Lintbase Mcp

io.github.Madia333Published by GitHub account Madia333v0.1.3Updated Oct 24, 2026

Real-time Firestore schema context for AI coding agents. Stop hallucinating field names.

VerifiedSTDIODesktop onlyDatabasesDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Lets an AI coding agent read a Firestore database's real schema and audit it for drift, security, performance, and cost issues before writing code.

What you can do
Connects an AI coding agent to a Firestore project so it can inspect actual field names, types, and presence rates instead of guessing them. Tools include lintbase_get_schema for one or all collections, lintbase_scan for a full audit with a 0-100 risk score across schema, security, performance, and cost analyzers, and lintbase_get_issues for filtered issue lists by severity, collection, or rule prefix. It also ships an optional agent skill file that prompts the agent to check the schema automatically.
When to use it
Useful when an assistant writes or refactors Firestore code and you want it grounded in the real schema rather than invented field names. Also suited to pre-deploy checks for schema drift, sensitive collections, oversized documents, or cost-heavy collections.
Requirements
Runs locally as a stdio process, typically launched with npx from the npm package lintbase-mcp, so Node.js is needed. A Firebase service account JSON key for the target project must be supplied, and the server needs network access to Firestore. No environment variables or headers are declared.
Before you install
The service account key is a powerful credential; the README says it is passed as a keyPath argument and stays local, but anyone with that file gains the access it grants, so store it carefully. The README states the server only performs read operations on Firestore, yet it samples and reports document contents and field names, which may include personal or sensitive data. The optional skill installer copies a SKILL.md file into the project's .agent/skills directory, which changes agent…

Installation

In SourceWeft

  1. Open Lintbase Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

lintbase-mcp

Give your AI coding agent real-time Firestore schema context — so it stops hallucinating field names.

[npm version] [npm downloads] [License: MIT] [MCP]

The Problem

When you ask Cursor, Claude, or Windsurf to write Firestore code, it guesses your schema.

// What your AI writes:await db.collection('users').doc(id).update({ name: value });
// What's actually in your DB:{ displayName, uid, email, createdAt, plan }   ← no "name" field

The result: silent bugs, runtime crashes, and schema drift baked in by your AI assistant.

The Fix

lintbase-mcp is a Model Context Protocol server that connects your AI agent directly to your Firestore database. Before writing any code, the agent checks what's actually there.

You: "Add a subscription status field to users"
Agent → lintbase_get_schema({ collection: "users" })      ← { uid, email, createdAt, plan, displayName }
Agent: "I can see users has uid, email, createdAt, plan, displayName.        I'll add subscriptionStatus as a string field alongside plan..."

No hallucinations. No drift. Ground-truth schema, every time.

Tools

ToolWhat it does
lintbase_scanFull database audit — schema drift, security issues, performance problems, cost leaks. Returns a structured report with a 0–100 risk score.
lintbase_get_schemaReturns real field names, types, and presence rates for one or all collections. Use before writing any DB code.
lintbase_get_issuesReturns filtered issues. Ask targeted questions: "any errors in users?", "all security issues?", "schema drift only?"

🤖 Agent Skill

Install the LintBase Agent Skill into any project so your AI agent automatically uses LintBase before writing Firestore code — no prompting required:

bash
npx -p lintbase-mcp lintbase-mcp-install-skill

This copies a SKILL.md file into .agent/skills/lintbase/ in your project. Cursor, Claude Code, Gemini CLI, and other MCP-compatible agents read this file on startup and follow its instructions automatically.

Same format as the Firebase official Agent Skills. ✅

Setup

You'll need a Firebase service account JSON key for your project.

Cursor

Add to .cursor/mcp.json in your project root:

json
{  "mcpServers": {    "lintbase": {      "command": "npx",      "args": ["-y", "lintbase-mcp"]    }  }}

Then in your conversation:

"Check my Firestore schema before writing this code. Key is at ./service-account.json"

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

json
{  "mcpServers": {    "lintbase": {      "command": "npx",      "args": ["-y", "lintbase-mcp"]    }  }}

Restart Claude Desktop and start a new conversation.

Windsurf

Add to your Windsurf MCP config:

json
{  "mcpServers": {    "lintbase": {      "command": "npx",      "args": ["-y", "lintbase-mcp"]    }  }}

Usage Examples

Once connected, your AI agent has three tools available. You can trigger them naturally in conversation or the agent will use them automatically when relevant.

Get the schema of a collection

"What fields are in the users collection?"→ lintbase_get_schema({ keyPath: "./sa.json", collection: "users" })

Returns:

markdown
## users  (50 docs sampled)| Field       | Type      | Presence | Stable ||-------------|-----------|----------|--------|| uid         | string    | 100%     | ✅     || email       | string    | 100%     | ✅     || createdAt   | timestamp | 100%     | ✅     || plan        | string    | 95%      | ✅     || displayName | string    | 62%      | ⚠️  ← mark as optional |

Run a full audit

"Run a full LintBase scan before I start this refactor"→ lintbase_scan({ keyPath: "./sa.json", sampleSize: 100 })

Returns: Complete report with risk score, all issues across 4 analyzers (schema drift, security, performance, cost).

Check for errors before deploying

"Any blocking errors I should know about?"→ lintbase_get_issues({ keyPath: "./sa.json", severity: "error" })

Check security issues only

"Are there any security problems with my database?"→ lintbase_get_issues({ keyPath: "./sa.json", rule: "security/" })

Security

  • Runs 100% locally — your service account key and Firestore data never leave your machine
  • The MCP server runs as a local stdio process spawned by your IDE
  • No data is sent to any LintBase servers during schema inspection
  • The server only performs read operations on your Firestore database

Available Filters for lintbase_get_issues

FilterValuesExample
severityerror, warning, infoOnly blocking errors
collectionany collection nameOnly issues in users
rulerule prefixschema/, security/, perf/, cost/

Rule Reference

RuleAnalyzerWhat it catches
schema/field-type-mismatchSchemaSame field holds multiple types across documents
schema/sparse-fieldSchemaField missing from >40% of documents
schema/high-field-varianceSchemaWildly different field counts between documents
security/sensitive-collectionSecurityCollection name suggests unprotected PII
security/field-contains-secretSecurityField name suggests stored secrets/tokens
security/debug-data-in-productionSecurityDebug/test collections left in production
perf/excessive-nestingPerformanceDocuments nested >5 levels deep
perf/document-too-largePerformanceDocuments approaching Firestore's 1MB limit
cost/large-avg-documentCostAverage document size driving up bandwidth costs
cost/logging-sinkCostCollection used as an unbounded write sink

Related

  • lintbase — The CLI tool. Run npx lintbase scan firestore --key ./sa.json for a full terminal report.
  • lintbase.com — Dashboard for teams: save scan history, track risk score over time, share reports.

License

MIT © Mamadou Dia

Source: packages/lintbase-mcp/README.md at commit f0c53a5

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.3LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts