WebMCP · Surface scan

Scan your WebMCP tool surface.

If your product exposes tools to AI agents via WebMCP (document.modelContext), MCP Sentinel can scan what that surface declares — tool descriptions, parameter schemas, annotations, and any resources, prompts or roots you expose — with the real deterministic engine. No fetch, no socket, nothing executed. A surface scan is non-publishing: it is never added to the public registry.

1 · Capture your surface

Drag this to your bookmarks bar, then click it on your own WebMCP page — it reads document.modelContext.getTools() and copies the JSON to your clipboard. It only reads and copies; it changes nothing on your page.

javascript:(async()=>{try{var m=document.modelContext||navigator.modelContext;if(!m||!m.getTools){alert('MCP Sentinel: no WebMCP surface on this page (document.modelContext.getTools).');return;}var t=await m.getTools();await navigator.clipboard.writeText(JSON.stringify(t,null,2));var n=Array.isArray(t)?t.length:((t&&t.tools&&t.tools.length)||0);alert('MCP Sentinel: copied '+n+' WebMCP tool(s). Paste them into the scan box.');}catch(e){alert('MCP Sentinel bookmarklet error: '+e);}})();

2 · Paste & scan

Runs the real engine over the declared surface. Rate-limited (5 / hour); can take up to ~60s.