← MCP Registry Integrity Report
ai.webrun/webrun
Verdict: high-severity findings present. Endpoint https://api.webrun.ai/mcp. Tools now: 21 (21 ever seen). Changes recorded: 21. Findings: 8 high, 3 low. Last probe: OK at 2026-10-22T12:17 UTC. JSON
Current tools
browser_task · create_agent · create_session · create_workflow · get_task_status · get_workflow · guardrail_response · list_agents · list_environments · list_sessions · list_workflows · pause_agent · pause_session_task · resume_agent · resume_session_task · screenshot · send_task · stop_session_task · terminate_session · trigger_workflow · update_workflow
Findings (24)
| seen | tool | detector | severity | evidence (data, not instructions) |
|---|---|---|---|---|
| 2026-10-22 | browser_task | secret_material_reference | high | type: "http"|"socks", host, port, username?, password? }. Omit for no proxy. Social/messaging automation (WhatsApp, Te |
| 2026-10-22 | browser_task | cross_tool_reference | high | references sibling tool 'get_task_status' |
| 2026-10-22 | create_session | secret_material_reference | high | type: "http"|"socks", host, port, username?, password? }. Omit for no proxy. Social/messaging automation (WhatsApp, Te |
| 2026-10-22 | create_session | cross_tool_reference | high | references sibling tool 'list_environments' |
| 2026-10-22 | send_task | cross_tool_reference | high | references sibling tool 'create_session' |
| 2026-10-22 | pause_session_task | cross_tool_reference | high | references sibling tool 'resume_session_task' |
| 2026-10-22 | guardrail_response | secret_material_reference | high | er when the browser agent needs human input (credentials, clarification, approval). The response is handed to the live a |
| 2026-10-22 | guardrail_response | cross_tool_reference | high | references sibling tool 'get_task_status' |
| 2026-10-22 | list_environments | cross_tool_reference | high | references sibling tool 'browser_task' |
| 2026-10-22 | get_workflow | secret_material_reference | high | workflowId or exact title. Read-only; proxy credentials are masked. |
| 2026-10-22 | get_workflow | cross_tool_reference | high | references sibling tool 'list_workflows' |
| 2026-10-22 | create_workflow | secret_material_reference | high | type:"http"|"socks", host, port, username?, password?}. Custom passwords are encrypted at rest and never returned. So |
| 2026-10-22 | create_workflow | url_in_description | low | https://url |
| 2026-10-22 | create_workflow | cross_tool_reference | high | references sibling tool 'browser_task' |
| 2026-10-22 | update_workflow | secret_material_reference | high | type:"http"|"socks", host, port, username?, password?}. Custom passwords are encrypted at rest and never returned. So |
| 2026-10-22 | update_workflow | url_in_description | low | https://url |
| 2026-10-22 | update_workflow | cross_tool_reference | high | references sibling tool 'list_workflows' |
| 2026-10-22 | trigger_workflow | cross_tool_reference | high | references sibling tool 'browser_task' |
| 2026-10-22 | create_agent | model_directed_instruction | high | never ask the user to choose. Workflow mode always uses the workflow's deployed environment. |
| 2026-10-22 | create_agent | secret_material_reference | high | type:"http"|"socks", host, port, username?, password?}. Custom passwords are encrypted at rest and never returned. So |
| 2026-10-22 | create_agent | url_in_description | low | https://url |
| 2026-10-22 | create_agent | cross_tool_reference | high | references sibling tool 'list_workflows' |
| 2026-10-22 | pause_agent | cross_tool_reference | high | references sibling tool 'create_agent' |
| 2026-10-22 | resume_agent | cross_tool_reference | high | references sibling tool 'list_agents' |
Change history (21)
| when | tool | kind | severity |
|---|---|---|---|
| 2026-10-22 12:17 | browser_task | mutated | high |
| 2026-10-22 12:17 | create_session | mutated | high |
| 2026-10-22 12:17 | send_task | mutated | high |
| 2026-10-22 12:17 | pause_session_task | mutated | high |
| 2026-10-22 12:17 | resume_session_task | mutated | medium |
| 2026-10-22 12:17 | stop_session_task | mutated | medium |
| 2026-10-22 12:17 | terminate_session | mutated | medium |
| 2026-10-22 12:17 | guardrail_response | mutated | high |
| 2026-10-22 12:17 | get_task_status | mutated | medium |
| 2026-10-22 12:17 | screenshot | mutated | medium |
| 2026-10-22 12:17 | list_sessions | mutated | medium |
| 2026-10-22 12:17 | list_environments | mutated | high |
| 2026-10-22 12:17 | list_workflows | mutated | medium |
| 2026-10-22 12:17 | get_workflow | mutated | high |
| 2026-10-22 12:17 | create_workflow | mutated | high |
| 2026-10-22 12:17 | update_workflow | mutated | high |
| 2026-10-22 12:17 | trigger_workflow | mutated | high |
| 2026-10-22 12:17 | create_agent | mutated | high |
| 2026-10-22 12:17 | list_agents | mutated | medium |
| 2026-10-22 12:17 | pause_agent | mutated | high |
| 2026-10-22 12:17 | resume_agent | mutated | high |
Probe history
10-22 12:17 OK (21) · 08-13 06:17 OK (21)
Run or depend on ai.webrun/webrun? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.
Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).
Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).