Vinklum Review

Linters check what a config is. This checks what a change to it does: an MCP server appearing or being retargeted, a pinned reference going floating, an approval bypass added, constraint language quietly deleted, a token pasted into an argument.

The hard part was not detection, it was silence. A check you learn to scroll past is worse than no check, so routine edits produce nothing at all: prose that leaves constraints intact, a reformatted config with no semantic change, a pinned dependency added. It is advisory by design and never blocks a pull request.

Suppression is deliberately asymmetric. A fingerprint already on the base branch is policy that passed review, and collapses to a count. One the pull request adds still suppresses — you have to be able to land an intentional change — but the finding is reprinted in full under a callout. Silencing your own review is allowed; doing it quietly is not.

The source is private while it is in development, so there is no link here yet.