MCP response integrity: ccs-lint-action for CI scanning

[DSHCorrectover]

We built a GitHub Action that scans MCP tool-call messages for unsigned receipt field injection in CI. ToolHive's sandboxing prevents many attacks, but forged _ccsReceipt/_verified fields in upstream responses are a separate attack class that runtime sandboxing doesn't catch.

Action: https://github.com/DSHCorrectover/ccs-lint-action
CLI: npx ccs-lint --demo

Would be great to see ToolHive integrate this as a pre-deployment scan step.