github analyzed a516fba

basgr/cf-webmcp

WebMCP at the edge. A Cloudflare Worker that equips any website with WebMCP from one TOML config.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

code evidence vv0.5.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

fs basgr-cf-webmcp-a516fba/scripts/build-config.ts :15 import { promises as fs } from "node:fs";
fs basgr-cf-webmcp-a516fba/scripts/build-schema.ts :7 import { promises as fs } from "node:fs";
fs basgr-cf-webmcp-a516fba/scripts/dev-origin.ts :10 import { promises as fs } from "node:fs";
fs basgr-cf-webmcp-a516fba/scripts/preflight.ts :18 import { promises as fs } from "node:fs";
fs basgr-cf-webmcp-a516fba/scripts/update-widget.ts :18 import { promises as fs } from "node:fs";
fs basgr-cf-webmcp-a516fba/scripts/upload-widget.ts :9 import { promises as fs } from "node:fs";

shell basgr-cf-webmcp-a516fba/scripts/upload-widget.ts :12 import { spawnSync } from "node:child_process";
shell basgr-cf-webmcp-a516fba/vitest.node.config.ts :5 * These cannot run in workerd because they use node-only APIs (fs, os, child_process).

net basgr-cf-webmcp-a516fba/scripts/build-config.ts :311 return fetch(endpoint, {
net basgr-cf-webmcp-a516fba/scripts/dev-origin.ts :9 import http from "node:http";
net basgr-cf-webmcp-a516fba/scripts/preflight.ts :117 const res = await fetch(check.url.toString(), {
net basgr-cf-webmcp-a516fba/scripts/update-widget.ts :56 const res = await fetch(url);
net basgr-cf-webmcp-a516fba/src/executors/common.ts :95 const res = await fetch(url.toString(), {
net basgr-cf-webmcp-a516fba/src/worker.ts :42 async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {

secrets basgr-cf-webmcp-a516fba/scripts/preflight.ts :177 const deployToken = process.env["CF_WEBMCP_DEPLOY_TOKEN"];