Launch check for AI-built apps: SAFE or DO NOT SHIP verdict, with evidence and paste-back fixes.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Read a receipt back as JSON by its id. Folded, it returns the twelve lines and a pay object naming where a human pays. With a bearer token that has credit it unseals: the evidence and the fix paragraph for every open line, and the SOTA Security Model read of the app. One fixed price per unsealed report. 401 for a token we did not issue, 402 when the balance will not cover it.
The receipt id, from scan_app.
Optional API credit token. Without it the receipt comes back folded.
Read a receipt back as JSON by its id. Folded, it returns the twelve lines and a pay object naming where a human pays. With a bearer token that has credit it unseals: the evidence and the fix paragraph for every open line, and the SOTA Security Model read of the app. One fixed price per unsealed report. 401 for a token we did not issue, 402 when the balance will not cover it.
| Argument | Type | Description |
|---|---|---|
| token | string | Optional API credit token. Without it the receipt comes back folded. |
| receipt_id* | string | The receipt id, from scan_app. |
{
"type": "object",
"required": [
"receipt_id"
],
"properties": {
"token": {
"type": "string",
"description": "Optional API credit token. Without it the receipt comes back folded."
},
"receipt_id": {
"type": "string",
"description": "The receipt id, from scan_app."
}
}
}Run twelve deterministic checks against the outside of a public web app and return a dated verdict: the stamp, the open/closed/not-checked counts, every line with its plain-English consequence, what was skipped, and the receipt id and URL. Free, no token. It reads public pages only: it does not sign in, does not create an account and does not guess anything. A clean verdict is not a guarantee of safety.
| Argument | Type | Description |
|---|---|---|
| url* | string | The app to check, e.g. https://example.com |
{
"type": "object",
"required": [
"url"
],
"properties": {
"url": {
"type": "string",
"description": "The app to check, e.g. https://example.com"
}
}
}