Qwen Code

Why scan Qwen Code?

Qwen Code exposes MCP servers as callable tools, so a server registered once becomes something the model may invoke on its own initiative in any later session.

Usage

CallLint can auto-discover and scan Qwen Code configurations:

calllint scan --agent qwen-code

How to start

Install nothing globally — run CallLint straight from npm:

npx calllint scan --auto

Then scan Qwen Code specifically:

calllint scan --agent qwen-code

How to verify it worked

Read the tool-facing description of each server as the model sees it. A tool the agent can choose for itself is the one whose authority needs to be narrowest.

What CallLint does to Qwen Code

Offline by default. Deterministic. Never executes the server it judges. SAFE means no blockers observed, not a proof of runtime safety.

A No blockers observed verdict means exactly that — no blocker under the evidence CallLint could collect. It is not a guarantee, and Insufficient evidence never becomes it on its own. See Coverage Boundary for what this scan does not look at.

Configuration Paths

CallLint looks for Qwen Code configurations in:

• ~/.qwen/settings.json
• <project>/.qwen/settings.json

Authority Surfaces

Qwen Code can grant tools the following authority surfaces:

• mcp
• tools

Distribution

CallLint is available for Qwen Code through:

• mcp-stdio (via officialMcpRegistry) — Listing not yet verified
• qwen-extension-conversion — Not available here
  Qwen Code can convert Claude/Gemini extensions
  ⚠️ There is nothing to submit, and that is the audit's finding rather than an obstacle. Audited 2026-08-27. Qwen Code publishes no gallery or catalogue of its own; it installs FROM other hosts' shelves and converts on the way in — `qwen extensions install <marketplace>:<plugin>` reads a Claude Code marketplace and converts the Claude manifest to `qwen-extension.json`, translating agents, skills and tool mappings, while `qwen extensions install <owner>/<repo>` does the same for a Gemini extension, carrying MCP servers and context files across. `/extensions explore` browses the Gemini CLI and Claude Code galleries. So this row is derivative of shelves we already publish or are working toward, and submitting to it is not a thing a person can do. Deliberately NOT marked available: no probe has installed CallLint through Qwen, so reachability is inferred from the documented conversion rather than observed, and ADR 0007 admits only observed acts as evidence. What would settle it is one command on a machine with Qwen Code — `qwen extensions install calllint/calllint` — after which this becomes an evidence-backed availability claim rather than a blocked row. Kept out of the to-do list because the to-do list is for acts a human can perform on a channel, and this channel accepts none.

Support Status

Auto-detects — CallLint finds this host’s config on its own.

The commands under Usage are the ones CallLint actually supports for Qwen Code today. Anything not listed there is not claimed.

Official Sources

• https://qwenlm.github.io/qwen-code-docs/
• https://github.com/QwenLM/Qwen-Code