eslint-plugin-llm-optimized

ESLint rules that AI assistants can actually understand and fix.


> Keywords: ESLint plugin, LLM-optimized, AI assistant, auto-fix, ESLint MCP, Model Context Protocol, code quality, security rules, TypeScript ESLint, automated code fixes, GitHub Copilot, Cursor AI, Claude AI, structured error messages, CWE references, deterministic fixes

---

🎯 The Problem with Traditional ESLint Rules

Traditional ESLint plugins tell developers what's wrong but leave them guessing how to fix it. This becomes critical when:

- Non-fixable rules leave AI assistants without guidance on how to resolve issues
- Generic error messages force LLMs to hallucinate solutions, leading to inconsistent fixes
- Multiple plugins are needed to cover security, architecture, React, and code quality
- No MCP optimization means AI tools can't leverage ESLint's Model Context Protocol effectively

---

💡 The Solution: LLM-Optimized Error Messages

This plugin provides 137 ESLint rules where every error message is structured to guide both humans and AI assistants toward the correct fix—even for rules that can't be auto-fixed.

``bash
src/api.ts
42:15 error 🔒 CWE-89 | SQL Injection detected | CRITICAL
Fix: Use parameterized query: db.query("SELECT * FROM users WHERE id = ?", [userId]) | https://owasp.org/www-community/attacks/SQL_Injection

58:3 warning ⚠️ CWE-532 | console.log found in production code | MEDIUM
Fix: Use logger.debug() or remove statement | https://eslint.org/docs/latest/rules/no-console
`

Core principle: Every error message should teach, not just warn.

---

🎬 See the Exact Difference

$3

eslint-plugin-security (standard):

`
src/api.ts:42:15
error Detected possible SQL injection security/detect-sql-injection
`

This plugin (LLM-optimized):

`
src/api.ts:42:15
🔒 CWE-89 OWASP:A03-Injection | SQL Injection | CRITICAL [SOC2,PCI-DSS]
Fix: Use parameterized query: db.query("SELECT * FROM users WHERE id = ?", [userId])
Docs: https://owasp.org/www-community/attacks/SQL_Injection
`

$3

eslint-plugin-security (standard):

`
error Variable used as key in object access security/detect-object-injection
`

This plugin (LLM-optimized):

`
🔒 CWE-915 | Prototype Pollution via dynamic property access | HIGH
Fix: Validate key against allowlist: if (ALLOWED_KEYS.includes(key)) obj[key]
Docs: https://portswigger.net/web-security/prototype-pollution
`

$3

| Aspect | Standard Plugins | This Plugin |
| ------------------- | ------------------ | ----------------------------- |
| Error format | "what's wrong" | "what's wrong + how to fix" |
| CWE reference | ❌ None | ✅ Auto-enriched |
| OWASP mapping | ❌ None | ✅ 2021 & 2025 |
| Compliance tags | ❌ None | ✅ SOC2, HIPAA, PCI-DSS |
| Fix instruction | ❌ Generic or none | ✅ Specific with code example |
| Documentation | ⚠️ Sometimes | ✅ Always linked |
| AI success rate | ~50% | 94% |

---

🔥 Three Competitive Edges

$3

The biggest differentiator. Traditional ESLint plugins with non-fixable rules just say "this is wrong." Our structured messages tell AI assistants exactly how to solve it.

| Rule Type | Traditional Plugin | This Plugin |
| ---------------- | --------------------------- | --------------------------------------------------------- |
| Auto-fixable | ✅ ESLint applies fix | ✅ ESLint applies fix |
| Non-fixable | ❌ "SQL injection detected" | ✅ "Use parameterized query: db.query("...", [userId])" |

Why this matters for organizations:

- Spread guidelines easily - Complex conventions that can't be auto-fixed (architecture patterns, security practices) become enforceable
- Consistent AI fixes - Same violation = same fix suggestion = deterministic results
- Self-documenting standards - Every error teaches the correct pattern with documentation links

$3

This plugin is specifically optimized for ESLint's Model Context Protocol (MCP), the official bridge between ESLint and AI assistants.

`json
// .cursor/mcp.json or .vscode/mcp.json
{
"mcpServers": {
"eslint": {
"command": "npx",
"args": ["@eslint/mcp@latest"]
}
}
}
`

MCP + LLM-Optimized Messages = Maximum AI Capability

- AI reads structured errors in real-time
- Understands severity, CWE references, and fix instructions
- Applies consistent fixes automatically
- Provides context-aware suggestions even for complex refactors

$3

Stop juggling multiple plugins. One install covers:

| Category | Rules | Examples |
| ------------------ | ----- | ---------------------------------------------- |
| Security | 29 | SQL injection, XSS, CSRF, credentials, crypto |
| Architecture | 28 | Circular deps, module boundaries, imports |
| React | 41 | Keys, hooks, state management, best practices |
| Code Quality | 9 | Complexity, null checks, ternary expressions |
| Development | 7 | Console logs, module formats, dependencies |
| Performance | 7 | Memory leaks, N+1 queries, render optimization |
| Error Handling | 4 | Unhandled promises, silent errors, context |
| Accessibility | 3 | Alt text, ARIA labels, keyboard navigation |
| Other | 9 | Complexity, DDD, migration, deprecation, API |

---

🚀 Quick Start

`bash


1. Install

npm install --save-dev eslint-plugin-llm-optimized

2. Add to eslint.config.js

import llmOptimized from 'eslint-plugin-llm-optimized';
import js from '@eslint/js';

export default [
js.configs.recommended,
llmOptimized.configs.recommended,
];

3. Run ESLint

npx eslint .
`

That's it! AI assistants now receive structured, actionable guidance for every violation.

---

📊 Why Choose This Plugin?

| Feature | This Plugin | Standard ESLint Plugins |
| ----------------------------- | ---------------------------------------- | ------------------------------ |
| Non-Fixable Rule Guidance | ✅ Structured fix instructions for AI | ❌ Generic "what's wrong" only |
| ESLint MCP Optimization | ✅ Built for MCP integration | ❌ No MCP consideration |
| All-in-One Coverage | ✅ 137 rules across 10+ categories | ⚠️ Multiple plugins needed |
| AI Auto-Fix Rate | ✅ 60-80% (including guided non-fixable) | ⚠️ 20-30% (auto-fix only) |
| Security Rules | ✅ 29 rules with CWE references | ⚠️ Limited coverage |
| Deterministic Fixes | ✅ Same violation = same fix | ⚠️ Inconsistent AI suggestions |
| Documentation Links | ✅ Every error includes docs | ❌ Rarely included |
| Package Name | ✅ Descriptive, self-explanatory | ⚠️ Generic names |

---

📈 Benchmarks

| Metric | This Plugin | eslint-plugin-security | eslint-plugin-import |
| -------------------------- | ----------- | ---------------------- | -------------------- |
| Security Rules | 29 rules | 6 rules | 0 rules |
| False Positive Rate | 7.1% | 24.9% | N/A |
| AI Fix Success Rate | 94% | 67% | 78% |
| Circular Dep Detection | 100% | N/A | 73% |

| Capability | Our Implementation | Industry Standard |
| ---------------------- | ------------------------------- | ----------------- |
| LLM Message Format | ✅ Structured 2-line with CWE | ❌ Plain text |
| Compliance Mapping | ✅ SOC2, HIPAA, PCI-DSS auto | ❌ None |
| SARIF Export | ✅ Full GitHub Security support | ⚠️ Basic |

> 📊 Full Benchmarks →

---

📋 Available Presets

| Preset | Rules | Best For |
| ----------------- | ------------------------ | ------------------------------------ |
| recommended | Core rules (balanced) | Most projects - balanced enforcement |
| strict | All 137 rules as errors | Maximum code quality |
| security | 29 security rules | Security-critical applications |
| react | 40+ React-specific rules | React/Next.js projects |
| sonarqube | SonarQube-inspired rules | Teams using SonarQube |

`javascript
// Use multiple presets
export default [
llmOptimized.configs.recommended,
llmOptimized.configs.security,
];
`

---

🏢 For Organizations

Scaling Code Standards Across Teams

This plugin enables organizations to enforce conventions that traditional static analysis can't handle:

| Challenge | Traditional Approach | LLM-Optimized Approach |
| ----------------------------- | -------------------------- | ---------------------------------- |
| Complex architecture patterns | Code reviews catch some | AI guided by structured rules |
| Security best practices | Training + manual review | Every violation teaches the fix |
| Domain-specific naming | Documentation nobody reads | Errors include correct terminology |
| Migration patterns | Manual tracking | AI applies consistent migrations |

---

📦 Package Information

> This package (eslint-plugin-llm-optimized) re-exports @forge-js/eslint-plugin-llm-optimized with a descriptive, unscoped name.

All these packages are functionally identical:

- eslint-plugin-llm-optimized (this package - descriptive)
- @forge-js/eslint-plugin-llm-optimized (scoped, original)
- eslint-plugin-llm (shortest name)
- eslint-plugin-mcp (MCP-focused)
- eslint-plugin-mcp-optimized (MCP-optimized)
- eslint-plugin-code-mode (Code Mode-focused)

Choose based on naming preference—they all work the same way!

---

❓ FAQ

Q: How is this different from standard ESLint plugins?
A: Standard plugins tell you "what's wrong." This plugin tells AI assistants "how to fix it" with structured messages—even for rules that can't be auto-fixed.

Q: Do I need ESLint MCP?
A: No, but it's recommended. This plugin works standalone but is specifically optimized for MCP integration.

Q: Will this slow down linting?
A: No. <10ms overhead per file. Rules use efficient AST traversal with caching.

Q: Can I use this without AI assistants?
A: Yes. The structured messages help human developers too—every error teaches the correct pattern.

---

📚 Rules Reference (137 Rules)

💼 Set in recommended | ⚠️ Warns in recommended` | 🔧 Auto-fixable | 💡 Editor suggestions

> 📖 Full documentation: github.com/ofri-peretz/forge-js/packages/eslint-plugin/docs

$3

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 |
| ------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- | --- | --- | --- | --- |
| no-sql-injection | Prevent SQL injection with string concatenation detection | 💼 | | | |
| database-injection | Comprehensive injection detection (SQL, NoSQL, ORM) | 💼 | | | |
| detect-eval-with-expression | Detect eval() with dynamic expressions (RCE prevention) | 💼 | | | |
| detect-child-process | Detect command injection in child_process calls | 💼 | | | |
| detect-non-literal-fs-filename | Detect path traversal in fs operations | 💼 | | | |
| detect-non-literal-regexp | Detect ReDoS vulnerabilities in RegExp construction | 💼 | | | |
| detect-object-injection | Detect prototype pollution in object property access | 💼 | | | |
| no-unsafe-dynamic-require | Forbid dynamic require() with non-literal arguments | 💼 | | | |
| no-hardcoded-credentials | Detect hardcoded passwords, API keys, tokens | 💼 | | | |
| no-weak-crypto | Detect weak cryptography (MD5, SHA1, DES) | 💼 | | | |
| no-insufficient-random | Detect weak random (Math.random()) | 💼 | | | |
| no-unvalidated-user-input | Detect unvalidated user input | 💼 | | | |
| no-unsanitized-html | Detect XSS via unsanitized HTML | 💼 | | | |
| no-unescaped-url-parameter | Detect unescaped URL parameters | 💼 | | | |
| no-missing-cors-check | Detect missing CORS validation | 💼 | | | |
| no-insecure-comparison | Detect insecure == and != | 💼 | | 🔧 | |
| no-missing-authentication | Detect missing auth checks | 💼 | | | |
| no-privilege-escalation | Detect privilege escalation | 💼 | | | |
| no-insecure-cookie-settings | Detect insecure cookie configs | 💼 | | | |
| no-missing-csrf-protection | Detect missing CSRF protection | 💼 | | | |
| no-exposed-sensitive-data | Detect PII exposure in logs | 💼 | | | |
| no-unencrypted-transmission | Detect HTTP vs HTTPS issues | 💼 | | | |
| no-redos-vulnerable-regex | Detect ReDoS patterns | 💼 | | | 💡 |
| no-unsafe-regex-construction | Detect unsafe RegExp | 💼 | | | 💡 |
| no-sensitive-data-exposure | Detect sensitive data exposure | 💼 | | | 💡 |
| no-toctou-vulnerability | Detect TOCTOU race conditions | 💼 | | | 💡 |
| no-missing-security-headers | Detect missing security headers | 💼 | | | 💡 |
| no-insecure-redirects | Detect open redirects | 💼 | | | 💡 |
| no-document-cookie | Detect document.cookie usage | 💼 | | | 💡 |

$3

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ | --- | --- | --- | --- |
| no-circular-dependencies | Detect circular dependencies with chain analysis | | | | |
| no-internal-modules | Forbid importing internal/deep paths | | | | |
| no-cross-domain-imports | Prevent cross-domain imports | | | | 💡 |
| enforce-dependency-direction | Enforce dependency direction | | | | 💡 |
| no-external-api-calls-in-utils | No API calls in utils | | | | 💡 |
| prefer-node-protocol | Enforce node: protocol | | ⚠️ | 🔧 | |
| consistent-existence-index-check | Consistent property checks | | ⚠️ | 🔧 | |
| prefer-event-target | Prefer EventTarget | | ⚠️ | | 💡 |
| prefer-at | Prefer .at() method | | ⚠️ | 🔧 | |
| no-unreadable-iife | Prevent unreadable IIFEs | | ⚠️ | | 💡 |
| no-await-in-loop | Disallow await in loops | | ⚠️ | | 💡 |
| no-self-import | Prevent self-imports | | ⚠️ | | 💡 |
| no-unused-modules | Find unused exports | | ⚠️ | | 💡 |
| no-extraneous-dependencies | Detect extraneous dependencies | | ⚠️ | | 💡 |
| max-dependencies | Limit module dependencies | | ⚠️ | | 💡 |
| no-anonymous-default-export | Forbid anonymous exports | | ⚠️ | | 💡 |
| no-restricted-paths | Restrict import paths | | ⚠️ | | 💡 |
| no-deprecated | Detect deprecated imports | | ⚠️ | | 💡 |
| no-mutable-exports | Forbid mutable exports | | ⚠️ | | 💡 |
| prefer-default-export | Prefer default export | | ⚠️ | | 💡 |
| no-unresolved | Detect unresolved imports | | | | 💡 |
| no-relative-parent-imports | Forbid relative parent imports | | ⚠️ | | 💡 |
| no-default-export | Forbid default exports | | ⚠️ | | 💡 |
| no-named-export | Forbid named exports | | ⚠️ | | 💡 |
| no-unassigned-import | Forbid unassigned imports | | ⚠️ | | 💡 |
| enforce-import-order | Enforce specific import order | | ⚠️ | 🔧 | 💡 |
| consistent-function-scoping | Consistent function scoping | | ⚠️ | | 💡 |
| filename-case | Enforce filename conventions | | ⚠️ | | 💡 |
| no-instanceof-array | Forbid instanceof Array | | ⚠️ | 🔧 | |

$3

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | --- | --- | --- | --- |
| hooks-exhaustive-deps | Enforce exhaustive hook dependencies | | ⚠️ | | 💡 |
| required-attributes | Enforce required attributes | | | 🔧 | |
| jsx-key | Detect missing React keys | | | | 💡 |
| no-direct-mutation-state | Prevent direct state mutation | | | | 💡 |
| require-optimization | Require React optimizations | | ⚠️ | | 💡 |
| no-set-state | Disallow setState in components | | | | 💡 |
| no-this-in-sfc | Disallow this in stateless components | | | | 💡 |
| no-access-state-in-setstate | Disallow this.state in setState | | | | 💡 |
| no-children-prop | Disallow passing children as props | | | | 💡 |
| no-danger | Disallow dangerouslySetInnerHTML | | | | 💡 |
| no-string-refs | Disallow string refs | | | | 💡 |
| no-unknown-property | Disallow unknown DOM properties | | | | 💡 |
| checked-requires-onchange-or-readonly | Require onChange or readOnly with checked | | | | 💡 |
| default-props-match-prop-types | Enforce defaultProps match propTypes | | | | 💡 |
| display-name | Require displayName in components | | | | 💡 |
| jsx-handler-names | Enforce handler naming conventions | | | | 💡 |
| jsx-max-depth | Limit JSX nesting depth | | | | 💡 |
| jsx-no-bind | Disallow bind() in JSX props | | | | 💡 |
| jsx-no-literals | Disallow string literals in JSX | | | | 💡 |
| no-adjacent-inline-elements | Disallow adjacent inline elements | | | | 💡 |
| no-arrow-function-lifecycle | Disallow arrow functions in lifecycle | | | | 💡 |
| no-did-mount-set-state | Disallow setState in componentDidMount | | | | 💡 |
| no-did-update-set-state | Disallow setState in componentDidUpdate | | | | 💡 |
| no-invalid-html-attribute | Disallow invalid HTML attributes | | | | 💡 |
| no-is-mounted | Disallow isMounted | | | | 💡 |
| no-multi-comp | One component per file | | | | 💡 |
| no-namespace | Disallow namespace imports for React | | | | 💡 |
| no-object-type-as-default-prop | Disallow object as default prop | | | | 💡 |
| no-redundant-should-component-update | Disallow redundant shouldComponentUpdate | | | | 💡 |
| no-render-return-value | Disallow render() return value | | | | 💡 |
| no-typos | Detect common typos in React | | | | 💡 |
| no-unescaped-entities | Disallow unescaped entities in JSX | | | | 💡 |
| prefer-es6-class | Prefer ES6 class syntax | | | | 💡 |
| prefer-stateless-function | Prefer stateless functional components | | | | 💡 |
| prop-types | Require propTypes declarations | | | | 💡 |
| react-in-jsx-scope | Require React in JSX scope | | | | 💡 |
| require-default-props | Require defaultProps for optional props | | | | 💡 |
| require-render-return | Require return in render | | | | 💡 |
| sort-comp | Enforce component method order | | | | 💡 |
| state-in-constructor | Enforce state initialization style | | | | 💡 |
| static-property-placement | Enforce static property placement | | | | 💡 |

$3

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------ | --- | --- | --- | --- |
| no-console-log | Disallow console.log with strategies | | ⚠️ | 🔧 | |
| prefer-dependency-version-strategy | Enforce version strategy | | ⚠️ | 🔧 | |
| no-amd | Disallow AMD imports | | ⚠️ | | 💡 |
| no-commonjs | Disallow CommonJS imports | | ⚠️ | | 💡 |
| no-nodejs-modules | Disallow Node.js modules | | | | 💡 |
| no-process-exit | Disallow process.exit() | | ⚠️ | | 💡 |
| no-console-spaces | Detect console.log spacing issues | | ⚠️ | 🔧 | |

$3

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 |
| --------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- | --- | --- | --- | --- |
| react-no-inline-functions | Prevent inline functions in renders | | ⚠️ | | |
| no-unnecessary-rerenders | Detect unnecessary rerenders | | ⚠️ | | 💡 |
| no-memory-leak-listeners | Detect memory leak listeners | | ⚠️ | | 💡 |
| no-blocking-operations | Detect blocking operations | | ⚠️ | | 💡 |
| no-unbounded-cache | Detect unbounded caches | | ⚠️ | | 💡 |
| detect-n-plus-one-queries | Detect N+1 queries | | ⚠️ | | |
| react-render-optimization | React render optimization | | ⚠️ | | 💡 |

$3

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 |
| --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- | --- | --- | --- | --- |
| no-commented-code | Remove commented code | | ⚠️ | | 💡 |
| max-parameters | Limit function parameters | | ⚠️ | | 💡 |
| no-missing-null-checks | Enforce null checks | | ⚠️ | | 💡 |
| no-unsafe-type-narrowing | Safe type narrowing | | ⚠️ | | 💡 |
| expiring-todo-comments | Detect expired TODO comments | | ⚠️ | | 💡 |
| no-lonely-if | Detect lonely if statements | | ⚠️ | 🔧 | |
| no-nested-ternary | Forbid nested ternary expressions | | ⚠️ | | 💡 |
| prefer-code-point | Prefer codePointAt over charCodeAt | | ⚠️ | 🔧 | |
| prefer-dom-node-text-content | Prefer textContent over innerText | | ⚠️ | 🔧 | |

$3

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 |
| ------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | --- | --- | --- | --- |
| no-unhandled-promise | Handle promise rejections | | | | 💡 |
| no-silent-errors | No silent error swallowing | | | | 💡 |
| no-missing-error-context | Error context required | | | | 💡 |
| error-message | Require error messages | | ⚠️ | | 💡 |

$3

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | --- | --- | --- | --- |
| img-requires-alt | Enforce alt text on images | | ⚠️ | | |
| no-keyboard-inaccessible-elements | Keyboard accessibility | | ⚠️ | | 💡 |
| no-missing-aria-labels | Enforce ARIA labels | | ⚠️ | | 💡 |

$3

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 |
| ----------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | --- | --- | --- | --- |
| cognitive-complexity | Limit cognitive complexity | | | | |
| nested-complexity-hotspots | Detect complexity hotspots | | | | 💡 |

$3

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 |
| ----------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | --- | --- | --- | --- |
| ddd-anemic-domain-model | Detect anemic models | | | | 💡 |
| ddd-value-object-immutability | Value object immutability | | | | 💡 |

$3

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 |
| ----------------------------------------------------------------------------------------------------------------------------------- | ------------------ | --- | --- | --- | --- |
| react-class-to-hooks | Migration to hooks | | | | |

$3

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 |
| ----------------------------------------------------------------------------------------------------------------------------- | ----------------------- | --- | --- | --- | --- |
| no-deprecated-api | Prevent deprecated APIs | | | | |

$3

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 |
| ----------------------------------------------------------------------------------------------------------------------- | ---------------------- | --- | --- | --- | --- |
| enforce-naming | Domain-specific naming | | | | |

$3

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 |
| --------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | --- | --- | --- | --- |
| identical-functions | Detect duplicate functions | | | | |

$3

| Name | Description | 💼 | ⚠️ | 🔧 | 💡 |
| ------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | --- | --- | --- | --- |
| enforce-rest-conventions | REST API conventions | | | | 💡 |

---

📄 License

MIT © Ofri Peretz