chore: add eslint rule to validate tool schema patterns (#1191)

## Summary

- Add `@local/no-zod-nullable-object` ESLint rule that disallows
`.nullable()` and `.object()` usage in tool schema files
(`src/tools/**/*.ts`)
- Fix the existing `zod.object()` violation in `fill_form` by converting
the elements array from objects to `"uid=value"` formatted strings
- Remove the TODO from CONTRIBUTING.md and link the rule name to the
documented restriction

## Context

Per the [PR #1073
review](#1073 (comment))
and the CONTRIBUTING.md guidelines, tool schemas should not use
`.nullable()` or `.object()` types. Complex objects should be
represented as short formatted strings instead.

The rule catches:
- `zod.object({...})` / `z.object({...})` - flags direct zod object
schema usage
- `.nullable()` - flags nullable schema usage on any expression

Closes #1076

## Test plan

- [ ] `npx eslint src/tools/` passes with no violations
- [ ] Creating a test file with `zod.object()` or `.nullable()` in
`src/tools/` triggers the rule
- [ ] TypeScript compilation passes (`npx tsc --noEmit`)
- [ ] Existing `fill_form` test updated to use new string format

---------

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: Alex Rudenko <OrKoN@users.noreply.github.com>
Co-authored-by: Nikolay Vitkov <34244704+Lightning00Blade@users.noreply.github.com>
Co-authored-by: Alex Rudenko <alexrudenko@chromium.org>

Author: 3 people

CONTRIBUTING.md

@@ -145,7 +145,5 @@ export const scenario: TestScenario = {
 
 ## Restrictions on JSON schema
 
-- no .nullable(), no .object() types.
+- no .nullable(), no .object() types. Enforced by the `@local/enforce-zod-schema` ESLint rule.
 - represent complex object as a short formatted string.
-
-TODO: implement eslint for schema https://github.com/ChromeDevTools/chrome-devtools-mcp/issues/1076

eslint.config.mjs

@@ -135,6 +135,13 @@ export default defineConfig([
       ],
     },
   },
+  {
+    name: 'Tools definitions',
+    files: ['src/tools/**/*.ts'],
+    rules: {
+      '@local/enforce-zod-schema': 'error',
+    },
+  },
   {
     name: 'Tests',
     files: ['**/*.test.ts'],

scripts/eslint_rules/enforce-zod-schema-rule.js

@@ -0,0 +1,62 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+export default {
+  name: 'enforce-zod-schema',
+  meta: {
+    type: 'problem',
+    docs: {
+      description:
+        'Disallow .nullable() and .object() in tool schemas. Use optional strings to represent complex objects.',
+    },
+    schema: [],
+    messages: {
+      noNullable:
+        'Do not use .nullable() in tool schemas. Use .optional() instead.',
+      noObject:
+        'Do not use .object() in tool schemas. Represent complex objects as a short formatted string.',
+    },
+  },
+  defaultOptions: [],
+  create(context) {
+    return {
+      CallExpression(node) {
+        if (
+          node.callee.type !== 'MemberExpression' ||
+          node.callee.property.type !== 'Identifier'
+        ) {
+          return;
+        }
+
+        const methodName = node.callee.property.name;
+
+        // We don't validate that .nullable() is called on a ZodObject
+        // specifically - this intentionally catches all .nullable() calls
+        // in tool schema files.
+        if (methodName === 'nullable') {
+          context.report({
+            node: node.callee.property,
+            messageId: 'noNullable',
+          });
+        }
+
+        if (methodName === 'object') {
+          // Only flag zod.object() calls, not arbitrary .object() calls.
+          const obj = node.callee.object;
+          if (
+            obj.type === 'Identifier' &&
+            (obj.name === 'zod' || obj.name === 'z')
+          ) {
+            context.report({
+              node: node.callee.property,
+              messageId: 'noObject',
+            });
+          }
+        }
+      },
+    };
+  },
+};

scripts/eslint_rules/local-plugin.js

@@ -5,5 +5,11 @@
  */
 
 import checkLicenseRule from './check-license-rule.js';
+import enforceZodSchemaRule from './enforce-zod-schema-rule.js';
 
-export default {rules: {'check-license': checkLicenseRule}};
+export default {
+  rules: {
+    'check-license': checkLicenseRule,
+    'enforce-zod-schema': enforceZodSchemaRule,
+  },
+};

src/tools/input.ts

@@ -322,6 +322,7 @@ export const fillForm = definePageTool({
   schema: {
     elements: zod
       .array(
+        // eslint-disable-next-line @local/enforce-zod-schema
         zod.object({
           uid: zod.string().describe('The uid of the element to fill out'),
           value: zod.string().describe('Value for the element'),