jmshinhwa/readystack-mcp

Regulation- and deadline-aware linters (EU CRA / CSAF, PCI DSS 6.4.3, WCAG 2.1 AA, DORA, NIS2, EU AI Act, KSeF FA(3), NF-e, GitHub Actions EOL, TLS certificate lifetime, Kubernetes removed APIs …) that an AI agent calls over the Model Context Protocol (MCP).

Every folder in this repository is one npm package @readystack/<name>. The same package runs three ways: as a stdio MCP server (--mcp), as a CLI, and as a CI step. No network calls: every rule set ships inside the package and runs offline on the files you point it at.

Run as an MCP server (Claude Code · Cursor · Windsurf · any MCP client)

{ "mcpServers": { "k8s-removed-api-lint": { "command": "npx", "args": ["-y", "@readystack/k8s-removed-api-lint", "--mcp"] } } }

The server speaks MCP over stdio (JSON-RPC 2.0, protocol version 2025-06-18: initialize, tools/list, tools/call). Tools exposed by every server: check_dir · check_file · check_text. check_text and check_file are free with no account; check_dir (the workspace sweep with an exportable report and a CI exit code) needs a licence key from https://getreadystack.com — the full sweep is free for the first 7 days. Each finding comes back with the file, the line number and the fix.

Registry names: io.github.jmshinhwa/<name> in the official MCP Registry (registry.modelcontextprotocol.io).

Run as a CLI or in CI

npx -y @readystack/k8s-removed-api-lint --file deploy.yaml      # one file
npx -y @readystack/k8s-removed-api-lint --dir . --ci             # whole repo, non-zero exit on findings (licence)

Servers (40)

npm package	what it checks
@readystack/actions-deprecation-lint-2026	Node 20 is removed from GitHub-hosted runners on 2026-09-23 and ubuntu-22.04 deprecation opens 2026-09-17. This checks a workflow file against 25 dated GitHub shutdowns and names the date each line st
@readystack/ai-model-retirement-lint	Finds the LLM model IDs pinned in your code that vendors have already switched off, or have dated to switch off, with the replacement and the date.
@readystack/auditor-ibs-cbs-nfe	A rejeição por falta de IBS/CBS foi suspensa em 31/07/2026: sua NF-e é autorizada mesmo errada. Este auditor lê o XML no editor e aponta o que a SEFAZ deixou passar.
@readystack/autorenew-signup-lint	Sixteen statutory checks on the signup page AB 2863 rewrote, in your editor and in the browser
@readystack/base-image-eol-lint	Marks every base image in your Dockerfiles, compose files and CI workflows whose security patches have already stopped - or stop before 13 November 2026 - and prints the tag that replaces it.
@readystack/cloud-cost-landmine-lint	Names every line in the file you have open that starts a recurring cloud charge, with the published us-east-1 price and the date it changes by itself.
@readystack/cra-24-72-14-reporting-lint	Reads your SECURITY.md against the EU Cyber Resilience Act reporting clock that started on 11 September 2026 — 24 hours, 72 hours, 14 days, to ENISA and your coordinating CSIRT.
@readystack/cron-schedule-lint	Names every schedule line in the file you have open that fires at the wrong hour, twice, or never at all - and prints the next three times each one really fires, in the zone that actually applies.
@readystack/currency-minor-unit-lint	Finds the money lines that send the wrong amount to a payment API: the x100 that charges 100x in JPY, the toFixed(2) that truncates KWD, and the currency codes that stopped being legal tender.
@readystack/dora-ict-contract-clause-lint	Twenty-two checks over the ICT vendor contracts in your repository - every missing Article 30 clause named, with the wording to paste in.
@readystack/dora-register-lint	24 checks on the register CSV before it reaches the supervisor — LEI check digits, ISO dates and codes, references that resolve
@readystack/eaa-form-lint-wcag22	Names every WCAG 2.2 AA form failure on its line, with the criterion and the fix
@readystack/einvoice-mandate-lint	Lints UBL and CII invoice XML against EN 16931 and the national e-invoicing mandates that are live in 2026
@readystack/email-footer-law-lint	Fourteen checks on an HTML email footer: CAN-SPAM postal address and 10-business-day opt-out, CASL's 60-day window, and German 5 DDG, the statute that replaced 5 TMG on 2024-05-14.
@readystack/firmware-release-gate	Finds the build-config lines that ship an ESP-IDF or Zephyr device with secure boot off, a debug port open, unsigned images or plaintext OTA.
@readystack/france-einvoice-reception-lint	12 checks for the French mandatory mentions a PDP rejects, on Factur-X, UBL and CII invoices
@readystack/gpsr-listing-lint	Audits a product feed row by row against Article 19 of the EU General Product Safety Regulation
@readystack/jct-transition-lint-2026	2026年9月30日で80%控除が終わります。10月1日からは50%ではなく70%です（令和8年度税制改正）。請求・仕入コードに残った 0.8 と 0.5、明細ごとの端数処理、T+13桁でない登録番号を、行番号と修正案つきで指摘します。
@readystack/k8s-removed-api-lint	15 checks for the apiVersions kubectl no longer serves, on the manifest open in your editor
@readystack/latex-submission-lint	Seventeen rules on your .tex file: the statements the editorial office looks for, and the source that breaks the publisher's build.
@readystack/license-flip-audit	Finds the dependencies whose licence changed under you - Terraform 1.6+ BUSL, Redis 7.4+ SSPL, Bitnami's August 2025 move, Elastic 7.11 - and names the exact version where each flip happened.
@readystack/log-pii-telemetry-lint	22 rules that name the lines where a Node or TypeScript service writes personal data into logs, crash reports and analytics — with the article it touches and the one-line fix.
@readystack/mcp-2026-migration-lint	The 2026-07-28 MCP revision removed the initialize handshake, sessions, ping and 4 more RPCs. 27 rules find them in your mcp.json and server code, with the replacement on each line.
@readystack/mcp-config-guard	Reads .mcp.json / .vscode/mcp.json / claude_desktop_config.json while you edit it and marks the lines that hand an AI agent more than you meant - unpinned servers, literal credentials, plaintext trans
@readystack/model-card-lint-gpai	Lints a Hugging Face model card against the Hub metadata spec and the EU AI Act general-purpose AI documentation duties, line by line.
@readystack/optout-signal-lint	Finds the ad and analytics code that keeps firing after a visitor’s browser has already sent Global Privacy Control.
@readystack/pci-payment-page-script-audit	PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1 have been mandatory since 2025-03-31, and the PCI SSC revised FAQ 1331 on 2026-08-04 so a QSA agreement alone no longer marks them not applicable. This read
@readystack/personal-data-map-dsar-audit	Reads a migration, Prisma schema, Django model or TypeORM entity and marks every column a subject access request has to reach - with the GDPR article each finding hangs on. 13 rules, line numbers, no
@readystack/play-release-blocker-lint	Finds the lines that make Google Play reject your release - target API below 36, Billing Library below 8, 4 KB-only native libs - and prints the date each gate closed.
@readystack/pqc-deprecation-lint	Dates every quantum-vulnerable algorithm in your code against the NIST IR 8547 clock: deprecated after 2030-12-31, disallowed after 2035-12-31.
@readystack/privacy-manifest-lint	Checks PrivacyInfo.xcprivacy and your C#, Dart, JS, Swift and Kotlin source for Apple required-reason APIs, and decodes all 17 reason codes back to the category they belong to.
@readystack/pyproject-release-gate	19 date-aware checks on the [project] metadata that decides whether your next release uploads
@readystack/robots-txt-ai-crawler-audit	Checks robots.txt line by line and says what each AI crawler token actually controls - training, AI-search citation, or user fetch - and which lines silently do nothing.
@readystack/security-headers-csp-lint	Reads security headers and CSP line by line in your config file and names the lines that silently do nothing: retired headers, keywords missing their quotes, directives the browser throws away.
@readystack/sql-card-data-lint	Names every column, index, view and seed row in a .sql migration that stores card data, with its PCI DSS Requirement 3 rule id
@readystack/tls-cert-lifetime-lint	Finds the 12 settings that break when public TLS certificates fall to 100 days on 2027-03-15: openssl -days, Terraform, cert-manager, late expiry alerts, HPKP, TLS 1.0/1.1, SHA-1, RSA-1024.
@readystack/vsix-publish-lint	Find the package.json lines that stop vsce before you run the release build
@readystack/wcag21-aa-legal-baseline-audit	Audits HTML, JSX, Vue, Twig, Blade, ERB and Razor markup against the 24 WCAG 2.1 Level AA checks that 28 CFR 35.200 and EN 301 549 actually name - not WCAG 2.2.
@readystack/wcag22-css-lint	Reads your stylesheet and names the success criterion each rule breaks, including the three WCAG 2.2 added that WCAG 2.1 linters never learned.
@readystack/wordpress-privacy-lint	Finds the 12 author-side privacy duties your plugin PHP breaks, with the article and the fix on every line.

Free vs licence

Free: checking the text or file you pass in, with every rule and every fix — no account, no telemetry. Licence key ($29 one-time per tool, or the yearly rule-update plan): the workspace sweep (check_dir / --dir), the exportable report and the CI exit code. Keys are verified against Polar; the free part never expires and never asks for the key.

Licence

LICENSE — source-available: read, audit and use freely (commercial use included); paid features require a valid licence key; the key check may not be removed or circumvented. Each package also ships a short LICENSE.txt with the same two rules.

Related

• Free web versions of every tool + the licence store: https://getreadystack.com
• VS Code / Open VSX extensions built from the same engines: https://github.com/jmshinhwa/readystack-themes