WebMCP Forge

Generate WebMCP tools from a web app or API, then prove which ones are safe for an agent to use. This dashboard is itself a WebMCP surface, so an agent can drive every step below while you watch it happen.

WebMCP ○ CheckingExtension ○ Checking📦 Extension (.zip)Smoke test
SECURITY SCANAnalyze any input to see which of the three tiers it qualifies for. The scan needs no execution; only validation needs a target we own.
📦 GitHub
🤖 Validator Agent:
Sample Security Benchmarks
○ Discover→
○ Generate→
○ Scan→
○ Validate→
○ Ship

Generated tools

Click a tool to see the description an agent would read, and any findings against it.

Analyze a repository, OpenAPI contract, or live URL to generate tools. The bundled storefront is a small Next.js app that was never built for agents.

Agent validation

The same task, run two ways, against the tools that were just generated.

No agent run yet. Click Validate: unguarded agent to see an AI agent blindly follow tool descriptions, or Validate: guarded agent to see PolicyGate protect the session.

Observed requests

Every network call the generated tools made, and what the gate did with it.

No network requests observed yet. Run agent validation to monitor live PolicyGate network interception.

WebMCP Diagnostics

Real browser modelContext registration status.

Checking WebMCP status...

Activity

Human and agent actions land in the same stream.

Idle.

Ask an agent to drive this

Tools this page exposes over WebMCP.

  • forge_analyze_repo
  • forge_list_tools
  • forge_run_security_scan
  • forge_get_findings
  • forge_get_execution_plan
  • forge_run_agent_validation
  • forge_export_integration

Try: “Analyze the demo storefront, scan the tools it generates, and tell me which ones you would refuse to use.”