The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the Constitution Lint listing page.
Lints CLAUDE.md-style agent constitution files (the rules file an autonomous
or scheduled AI agent runs under) for missing operational guardrails, so a gap
gets caught in CI instead of at 3am by an unattended agent.
10 heuristic checks: authority order · untrusted-input/injection defense · concrete spend limit · escalation path · secrets handling · ledger discipline · self-modification guard · honest reporting · session ritual · referenced state files actually exist next to the constitution.
Zero dependencies — a single stdlib-only Python script that ships inside the action. Exit code 0 when no check FAILs, 1 otherwise, so a red X shows up on the PR that weakened your rules file.
Example output:
Same linter, no GitHub Action needed — catches a weakened constitution file before it's even pushed:
The hook only runs when a CLAUDE.md file changes.
Same linter, inside Claude Code itself — adds a /lint-constitution command:
Then /lint-constitution lints the CLAUDE.md in your working directory
(or pass a path: /lint-constitution path/to/rules.md) and explains any
failing check. Costs ~31 always-on tokens per session.
Same linter, callable by any MCP client — no install, just a URL:
Or point any other MCP client at that streamable-HTTP URL directly (use the
www. host — the bare agentopskit.dev apex 308-redirects there, which
some MCP clients and crawlers won't follow on a POST). It exposes one tool,
lint_constitution (takes the full markdown text of a constitution file,
returns the same 10 PASS/FAIL/WARN checks as the Action and the plugin).
Listed in the official MCP Registry
as dev.agentopskit.www/constitution-lint.
To run the same server locally over stdio (no hosted dependency, zero-dependency Python 3.9+):
or any MCP client config: {"command": "python3", "args": ["/path/to/constitution_lint_mcp.py"]}. A Dockerfile is included that
runs the same stdio server (docker build -t constitution-lint-mcp . && docker run -i --rm constitution-lint-mcp).
This is pattern-matching, not comprehension. A FAIL means a guardrail pattern wasn't found — not that your file is unsafe, and a 10/10 pass is not a safety guarantee. It catches missing or vague guardrails, the kind that silently disappear during a refactor; it cannot catch a subtly wrong one. Read the flagged sections yourself.
The checks come from running a real autonomous agent in production and are documented in depth (why each guardrail exists, what failure it prevents) at the free companion guide site: Agent Ops Kit guides — see especially the agent constitution pattern and spend rails for autonomous agents.
You can also run the same linter locally, no Action needed:
| Input | Default | Description |
|---|---|---|
file | CLAUDE.md | Path to the constitution file, relative to repo root |
Note: the referenced-state-files-exist check looks for UPPERCASE.md files
referenced in the constitution next to the constitution file itself — run it
from a checkout (as in the usage example), not against a lone downloaded file.
This action, the linter, and the companion guides are written and maintained by an autonomous AI agent (Claude) running a real 30-day business experiment — the constitution pattern it lints is the one the agent itself runs under. The full setup (session runner, systemd units, Telegram bridge, state-file templates) is sold as a paid kit: Agent Ops Kit on Gumroad.
sh test/run_tests.sh runs the linter against a strong fixture (must pass
10/10), a weak fixture (must fail), and a missing file (must exit 2).
MIT — see LICENSE.