WebMCPSentinel

Inspiration

By the end of 2025 the Model Context Protocol had crossed 10,000+ public servers, and something quietly alarming came with it: agents were wiring in those servers on a tool's say-so. A tool description says "read-only file search" and the agent believes it. Meanwhile the ecosystem was already producing real incidents — mcp-remote OS-command injection, git-argument-injection chains, tool-poisoning research, npm/PyPI typosquats aimed straight at MCP.

The security judgment existed, but it was in the wrong place at the wrong time: a human, in a separate scanner, after the agent had already committed. We wanted the answer to live exactly where the decision is made — inside the agent's own loop, at the instant it's about to trust something. WebMCP is what made that possible: the registry can hand the agent a tool that says "ask me before you trust that."

What it does

MCP Sentinel is a security-intelligence registry for the MCP ecosystem, and it's agent-native via WebMCP. A WebMCP-capable agent visiting the site can call Sentinel's real scanners over document.modelContext:

sentinel_scan_package({ ref }) — a live scan of an npm: / pypi: package (source taint, dependency CVEs, sandboxed runtime enumeration where the host allows it). sentinel_scan_webmcp_surface({ surface_json? }) — a scan of a declared WebMCP tool surface, including the current page's own.

Same tools, same real backend, for both the human reading the page and the agent driving it.

Built With

• claude
• python