Free front-end security check for any website: a grade plus the secrets and keys it exposes.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Run a free front-end security check on any website and get a letter grade (A to F) plus specific findings. Answers questions like 'is example.com leaking API keys or secrets in its front-end code', 'does this site expose a Stripe/AWS/OpenAI key or a publicly readable database', or 'how is this website's client-side security'. Reads only what the site serves publicly; never logs in or changes anything.
The website to check: a domain like example.com or a full URL like https://example.com
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Run a free front-end security check on any website and get a letter grade (A to F) plus specific findings. Answers questions like 'is example.com leaking API keys or secrets in its front-end code', 'does this site expose a Stripe/AWS/OpenAI key or a publicly readable database', or 'how is this website's client-side security'. Reads only what the site serves publicly; never logs in or changes anything.
| Argument | Type | Description |
|---|---|---|
| domain* | string | The website to check: a domain like example.com or a full URL like https://example.com |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"domain"
],
"properties": {
"domain": {
"type": "string",
"maxLength": 255,
"minLength": 3,
"description": "The website to check: a domain like example.com or a full URL like https://example.com"
}
}
}