---
summary: Linter hardening — schema serializability, auth scope, annotation coherence, and URI template-params alignment checks added, tool name format upgraded to error
breaking: false
---

# 0.1.22 — 2026-03-21

Linter hardening: new rules catch schema serializability failures, auth scope issues, annotation contradictions, and URI template mismatches before they become runtime errors.

## Added

- **Schema serializability rule** — `checkSchemaSerializable` validates that tool/resource/prompt Zod schemas can convert to JSON Schema via `toJSONSchema()`. Non-serializable types (`z.custom()`, `z.date()`, `z.transform()`, etc.) that would crash `tools/list` at runtime are now caught at startup.
- **Auth scope validation** — `lintAuthScopes` checks that `auth` arrays on tools and resources contain only non-empty strings. Catches typos like `auth: 'scope'` (not an array) or `auth: ['']` (empty scope).
- **Annotation coherence warnings** — Flags contradictory annotation combos: `destructiveHint` with `readOnlyHint: true` (meaningless) and `idempotentHint` with `readOnlyHint: true` (redundant).
- **Template-params alignment** — Resource linter cross-references URI template variables against `params` schema keys. Mismatches (e.g., `{itemId}` in template but `item_id` in schema) cause every resource read to fail silently — now caught at startup.
- **`_.dockerignore` template** — Scaffolded projects now include a comprehensive `.dockerignore`, matching the framework's own.
- **Linter tests** — ~130 lines of new test coverage for all new rules.

## Changed

- **Tool name format severity** — Upgraded from warning to error. The MCP spec uses MUST for the `[A-Za-z0-9._-]{1,128}` format; non-conforming names may break clients.
- **README template** — `polish-docs-meta` reference updated: scoped package names in `<h1>`, count line (tools · resources · prompts), framework badge linking to `@cyanheads/mcp-ts-core`.
- **Docs & skills** — Added JSON-Schema-serializable type guidance to `CLAUDE.md`, `add-tool`, `design-mcp-server`, `field-test` skills, and `AGENTS.md`/`CLAUDE.md` templates.

## Fixed

- **`lint-mcp` task tool detection** — `isToolLike()` now recognizes task tools (which have `taskHandlers` instead of `handler`).
- **`.dockerignore`** — Added `.git/` to version control exclusions.
