Field note 01WebMCP Safety Check

A field guide for browser-agent surfaces

Know what a tool claims before an agent acts.

Inspect a WebMCP/MCP manifest or session transcript. Classify mutation, navigation, profile, origin, credentials, approval, and evidence declarations—without running the tool or uploading browser content.

Inspect a manifestDownload extension

✓ Local only✓ No host permissions✓ Open policy

An illustrated fern with browser-tab-shaped leaves examined through a brass hand lens
Plate 01 · declarations under inspection

Identification method

From unknown surface to reviewable inventory.

  1. 01

    Collect

    Open a manifest or a JSON/JSONL tools/list transcript. The file stays on your device.

  2. 02

    Identify

    See explicit claims, omissions, risky combinations, and description-only signals per tool.

  3. 03

    Preserve

    Export structured JSON or a printable review card; run the same rules in CI.

Live specimen desk

Inspect locally, right now.

The checker recognizes plain manifests, MCP tools/list responses, transcript arrays, and newline-delimited JSON. Maximum 2 MB.

Honest boundary

An inventory, not a trust verdict.

Servers self-declare these properties. WebMCP Safety Check spots missing and contradictory declarations; it does not execute tasks, observe runtime behavior, scrape pages, or certify a vendor.

The same lens in CI

Fail on missing safety claims.

The standalone Node 20+ CLI exits 1 when required mutation/effect, approval, or before/after evidence declarations are missing. Add stricter claims with a checked-in policy file.

Download CLI
review.yml
# No install required
node webmcp-safety-check.mjs manifest.json \
  --format json --out safety-report.json

# Optional .webmcp-safety.json
{
  "requiredClaims": [
    "effect", "approval", "evidence",
    "profile", "origins", "credentials"
  ],
  "failOn": "warning"
}

Open claim shape

Small enough to add by hand.

Use x-webmcp-safety, metadata.safety, or standard annotations.readOnlyHint. Unknown future keys are preserved by your manifest and ignored by the checker.

View a complete example →
"x-webmcp-safety": {
  "effect": "mutate",
  "approval": "required",
  "evidence": {
    "before": true,
    "after": true
  },
  "profile": "real",
  "origins": ["https://shop.example"],
  "credentials": "origin-scoped"
}