Permlang

GitHub Actions

Build-time permission checker for TypeScript and AI agents. Fails the pull request when code starts reaching a new server, file, secret, database table, or CI permission, and flags risky MCP and other

Devops Databases Developer Tools

Add to Cursor Add to VS Code Run on PlugMCP

GitHub npm Website

Add to Cursor Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "permlang": {4      "command": "npx",5      "args": [6        "-y",7        "[email protected]"8      ]9    }10  }11}

.cursor/mcp.jsonMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

npx -y [email protected]

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1claude mcp add permlang -- npx -y permlang@0.4.3

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "permlang": {4      "command": "npx",5      "args": [6        "-y",7        "[email protected]"8      ]9    }10  }11}

claude_desktop_config.json

Local · npmPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
Version: 0.4.3
Last checked: 2026-10-28

Stars: —
Tools: —
Uptime: —

Overview

About Permlang

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Permlang?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Permlang need an API key?

No required environment variable is listed on this record.

What transport does Permlang use?

Permlang runs locally over stdio.

When was Permlang last checked?

Last checked 2026-10-28. Build-time permission checker for TypeScript and AI agents. Fails the pull request when code starts reaching a new server, file, secret, database table, or CI permission, and flags risky MCP and other AI tools.

From the publisher

Documentation

PermLang

Know what your code can touch, before it ships.

A safety check for TypeScript projects. It notices when a change makes your code contact a new server, read or write files, use a secret, or change your database, and makes sure someone sees it before it's merged.

Get started · How it works · Reference · Live demo

Why it matters

Code gets written faster than ever, much of it by AI assistants. One added line can send customer data to an unknown website, and in a pull request with hundreds of changed lines, that line is easy to miss.

PermLang works like the permission prompts on your phone ("This app wants to use your location"), but for your codebase. It keeps an inventory of what every part of your code can reach. When a change reaches something new, PermLang flags it, in plain view, on the pull request.

How it works

	Step	What happens
1️⃣	Take inventory	PermLang reads your code and records everything it can touch in a file called `permlang.lock.json`. You don't change any code to start.
2️⃣	Check every change	On each pull request, PermLang compares the new code to the inventory.
3️⃣	Show what's new	Anything new is posted as a comment on the pull request, and the check fails until someone approves it by updating the inventory.

The image at the top is a real pull request: it adds an enrich helper that sends each lead's email and phone number to api.data-broker.io. The tests still pass. PermLang fails the check, marks the line, and comments with what's new. In words: this change makes the code send data to api.data-broker.io from enrich, and handleLead can now trigger it too. See the pull request.

What it watches

	Kind of access	Example	Written as
🌐	The internet: which servers the code contacts	Calling Stripe's API	`net(api.stripe.com)`
📁	Files: reading or writing them	Saving a report to disk	`fs.write(./reports)`
🗄️	The database: which tables are read or changed	Recording an order	`db.write(orders)`
🔑	Secrets: environment variables like API keys	Reading the Stripe key	`env(STRIPE_KEY)`
⚙️	System commands: running other programs	Starting a script	`exec`
🧩	Your own actions, defined per library	Issuing a refund	`payments.refund`
🛠️	Your CI and scripts: workflow permissions, secrets, Actions, install hooks	A workflow gaining write access	`ci.permission(contents: write)`

It also flags two things code review rarely catches:

🤖 Tools you give an AI model. A function registered as an AI tool (MCP, the Vercel AI SDK, the OpenAI SDK and OpenAI Agents, LangChain, LlamaIndex, Genkit, and others) can be triggered by whoever controls the model's input. PermLang lists every tool and what it can reach, and warns when a model could run commands, write data, send to any address, or read any file or secret it names.
🔒 Where secrets may go. A rule like "the Stripe key may only be sent to Stripe" fails a change where code that gets hold of the key can also send it somewhere else: another server, an email, a command, or a library PermLang can't see into. It follows the functions that read the key, not the key itself, so a key kept in a variable outside a function isn't tracked (details).

Going further: rules in the code

The inventory catches anything new. To also set limits, developers write a one-line note above a function saying what it's allowed to do:

/** @perm net(api.stripe.com), db.write(orders), env(STRIPE_KEY) */
export async function chargeCustomer(order: Order) { ... }

If a later change makes that function do more, the build stops and says exactly where, and how to fix it:

src/billing.ts:9:9 error PERM001: chargeCustomer calls fetch("https://data-broker.io/enrich", ...)
  but its declared permissions do not include net(data-broker.io).
  -> add net(data-broker.io) to @perm, or remove the call.

PermLang follows calls between functions and files, so moving the access into a helper function doesn't get around it.

Choose how strict

Start gentle and tighten up when you're ready.

Level	Best for	What fails the build
🌱 Sketch	Trying it on an existing project	Only differences from the inventory (new access, access it lists that the code no longer has, or a changed setting), and rules you add to the settings file yourself (such as where a secret may go). Everything else is just reported.
🛠️ Development (default)	Most teams	Also: functions that break their own rules, code that can't be analyzed (such as `eval`), and public functions with no rules.
🔒 Production	Sensitive code	Also: every function, including internal helpers, must be covered by a rule.

Get started

In a TypeScript project:

npm install --save-dev permlang
npx permlang init src --workflow

This creates the inventory, a settings file, and a GitHub workflow that checks every pull request. Commit all three. The getting started guide walks through the rest in about ten minutes.

[!NOTE] PermLang is new (v0.x). Feedback, false positives, and missed access are all welcome as issues. See the changelog for what each release changes.

Upgrading from 0.3? The check fails with one error until you update PermLang (npm install --save-dev permlang@^0.4.0), run npx permlang lock with the same paths as your check, review the updated inventory, and commit it (details).

What it can't see (yet)

PermLang is upfront about its blind spots, and reports them instead of hiding them:

Libraries it doesn't know. It understands many popular ones (Stripe, AI SDKs, Redis, databases, HTTP clients, and more). Unknown libraries are listed in every report, and a change that starts using a new one fails the check until someone reviews it.
Code that can't be analyzed ahead of time, such as eval, is reported. At the default strictness it's an error until a developer marks it as reviewed and gives a reason. Every such exception is listed.
A few advanced tricks are documented, with tests, in the reference.

Common questions

Does it work with code from AI coding assistants? Yes. It checks the code, whoever wrote it: GitHub Copilot, Cursor, another AI assistant, or a person. It's built for the pull request nobody reads line by line.

How do I see what my MCP server's tools can do? Run npx permlang check src. The report lists every tool registered with MCP, the Vercel AI SDK, the OpenAI SDK, OpenAI Agents, LangChain, LlamaIndex, Genkit, and the other frameworks it recognizes, what each can reach, and warns when a model could use one to run commands, write data, send to any address, or read any file or secret it names. More on AI tools.

How is it different from CodeQL or Semgrep? Those scanners look for known-bad patterns, such as SQL injection. PermLang tracks what your code can reach and flags anything new, even when it looks perfectly normal, like a call to an unfamiliar server. They work well together: PermLang's own repository runs CodeQL too.

Does it run my code or send it anywhere? No. It reads your source with the TypeScript compiler and never runs it. Your code stays on your machine or CI runner: the command-line tool makes no network calls. The GitHub Action downloads what it needs to build PermLang (from npm), and sends GitHub only its results, which quote short lines of code, for the pull-request comment and annotations (and code scanning, if you turn that on). The workflow init writes passes your installed packages, not your code, from the job that installs them to the job that checks, as an artifact kept for a day.

Is it free? Yes. PermLang is open source under the Apache 2.0 license.

Learn more


📘 Getting started	From zero to a pull-request check in ten minutes
📖 Reference	Everything it detects, matching rules, libraries, the lock file, the GitHub Action, and the command line
🧪 Real-world trial	Results on two open-source apps, Umami and Ghostfolio
📝 Spec format	Early work on describing business rules alongside permissions
🗒️ Changelog	What changed, release by release
🏗️ Design	How it's put together, and every interface it has
🛡️ Threat model	What could go wrong, the defences, and the vulnerabilities found so far
🧭 Roadmap, governance, policies	Where it's going, who decides, and the rules every change follows

License

Apache License 2.0. See LICENSE and NOTICE. The license covers the code; it grants no rights to the PermLang name or marks (Section 6).

Permlang

GitHub Actions

Devops Databases Developer Tools

Add to Cursor Add to VS Code Run on PlugMCP

GitHub npm Website

Add to Cursor Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "permlang": {4      "command": "npx",5      "args": [6        "-y",7        "[email protected]"8      ]9    }10  }11}

.cursor/mcp.jsonMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

npx -y [email protected]

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1claude mcp add permlang -- npx -y permlang@0.4.3

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "permlang": {4      "command": "npx",5      "args": [6        "-y",7        "[email protected]"8      ]9    }10  }11}

claude_desktop_config.json

Local · npmPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
Version: 0.4.3
Last checked: 2026-10-28

Stars: —
Tools: —
Uptime: —

Overview

About Permlang

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Permlang?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Permlang need an API key?

No required environment variable is listed on this record.

What transport does Permlang use?

Permlang runs locally over stdio.

When was Permlang last checked?

From the publisher

Documentation

PermLang

Know what your code can touch, before it ships.

Get started · How it works · Reference · Live demo

Why it matters

How it works

	Step	What happens
1️⃣	Take inventory	PermLang reads your code and records everything it can touch in a file called `permlang.lock.json`. You don't change any code to start.
2️⃣	Check every change	On each pull request, PermLang compares the new code to the inventory.
3️⃣	Show what's new	Anything new is posted as a comment on the pull request, and the check fails until someone approves it by updating the inventory.

What it watches

	Kind of access	Example	Written as
🌐	The internet: which servers the code contacts	Calling Stripe's API	`net(api.stripe.com)`
📁	Files: reading or writing them	Saving a report to disk	`fs.write(./reports)`
🗄️	The database: which tables are read or changed	Recording an order	`db.write(orders)`
🔑	Secrets: environment variables like API keys	Reading the Stripe key	`env(STRIPE_KEY)`
⚙️	System commands: running other programs	Starting a script	`exec`
🧩	Your own actions, defined per library	Issuing a refund	`payments.refund`
🛠️	Your CI and scripts: workflow permissions, secrets, Actions, install hooks	A workflow gaining write access	`ci.permission(contents: write)`

It also flags two things code review rarely catches:

🤖 Tools you give an AI model. A function registered as an AI tool (MCP, the Vercel AI SDK, the OpenAI SDK and OpenAI Agents, LangChain, LlamaIndex, Genkit, and others) can be triggered by whoever controls the model's input. PermLang lists every tool and what it can reach, and warns when a model could run commands, write data, send to any address, or read any file or secret it names.
🔒 Where secrets may go. A rule like "the Stripe key may only be sent to Stripe" fails a change where code that gets hold of the key can also send it somewhere else: another server, an email, a command, or a library PermLang can't see into. It follows the functions that read the key, not the key itself, so a key kept in a variable outside a function isn't tracked (details).

Going further: rules in the code

The inventory catches anything new. To also set limits, developers write a one-line note above a function saying what it's allowed to do:

/** @perm net(api.stripe.com), db.write(orders), env(STRIPE_KEY) */
export async function chargeCustomer(order: Order) { ... }

If a later change makes that function do more, the build stops and says exactly where, and how to fix it:

src/billing.ts:9:9 error PERM001: chargeCustomer calls fetch("https://data-broker.io/enrich", ...)
  but its declared permissions do not include net(data-broker.io).
  -> add net(data-broker.io) to @perm, or remove the call.

PermLang follows calls between functions and files, so moving the access into a helper function doesn't get around it.

Choose how strict

Start gentle and tighten up when you're ready.

Level	Best for	What fails the build
🌱 Sketch	Trying it on an existing project	Only differences from the inventory (new access, access it lists that the code no longer has, or a changed setting), and rules you add to the settings file yourself (such as where a secret may go). Everything else is just reported.
🛠️ Development (default)	Most teams	Also: functions that break their own rules, code that can't be analyzed (such as `eval`), and public functions with no rules.
🔒 Production	Sensitive code	Also: every function, including internal helpers, must be covered by a rule.

Get started

In a TypeScript project:

npm install --save-dev permlang
npx permlang init src --workflow

This creates the inventory, a settings file, and a GitHub workflow that checks every pull request. Commit all three. The getting started guide walks through the rest in about ten minutes.

[!NOTE] PermLang is new (v0.x). Feedback, false positives, and missed access are all welcome as issues. See the changelog for what each release changes.

Upgrading from 0.3? The check fails with one error until you update PermLang (npm install --save-dev permlang@^0.4.0), run npx permlang lock with the same paths as your check, review the updated inventory, and commit it (details).

What it can't see (yet)

PermLang is upfront about its blind spots, and reports them instead of hiding them:

Libraries it doesn't know. It understands many popular ones (Stripe, AI SDKs, Redis, databases, HTTP clients, and more). Unknown libraries are listed in every report, and a change that starts using a new one fails the check until someone reviews it.
Code that can't be analyzed ahead of time, such as eval, is reported. At the default strictness it's an error until a developer marks it as reviewed and gives a reason. Every such exception is listed.
A few advanced tricks are documented, with tests, in the reference.

Common questions

Is it free? Yes. PermLang is open source under the Apache 2.0 license.

Learn more


📘 Getting started	From zero to a pull-request check in ten minutes
📖 Reference	Everything it detects, matching rules, libraries, the lock file, the GitHub Action, and the command line
🧪 Real-world trial	Results on two open-source apps, Umami and Ghostfolio
📝 Spec format	Early work on describing business rules alongside permissions
🗒️ Changelog	What changed, release by release
🏗️ Design	How it's put together, and every interface it has
🛡️ Threat model	What could go wrong, the defences, and the vulnerabilities found so far
🧭 Roadmap, governance, policies	Where it's going, who decides, and the rules every change follows

License

Apache License 2.0. See LICENSE and NOTICE. The license covers the code; it grants no rights to the PermLang name or marks (Section 6).