Lintsure

Compliance checks for the code your AI writes.
Open source · Runs on your machine · Same input, same result

Important: Lintsure is a readiness tool, not an audit, a certification or legal advice. Its rules reflect our reading of the publicly available text of each framework, and they check code only. Work outside code, such as policies, training, contracts and evidence, still has to be done. Have a qualified person review the results before any audit, certification or decision. See DISCLAIMER.md.

What it does

Lintsure reads your repository and checks it against the EU AI Act, GDPR, OWASP Top 10, OWASP LLM Top 10, CWE Top 25 and the EU Cyber Resilience Act. Every finding shows:

• the file and line
• a status: Gap, Partial, Met or Outside code
• every control it touches, across all four frameworks at once
• a suggested fix and a plain auditor note

It also lists what code can't prove (access reviews, training records, contracts) and the evidence an auditor will ask for, and can write a multi-page assessment report with a human review and sign-off page (--report).

✓ 3 findings · 2 gap · 1 partial · 13 rules met · 22 outside code
partial  src/billing.ts:4  Data sent over plain HTTP
gap      src/config.ts:2   Secret or private key committed to source
gap      src/users.ts:5    Personal data written to logs

Built to inform, not to decide

• Never uploads your code. The engine has no network code. A test fails the build if any appears.
• Same input, same result. The Checker is a fixed rule engine, not a language model.
• No fake green ticks. Only the Checker can mark a control Met, and Met only means the rules found no problem in the files they read.
• Never decides for you. Every report and every MCP reply ends with the disclaimer and the next steps a person still needs to take. The MCP server tells coding agents not to call you compliant, certified or ready, not to make decisions, and to ask before changing anything. Tests check that Lintsure's own wording never claims a verdict.

Try it

Status: Beta. All rules are in Beta: their mappings are our own reading of the public texts, not independently reviewed.

npx lintsure scan

Use it inside Claude Code:

claude mcp add lintsure -- npx -y @lintsure/mcp

From source: git clone, npm install, npm test, then node packages/cli/dist/src/index.js scan /path/to/your-app.

Then ask: check this repo for compliance. Setup for Cursor, Codex and Devin Desktop (formerly Windsurf), every CLI flag, the report format and the full rules reference are in the docs.

Run it on every pull request w

... View full README on GitHub