Browser-local execution surface scanner

Source-first policy compiler.

Load redacted tool material, inspect the detected surface, then edit fail-closed policy and export local HELM artifacts. Verify receipt stays available as a peer mode.

01 Source

Paste, upload, or load a sample.

02 Surface

Review detected action categories.

03 Policy

Edit fail-closed decisions.

04 Export

Download local artifacts.

Boundary instrument Surface before policy.

Execution surface desk

Policy workbench

Browser-only. Raw input stays local. Events are optional derived counts.

InspectMCP config
Compile12 rules compiled
Decide10 escalations · 0 denies
Review6 custom MCP · 4 queued

Intake

Load one surface

Use redacted MCP configs, tool manifests, GitHub app scopes, or sample logs. The pasted text stays in this browser.

Raw pasted material is never attached to the contact request or telemetry. Only derived counts and the generated summary are staged locally after compile.

MCP config - 12 rules - default DENY

Fail-closed policy compiled

Review every consequential action before exporting this as a policy overlay.

100/100Critical
Bulk controls

Custom MCP review

6 custom or low-confidence actions are visible before export. Unknown write-like tools default to DENY until mapped.

  • Money - stripe.refund.create
  • Money - payments.transfer
  • Access - conversations.invite
  • Customer data - chat.postMessage

Code

5 actions

docs.searchreadonlyDocs - medium confidence - json_structural

The surface appears read-only from this sample.

mcpServers.readonlyDocs.tools[0]: docs.search
issues.readreadonlyDocs - medium confidence - json_structural

The surface appears read-only from this sample.

mcpServers.readonlyDocs.tools[1]: issues.read
Code write or repository mutationgithub - high confidence - scope_pattern

The surface can change source code, pull requests, workflows, or repository state.

mcpServers.github.permissions.contents: write
Code write or repository mutationgithub - high confidence - scope_pattern

The surface can change source code, pull requests, workflows, or repository state.

mcpServers.github.permissions.pull_requests: write
Code write or repository mutationgithub - high confidence - scope_pattern

The surface can change source code, pull requests, workflows, or repository state.

mcpServers.github.permissions.actions: write

Customer data

1 actions

chat.postMessageslack - high confidence - connector_profile

The surface can export, transform, or post customer records or private user data.

mcpServers.slack.tools[0]: chat.postMessage

Money

2 actions

stripe.refund.createfinance - high confidence - json_structural

The surface can move money, issue refunds, create invoices, or change financial state.

mcpServers.finance.tools[0]: stripe.refund.create
payments.transferfinance - high confidence - json_structural

The surface can move money, issue refunds, create invoices, or change financial state.

mcpServers.finance.tools[1]: payments.transfer

Access

4 actions

conversations.inviteslack - high confidence - connector_profile

The surface can grant roles, invite users, rotate tokens, or change permission state.

mcpServers.slack.tools[1]: conversations.invite
Access, identity, or secret boundarygithub - high confidence - scope_pattern

The surface can grant roles, invite users, rotate tokens, or change permission state.

mcpServers.github.permissions.contents: write
Access, identity, or secret boundarygithub - high confidence - scope_pattern

The surface can grant roles, invite users, rotate tokens, or change permission state.

mcpServers.github.permissions.pull_requests: write
Access, identity, or secret boundarygithub - high confidence - scope_pattern

The surface can grant roles, invite users, rotate tokens, or change permission state.

mcpServers.github.permissions.actions: write

Risk report

Top 5 of 10.

SeverityActionStatusControl
CriticalLine 8 - high
Access, identity, or secret boundary

The surface can grant roles, invite users, rotate tokens, or change permission state.

mcpServers.slack.tools[1]: conversations.invite
UnguardedAccess

Require least-privilege scope, owner approval, identity binding, and an access receipt.

CriticalLine 9 - high
Money movement or billing change

The surface can move money, issue refunds, create invoices, or change financial state.

mcpServers.finance.tools[0]: stripe.refund.create
UnguardedMoney

Require spend policy, threshold approval, ledger context, and a finance receipt.

CriticalLine 10 - high
Money movement or billing change

The surface can move money, issue refunds, create invoices, or change financial state.

mcpServers.finance.tools[1]: payments.transfer
UnguardedMoney

Require spend policy, threshold approval, ledger context, and a finance receipt.

HighLine 4 - high
Code write or repository mutation

The surface can change source code, pull requests, workflows, or repository state.

mcpServers.github.permissions.contents: write
UnguardedCode

Require repository scope, code-owner approval, policy verdict, and a code/action receipt.

HighLine 4 - high
Access, identity, or secret boundary

The surface can grant roles, invite users, rotate tokens, or change permission state.

mcpServers.github.permissions.contents: write
UnguardedAccess

Require least-privilege scope, owner approval, identity binding, and an access receipt.

Decision queue

4 shown

  1. Escalatestripe.refund.create

    Receipt required - Threshold required

  2. Escalatepayments.transfer

    Receipt required - Threshold required

  3. Escalateconversations.invite

    Receipt required - Owner required

  4. Escalatechat.postMessage

    Receipt required - Owner required

Compiler boundary

ALLOW / ESCALATE / DENY

ReadyDefault decision

Runtime overlay remains deny by default unless a rule says otherwise.

ReadyPolicy verdicts

12 local rules compiled.

ReadyReceipts

10 rules require receipt evidence.

NeededCustom MCP review

6 custom or low-confidence actions need mapping.

Export warnings

1

  • 6 custom or low-confidence tool actions require explicit review before execution.

Export / review

All files are generated in this browser.

Request architecture review

Review handoff contains the generated summary, categories, decision counts, and custom MCP count only.

Verification remains a peer mode

Receipts are checked after the policy path is clear.

Use the Verify receipt tab to inspect EvidencePack hashes offline without changing scanner behavior or uploading source material.

Receipt artifact terms
EvidencePack
A small bundle of records used to verify one event or review path.

Route-local notes

How the local compiler boundary works.

What the compiler reads

The scanner accepts redacted MCP configs, tool manifests, GitHub scopes, and sample logs. It classifies likely side effects by category, confidence, and sanitized evidence snippets. The raw source remains in the browser and is not attached to telemetry or contact handoff.

How fail-closed defaults work

Read-only actions can move to Allow. Consequential writes move to Escalate or Deny with receipts and owner approval. Unknown custom MCP tools stay denied until a human maps the action, because absence of a known policy is treated as no authority to execute.

What leaves the browser

Exports are generated locally as Markdown, JSON, MCP overlay, and HELM kernel policy pack files. The review handoff stores only derived summaries: source type, category counts, decision counts, warning state, and custom MCP count. Pasted or uploaded source text does not leave the page.