Getting started

OAuthLint scans your code for the OAuth 2.0 / OIDC / JWT / session / cookie / CORS / TLS / secrets / MCP server auth anti-patterns that AI coding tools ship by default. It covers eleven languages (JavaScript, TypeScript, Python, Go, C#, and more) plus mobile auth (Swift/iOS, Android), and flags each finding with a fix, before the code reaches a pull request.

Run your first scan

No install, no config, no account. Point it at your source:

npx oauthlint scan ./src

It scans the directory, prints every finding it’s confident about, and exits non-zero if anything fired. On clean, idiomatic auth code it stays silent, which is the whole point.

Read a finding

Each finding is one line of signal:

CRITICAL  auth.jwt.no-verification  src/auth/session.ts:42
  Decoding a JWT does not verify its signature, so claims.sub can be forged.
  ✓ Fix: jwt.verify(token, key, { algorithms: ['RS256'] })

• Severity: critical · high · medium · low · info. Use it to decide what blocks CI.
• Rule id, for example auth.jwt.no-verification. Every rule has a page in the rules catalogue with a vulnerable and a safe example, mapped to CWE/OWASP.
• Location: file:line, so it’s clickable in your terminal and editor.

Fail CI on real issues

By default scan reports everything but only fails on findings. Gate your pipeline by severity:

# block the build on HIGH severity and above
npx oauthlint scan ./src --fail-on HIGH

See every flag in the CLI reference.

Where to run it

OAuthLint meets your code where it already lives:

• CLI / CI: npx oauthlint scan, locally or in any pipeline. → CLI reference
• GitHub Action: PR annotations and SARIF upload to GitHub code scanning. It’s Docker-based, so it runs for any language. → GitHub Action
• Your editor (VS Code, Cursor, Windsurf, and more): inline diagnostics as you type, with Quick Fix suppressions. The extension ships via OpenVSX too, so it runs in other VS Code forks and agentic editors. → VS Code extension
• AI coding tools: an MCP server so Claude Code, Cursor, Windsurf and others scan the auth code they generate, in the loop. → MCP server
• Building MCP servers: a rule pack for OAuth 2.1 resource-server mistakes (token pass-through, missing audience binding, unauthenticated transports, tool-handler SSRF) plus a live probe command. → Scanning MCP servers

Tune it to your project

• Configuration: pin a severity floor, scope paths, and toggle rules with an .oauthlintrc.yml.
• Suppressing rules: silence a single line with an auditable inline comment when you’ve made a deliberate exception.

New here? Run npx oauthlint scan ./src on a real project first. The output is the fastest way to understand what OAuthLint catches.