Protect data and access

WebMCP Security Checker

This browser-local analyzer reviews WebMCP tool definitions in selected source files or pasted code for 10 assurance controls, prepares a visible rewrite diff, and exports the result to JSON, Markdown, or SARIF.

Local analyzer: Runs entirely in this browser. Files and pasted code never leave your device.

Run the checkLocal · nothing uploaded

Choose source files to check locally

At most 20 files, 1 MiB each, 5 MiB total. Unsupported files are rejected.

Results appear here. Everything runs locally — nothing is uploaded.

Export

Download the current result as JSON, Markdown, or SARIF. The export stays on your device.

CI setup

Run the same bounded checks on your repository with the LyraShield CLI or GitHub Action. Results are local to the CI runner.

CLI check

npx lyrashield gate --fail-on HIGH

GitHub Action step

- uses: ecryptoguru/lyrashield-ai@v2
  with:
    fail_on_severity: HIGH

For setup details, read the GitHub Action integration guide.

Local analysis: Files and pasted code never leave your device. In supported browsers, an agent may invoke the page tools; only bounded summaries and rewrite metadata are returned.

What this checks

Imperative document.modelContext.registerTool and declarative form tool annotations
Cross-origin exposure, Permissions-Policy headers, and origin isolation
Durable mutations, unbounded contracts, cancellation, cleanup, and bounded rewrite diffs

What this cannot prove

It analyzes the files you select or paste; dynamic runtime behavior and server-side context stay out of scope
Static discovery can miss obfuscated or framework-wrapped tool registrations
A clear result does not prove the whole application is secure; review the output before acting

Primary references

Use these standards and vendor references when you investigate a result. A link does not imply certification or full coverage of the source.

Need an app-wide assurance record?

LyraShield AI adds authorized target scanning, explicit coverage receipts, evidence states, approval-gated fix proposals, server-owned retests, and immutable reports. This browser tool remains guidance, not a security guarantee.

Create a free account

Frequently asked questions

Does this upload my input?

Files and pasted code never leave your device.

Does a clear result mean my app is secure?

No. Each result is limited to the checks shown here. Use it as a next-step guide, then test the relevant application path.