API, Auth, MCP & Skill Discovery

WebMCP

WebMCP lets a page expose tools to an agent running in the browser, with the user present and in control.

Why it matters

It is the middle ground between scraping and a server-side API: your existing UI becomes tool calls.

Pass criteria

Page code registers browser-side tools through navigator.modelContext.

What the scanner records
Every request the check makes is recorded (URL, method, response status, relevant headers and a body preview) and shown under the check in your results.

How to implement it

Support WebMCP to expose site tools to AI agents via the browser

Page code registers browser-side tools through navigator.modelContext.

The step-by-step implementation prompt is part of the Pro plan.

See plans

webmcp.org github.com SKILL.md

Scan your site

See whether this check passes on your domain, along with the other 21.

Run a scan

Related checks

API Catalog

/.well-known/api-catalog returns application/linkset+json with at least one entry.

OAuth discovery

/.well-known/oauth-authorization-server or /.well-known/openid-configuration exposes usable metadata.

OAuth Protected Resource

/.well-known/oauth-protected-resource declares resource and authorization_servers.

Auth.md

/auth.md exists with a markdown H1 mentioning auth.md.

MCP Server Card

/.well-known/mcp/server-card.json describes the server with a serverInfo.name.

A2A Agent Card

/.well-known/agent-card.json declares name, version and supported interfaces.

Agent Skills

/.well-known/agent-skills/index.json lists at least one skill.

ARD manifest

/.well-known/ai-catalog.json declares specVersion, host and at least one entry.