Configuration

The config file

Put lintsure.config.yaml in the root of the folder you scan:

frameworks:
  - gdpr
  - soc2

The CLI, the MCP scan tool and the GitHub Action all read it. A --framework flag, a frameworks tool input or a frameworks action input takes priority over the file.

Skip paths

Add an ignore: list for paths Lintsure shouldn’t read, such as tests, fixtures or vendored code. Paths are relative to the scanned folder, and a folder skips everything inside it:

ignore:
  - tests/
  - fixtures/
  - src/legacy/old-client.ts

Lintsure already skips dependencies, build output and caches (node_modules, dist, build, out, .output, .next, .nuxt, .svelte-kit, .astro, .vercel, .wrangler, .turbo, .cache, venv, .venv, __pycache__, coverage, .git), minified files and files over 1 MB.

Skipped paths aren’t checked at all, so keep the list short. Code you ship should be scanned.

Framework ids

Id	Framework	Status
eu-ai-act	EU AI Act	Checked
gdpr	GDPR	Checked
soc2	SOC 2	Checked
iso-27001	ISO/IEC 27001	Checked

Other ids, such as hipaa or iso-42001, are allowed in the file. Lintsure prints them as Skipping, not checked yet and checks the rest. That way your config is ready when their rules ship. See all frameworks on the roadmap.

Supported syntax

Lintsure reads a simple list on purpose, with no YAML library:

• a line frameworks: followed by indented - id lines
• frameworks: [] to check nothing
• a line ignore: followed by indented - path lines
• # comments, on their own line or at the end of a line

Other YAML forms, like inline lists [gdpr, soc2], aren’t read yet. If the file is missing, Lintsure checks every available framework.

Not sure what applies?

Answer four questions on the frameworks page and copy the generated file, or ask your agent to run the MCP classify tool.