Merge pull request #10092 from saintl1022/add-calllint

Add CallLint — pre-flight MCP security linter 🤖🤖🤖

README.md

@@ -3138,6 +3138,7 @@ Tools for conducting research, surveys, interviews, and data collection.
 - [yessGlory17/job-verify](https://github.com/yessGlory17/job-verify) [![yessGlory17/job-verify MCP server](https://glama.ai/mcp/servers/yessGlory17/job-verify/badges/score.svg)](https://glama.ai/mcp/servers/yessGlory17/job-verify) 🐍 ☁️ 🍎 🪟 🐧 - Check whether a recruiter or job offer is a scam before you reply. Extracts entities (company, links, email, phone, wallets) from a pasted message and cross-checks company registration, domain age, look-alike/typosquat domains, phishing & malware blocklists, email deliverability, crypto-scam databases, and Internet Archive history — free OSINT, no API keys.
 - [shieldly-io/mcp](https://github.com/shieldly-io/mcp) [![shieldly-io/mcp MCP server](https://glama.ai/mcp/servers/shieldly-io/mcp/badges/score.svg)](https://glama.ai/mcp/servers/shieldly-io/mcp) 🎖️ 📇 ☁️ - Official [Shieldly](https://www.shieldly.io) MCP server: `analyze_iam_policy` and `analyze_cloudformation_template` tools flag AWS IAM privilege-escalation paths, wildcards, and over-permissive access. Free demo mode, no signup or API key needed. `npx -y @shieldly/mcp`.
 - [mcpindex-ai/mcp-server-mcpindex](https://github.com/mcpindex-ai/mcp-server-mcpindex) [![mcp-server-mcpindex MCP server](https://glama.ai/mcp/servers/mcpindex-ai/mcp-server-mcpindex/badges/score.svg)](https://glama.ai/mcp/servers/mcpindex-ai/mcp-server-mcpindex) 📇 ☁️ 🍎 🪟 🐧 - Find MCP servers by natural-language task and get advisory trust screens (check_tool_trust, assess_server) before you connect. The directory client for mcpindex.ai; advisory, not a safety verdict.
+- [calllint/calllint](https://github.com/calllint/calllint) [![calllint/calllint MCP server](https://glama.ai/mcp/servers/calllint/calllint/badges/score.svg)](https://glama.ai/mcp/servers/calllint/calllint) 📇 🏠 - Pre-flight security linter for MCP servers, agent tools, and skills. Scans a config *before* it runs — offline, deterministic, evidence-backed — and returns SAFE / REVIEW / BLOCK / UNKNOWN verdicts without executing the server it judges. CLI (`npx calllint scan`), MCP server (`npx calllint-mcp`), SARIF + CI gate. UNKNOWN is never SAFE.
 
 ### 🌐 <a name="social-media"></a>Social Media