Skip to content
All tools

Protect data and access

WebMCP Security Checker

This browser-local analyzer reviews WebMCP tool definitions in selected source files or pasted code for 14 assurance controls, prepares a visible rewrite diff and exports the result to JSON, Markdown or SARIF.

Local analyzer: Runs entirely in this browser. Files and pasted code never leave your device.

Run the checkLocal · nothing uploaded

WebMCP Security Lab

At most 20 files, 1 MiB each, 5 MiB total. Unsupported files are rejected.

Results appear here. Everything runs locally — nothing is uploaded.

Local analysis: Files and pasted code never leave your device. In supported browsers, an agent may invoke the page tools; only bounded summaries and rewrite metadata are returned.

Sample result

An example of the output shape, not a result from your input:

2 of 14 controls detected · a write tool is registered without a confirmation boundary

Run this on your whole app

This check covered only what you pasted or selected here. A free trial lets you authorize a repository, live URL or API, run the checks available for your authorized target and plan and keep one launch report you can share.

Start free trial

Related tools

Most reviewers run two or three of these together. Each runs in your browser and states what it cannot prove.

See all free tools

What this checks

  • Imperative document.modelContext.registerTool and declarative form tool annotations
  • Cross-origin exposure, Permissions-Policy headers and origin isolation
  • Durable mutations, unbounded contracts, cancellation, cleanup and bounded rewrite diffs

What this cannot prove

  • It analyzes the files you select or paste; dynamic runtime behavior and server-side context stay out of scope
  • Static discovery can miss obfuscated or framework-wrapped tool registrations
  • A clear result does not prove the whole application is secure; review the output before acting

Primary references

Use these standards and vendor references when you investigate a result. A link does not imply certification or full coverage of the source.

Frequently asked questions

Does this upload my input?

Files and pasted code never leave your device.

Does a clear result mean my app is secure?

No. Each result is limited to the checks shown here. Use it as a next-step guide, then test the relevant application path.