eslint-plugin-llm-optimized

v2.7.0

Published

4 months ago

ESLint rules that AI assistants can actually fix - error messages optimized for both human developers and Large Language Models

Downloads

0High
0Medium
0Low

ofriperetz

eslint eslint-plugin typescript linting llm-optimized code-quality ast static-analysis

eslint-plugin-llm-optimized

ESLint rules that AI assistants can actually understand and fix.

Keywords: ESLint plugin, LLM-optimized, AI assistant, auto-fix, ESLint MCP, Model Context Protocol, code quality, security rules, TypeScript ESLint, automated code fixes, GitHub Copilot, Cursor AI, Claude AI, structured error messages, CWE references, deterministic fixes

🎯 The Problem with Traditional ESLint Rules

Traditional ESLint plugins tell developers what's wrong but leave them guessing how to fix it. This becomes critical when:

Non-fixable rules leave AI assistants without guidance on how to resolve issues
Generic error messages force LLMs to hallucinate solutions, leading to inconsistent fixes
Multiple plugins are needed to cover security, architecture, React, and code quality
No MCP optimization means AI tools can't leverage ESLint's Model Context Protocol effectively

💡 The Solution: LLM-Optimized Error Messages

This plugin provides 137 ESLint rules where every error message is structured to guide both humans and AI assistants toward the correct fix—even for rules that can't be auto-fixed.

src/api.ts
  42:15  error  🔒 CWE-89 | SQL Injection detected | CRITICAL
                  Fix: Use parameterized query: db.query("SELECT * FROM users WHERE id = ?", [userId]) | https://owasp.org/www-community/attacks/SQL_Injection

  58:3   warning  ⚠️ CWE-532 | console.log found in production code | MEDIUM
                  Fix: Use logger.debug() or remove statement | https://eslint.org/docs/latest/rules/no-console

Core principle: Every error message should teach, not just warn.

🎬 See the Exact Difference

SQL Injection Detection

eslint-plugin-security (standard):

src/api.ts:42:15
  error  Detected possible SQL injection  security/detect-sql-injection

This plugin (LLM-optimized):

src/api.ts:42:15
  🔒 CWE-89 OWASP:A03-Injection | SQL Injection | CRITICAL [SOC2,PCI-DSS]
     Fix: Use parameterized query: db.query("SELECT * FROM users WHERE id = ?", [userId])
     Docs: https://owasp.org/www-community/attacks/SQL_Injection

Object Injection Detection

eslint-plugin-security (standard):

error  Variable used as key in object access  security/detect-object-injection

This plugin (LLM-optimized):

🔒 CWE-915 | Prototype Pollution via dynamic property access | HIGH
   Fix: Validate key against allowlist: if (ALLOWED_KEYS.includes(key)) obj[key]
   Docs: https://portswigger.net/web-security/prototype-pollution

Side-by-Side Comparison

| Aspect | Standard Plugins | This Plugin | | ------------------- | ------------------ | ----------------------------- | | Error format | "what's wrong" | "what's wrong + how to fix" | | CWE reference | ❌ None | ✅ Auto-enriched | | OWASP mapping | ❌ None | ✅ 2021 & 2025 | | Compliance tags | ❌ None | ✅ SOC2, HIPAA, PCI-DSS | | Fix instruction | ❌ Generic or none | ✅ Specific with code example | | Documentation | ⚠️ Sometimes | ✅ Always linked | | AI success rate | ~50% | 94% |

🔥 Three Competitive Edges

1. LLM Guidance for Non-Fixable Rules

The biggest differentiator. Traditional ESLint plugins with non-fixable rules just say "this is wrong." Our structured messages tell AI assistants exactly how to solve it.

| Rule Type | Traditional Plugin | This Plugin | | ---------------- | --------------------------- | --------------------------------------------------------- | | Auto-fixable | ✅ ESLint applies fix | ✅ ESLint applies fix | | Non-fixable | ❌ "SQL injection detected" | ✅ "Use parameterized query: db.query("...", [userId])" |

Why this matters for organizations:

Spread guidelines easily - Complex conventions that can't be auto-fixed (architecture patterns, security practices) become enforceable
Consistent AI fixes - Same violation = same fix suggestion = deterministic results
Self-documenting standards - Every error teaches the correct pattern with documentation links

2. Built for ESLint MCP Integration

This plugin is specifically optimized for ESLint's Model Context Protocol (MCP), the official bridge between ESLint and AI assistants.

// .cursor/mcp.json or .vscode/mcp.json
{
  "mcpServers": {
    "eslint": {
      "command": "npx",
      "args": ["@eslint/mcp@latest"]
    }
  }
}

MCP + LLM-Optimized Messages = Maximum AI Capability

AI reads structured errors in real-time
Understands severity, CWE references, and fix instructions
Applies consistent fixes automatically
Provides context-aware suggestions even for complex refactors

3. All-in-One Solution (137 Rules)

Stop juggling multiple plugins. One install covers:

| Category | Rules | Examples | | ------------------ | ----- | ---------------------------------------------- | | Security | 29 | SQL injection, XSS, CSRF, credentials, crypto | | Architecture | 28 | Circular deps, module boundaries, imports | | React | 41 | Keys, hooks, state management, best practices | | Code Quality | 9 | Complexity, null checks, ternary expressions | | Development | 7 | Console logs, module formats, dependencies | | Performance | 7 | Memory leaks, N+1 queries, render optimization | | Error Handling | 4 | Unhandled promises, silent errors, context | | Accessibility | 3 | Alt text, ARIA labels, keyboard navigation | | Other | 9 | Complexity, DDD, migration, deprecation, API |

🚀 Quick Start

# 1. Install
npm install --save-dev eslint-plugin-llm-optimized

# 2. Add to eslint.config.js
import llmOptimized from 'eslint-plugin-llm-optimized';
import js from '@eslint/js';

export default [
  js.configs.recommended,
  llmOptimized.configs.recommended,
];

# 3. Run ESLint
npx eslint .

That's it! AI assistants now receive structured, actionable guidance for every violation.

📊 Why Choose This Plugin?

| Feature | This Plugin | Standard ESLint Plugins | | ----------------------------- | ---------------------------------------- | ------------------------------ | | Non-Fixable Rule Guidance | ✅ Structured fix instructions for AI | ❌ Generic "what's wrong" only | | ESLint MCP Optimization | ✅ Built for MCP integration | ❌ No MCP consideration | | All-in-One Coverage | ✅ 137 rules across 10+ categories | ⚠️ Multiple plugins needed | | AI Auto-Fix Rate | ✅ 60-80% (including guided non-fixable) | ⚠️ 20-30% (auto-fix only) | | Security Rules | ✅ 29 rules with CWE references | ⚠️ Limited coverage | | Deterministic Fixes | ✅ Same violation = same fix | ⚠️ Inconsistent AI suggestions | | Documentation Links | ✅ Every error includes docs | ❌ Rarely included | | Package Name | ✅ Descriptive, self-explanatory | ⚠️ Generic names |

📈 Benchmarks

| Metric | This Plugin | eslint-plugin-security | eslint-plugin-import | | -------------------------- | ----------- | ---------------------- | -------------------- | | Security Rules | 29 rules | 6 rules | 0 rules | | False Positive Rate | 7.1% | 24.9% | N/A | | AI Fix Success Rate | 94% | 67% | 78% | | Circular Dep Detection | 100% | N/A | 73% |

| Capability | Our Implementation | Industry Standard | | ---------------------- | ------------------------------- | ----------------- | | LLM Message Format | ✅ Structured 2-line with CWE | ❌ Plain text | | Compliance Mapping | ✅ SOC2, HIPAA, PCI-DSS auto | ❌ None | | SARIF Export | ✅ Full GitHub Security support | ⚠️ Basic |

📊 Full Benchmarks →

📋 Available Presets

| Preset | Rules | Best For | | ----------------- | ------------------------ | ------------------------------------ | | recommended | Core rules (balanced) | Most projects - balanced enforcement | | strict | All 137 rules as errors | Maximum code quality | | security | 29 security rules | Security-critical applications | | react | 40+ React-specific rules | React/Next.js projects | | sonarqube | SonarQube-inspired rules | Teams using SonarQube |

// Use multiple presets
export default [
  llmOptimized.configs.recommended,
  llmOptimized.configs.security,
];

🏢 For Organizations

Scaling Code Standards Across Teams

This plugin enables organizations to enforce conventions that traditional static analysis can't handle:

| Challenge | Traditional Approach | LLM-Optimized Approach | | ----------------------------- | -------------------------- | ---------------------------------- | | Complex architecture patterns | Code reviews catch some | AI guided by structured rules | | Security best practices | Training + manual review | Every violation teaches the fix | | Domain-specific naming | Documentation nobody reads | Errors include correct terminology | | Migration patterns | Manual tracking | AI applies consistent migrations |

📦 Package Information

This package (eslint-plugin-llm-optimized) re-exports @forge-js/eslint-plugin-llm-optimized with a descriptive, unscoped name.

All these packages are functionally identical:

eslint-plugin-llm-optimized (this package - descriptive)
@forge-js/eslint-plugin-llm-optimized (scoped, original)
eslint-plugin-llm (shortest name)
eslint-plugin-mcp (MCP-focused)
eslint-plugin-mcp-optimized (MCP-optimized)
eslint-plugin-code-mode (Code Mode-focused)

Choose based on naming preference—they all work the same way!

❓ FAQ

Q: How is this different from standard ESLint plugins?
A: Standard plugins tell you "what's wrong." This plugin tells AI assistants "how to fix it" with structured messages—even for rules that can't be auto-fixed.

Q: Do I need ESLint MCP?
A: No, but it's recommended. This plugin works standalone but is specifically optimized for MCP integration.

Q: Will this slow down linting?
A: No. <10ms overhead per file. Rules use efficient AST traversal with caching.

Q: Can I use this without AI assistants?
A: Yes. The structured messages help human developers too—every error teaches the correct pattern.

📚 Rules Reference (137 Rules)

💼 Set in recommended | ⚠️ Warns in recommended | 🔧 Auto-fixable | 💡 Editor suggestions

📖 Full documentation: github.com/ofri-peretz/forge-js/packages/eslint-plugin/docs

Security (29 rules)

| Name | Description | ------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- | no-sql-injection | database-injection | detect-eval-with-expression | detect-child-process | detect-non-literal-fs-filename | detect-non-literal-regexp | detect-object-injection | no-unsafe-dynamic-require | no-hardcoded-credentials | no-weak-crypto | no-insufficient-random | no-unvalidated-user-input | no-unsanitized-html | no-unescaped-url-parameter | no-missing-cors-check | no-insecure-comparison | no-missing-authentication | no-privilege-escalation | no-insecure-cookie-settings | no-missing-csrf-protection | no-exposed-sensitive-data | no-unencrypted-transmission | no-redos-vulnerable-regex | no-unsafe-regex-construction | no-sensitive-data-exposure | no-toctou-vulnerability | no-missing-security-headers | no-insecure-redirects | no-document-cookie | 💼 | ⚠️ | 🔧 | 💡 | | --- | --- | --- | --- | | Prevent SQL injection with string concatenation detection | 💼 | | | | | Comprehensive injection detection (SQL, NoSQL, ORM) | 💼 | | | | | Detect eval() with dynamic expressions (RCE prevention) | 💼 | | | | | Detect command injection in child_process calls | 💼 | | | | | Detect path traversal in fs operations | 💼 | | | | | Detect ReDoS vulnerabilities in RegExp construction | 💼 | | | | | Detect prototype pollution in object property access | 💼 | | | | | Forbid dynamic require() with non-literal arguments | 💼 | | | | | Detect hardcoded passwords, API keys, tokens | 💼 | | | | | Detect weak cryptography (MD5, SHA1, DES) | 💼 | | | | | Detect weak random (Math.random()) | 💼 | | | | | Detect unvalidated user input | 💼 | | | | | Detect XSS via unsanitized HTML | 💼 | | | | | Detect unescaped URL parameters | 💼 | | | | | Detect missing CORS validation | 💼 | | | | | Detect insecure == and != | 💼 | | 🔧 | | | Detect missing auth checks | 💼 | | | | | Detect privilege escalation | 💼 | | | | | Detect insecure cookie configs | 💼 | | | | | Detect missing CSRF protection | 💼 | | | | | Detect PII exposure in logs | 💼 | | | | | Detect HTTP vs HTTPS issues | 💼 | | | | | Detect ReDoS patterns | 💼 | | | 💡 | | Detect unsafe RegExp | 💼 | | | 💡 | | Detect sensitive data exposure | 💼 | | | 💡 | | Detect TOCTOU race conditions | 💼 | | | 💡 | | Detect missing security headers | 💼 | | | 💡 | | Detect open redirects | 💼 | | | 💡 | | Detect document.cookie usage | 💼 | | | 💡 |

Architecture (28 rules)

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 | | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ | --- | --- | --- | --- | | no-circular-dependencies | Detect circular dependencies with chain analysis | | | | | | no-internal-modules | Forbid importing internal/deep paths | | | | | | no-cross-domain-imports | Prevent cross-domain imports | | | | 💡 | | enforce-dependency-direction | Enforce dependency direction | | | | 💡 | | no-external-api-calls-in-utils | No API calls in utils | | | | 💡 | | prefer-node-protocol | Enforce node: protocol | | ⚠️ | 🔧 | | | consistent-existence-index-check | Consistent property checks | | ⚠️ | 🔧 | | | prefer-event-target | Prefer EventTarget | | ⚠️ | | 💡 | | prefer-at | Prefer .at() method | | ⚠️ | 🔧 | | | no-unreadable-iife | Prevent unreadable IIFEs | | ⚠️ | | 💡 | | no-await-in-loop | Disallow await in loops | | ⚠️ | | 💡 | | no-self-import | Prevent self-imports | | ⚠️ | | 💡 | | no-unused-modules | Find unused exports | | ⚠️ | | 💡 | | no-extraneous-dependencies | Detect extraneous dependencies | | ⚠️ | | 💡 | | max-dependencies | Limit module dependencies | | ⚠️ | | 💡 | | no-anonymous-default-export | Forbid anonymous exports | | ⚠️ | | 💡 | | no-restricted-paths | Restrict import paths | | ⚠️ | | 💡 | | no-deprecated | Detect deprecated imports | | ⚠️ | | 💡 | | no-mutable-exports | Forbid mutable exports | | ⚠️ | | 💡 | | prefer-default-export | Prefer default export | | ⚠️ | | 💡 | | no-unresolved | Detect unresolved imports | | | | 💡 | | no-relative-parent-imports | Forbid relative parent imports | | ⚠️ | | 💡 | | no-default-export | Forbid default exports | | ⚠️ | | 💡 | | no-named-export | Forbid named exports | | ⚠️ | | 💡 | | no-unassigned-import | Forbid unassigned imports | | ⚠️ | | 💡 | | enforce-import-order | Enforce specific import order | | ⚠️ | 🔧 | 💡 | | consistent-function-scoping | Consistent function scoping | | ⚠️ | | 💡 | | filename-case | Enforce filename conventions | | ⚠️ | | 💡 | | no-instanceof-array | Forbid instanceof Array | | ⚠️ | 🔧 | |

React (41 rules)

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | --- | --- | --- | --- | | hooks-exhaustive-deps | Enforce exhaustive hook dependencies | | ⚠️ | | 💡 | | required-attributes | Enforce required attributes | | | 🔧 | | | jsx-key | Detect missing React keys | | | | 💡 | | no-direct-mutation-state | Prevent direct state mutation | | | | 💡 | | require-optimization | Require React optimizations | | ⚠️ | | 💡 | | no-set-state | Disallow setState in components | | | | 💡 | | no-this-in-sfc | Disallow this in stateless components | | | | 💡 | | no-access-state-in-setstate | Disallow this.state in setState | | | | 💡 | | no-children-prop | Disallow passing children as props | | | | 💡 | | no-danger | Disallow dangerouslySetInnerHTML | | | | 💡 | | no-string-refs | Disallow string refs | | | | 💡 | | no-unknown-property | Disallow unknown DOM properties | | | | 💡 | | checked-requires-onchange-or-readonly | Require onChange or readOnly with checked | | | | 💡 | | default-props-match-prop-types | Enforce defaultProps match propTypes | | | | 💡 | | display-name | Require displayName in components | | | | 💡 | | jsx-handler-names | Enforce handler naming conventions | | | | 💡 | | jsx-max-depth | Limit JSX nesting depth | | | | 💡 | | jsx-no-bind | Disallow bind() in JSX props | | | | 💡 | | jsx-no-literals | Disallow string literals in JSX | | | | 💡 | | no-adjacent-inline-elements | Disallow adjacent inline elements | | | | 💡 | | no-arrow-function-lifecycle | Disallow arrow functions in lifecycle | | | | 💡 | | no-did-mount-set-state | Disallow setState in componentDidMount | | | | 💡 | | no-did-update-set-state | Disallow setState in componentDidUpdate | | | | 💡 | | no-invalid-html-attribute | Disallow invalid HTML attributes | | | | 💡 | | no-is-mounted | Disallow isMounted | | | | 💡 | | no-multi-comp | One component per file | | | | 💡 | | no-namespace | Disallow namespace imports for React | | | | 💡 | | no-object-type-as-default-prop | Disallow object as default prop | | | | 💡 | | no-redundant-should-component-update | Disallow redundant shouldComponentUpdate | | | | 💡 | | no-render-return-value | Disallow render() return value | | | | 💡 | | no-typos | Detect common typos in React | | | | 💡 | | no-unescaped-entities | Disallow unescaped entities in JSX | | | | 💡 | | prefer-es6-class | Prefer ES6 class syntax | | | | 💡 | | prefer-stateless-function | Prefer stateless functional components | | | | 💡 | | prop-types | Require propTypes declarations | | | | 💡 | | react-in-jsx-scope | Require React in JSX scope | | | | 💡 | | require-default-props | Require defaultProps for optional props | | | | 💡 | | require-render-return | Require return in render | | | | 💡 | | sort-comp | Enforce component method order | | | | 💡 | | state-in-constructor | Enforce state initialization style | | | | 💡 | | static-property-placement | Enforce static property placement | | | | 💡 |

Development (7 rules)

Performance (7 rules)

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 | | --------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- | --- | --- | --- | --- | | react-no-inline-functions | Prevent inline functions in renders | | ⚠️ | | | | no-unnecessary-rerenders | Detect unnecessary rerenders | | ⚠️ | | 💡 | | no-memory-leak-listeners | Detect memory leak listeners | | ⚠️ | | 💡 | | no-blocking-operations | Detect blocking operations | | ⚠️ | | 💡 | | no-unbounded-cache | Detect unbounded caches | | ⚠️ | | 💡 | | detect-n-plus-one-queries | Detect N+1 queries | | ⚠️ | | | | react-render-optimization | React render optimization | | ⚠️ | | 💡 |

Code Quality (9 rules)

Error Handling (4 rules)

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 | | ------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | --- | --- | --- | --- | | no-unhandled-promise | Handle promise rejections | | | | 💡 | | no-silent-errors | No silent error swallowing | | | | 💡 | | no-missing-error-context | Error context required | | | | 💡 | | error-message | Require error messages | | ⚠️ | | 💡 |

Accessibility (3 rules)

Complexity (2 rules)

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 | | ----------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | --- | --- | --- | --- | | cognitive-complexity | Limit cognitive complexity | | | | | | nested-complexity-hotspots | Detect complexity hotspots | | | | 💡 |

DDD (2 rules)

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 | | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | --- | --- | --- | --- | | ddd-anemic-domain-model | Detect anemic models | | | | 💡 | | ddd-value-object-immutability | Value object immutability | | | | 💡 |

Migration (1 rule)

Deprecation (1 rule)

Domain (1 rule)

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 | | ----------------------------------------------------------------------------------------------------------------------- | ---------------------- | --- | --- | --- | --- | | enforce-naming | Domain-specific naming | | | | |

Published

Vulnerabilities

Links

Maintainers

Keywords

Readme

eslint-plugin-llm-optimized

🎯 The Problem with Traditional ESLint Rules

💡 The Solution: LLM-Optimized Error Messages

🎬 See the Exact Difference

SQL Injection Detection

Object Injection Detection

Side-by-Side Comparison

🔥 Three Competitive Edges

1. LLM Guidance for Non-Fixable Rules

2. Built for ESLint MCP Integration

3. All-in-One Solution (137 Rules)

🚀 Quick Start

📊 Why Choose This Plugin?

📈 Benchmarks

📋 Available Presets

🏢 For Organizations

📦 Package Information

❓ FAQ

📚 Rules Reference (137 Rules)

Security (29 rules)

Architecture (28 rules)

React (41 rules)

Development (7 rules)

Performance (7 rules)

Code Quality (9 rules)

Error Handling (4 rules)

Accessibility (3 rules)

Complexity (2 rules)

DDD (2 rules)

Migration (1 rule)

Deprecation (1 rule)

Domain (1 rule)

Duplication (1 rule)

API (1 rule)

📄 License