nekuda WebMCP Workbench ↗
nekuda WebMCP Workbench is a community-maintained WebMCP tool from Nekuda. Anomity scores its risk at 40 out of 100 (medium).
Analysis summary
nekuda WebMCP Workbench is a community-maintained WebMCP tool from Nekuda. Anomity scores its risk at 40 out of 100 (medium).
A Chrome side-panel workbench for working with WebMCP tools end to end: inspect the tools a page registers, invoke them with structured arguments, test sequences, and audit what was called. It targets developers building agent-native pages who need to see their own tool surface the way an agent sees it.
Because it both reads and invokes, it inherits the full risk of the page it is pointed at. Its declared capabilities are browser control and outbound network access. The audit trail is the part worth adopting as practice: if you are shipping WebMCP tools, the record of which tools were invoked with which arguments is the difference between debugging an agent's behaviour and guessing at it.
Why this entry scored 40 out of 100
This profile starts at the catalog's neutral base of 50. Because the entry is community-maintained, trust adjusts the score by -10. The entry declares no high-risk capabilities on its own, so capabilities add nothing. It matches no dangerous capability combinations. The clamped result is 40, placing it in the medium band.
Findings
-
Established community project Trust offset
Capabilities
Every capability the entry declares, with the security implication of each.
-
browser:controlBrowser controlDrives a browser session. Combined with credential access can impersonate the user on web services. -
network:outboundOutbound networkCan make outbound network requests. Required for hosted model providers and remote APIs; also the path for data exfiltration if combined with read access.