude Code hook configuration (.claude/settings.json).
rm -rf, curl | sh, fork bombs)&& without set -e)karpathy) 🆕Opinionated CLAUDE.md style advisories inspired by Andrej Karpathy's commentary on writing for LLMs and "context engineering" — you program the model in English, so the context window should be minimal, high signal-to-noise, literal, and example-driven. Heuristics, not an official standard.
try to, where appropriate) that makes instructions non-literalplease, thank you, you are a helpful assistant) that spends context without signalCLAUDE.md files only; code fences are ignoredfile-size)Validates that CLAUDE.md files don't exceed size limits for optimal performance.
--max-size <number>structure)Ensures required sections are present in CLAUDE.md files.
content) ⚠️ DeprecatedNote: This rule is deprecated in v0.5.0. Use
content-organizationinstead.
Technology-specific content validation (deprecated in favor of content-organization).
content-organization ruleformat)Validates Markdown syntax and formatting best practices.
# Header not #Header)code-blocks)Validates fenced code blocks inside CLAUDE.md.
```bash not bare ```)--fix can add missing language tagscommand-safety rule.Run cclint inside any MCP-compatible client (Claude Desktop, Claude Code, Cursor) — no global install required. Add to your MCP config:
{
"mcpServers": {
"cclint": {
"command": "npx",
"args": ["@felixgeelhaar/cclint", "mcp"]
}
}
}
Tools exposed:
lint_file — lint a file on disklint_string — lint inline content (e.g. before saving an edit)list_rules — list every cclint ruleexplain_rule — get rationale + examples for a ruleOr run as a standalone bin: npx cclint-mcp.
cclint why — AI fix suggestionsGet plain-language explanations and AI-generated fix suggestions for any violation:
cclint why CLAUDE.md # all violations
cclint why CLAUDE.md --rule command-safety # filter by rule
cclint why CLAUDE.md --line 41 # filter by line
cclint why CLAUDE.md --ai # AI-generated fix (needs ANTHROPIC_API_KEY)
Without --ai, prints the rule rationale and good example. With --ai, sends the offending line + rule context to Claude Haiku 4.5 and prints a focused 3–6 line fix suggestion.
cclint lint [options] <file>
Options:
-f, --format <format> Output format (text, json) (default: "text")
--max-size <size> Maximum file size in characters (default: "10000")
-c, --config <path> Path to configuration file
--fix Automatically fix problems where possible
-h, --help Display help for command
cclint install [options]
Options:
--hooks Install pre-commit git hooks (default: true)
--pre-push Install pre-push quality check hooks (default: true)
-h, --help Display help for command
0: No errors (warnings allowed)1: Errors found or execution failedCC Linter follows a hexagonal architecture with clean separation of concerns:
┌─────────────────┐ ┌─────────────────┐
│ CLI Adapter │ │ VS Code Extension│
│ │ │ (Future) │
└─────────┬───────┘ └─────────┬───────┘
│ │
└──────────┬───────────┘
│
┌──────────▼───────────┐
│ Core Engine │
│ ┌─────────────────┐ │
│ │ Rules Engine │ │
│ │ - FileSizeRule │ │
│ │ - StructureRule │ │
│ │ - ContentRule │ │
│ │ - FormatRule │ │
│ └─────────────────┘ │
└──────────────────────┘
# Clone the repository
git clone https://github.com/felixgeelhaar/cclint.git
cd cclint
# Install dependencies
npm install
# Run tests
npm test
# Build the project
npm run build
# Run the linter on itself
npm run dev -- lint CLAUDE.md
# Or after global install
cclint lint CLAUDE.md
npm test # Run test suite with Vitest
npm run test:watch # Run tests in watch mode
npm run test:coverage # Generate coverage report
npm run typecheck # Type check with TypeScript
npm run lint # Lint source code
npm run build # Build for production
npm run dev # Run development version
CC Linter follows Test-Driven Development (TDD):
We welcome contributions! Please read our Contributing Guide for details on:
git checkout -b feature/amazing-feature)npm test)git commit -m 'Add amazing feature')git push origin feature/amazing-feature)This project is licensed under the MIT License - see the LICENSE file for details.
Create a .cclintrc.json file to customize rules for your project:
{
"rules": {
"file-size": {
"enabled": true,
"severity": "warning",
"options": {
"maxSize": 15000
}
},
"structure": {
"enabled": true,
"options": {
"requiredSections": ["Overview", "Commands", "Architecture"]
}
}
},
"ignore": ["*.backup.md"]
}
Automatically fix common formatting issues:
cclint lint CLAUDE.md --fix
Install pre-commit hooks to lint files automatically:
cclint install --hooks
Install pre-push hooks for comprehensive quality checks:
cclint install --pre-push
Install both hooks:
cclint install --hooks --pre-push
The pre-push hook runs:
Add automated linting to your CI/CD pipeline:
- name: Lint CLAUDE.md
uses: felixgeelhaar/cclint@v0.15.0
with:
files: 'CLAUDE.md'
format: 'text'
Create your own validation rules with the powerful Custom Rules API:
import { CustomRule } from '@felixgeelhaar/cclint';
class MyCustomRule extends CustomRule {
constructor() {
super('my-rule', 'Description of my custom rule');
}
validateInternal(file) {
const violations = [];
// Your validation logic here
return violations;
}
generateFixes(violations, content) {
// Your auto-fix logic here
return [];
}
}
// Plugin export
export default {
name: 'my-plugin',
version: '1.0.0',
rules: [new MyCustomRule()],
};
Configuration (.cclintrc.json):
{
"plugins": [
{
"name": "./my-plugin.js",
"enabled": true
}
],
"rules": {
"my-rule": {
"enabled": true,
"severity": "warning"
}
}
}
Features:
.cclintrc.json for project-specific rules ✅Made with ❤️ by Felix Geelhaar for the Claude AI developer community
FAQs
Catch CLAUDE.md drift before Claude misbehaves. Lints CLAUDE.md, skills, subagents, and hooks for Claude Code projects.
We found that @felixgeelhaar/cclint demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.